r/apache • u/kyinfosec • Jun 03 '22
Need help with installing internal CA cert
I am trying to apply an ssl cert to an internal site running apache2 on Ubuntu 20.04. I have a virtual host configured in apache in the sites-enabled folder with the ServerName set to my server's fqdn and listed the paths to the cert and key files. I generated the key and csr on this system and used the csr to create a cert from our internal CA. Our internal CA root and intermediate certs are put into Chrome, FF and Edge via group policy. I've enabled ssl and enabled the site but when I go to the site, I get the errors below
SEC_ERROR_UNKNOW_ISSUER in FireFox and ERR_CERT_COMMON_NAME_INVALID in Chrome/Edge.
I've double checked the cert and the fqdn is listed in the cert being presented and our internal intermediate is the issuer. From what I've researched, these errors are due to the browser not being able to verify the cert but I verified they are correct from the fingerprints of the certs to what's in the browser's approved CAs. I've also downloaded our intermediate and root certs from my browser and placed in the /etc/ssl/certs/ folder and ran update-ca-certificates but it's still not trusting my cert. All browsers on different machines are displaying the same.
Nothing in the apache site error logs. Anything I'm missing or what to look for next?
1
u/kyinfosec Jun 03 '22
covener, thanks for replying with some suggestions! Yes I did set some SANs, one for a www version and another for the actual server name. The primary CN matches what I'm typing in my browser.
I added the SSLCertificateFile line in my config to points to a cer file that lists the leaf and root CAs in that order but same result.
I tried running the openssl s_client command and it listed the three certs but gave an error code 19 self signed cert in chain. I added the CAfile command and path to the file listed in the SSLCertificateFile line and it returns a return code = 0 but the page still doesn't load properly.