1

Been fighting a expired cert issue for the past few days. I am updating a cisco ace load balancer with an updated cert. However every time I attempt to validate the cert it is not valid or does not match. Steps I have used:

  • Log into web server with valid cert installed Go to IIS Manager
  • Create Certificate request in server certificates Edit correct information for company location etc. RSA and 2048 and save as a cert.csr
  • Once *.csr is created
  • open in notepad to get server request info.
  • Go to: microsoft web certsvr address to create AD cert.
  • Request new cert.
  • Advanced and add the info copied from notepad into the appropriate field.
  • click next and download the cert.cer
  • Install the cert.cer into the cert store (personal)
  • Open MMC on the same server and move the cert from personal to trusted root. (shows the key and cert as valid.)
  • Edit the newly created cert.cer file with: Openssl openssl x509 -inform der -in certs\cert.cer -out certs\certs.cer.pem

  • Export the PFX from the trusted root store. Create cert.pfx placed in the same folder that cert.cer and cert.cer.pem is located.

  • get the certificate only and not the private key from a PFX file.

  • Run the following command to export the private key: openssl pkcs12 -in certs\cert.pfx -nocerts -out certs\cert.key.pem -nodes

  • Run the following command to remove the passphrase from the private key: openssl rsa -in certs\cert.key.pem -out certs\cert.server.key

    *Just for fun I also do the following to allow for compatibility: // Convert without requiring a password for the private key and include the private key in the cert. openssl pkcs12 -in Certs\cert.pfx -out certs\certs_nokey.pem -nodes

Any help or suggestions would be deeply appreciated.

UPDATE the CA is Microsoft certificate services. This would be a DHCP server giving out certs for the connecting servers. Affectionately (CertServ CA) UPDATE* This actually worked with the cisco load balancer as well as the Servers under it. Thanks.

  • 1
    Log into web server with valid cert installed - Create Certificate request - I am confused about what you are trying to do here. Can you update your question to describe what you actually need instead of just a simple description of steps. Did you already request the certificate you wanted from the web server, and get it issued from a public CA, and now you are trying to export, or are you trying to generate a completely new cert from an internal CA? It looks like you have tried to mix-and-match three different sets of instructions for completely separate tasks. I am very confused. – Zoredache Jul 8 '14 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.