Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have successfully configured an Extended-Validation Certificate on an Azure Website following this article:

http://www.windowsazure.com/en-us/documentation/articles/web-sites-configure-ssl-certificate/

The main (non-technical) stakeholder of the web application went through great lengths to validate that our site is secure. He went to this site to check the validity of our SSL: http://www.whynopadlock.com/

The site throw the following error: `SSL verification issue (Possibly mis-matched URL or bad intermediate cert.). Details: ERROR: no certificate subject alternative name matches``

The certificate is installed using IP Based SSL instead of SNI. This is done this way because some site visitors still use Internet Explorer 8 on Windows XP, which has no support for SNI and throws a security warning.

Is my certificate correclty installed? I received three .CRT files from my SSL provider:

  • PrimaryIntermediate.crt
  • SecondaryIntermediate.crt
  • EndCertificate.crt

This is how I exported our certificate as a .PFX file to Azure:

openssl pkcs12 -export -out myserver.pfx -inkey myserver.key -in myserver.crt

share|improve this question
    
What does myserver.crt contain? If all three certificates, in what order? –  Mathias R. Jessen Jan 10 '14 at 0:12
    
It contains only the end certificate –  amhed Jan 10 '14 at 5:16

1 Answer 1

Sounds like you need to include the intermediate certificates in the PFX you send to Azure.

If you open PrimaryIntermediate.crt and SecondaryIntermediate.crt in a text editor and copy/paste the entire content into a single file called BothIntermediate.crt. The order the content is in doesn't matter, but make sure you include the headers ("-----BEGIN CERTIFICATE-----", etc.) and leave a blank line between the two.

You'd then want to run something like this to do the PFX conversion:

openssl pkcs12 -export -in EndCertificate.crt -inkey myserver.key -certfile intcacerts.pem -out myserver.pfx

This would give you a single PFX file that contains your all three of your CA's certificates, your certificate, and your private key. You can then upload it to Azure using the same process you used previously.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.