- Ubuntu 12.04
- OpenSSL 1.0.1 14
- Wget 1.13.4
- create our own CA (
- generate a certificate which is signed with the above CA (
- Concatenate that cert and the CA cert into a bundle file
ssl_certificate /etc/ssl/certs/graphite.local.crt; ssl_certificate_key /etc/ssl/certs/graphite.local.key; ssl_client_certificate /etc/ssl/certs/our_own_ca_chained.crt;
our_own_ca_chained.crt = graphite.local.crt + own_own_ca.crt
To install this CA into the trusted store, according to
/usr/share/doc/ca-certificates/README.Debian, I just need to copy it to the
/usr/local/share/ca-certificates/, then run
update-ca-certificates. Here's the output:
Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d.... Warning: there was a problem reading the certificate file /etc/ssl/certs/our_own_ca.pem. Message: Extensions not allowed in v2 certificate done. done.
After that, we have something like belows in
lrwxrwxrwx 1 root root 17 Mar 11 05:27 99ff557c.0 -> our_own_ca.pem lrwxrwxrwx 1 root root 17 Mar 11 05:27 dc79b3f0.0 -> our_own_ca.pem lrwxrwxrwx 1 root root 50 Mar 11 05:27 our_own_ca.pem -> /usr/local/share/ca-certificates/our_own_ca.crt
curl -I https://graphite.local
HTTP/1.1 302 FOUND Server: nginx Date: Wed, 11 Mar 2015 05:30:30 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Vary: Cookie Location: https://graphite.local/account/login?next=/ Strict-Transport-Security: max-age=15768000
wget does not:
wget https://graphite.local --2015-03-11 05:31:22-- https://graphite.local/ Resolving graphite.local (graphite.local)... 127.0.0.1 Connecting to graphite.local (graphite.local)|127.0.0.1|:443... connected. ERROR: cannot verify graphite.local's certificate, issued by `xxx': Self-signed certificate encountered. To connect to graphite.local insecurely, use `--no-check-certificate'.
I also tried to use the
--ca-certificate but got the same error.
Did I miss something?