I am trying to install a new SSL certificate into Traefik. My certificate is signed by a third party (Setigo), and was provided to me with the chain:
-----BEGIN CERTIFICATE-----
[[SNIP - Root CA]]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[[SNIP - Intermediate CA]]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[[SNIP - Intermediate CA]]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[[SNIP - MyServer Cert]]
-----END CERTIFICATE-----
The last certificate in the chain matches the individual certificate. When I pass that certificate and coresponding key to Traefik, I get the following error:
failed to load X509 key pair: tls: private key does not match public key
Researching online, I have found these commands to verify the public keys/modulus for the cert and private key
openssl rsa -modulus -noout -in myserver.key | openssl md5
openssl x509 -modulus -noout -in myserver.crt | openssl md5
When I run this against the chained cert the results do not match. When I run it against the individual cert it matches.
I can not use the individual cert, as it is not signed by a trusted root, so I get the following error when using OpenSSL s_client:
openssl s_client -connect myserver:443 -showcerts
verify error:num=20:unable to get local issuer certificate
verify error:num=21:unable to verify the first certificate
I'm wracking my brain here, what am I missing???
Your chain is wrong. You need to reverse it and drop the root CA certificate.
The server is thinking the root CA is the main certificate and it's trying to load the private key against the root ca certificate which it why you are seeing the message.
Also there is no need for the root CA as this should always be in the clients CA list, so you are sending the CA certificate to the client and the client will just ignore it.
i.e.
-----BEGIN CERTIFICATE-----
[[SNIP - MyServer Cert]]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[[SNIP - Intermediate CA]]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[[SNIP - Intermediate CA]]
-----END CERTIFICATE-----
Related
I recently purchased a wildcard SSL certificate from GoDaddy and I need to convert it to a pfx file.
First, GoDaddy gave me two text blobs in their web UI, a CSR and Private Key:
CSR:
-----BEGIN CERTIFICATE REQUEST-----
MIICWDCCAUICAQAwFzEVMBMGA1UEAwwMKi5jeW50aGlhLmlvMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzcxAT8EtKxb4BSCRYBYcTDt8DgR/Fe/rjBpl
...
Private Key:
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDNzEBPwS0rFvgF
IJFgFhxMO3wOBH8V7+uMGmXDx+n3Mzvz9gk0nj/h5kX9RH+M9byS4iCfUZ8rURXQ
...
Next, I downloaded a Zip file containing two crt files and a pem file:
54994fbd90cc1fc8.crt
54994fbd90cc1fc8.pem
gd_bundle-g2-g1.crt
54994fbd90cc1fc8.crt
-----BEGIN CERTIFICATE-----
MIIGiDCCBXCgAwIBAgIIVJlPvZDMH8gwDQYJKoZIhvcNAQELBQAwgbQxCzAJBgNV
BAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMRow
...
54994fbd90cc1fc8.pem
-----BEGIN CERTIFICATE-----
MIIGiDCCBXCgAwIBAgIIVJlPvZDMH8gwDQYJKoZIhvcNAQELBQAwgbQxCzAJBgNV
BAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMRow
...
gd_bundle-g2-g1.crt
-----BEGIN CERTIFICATE-----
MIIE0DCCA7igAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx
EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoT
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEfTCCA2WgAwIBAgIDG+cVMA0GCSqGSIb3DQEBCwUAMGMxCzAJBgNVBAYTAlVT
MSEwHwYDVQQKExhUaGUgR28gRGFkZHkgR3JvdXAsIEluYy4xMTAvBgNVBAsTKEdv
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEh
MB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBE
...
-----END CERTIFICATE-----
I need to generate a pfx file for my cloud provider.
I tried this command:
openssl pkcs12 -export -out cert.pfx -inkey generated-private-key.txt -in 54994fbd90cc1fc8.pem
But I got this error:
unable to load private key
4530953728:error:0909006C:PEM routines:get_name:no start
line:crypto/pem/pem_lib.c:745:Expecting: ANY PRIVATE KEY
The file generated-private-key.txt has 400. permissions:
-r--------# 1 david staff 1707 Oct 24 20:12 generated-private-key.txt
How do I generate a pfx file from the files I have? Should I generate my own private key with ssh-keygen and then re-key with a new CSR in the GoDaddy UI?
This turned out to be because the key was in UTF8-BOM instead of UTF8 format.
I'm trying to install Comodo Essential SSL via Vestacp here's that I did. I opened www_example_com.crt and copied the digest and pasted it into SSL Certificate box then opened www_example_com.key used to generate the ssl at the beginning which starts with -----BEGIN PRIVATE KEY----- and pasted the digest into SSL Key box then copied the digest of the other 3 files in this order into one file and copied the whole digest and pasted it into SSL Certificate Authority / Intermediate box but I get SSL intermediate chain is not valid
AddTrustExternalCARoot.crt
USERTrustRSAAddTrustCA.crt
SectigoRSADomainValidationSecureServerCA.crt
Final digest looks like this
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
I checked the certificate and the key and have no issue using https://www.sslshopper.com/certificate-key-matcher.html
I restored a back up so the key file doesn't exist on the server now does it matter? It's the first time I try to install SSL so please assist. Thanks in advance.
The Authority digest must be the content of these files in this order
SectigoRSADomainValidationSecureServerCA.crt
AddTrustExternalCARoot.crt
USERTrustRSAAddTrustCA.crt
I want to have ssl certificate on my IIS server, so I get on my Mail letter from reg.ru with:
You certificate is presented below: (original language: Ваш сертификат предоставлен ниже)
-----BEGIN CERTIFICATE-----
[values]
-----END CERTIFICATE-----
Root certificate (original language: Корневой сертификат)
-----BEGIN CERTIFICATE-----
[values]
-----END CERTIFICATE-----
Intermediate certificate (original language: Промежуточный сертификат)
-----BEGIN CERTIFICATE-----
[values]
-----END CERTIFICATE-----
Request for a certificate (original language: Запрос на получение сертификата)
-----BEGIN CERTIFICATE REQUEST-----
[values]
-----END CERTIFICATE REQUEST-----
Save the private key on the local computer (original language:Сохраните приватный ключ на локальном компьютере.)
-----BEGIN RSA PRIVATE KEY-----
[values]
-----END RSA PRIVATE KEY-----
But my IIS requires .cer file, what have I to do to get .cer file?
Oh, I find a solution
go here
https://www.sslshopper.com/ssl-converter.html
create pfx file from first certificate, private key, Intermediate certificate and root sertificate
click import in iis server sertificates page and select this file.
(Maybe my problem because of service reg.ru)
I've installed a SSL certificate on my Website, but the intermediate.crt isn't working.
Any SSL Checker (e.g. GeoTrust Checker) told me, that an intermediate key is missing.
On the website a SSL certificate was already in use, only the switch from SHA1 to SHA2 is new.
I use this structure:
-----BEGIN CERTIFICATE-----
(Secondary Intermediate Certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Primary Intermediate Certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Root certificate)
-----END CERTIFICATE-----
Who has an idea to solve this problem?
I solve it.
It was the wrong reference to the intermediate
Hi I not bale to configure my entrust SSL certificate with Heroku
I download my certificate from entrust with below option
Select Certificate: my domain name
Select Server Type: Other
its give me three file for download
1)L1Cchain.txt
2)L1Croot.txt
3)entrustcert.crt
after that I fellow steps :
step 1) create private key using.
openssl genrsa -des3 -out server.pass.key 2048 with password "passone"
openssl rsa -in server.pass.key -out server.key with password "passone"
step 2) bundle all certificate in one file called server.pem.
-----BEGIN CERTIFICATE-----
L1Cchain.txt
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
L1Croot.txt
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
entrustcert.crt
-----END CERTIFICATE-----
step 3) heroku certs:add server.pem server.key -a myapp
when I am at step 3 I got error
heroku certs:add server.pem server.key -a myapp
Resolving trust chain... failed
! No key found that signs the certificate.
with option bypass
heroku certs:add heroku.pem server.key -a myapp --bypass
Adding SSL Endpoint to myapp... failed
! Key doesn't match the PEM certificate
please help me to solve this problem and what I am miss out to configure.
I am using windows PC and my heroku toolbelt
heroku --version
heroku/toolbelt/3.4.1 (i386-mingw32) ruby/1.9.3
I think you are bundling your chain in the wrong order. enTrust NGINX instructions (recommended by Heroku) says to bundle them in this order.
-----BEGIN CERTIFICATE-----
(Your Web server Certificate) // entrustcrt.crt
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Entrust L1C Cross Certificate) // L1Cchain.txt
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Entrust 2048 Root) // L1Croot.txt
-----END CERTIFICATE-----
After that, I got it working using...
heroku certs:add server.pem server.key -a myapp --bypass