After importing a certificate PEM file with more than one CERTIFICATE section, you cannot access the management console
book
Article ID: CTX238556
calendar_today
Updated On:
Description
You have a PEM file which contains a PRIVATE KEY section, and more than one CERTIFICATE section. The additional CERTIFICATE sections are for other root certificate authorities. In the Management Console, you go to Settings and Configuration, and upload the certificate. Once that completes, the Management Console does not come back up. Apache HTTPD is simply not running.
You can login as "root" and look at /vatr/log/httpd/ssl_error_log and you will see messages about the certificate chain or name mismatches.
If you look at /etc/ssl/pem/unidesk.pem, which should be an exact copy of your original PEM file, you will notice that only one CERTIFICATE section is present. The error you get depends on which CERTIFICATE section we preserved and which we threw away.
Resolution
You can manually update the PEM file instead of using the Management Console. This is an available option if you have not already uploaded the certificate or have rolled back to a snapshot. It is required to recover if you have already uploaded the certificate and have no backup.
Login to the ELM as root. Login through an SSH client like SecureCRT or PuTTY so that you can copy/paste in the correct PEM file. Otherwise, you might need to use SCP to upload your PEM file and cp or mv to put it in place.
The Apache httpd certificate file is always stored in /etc/ssl/pem/unidesk.pem. When we upload a certificate, we simply overwrite this file. If you want to manually upload a certificate, you can overwrite this file too.
service httpd stop
cd /etc/ssl/pem
cp unidesk.pem unidesk.pem.old
cat > unidesk.pem
{copy and paste your PEM text}
ctrl-D
reboot
If you cannot copy, paste the text of your PEM file, you can use WinSCP or some other SCP \client to get your PEM file uploaded. Then your middle command becomes something more like this:
mv unidesk.pem unidesk.pem.old
mv your-new.pem unidesk.pem
After the reboot, httpd will restart. First, just try logging in through the management console. Otherwise, check ssl_error_log or the output of "service httpd status" to see what happened when it started. However, manually replacing unidesk.pem is perfectly supported. It's supposed to be exactly what the web console does.
Was this article helpful?
thumb_up
Yes
thumb_down
No