1

I was following the directions from this site (https://www.sslshopper.com/move-or-copy-an-ssl-certificate-from-a-windows-server-to-an-apache-server.html) to migrate my GoDaddy.com certificate from a Windows Server 2003 machine to a server Running Debian & Apache (v 2.4.10). I converted the .pfx file to a .txt and opened it to extract the Private Key and certificate. But, my file has three certificates, not just the one in the tutorial. So, which section is my SSLCertificateFile, SSLCertificateKeyFile, or SSLCertificateChainFile? I tried adding the top portion as my Private key, and the 2nd section as my Certificate, but in Chrome I get a 'NET:ERR_CERT_AUTHORITY_INVALID'message when navigating to my site. Any help would appreciated.

Bag Attributes
Microsoft Local Key set: <No Values>
localKeyID: 01 00 00 00 
Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider
friendlyName: 921ddddfb37214c2d5593e0c9b386a34_bc31898e-7ad7-4e24-9c39-0088bf3b937a
Key Attributes
X509v3 Key Usage: 10 
-----BEGIN ENCRYPTED PRIVATE KEY-----
Some Text Here   
-----END ENCRYPTED PRIVATE KEY-----
Bag Attributes
localKeyID: 01 00 00 00 
subject=/OU=Domain Control Validated/CN=example.com
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2
-----BEGIN CERTIFICATE-----
More Text here 
-----END CERTIFICATE-----
Bag Attributes
friendlyName: Go Daddy Root Certificate Authority  G2
subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2
-----BEGIN CERTIFICATE-----
Other Text here as well
-----END CERTIFICATE-----
Bag Attributes: <Empty Attributes>
subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2
-----BEGIN CERTIFICATE-----
Last bit of text here 
-----END CERTIFICATE-----

( removed the text of the certificates for ease of reading, and security)

0

The text:

-----BEGIN ENCRYPTED PRIVATE KEY-----
Some Text Here   
-----END ENCRYPTED PRIVATE KEY-----

is an encrypted PKCS#8 private key and it should be placed in a file and the passphrase removed with:

openssl pkcs8 -topk8 -inform PEM -in <in file> -nocrypt -out private.key

Note that the above command will ask for the password.

This private.key file is pointed to by SSLCertificateKeyFile.

The various sections with:

-----BEGIN CERTIFICATE-----
Text here 
-----END CERTIFICATE-----

are your certificates. They need to be placed in files as follows:

The one below subject=/OU=Domain Control Validated/CN=example.com is your site certificate and should be placed in a file that is pointed to by SSLCertificateFile.

The last one is your issuing CA's certificate and should be placed in a file that is pointed to by SSLCertificateChainFile.

The remaining one (the one in between the two above) is the Root CA certificate and that should already be stored in the trust anchor store of all clients. You don't need to do anything with that one.

  • So, I created my private.key following your example. I split the 3 certificates up calling them cert_1.crt, cert2.crt, & cert3.crt SSLCertificateFile /var/cert_1.crt SSLCertificateKeyFile /var/private.key SSLCertificateChainFile /var/cert_3.crt I when restarting Apache I get the following message: Certificate and private key example.com:443:0 from /var/arges86_1.crt and /var/private.key do not match – Arges86 Nov 6 '16 at 17:22
  • Where does arges86_1.crt come into it? SSLCertificateFile points to cert_1.crt - or is that a typo? – garethTheRed Nov 6 '16 at 18:27
  • Sorry, that was a typo. Should have been /var/cert_1.crt – Arges86 Nov 6 '16 at 18:29
  • You can check that the key and certificate match using OpenSSL. For the key use: openssl rsa -noout -modulus -in <keyfile> | md5sum and for the certificate use: openssl x509 -noout -modulus -in <certificate> | md5sum. The output of both should match. Note that you can run those commands without piping to md5sum but the two outputs for comparison will be very long - comparing the md5 hash of those values just makes it a shorter task. – garethTheRed Nov 6 '16 at 18:35
  • Ok, so it seems i'm bad @ copy & paste. I fixed that, and named them correctly and Apache now starts w/o errors. Thank you so much @garethTheRed for your help. On android devices, my website prompts saying " No Certificates found" should this be its own thread? I found a related (but unhelpful since he was using IIS) post here link – Arges86 Nov 7 '16 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.