Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do you change which SSL cert Go server uses? We've got a mismatch between the domain in the cert and domain we actually use to access the server. So we always get cert issues even after adding the cert to the local store.

share|improve this question

migrated from stackoverflow.com Apr 24 '11 at 21:03

This question came from our site for professional and enthusiast programmers.

    
If you don't mean golang, I will have to cast a close vote. What is thoughtworks? –  Matt Joiner Apr 24 '11 at 14:05
    
thoughtworks-studios.com/go-agile-release-management Its a build server. Think Cruise Control. Really nice interface. –  Grummle Apr 24 '11 at 15:20
    
You should perhaps post a query at the Go support site: community.thoughtworks.com/groups/0cb47e7ff8/summary –  Tom Duckering May 11 '11 at 11:57
    
Ugh. No can do. community.thoughtworks.com/posts/9d33d7f2b5 –  Grummle Jun 2 '11 at 20:01

1 Answer 1

There is a suggested work around for this problem described here: http://sachinsudheendra.github.io/2014/03/08/using-go-cd-with-custom-certificates.html

Haven't tried it yet but will be doing so soon so will post results here when I have tried it.

Edit: I tried this today and can confirm it works fine.

Tested using OpenSSL 64-bit http://slproweb.com/download/Win64OpenSSL-1_0_0l.exe

Steps to reproduce (on Windows Server 2012 R2 using GO version 13.4):

(Assumes you have already created a DNS entry for the name you wish to use e.g. mycdserver.mycompany.com)

(These steps can be performed on any machine with OpenSSL installed)

  1. Obtain a valid X509 SSL certificate either using an internal certificate authority or from a public certificate authority with a CN matching the DNS entry e.g. mycdserver.mycompany.com
  2. Import the certificate into the Windows certificate store
  3. Using the certificates MMC snap-in, export the certificate as a .pfx file specifying a password of serverKeystorepa55w0rd
  4. Export the key file from the .pfx source file using the following command:

    openssl pkcs12 -in mycertificatepath.pfx -nocerts -out mycertificatepath.key

  5. Export the crt file from the .pfx source file using the following command:

    openssl.exe pkcs12 -in mycertificatepath.pfx -clcerts -nokeys -out mycertificatepath.crt

  6. Convert the key file and crt file into a pkcs12 file using the following command:

    openssl pkcs12 -inkey mycertificatepath.key -in mycertificatepath.crt -export -out mycertificatepath.pkcs12

(These steps should be performed on the server)

  1. On the server, open a command prompt as Administrator
  2. Navigate to the directory where the Java Runtime Environment binaries are installed. The default path is C:\Program Files (x86)\Go Server\jre\bin
  3. Import the PKCS12 file produced in the earlier steps into a keystore file using the KeyTool executable in the bin directory using the following command:

    keytool -importkeystore -srckeystore mycertificatepath.pkcs12 -srcstoretype PKCS12 -destkeystore keystore -srcalias 1 -destalias cruise

  4. Stop the Go Server service using the following command:

    net stop "Go Server"

  5. Start the Go Server service using the following command:

    net start "Go Server"

  6. Verify that the service has started correctly and try to navigate to the url corresponding to your certificate over https e.g. mycdserver.mycompany.com

  7. You may need to close your browser first however once reopened you should see your GO server over HTTPS with valid certificate (assuming your client is setup to trust the certificate authority that issued the certificate!)

If there are any problems then the GO Server service will stop and details will be logged in the file "C:\Program Files (x86)\Go Server\go-server-wrapper.log"

Hope that helps.

share|improve this answer
    
This is not really an answer. –  Rico Apr 23 at 15:05
    
Sorry what do you mean it is not an answer? The link is to an article which has a solution for the problem discussed. How is that not an answer? –  CarlR Apr 23 at 15:10
    
Well you haven't even tried it so in a sense it's not a definitive answer. According to the policies of this website the above should be more of a comment. Since you don't have enough reputation yet to comment I suggest trying your answer before posting it as an "answer". –  Rico Apr 23 at 15:13
    
I would have posted it as a comment but for a reason I cannot possibly understand I am not allowed to add comments. However I thought this was all about helping each other, the poster may never find this link on their own and I may never ever get around to testing it but it could be useful for him/her. Certainly more useful than no reply would be as it is. –  CarlR Apr 23 at 16:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.