Problem with uploading SSL certificate

[John Weissberg]

I just installed FreeNAS 9.2.1.8. I want to replace the self-signed default SSL certificate with my own cert and key.

When I visit the settings page and try to paste in my key and cert, I get this warning message in red:

You can either enter details to internally create a certificate
Or You can copy paste your existing keypair and certificate
into the 'ssl_certfile' filed. BUT NOT BOTH!

If I navigate away from the "settings" page and then back, the new certificate was not correctly saved and I see the default self-signed certificate in place.


Here is what my key and cert look like concatenated together:

-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAkN/5kmQRLMa20DznrwEpJRpSCQKJPnxU0+ViXILY+2OnqJUo
...
//4QDkKCiJ1AthJUdW2B1PjYm7xAVvxuy/AM6mvMbI8GTsHDEoA=
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIEszCCA5ugAwIBAgISESGv1ls/DlUi38TqxA5UzA4QMA0GCSqGSIb3DQEBBQUA
...
B8vVGPcvS69RBjP4r1p9PBNSazQrnU+/Gu+eHEatx8d1ROapu2N20jGfxdzflvnb
Li4BICqF/w==
-----END CERTIFICATE-----

 

[dlavigne]

Were you able to figure this out?

 

[pjc]

I was poking at this the other day and found some strange behavior as well. I hadn't quite replicated my issues sufficiently to create a bug report, but since you asked:

1) Either the passphrase doesn't work with a pasted private key, or it doesn't like this format:

Code:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,93A5E0BD67C90744.
...

2) Sometimes clicking "save" doesn't have any effect. Eventually I discovered that a green overlay appears saying that the SSL settings were applied when it does work. And then I had trouble reproducing the problem.

Incidentally, it seems like you should really be doing "/usr/sbin/nginx -s reload" after the settings are updated. It didn't serve the new cert until I did that.

 

[airflow]

certificate management in FreeNAS 9.2.x is broken and will be much improved in 9.3. I recommend to wait for that version.

more details here: https://forums.freenas.org/index.ph...t-self-signed-cert-to-a-ca-signed-cert.23917/

regards,
airflow

 

[John Weissberg]

No. I was not able to solve this issue with FreeNAS 9.2.1.8. I will wait until 9.3 and then try again.