Repost from Stack Overflow. Was suggested that I post here instead, as Stack Overflow is meant for programming, and this question is focused on SSL and HAProxy.
I'm trying to complete the setup of SSL with HAProxy. To do so, I've made a CSR and sent it to my organization, and received the trusted certificates back. I created the required pem file form the jks store, and set it in the haproxy.cfg file. However, the browser still reports that the site is not trusted, and that the root certificate is not in the trusted store:
This CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store.
The other intermediate certificate beneath it are ok, though. I've already tried installing the certificate on my side as the client, but it reports that it still is not trusted. Also, when I wen to a colleague to go to this page, they had the same issue, despite not importing any of the certificates on the client side. This makes me think that the issue is with the setup of the pem file.
I used the following to create the certificate:
- Create a keystore
keytool -keystore test.jks -alias localhost -validity 365 -genkeypair -storepass changeit -keypass changeit -dname "CN=<FQDN for server>, OU=***** O=*****, L=*****, S=*****, C=*****" -ext SAN=DNS:$(hostname) -sigalg SHA256withRSA -keysize 2048 -keyalg RSA
- Create a CSR
keytool -keystore test.jks -alias localhost -certreq -file cert-file -storepass changeit -sigalg SHA256withRSA -keysize 2048 -keyalg RSA
Download root, intermediate, and service certs to server
Import certs into jks file
keytool -importcert -file $CERT -alias $ALIAS -keystore test.jks
- Convert jks to p12 file
keytool -importkeystore -srckeystore test.jks -destkeystore test.p12 -srcstoretype jks -deststoretype pkcs12
- Extract private key, without passphrase:
openssl pkcs12 -in test.p12 -nodes -nocerts -out key.pem
- Convert private key to rsa key:
openssl rsa -in key.pem -check -out rsa.pem
- Extract certificates, without passphrase:
openssl pkcs12 -in test.p12 -nokeys -out cert.pem
- Combine rsa and cert files to one pem file.
cat rsa.pem cert.pem > certrsa.pem
- Correct format for rsa part for file. This:
RSA key ok
-----BEGIN RSA PRIVATE KEY-----
should become something like this (please, also show me how to do this correctly:
Bag Attributes
friendlyName: *****
localKeyID: *****
Key Attributes: <No Attributes>
-----BEGIN RSA PRIVATE KEY-----
- Check resulting pem file to ensure that intermediate certificate is listed after RSA key. HAProxy seems to error out, otherwise.
The end result is a pem file with the following format:
Bag Attributes
friendlyName: <private key>
localKeyID: ****
Key Attributes: <No Attributes>
-----BEGIN RSA PRIVATE KEY-----
<Hash goes here>
-----END RSA PRIVATE KEY-----
Bag Attributes
friendlyName: <bottom certificate>
2.16.840.1.113894.746875.1.1: <Unsupported tag 6>
subject=/C=****/ST=****/L=****/O=**** PLC/OU=****/CN=****
issuer=/O=****/OU=<Intermediate CA>/CN=<Intermediate CA>
-----BEGIN CERTIFICATE-----
<Hash goes here>
-----END CERTIFICATE-----
Bag Attributes
friendlyName: intermediate
2.16.840.1.113894.746875.1.1: <Unsupported tag 6>
subject=/O=****/OU=<Intermediate CA>/CN=<Intermediate CA>
issuer=/O=****/OU=<Root CA>/CN=<Root CA>
-----BEGIN CERTIFICATE-----
<Hash goes here>
-----END CERTIFICATE-----
Bag Attributes
friendlyName: root
2.16.840.1.113894.746875.1.1: <Unsupported tag 6>
subject=/O=****/OU=<Root CA>/CN=<Root CA>
issuer=/O=****/OU=<Root CA>/CN=<Root CA>
-----BEGIN CERTIFICATE-----
<Hash goes here>
-----END CERTIFICATE-----
Despite the end pem file having all certificates, I still end up with the root certificate not being trusted. Going through my process, is there anything I'm missing or doing wrong?
Update: I was able to extract the root certificate with Chrome, and added it to my local certificate store. When I previously installed it, the installation was set to automatically search for the store, so it likely was not selecting the correct ticket. The certificate information now says that the certificate is ok. However, the security tab still reports that:
Certificate - missing
This site is missing a valid, trusted certificate (net::ERR_CERT_AUTHORITY_INVALID).
Update 2: Removed self signed certificate at the end of the file. I'm not sure how that got into the request.
Update 3: After removing the self signed certificate at the end of the pem file, I'm no longer getting warnings from chrome saying that the certificate is invalid. However, when I tested with my colleagues, we found that they are still getting the error. My leading theory right now is that they need to download and install the certificates in a local trust store. I'm currently looking at how new websites handle this when no one has their certificates yet.
