3

I had a certificate expire today and needed to get one reissued from GoDaddy. In the past, I've had no trouble using the pem encodings they generate with the ELB SSL interface. However, when I try to include the SHA-2 bundle (the pem encoded list of certificates in the cert chain) in the certificate chain text area, I get a "Invalid Public Key Certificate" error. If I don't include the certificate chain, I'm able to configure the certificate (however it doesn't validate on iOS and Android).

When I did this a year ago I had no trouble. Also, I should note that this bundle file works just fine with two Apache servers that are not behind load balancers.

6
  • 1
    What is "the SHA-2 bundle"? Jan 15, 2014 at 3:53
  • Does the bundle file which you're trying to add in include your certificate as well? When I've installed SSL certificates on Stunnel, I've had to bundle the private key, certificate and chain certificate into the one .PEM file for it to work, but Amazon requires them to be separately added.
    – jaseeey
    Jan 15, 2014 at 3:59
  • @JasonIlicic as far as I can tell, none of the certificates in the cert chain bundle file are the same as the signed cert GoDaddy issued. Jan 15, 2014 at 4:03
  • @MichaelHampton Does my edit help clarify things? Jan 15, 2014 at 4:04
  • 1
    Are you able to try and invert the order of the certificates in the CA bundle file? So put the bottom one on the top, and vice versa. Just reading around and came across this: stackoverflow.com/questions/14263355/…
    – jaseeey
    Jan 15, 2014 at 4:07

2 Answers 2

4

Use gd_bundle-g2.crt instead.

Thank you to my friends over at trusted advisor.

Quick Review

  1. Ensure private key is in RSA format without a password.

    openssl rsa -in private.key -text > private.pem

  2. Your .crt file from godaddy is probably already in pem format.

    openssl x509 -inform PEM -in blahblah.crt > public.pem

  3. Download gd_bundle-g2.crt from https://certs.godaddy.com/anonymous/repository.pki


Field mappings (Dear amazon, this form is terrible.)

  • Private Key -> private.pem
  • Public Key Certificate -> public.pem
  • Certificate Chain -> gd_bundle-g2.crt

If your form looks like this, these instructions probably still apply. https://i.stack.imgur.com/yB918.png

1
  • Wish I could add more star up-votes! The documentation across both AWS and GoDaddy is shamefully inconsistent. Thanks for the clarity! May 7, 2015 at 2:02
0

Supporting evidence ... I too am having this problem with a GoDaddy SHA-2 intermediate certificate (gd_bundle-g2-g1.crt).

It fails on the AWS console, from "aws cli" and using "openssl verify":

gd_bundle-g2-g1.crt: /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=https://certs.godaddy.com/repository//CN=Go Daddy Root Certificate Authority - G2 error 20 at 0 depth lookup:unable to get local issuer certificate

I have tried inverting the order and other things mentioned here and other places and thus far no luck.

1
  • Did you try using the "gd_bundle-g2.crt" instead as the other answer suggested? Feb 14, 2015 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .