0

Using Openssl, I generated my own CertificateAuthority (CA) and using this CA I generated self signed server certificate and key. This server certificate and key was used to configure Apache HTTPD proxy and Tomcat server which starts successfully and I am able to load application UI and work as expected (All functionality is fine)

Now since it is a self signed server certificate, the browser URL pane shows Certificate error / Not secure everytime. I try to import this certificate into my windows Trusted Root Certification Authorities store using chrome or IE. The certificate import is successful. Looking at certificate in the Windows Certificate Manager (certmgr.msc) Windows says it "does not have enough information to verify this certificate". When looking at the certificate path, the only certificate that is shown is the certificate itself (with a yellow exclamation mark), and the Certificate status indicates: "The issuer of this certificate could not be found" and checking the certificate name I find that instead of the CA certificate the server certificate is imported. While I can see the certificate on certmgr.msc , but on the browser the imported certificate does not even show under Trusted Root Certification Authorities. The Common Name (CN), SubjectAlternativeName (SAN) etc are all present as expected as I know they are important.

After I manually import the CA certificate (which I already have) separately from the browser, the UI loads with green padlock as expected.

I checked online for suggestions and I can see many threads exists like this0, this1, this2 this3, this4, this5 without much help. None of them have solved this import issue without any manual CA cert import.

What am I missing? With browser certificate import why is server certificate imported and not CA certificate?
What should I do to import the CA certificate directly reading from the server certificate? Should we install the CA certificate manually? If yes, then how to import this CA certificate on a remote machine when I try to access my application from outside the system (remote system browser)? kindly help.

Arun kumar R
  • 235
  • 3
  • 12

1 Answers1

1

Finally I was able to figure out how to solve this issue. Answering my own question here so that it might help anyone else facing the same issue.

Initially you generate your own CA and and server private key and then using that CA you sign the server certificate. We were using Apache Httpd proxy server and in the configuration along with SSLCertificateFile, SSLCACertificateFile needs to be set to the CA certificate. Upon loading the URL in the browser, "Certificate error" or "Not Secure" will be shown. While clicking on to importing the certificate, under Certificate details you will see CA certificate followed by server certificate. Click to save the CA certificate locally to Trusted Root Certification Authorities (save CA and NOT server certificate) so that you can install this CA (what we created) and once the CA certificate is imported successfully, the connection will be shown as secure with green padlock in the URL bar. This can be done from local or any remote machine accessing the URL.

All certificates that we newly generate and signed by this same CA will be inherently trusted thereafter.

Arun kumar R
  • 235
  • 3
  • 12