I was asked by a customer / partner company to send them the certificate for one our webservers and the corresponding root ca certificate in .pkcs or .pem format to install it in his Riverbed proxy for better performance.

The certificate is not self signed (GlobalSign), so besides the fact that he should be able to get the root CA certificate himself - is it correct to have it in pkcs or pem?

Wouldn't that enable him to install a webserver with our domain name and have a valid certificate?




SSL acceleration with Riverbed needs the certificate and private key to be installed on the sever-side Steelhead appliance.

This allows the client side host to setup an SSL session, which will be intercepted by the server-side steelhead. This means the server-side steelhead needs the certificate and private key.

The server-side steelhead initiates an SSL session with the actual server, and keeps the client-side steelhead aware of the session key.

The net effect is that the client’s SSL connection logically terminates at the server but physically terminates at the client-side Steelhead

Check the riverbed website for more details on SSL acceleration with Riverbed: http://media-cms.riverbed.com/documents/FeatureBrief-Riverbed-SSL.pdf.

  • So installing the certificate including private key would only make sense if I had riverbeds on both sides of the communication, right? That is not the case. Well, I will send him the .pem files exported through the browser as suggested by mulaz. Let's see hat happens... Thanks! – st3dster Jan 7 '14 at 7:04
  • Riverbed normally operate in pairs, but note that there is also a software version of client-side riverbed for mobile clients. – aseaudi Jan 7 '14 at 10:05
  • Yes, they actually have two and want to optimize traffic inside their WAN before it goes to us through the Internet. Thanks! – st3dster Jan 8 '14 at 11:20

A certificate is a public key + owner data, signed by a certificate authority that somebody (OS, browser, organization,...) trusts that they have verified your identity.

If they wanted to spoof your server, they would also need your private key (which you must not give them - thus the "private" in the name).

You can export your certificate even from the browser (or they can do it).

Procedure for firefox (24 esr):

  • Click the "lock" symbol next to the url in the url bar, More information
  • A new window pops out, click "View certificate"
  • A new windows with certificate data pops out - click the "Details" tab, and export

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.