I'm trying to implement Stud as an SSL termination point before HAProxy as a proof of concept for WebSockets routing. My domain registrar Gandi.net offers free 1-year SSL certs.
Through OpenSSL, I generated a CSR which gave me two files:
I gave domain.csr to my trusted authority and they gave me two files:
- GandiStandardSSLCA.pem (I think this is referred to as the intermediary cert?)
This is where I encountered friction: Stud, which uses OpenSSL, expects there to be an "rsa private key" in the "pem-file" - which it describes as "SSL x509 certificate file. REQUIRED."
If I add the domain.key to the bottom of Stud's pem-file, Stud will start but I receive the browser warning saying "The certificate is self-signed." If I omit the domain.key Stud will not start and throws an error triggered by an OpenSSL function that appears intended to determine whether or not my "pem-file" contains an "RSA Private Key".
At this point I cannot determine whether the problem is:
- Free SSL cert will always be self-signed and will always cause browser to present warning
- I'm just not using Stud correctly
- I'm using the wrong "RSA private key"
- The CA domain cert, the intermediary cert, and the private key are in the wrong order.