1

I have got a nic signed certificate which I am trying to configure in my apache server without much luck :(. For this certificate to be generated, they needed CSR from my side. I created CSR using the following commands:

Created keystore file first using command -

keytool -genkey -alias generated -keyalg RSA -keysize 2048 -keystore generated.keystore

Generated CSR from this keystore using following command:

keytool -certreq -keyalg RSA -alias generated -file generated.csr -keystore generated.keystore

My csr looked like:

-----BEGIN NEW CERTIFICATE REQUEST-----
MIIC7jCCAdYCAQAwgagxCzAJBgNVBAYTAklOMRAwDgYDVQQIEwdNYW5pcHVyMQ8wDQYDVQQHEwZJ
bXBoYWwxNTAzBgNVBAoTLE1hbmlwdXIgU3RhdGUgSW5mb3JtYXRpb24gVGVjaG5vbG9neSBTb2Np
ZXR5MRkwFwYDVQQLDBBTUCBTU0RHICYgZUZvcm1zMSQwIgYDVQQDExt3d3cubWFuaXB1cnBvcnRh
......
......
bC5tbi5nb3YuaW4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRVxKwt/xCiAgGfuCs
ud5kcf+BKQURwKExLHUeUNQHpT1IMcx/is9anki+u3ijFbV1ei/ybgSRzFgesem+yTUutTYCgyqd
U7ZxJTuKmHDkZCVEBzGxl+Jl8AQxHHQzBI9PWuCBURR0q1eNeasfO3yWZpkRvK58uXf6vGZakYHZ
-----END NEW CERTIFICATE REQUEST-----

They have generated a certificate (.cer) file for this, which looks like:

-----BEGIN CERTIFICATE-----
MIIEKTCCAxGgAwIBAgIJEiLiRbpaYkqOMA0GCSqGSIb3DQEBCwUAMGYxCzAJBgNV
BAYTAklOMSQwIgYDVQQKExtOYXRpb25hbCBJbmZvcm1hdGljcyBDZW50cmUxDzAN
BgNVBAsTBlN1Yi1DQTEgMB4GA1UEAxMXTklDIHN1Yi1DQSBmb3IgTklDIDIwMTEw
HhcNMTIwMTIzMDcyNzEyWhcNMTQwMTIyMDcyNzEyWjAmMSQwIgYDVQQDExt3d3cu
bWFuaXB1cnBvcnRhbC5tbi5nb3YuaW4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQDRVxKwt/xCiAgGfuCsud5kcf+BKQURwKExLHUeUNQHpT1IMcx/is9a
nki+u3ijFbV1ei/ybgSRzFgesem+yTUutTYCgyqdU7ZxJTuKmHDkZCVEBzGxl+Jl
8AQxHHQzBI9PWuCBURR0q1eNeasfO3yWZpkRvK58uXf6vGZakYHZ9vWAYP7uhtMP
5je1Scqcc09vB5F33ux2svkwzXPxB+KOwx2stvKJ93Vw2VChLLDNByW321L/A7AA
nwZ4Jdplh/z+armGZtQO27kgNQdWAA7wQ2wr
..
...
..
fDpYOCBy87y4C6CrCaR9WMrAOP2PIazHZFKNjz0sng6TOVQ+SxBW0mmBWJamt2DJ
RoBV8pUPMvKmO6ptqklhWOYe4lIIbowhM9K7qyQR03ICiGwMuocj6IbGrJwdfgr1
CTm+L1Zs7UNMJvNxBXTZ41gd9tRazFdo5yAqKO4nPXys0oV6NAmFtUjix+sy6rkn
4O5pyizzRdB2ABcBbpn2yTEggerL2SBwxEwoD1WR3+b09UNZKMBDkHcd8HuJ3NpO
F4b5LXnKDXNG9ZKFUVxcDM70mD0YH/ypCthp/2aBFzV46yF73hqXaQwMNQY+dd+R
orWm8k2LfwFOxs5jqQ==
-----END CERTIFICATE-----

Apache configuration in ssl.conf file:

SSLCertificateFile /etc/pki/tls/certs/signed.cer
SSLCertificateKeyFile /etc/pki/tls/private/generated.keystore

Now when I start my apache I get an error saying:

[Tue Jan 24 13:10:38 2012] [error] Init: Private key not found
[Tue Jan 24 13:10:38 2012] [error] SSL Library Error: 218710120 error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag
[Tue Jan 24 13:10:38 2012] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Tue Jan 24 13:10:38 2012] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Tue Jan 24 13:10:38 2012] [error] SSL Library Error: 218734605 error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib

Does anyone know what is the issue?

1
  • Is your SSl certificate key is authenticated?
    – user109367
    Feb 6, 2012 at 11:26

3 Answers 3

5

You need to convert the private key from the Java keystore format to the PEM format used by OpenSSL. With the keytool version from JDK >= 1.6 you can do it by first converting the keystore to the PKCS#12 format, and then extracting just the private key:

keytool -importkeystore -srckeystore generated.keystore -destkeystore generated.p12 -deststoretype PKCS12
openssl pkcs12 -in generated.p12 -out generated.pem -nocerts

This writes the private key file to generated.pem; then specify this file in the Apache configuration:

SSLCertificateKeyFile /etc/pki/tls/private/generated.pem

Because the private key file is by default encrypted with a password, every time you start Apache you will need to enter this password. You can either use the SSLPassPhraseDialog to provide the password automatically, or just add the -nodes option to the openssl pkcs12 command to produce an unencrypted private key file.

4
  • One more thing, I wanted to test my certificate validity before Go-Live. What I have done is made an entry in my hosts file for the domain name with apache web server ip address which has this valid ca signed certificate and now I am hitting my application on browser using the domain name that I have. Is this correct way to test it, or is there any other way available?
    – Ankit
    Jan 24, 2012 at 9:45
  • I have been able to test the SSL certificate successfully, I had to install the chain certificates as well, which i missed. Now IE browser is showing me secure sign, but still firefox is saying that the certificate is invalid. Some (Error code: sec_error_unknown_issuer) error is there. I imported the chain certificate in webserver using keytool –importcert –alias nicchain –file chain.cer –keystore ../jre/lib/security/cacerts –storepass changeit command and also Made an entry in ssl.conf for SSLCertificateChainFile /etc/pki/tls/certs/chain.cer
    – Ankit
    Jan 24, 2012 at 10:52
  • The problem is that the “CCA India 2011” root certificate is included in Windows Root CA list, but not yet included in Mozilla's list (see #511380 and #557167, but that is for “CCA India 2007”, and the new 2011 cert with the SHA256 hash is not mentioned at all). Therefore all certs signed by the “CCA India 2011” root will not be trusted in Mozilla products, unless the root certificate is installed manually. Jan 25, 2012 at 9:40
  • Use the .jks-File instead of generated.keystore if you have one.
    – Grim
    Apr 17, 2015 at 11:42
2

You need to point SSLCertificateKeyFile to a private key, not a keystore.

1

Instal Apache mod ssl

# yum install mod_ssl

Go to certs folder in centos 6

# cd /etc/ssl/certs/

Regenerate Private Key and CSR with the help of following OpenSSL command

# openssl req -nodes -newkey rsa:2048 -keyout namhuy_net.key -out namhuy_net.csr

Get the CA Root Certificate from Verisign, Thawte, Globalsign, Comodo. After you purchase a cert from those vendor, you will get an email w/ cert files. Upload those files to

/etc/ssl/certs/

Save the combined file as namhuy_net.pem. The .pem file is now ready to use.

The SSL configuration file for Apache is where I ended up putting the configurations for my server.

# nano /etc/httpd/conf.d/ssl.conf

Edit lines

SSLEngine on
SSLCertificateFile /etc/ssl/certs/namhuy_net.crt
SSLCertificateKeyFile /etc/ssl/certs/namhuy_net.key
SSLCertificateChainFile /etc/ssl/certs/namhuy_net.pem

Restart httpd service

# service httpd restart

Source: http://namhuy.net/760/how-to-install-an-ssl-certificate-on-centos-for-apache.html

1
  • Easy on the copy-n-paste job... Your answers should be relevant to the question your posting them to, most of this "answer" doesn't apply to this question.
    – Chris S
    Dec 21, 2013 at 5:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .