6

We have a need to deploy a server app that has its own SSL certificate built in. This will get rolled to an unknown number of servers, that will go up and down.

We can generate this certificate using any CA, but in the end, we will just have the 509 certificate pfx file (issued by godaddy or whatever CA). We can have in hand the intermediate certs, but this web server is simple, and only lets us specify the pfx file.

We won't be able to distribute or install intermediate certificates.

The app is a C# app that runs on Win2008 and higher.

What methods are there to solve this?

-- Is there a certificate that is reliable enough for browsers to trust it without intermediate certificates?

-- or ?

  • 1
    509 certificate pfx file - this would include the public key as well as the private key; it's impossible for an SSL listener to function with only the private part of the certificate. Do you by chance mean that you'll only have the subject certificate and can't install an intermediate? Can you clarify why this restriction is in place? – Shane Madden Dec 1 '14 at 21:57
  • 4
    A PKCS #12 (pfx) file can bundle the entire trust chain including intermediate and root CA certs. You could even add the trust chain after receiving the file from godaddy. – Andrew Domaszek Dec 1 '14 at 22:25
  • @ShaneMadden OP enhanced. But I think Andrew just pegged it. – samsmith Dec 1 '14 at 22:25
  • @AndrewDomaszek Can you share a link how to do that? A quick survey of the net is not showing me the magic. – samsmith Dec 1 '14 at 22:27
13

You can add additional certs from the trust chain to a PKCS #12 file using openssl.

For example, to include the trust chain you could use the following command:

openssl pkcs12 -export -in input.pfx -out bundle.pfx -CAfile allcacerts.crt -chain

This would attempt to include the entire cert trust chain in your output pfx. You may need to include -passin <input password> and -passout <output password> for password requirements. You can force the inclusion of any particular certs with -certfile cacert.crt to include all certs in that file.

You can use the same utility to inspect the pfx file to see its contents and print a significant amount of diagnostic information.

openssl pkcs12 -in bundle.pfx -info
  • Cool, thanks! Is there a way to validate that the resulting pfx has the whole chain in it? (other than installing it on a web server and testing it there) – samsmith Dec 1 '14 at 23:40
  • I cannot yet make this work all the way. I can put all the intermediate and root certs from godaddy into one .crt file. I can run your command fine. I get a pfx. I can run -info on the pfx fine, and see two (of the four) CA related certs, plus my cert, in the pfx. But on IIS web server, I still get intermediate cert not found issues. – samsmith Dec 2 '14 at 20:04
  • Andrew, when I create the "allcacerts.crt" does it matter what sequence the certs appear? Is there any downside to including extra certs? Will openssl intelligently grab the needed certs for the cert chain and put them in the output pfx? – samsmith Dec 2 '14 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.