LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   openssl certificate organization mismatch (https://www.linuxquestions.org/questions/linux-security-4/openssl-certificate-organization-mismatch-4175625195/)

archsupport 03-08-2018 07:42 AM
openssl certificate organization mismatch
 
I've configured an apache virtualhost with an ssl certificate that I generated on another host. Below I've pasted the ssl.conf from /etc/httpd/conf.d/ as well as the beginning portion of the decrypted ssl certificate. When I navigate to https://system1.mwimp.com from a browser the ssl certificate Organization says SomeOrganization as indicated in the attached screenshot.

Code:
<VirtualHost 192.168.1.146:443>
        ServerAdmin root@system1.mwimp.com
        DocumentRoot /var/www/html
        ServerName system1.mwimp.com
        SSLEngine on
        SSLProtocol all -SSLv2 -SSLv3
        SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
        SSLCertificateFile /etc/pki/tls/certs/ca.crt
        SSLCertificateKeyFile /etc/pki/tls/private/ca.key
        SSLCertificateChainFile /etc/pki/tls/certs/ca.crt
</VirtualHost>
Code:
[root@system1 certs]# openssl x509 -text -noout -in ca.crt  | grep Issue | awk '{print  $7}'
O=MattMan
The browser shows this

https://imgur.com/a/gbUYA

scasey 03-08-2018 10:22 AM
The browser is notifying that the certificate was not issued by a known certificate issuer...which it wasn't.

It is what's known as a "self-issued certificate" Self issued certificates will still encrypt the transmission between the browser and the server*, but are not considered "secure" because the browser doesn't know the creating entity (SomeOrganization).

*after the user accepts the certificate, telling the browser the cert is OK, that is.

archsupport 03-08-2018 10:45 AM
Thanks for the reply. One thing I noticed, is that when I generate the ssl certs on the server itself and put them in the same place, the browser will show the right O.

Code:
# Generate private key
openssl genrsa -out ca.key 2048

# Generate CSR
openssl req -new -key ca.key -out ca.csr

# Generate Self Signed Key
openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
https://imgur.com/mP7BSTh


Could it be the issue that I'm using a .crt and a .key that I did not generate on the host itself?

scasey 03-08-2018 01:06 PM
Quote:
Originally Posted by archsupport (Post 5828736)
Could it be the issue that I'm using a .crt and a .key that I did not generate on the host itself?
Yes, that would be the reason that the Issuer is different, and you should always generate a self-signed cert on the server on which it will be used.
However, the reason you're seeing these dialogs at all is because the certificate is self-signed and must be accepted (overridden) to work at all.

Avoid that by purchasing a "real" certificate.

archsupport 03-08-2018 03:38 PM
Thanks so much for the help. Just out of curiousity do you know exactly why importing the certs doesn't work? In other words why does the issuer show up when I generate it on the machine vs when I copy the exact same cert to another bo?

archsupport 03-10-2018 07:49 AM
I found the issue. The ssl.conf was using the localhost.key and localhost.crt because they're specified in the default virtualhost. I'll mark this issue as closed.


All times are GMT -5. The time now is 07:13 AM.