Own SSL Certificate is not Valid

[gnulab]

Hi,

I am uploading a renewed certificate but I am facing the same problem as this post https://forum.cloudron.io/topic/9278/own-certificate-upload-problem which after uploading the ssl certificate files cloudron complains of "Certificate is not valid for this domain. Expecting test.domain.com".

How do I solve this?

Thank you
Henry

[joseph]

@gnulab you can run that locally on your laptop (I think it's also available on OS X). Alternately, you can upload the crt file to your server and run the command there. When you upload a cert, that is the command that Cloudron runs to validate the cert.

[joseph]

I assume you are uploading this in the Domains view. For which domains is the certificate valid? Cloudron is expecting a wildcard certificate.

[gnulab]

Hi,

Yes, the purchased certificate is a *.domain.com and I am uploading it to here.

[joseph]

Can you check cat cert_file | openssl x509 -noout -checkhost test.yourdomain.com ? It should say "does match certificate" .

[gnulab]

Hi,

do I ssh into cloudron to issue that command? If yes, what is the location of the cert_file? I searched through cloudron dashboard does not have terminal access, and I 'find -type f -iname *.crt' but don't see the certificate uploaded.

[joseph]

@gnulab you can run that locally on your laptop (I think it's also available on OS X). Alternately, you can upload the crt file to your server and run the command there. When you upload a cert, that is the command that Cloudron runs to validate the cert.

[gnulab]

Turns out the certificate seller emailed the wrong private key.
@joseph thanks for the heads up.

[potemkin_ai]

@joseph have the very same problem here.

openssl x509 -noout -in STAR.domain.com.crt -checkhost test.domain.com works on pure (aka 'leaf') CRT file, but fails on a bundle (cat STAR.*.crt STAR.*.ca-bundle > ssl-complete-bundle.crt) - with an intermediate certificate build-in.

And if I upload that pure / leaf certificate, then all apps that are not browsers fails with unable to verify the first certificate kind of error (that particular is from UpTime Kuma) - as an intermediate certificate is missing.

So, I would say that own wildcard certificate functionality is quite broken as of now on Cloudron.

[potemkin_ai]

Apologies and correction.

Cloudron's functionality works just as intended. The problem is in docs in major sites and hence chatGPT as well (which I used to troubleshoot that).

All of the docs, except for NameCheap (thanks, guys!) says that the correct way to combine crt files - is just do cat .. > final.crt which lead to one problem:

-----END CERTIFICATE----------BEGIN CERTIFICATE-----

On the line 37, which, absolutely reasonably, brakes any SSL parser.

Correct way to join CRT files is:

cat STAR.*.crt > ssl-complete-bundle.crt && echo >> ssl-complete-bundle.crt && cat STAR.*.ca-bundle >> ssl-complete-bundle.crt

And you can check if it is valid than with

openssl x509 -noout -in ssl-complete-bundle.crt -checkhost test.`basename STAR.*.crt | sed -E 's/^STAR\.([^.]+(\.[^.]+)?)\.crt$/\1/'`

Guess, it might make sense to document it.