1

Repost from Stack Overflow. Was suggested that I post here instead, as Stack Overflow is meant for programming, and this question is focused on SSL and HAProxy.

I'm trying to complete the setup of SSL with HAProxy. To do so, I've made a CSR and sent it to my organization, and received the trusted certificates back. I created the required pem file form the jks store, and set it in the haproxy.cfg file. However, the browser still reports that the site is not trusted, and that the root certificate is not in the trusted store:

This CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store.

The other intermediate certificate beneath it are ok, though. I've already tried installing the certificate on my side as the client, but it reports that it still is not trusted. Also, when I wen to a colleague to go to this page, they had the same issue, despite not importing any of the certificates on the client side. This makes me think that the issue is with the setup of the pem file.

I used the following to create the certificate:

  1. Create a keystore
keytool -keystore test.jks -alias localhost -validity 365 -genkeypair -storepass changeit -keypass changeit -dname "CN=<FQDN for server>, OU=***** O=*****, L=*****, S=*****, C=*****" -ext SAN=DNS:$(hostname) -sigalg SHA256withRSA -keysize 2048 -keyalg RSA
  1. Create a CSR
keytool -keystore test.jks -alias localhost -certreq -file cert-file -storepass changeit -sigalg SHA256withRSA -keysize 2048 -keyalg RSA
  1. Download root, intermediate, and service certs to server

  2. Import certs into jks file

keytool -importcert -file $CERT -alias $ALIAS -keystore test.jks
  1. Convert jks to p12 file
keytool -importkeystore -srckeystore test.jks -destkeystore test.p12 -srcstoretype jks -deststoretype pkcs12
  1. Extract private key, without passphrase:
openssl pkcs12 -in test.p12  -nodes -nocerts -out key.pem
  1. Convert private key to rsa key:
openssl rsa -in key.pem -check -out rsa.pem
  1. Extract certificates, without passphrase:
openssl pkcs12 -in test.p12 -nokeys -out cert.pem
  1. Combine rsa and cert files to one pem file.
cat rsa.pem cert.pem > certrsa.pem
  1. Correct format for rsa part for file. This:
RSA key ok
-----BEGIN RSA PRIVATE KEY-----

should become something like this (please, also show me how to do this correctly:

Bag Attributes
    friendlyName: *****
    localKeyID: *****
Key Attributes: <No Attributes>
-----BEGIN RSA PRIVATE KEY-----
  1. Check resulting pem file to ensure that intermediate certificate is listed after RSA key. HAProxy seems to error out, otherwise.

The end result is a pem file with the following format:

Bag Attributes
    friendlyName: <private key>
    localKeyID: ****
Key Attributes: <No Attributes>
-----BEGIN RSA PRIVATE KEY-----
<Hash goes here>
-----END RSA PRIVATE KEY-----
Bag Attributes
    friendlyName: <bottom certificate>
    2.16.840.1.113894.746875.1.1: <Unsupported tag 6>
subject=/C=****/ST=****/L=****/O=**** PLC/OU=****/CN=****
issuer=/O=****/OU=<Intermediate CA>/CN=<Intermediate CA>
-----BEGIN CERTIFICATE-----
<Hash goes here>
-----END CERTIFICATE-----
Bag Attributes
    friendlyName: intermediate
    2.16.840.1.113894.746875.1.1: <Unsupported tag 6>
subject=/O=****/OU=<Intermediate CA>/CN=<Intermediate CA>
issuer=/O=****/OU=<Root CA>/CN=<Root CA>
-----BEGIN CERTIFICATE-----
<Hash goes here>
-----END CERTIFICATE-----
Bag Attributes
    friendlyName: root
    2.16.840.1.113894.746875.1.1: <Unsupported tag 6>
subject=/O=****/OU=<Root CA>/CN=<Root CA>
issuer=/O=****/OU=<Root CA>/CN=<Root CA>
-----BEGIN CERTIFICATE-----
<Hash goes here>
-----END CERTIFICATE-----

Despite the end pem file having all certificates, I still end up with the root certificate not being trusted. Going through my process, is there anything I'm missing or doing wrong?

Update: I was able to extract the root certificate with Chrome, and added it to my local certificate store. When I previously installed it, the installation was set to automatically search for the store, so it likely was not selecting the correct ticket. The certificate information now says that the certificate is ok. However, the security tab still reports that:

Certificate - missing
This site is missing a valid, trusted certificate (net::ERR_CERT_AUTHORITY_INVALID).

Update 2: Removed self signed certificate at the end of the file. I'm not sure how that got into the request.

Update 3: After removing the self signed certificate at the end of the pem file, I'm no longer getting warnings from chrome saying that the certificate is invalid. However, when I tested with my colleagues, we found that they are still getting the error. My leading theory right now is that they need to download and install the certificates in a local trust store. I'm currently looking at how new websites handle this when no one has their certificates yet.

  • @garethTheRed When I first started setting this up, I used a self signed certificate, but I didn't include that in the CSR, or in any part of this process. I'm not sure how that got in there. I've removed it and tested the config file. I will edit the question to reflect that. – SVill Jun 11 at 18:58
  • You should only need to install the Root CA certificate in the clients (browser) as all other certificates are sent by the proxy as part of the TLS handshake. There is also no need to have the Root CA certificate in your certificate bundle. – garethTheRed Jun 11 at 19:15
0

Kindly remove the 'Bag attributes' because they are picked up from the pfx file which is a windows based attribute. It should look like this.

-----BEGIN RSA PRIVATE KEY-----
ENCRYPTED TEXT
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
ENCRYPTED TEXT
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
ENCRYPTED TEXT
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
ENCRYPTED TEXT
-----END CERTIFICATE-----

THE Sequence should be like the one below

  1. private key
  2. server certificate
  3. intermediate certificate
  4. root certificate (optional)
| improve this answer | |
  • This won't make any difference. HAproxy uses OpenSSL PEM routines, which ignore any extraneous content before or after a PEM block. Also, while there are some Windows-defined attributes sometimes used in PKCS12/PFX files, none of the attributes in this Q are such -- unsurprisingly so since it was created by Java. – dave_thompson_085 Jun 20 at 4:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.