2

I have the following:

  1. OpenSSL-generated, Self-signed Internal CA cert
  2. OpenSSL-generated Internal-CA signed, wildcard cert

This cert protects our internal websites. e.g. "myservice.corp.example.com"

In this example, the wildcard cert has the following fields of note:

CN = ".corp.example.com" DNS = ".abc.corp.example.com" DNS = "*.xyz.corp.example.com"

(i.e. those last two are SANs)

To make the CA chain acceptable to the OS, I install the CA certs on workstations.

This works fine on macOS. "Fine" == "Green site-is-secure icon in browsers". I install the CA cert in the site-wide keychain, and set the Trust to "Always Trust"

However, on Windows 10, I install the CA cert via the Certificates snap-in (or by right-clicking on the cert -> Install). No matter what I do, I get the following error notices in the cert:

  1. Certificate -> General -> "The integrity of this certificate cannot be guaranteed. The certificate may be corrupted or may have been altered."
  2. Certificate -> Certification Path -> Certificate Status -> "This certificate has an invalid digital signature"

Finally, the RSA key is 2048 bits, and the signature algorithm on both the CA cert and the self-signed cert are sha256

I've scoured the web but can't find any resolution that helps me yet, but it appears it may be one of the following:

  1. Issuer and Subject can't match. Or must match? not sure. (They do match in my CA cert)
  2. Minimum key length not satisfied. (we are using 2048 bits, though)
  3. something else?

My problem is I don't even know how to troubleshoot this on Windows. I'm a Linux admin. So, requesting troubleshooting steps and possible resolutions.

9
  • "This certificate has an invalid digital signature" - what is the digital signature algorithm used? When you view the certificate in Windows, click on the Details tab and read the Signature Algorithm. It will be something similar to sha256RSA. The algorithm in this case is sha256. Aug 1, 2017 at 18:09
  • The sig algorithm is sha256
    – JDS
    Aug 1, 2017 at 19:00
  • Is that the case for both certificates? Aug 1, 2017 at 19:11
  • Yes. Both CA cert and self-signed cert use sha256 sig algo
    – JDS
    Aug 1, 2017 at 20:03
  • 1
    If the end-entity cert is signed by the CA cert, then check that the Authority Key Identifier of the end-entity certificate is the same value as the Subject Key Identifier of the CA certificate. Also check that the CA certificate installed in the browser has the same Subject Key Identifier. Aug 1, 2017 at 20:24

1 Answer 1

1

We have experienced this error if both have the same "Common Name". This is better suited as a comment but the site limits by rep points to post comment.

1
  • 1
    This was my issue. Thanks for adding this.
    – SteveSims
    Jan 7 at 0:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .