Impossible to add a wildcard SSL certificate

system · May 17, 2007, 3:48am

Hello,

In siteworx, ssl, we can’t generate the CSR for a wildcard SSL certificate.

For this kind of certificate you have to set the CN like this :
CN=*.mydomain.com

But if you do this Siteworx complains about a bad CN name

Pascal

IWorx-Socheat · May 17, 2007, 4:07am

Is this 2.1.3 or a 3.0 box? This is a bug in 2.1.3 and has been fixed in 3.0.

system · May 17, 2007, 4:20am

unfortunatly it is still a 2.1.3 (we have only one 3.0.1, and it is not our cluster. )

Do you think it is safe now to go to RC4 for a cluster install ?
We have to install this wildcard cert now and I have more and more tickets asking us why pointers/subdomain menu are notre there !!!
I’m always saying it is coming soon, soon, … but …

If there is just the doc which is missing and some little bugs, for us the advantages migrating to v3 will be much more important that stay at v2 !

Could you tell me which kind of “little bug” there still is in RC4 ?

About the wildcard, could I perform a degraded solution :
Manually Generate a wildcard CSR like this

1- Create a conf file

[ req ]
default_bits = 1024
encrypt_key = yes
distinguished_name = req_dn
x509_extensions = cert_type
prompt = no

[ req_dn ]
C=FR
ST=Idf
L=Paris
O=Carat-Hosting
OU=Carat-Hosting NOC
CN=*.my-domain.com
emailAddress=contact@my-domain.com

[ cert_type ]
nsCertType = server

2- Run

openssl req -config carat.cnf -new -out server.csr

3- Send to the CA this generated CSR

4- Copy in /home/account/var/domain.com/ssl/ the csr, key and crt

Should it work ?

Thanks a ton
Pascal

IWorx-Socheat · May 17, 2007, 4:23am

Yes, manually generating a CSR should work.

system · May 17, 2007, 5:50am

Socheat

Could you please provide me here the code iworx use to generate the CSR.

A wildcard certificate cost some money and I wan’t to be sure the CSR I generate will allow the cert provide by the CA to work !

Do you have just an example of your CSR generation, or could you please confirm me than the example i gave will work with Apache/iworx

Pascal

IWorx-Socheat · May 17, 2007, 6:31am

We actually use the PHP built in functions:


    $key_res = openssl_get_privatekey( $key );
    $csr_res = openssl_csr_new( $params, $key_res );

    if( $csr_res !== false ) {
      openssl_csr_export( $csr_res, $csr );
    }

$key is a string containing the contents of the private key file. $params is an array containing the various values needed to create a CSR:

http://us.php.net/manual/en/function.openssl-csr-new.php

Afterwards, $csr should be a string containing the CSR data, and can be written to a file using the usual PHP methods.

system · May 17, 2007, 6:41am

Ok thanks

So as you use openssl_get_privatekey it means you have first generated a private key in a file ? right ? how do you generate it ?

Do you generate a key with openssl_pkey_new(); ?

Pascal

IWorx-Socheat · May 17, 2007, 6:49am


$key_res = openssl_pkey_new();
openssl_pkey_export( $key_res, $key );

If you prefer, open a ticket, and I can see if I can quickly patch your box to allow wildcard SSL domains. That might be the safest way.

system · May 17, 2007, 6:49am

Ok thanks this code works juts fine



#!/usr/bin/php5-cli -q
<?
    $dn = array(
    "countryName" => "UK",
    "stateOrProvinceName" => "Somerset",
    "localityName" => "Glastonbury",
    "organizationName" => "The Brain Room Limited",
    "organizationalUnitName" => "PHP Documentation Team",
    "commonName" => "domain.com",
    "emailAddress" => "wez@example.com"
    );

        // Generate a new private (and public) key pair
        $key = openssl_pkey_new();

    $key_res = openssl_get_privatekey( $key );
    $csr_res = openssl_csr_new( $dn, $key_res );

    if( $csr_res !== false ) {
      openssl_csr_export( $csr_res, $csr );
      openssl_pkey_export( $key_res, $key );
    }

echo $key."
";
echo $csr;

?>

Thanks a ton socheat

system · May 17, 2007, 6:52am

[QUOTE=IWorx-Socheat;13015]


$key_res = openssl_pkey_new();
openssl_pkey_export( $key_res, $key );

If you prefer, open a ticket, and I can see if I can quickly patch your box to allow wildcard SSL domains. That might be the safest way.[/QUOTE]

Well, I just want to be sure to not buy a cert and have pbms after

So if you confirm me that this code is what you do, then I use it, if not and if you have time for this OK to open a ticket. It’s up to you

Thanks

Pascal

system · May 17, 2007, 6:56am

but as this code


#!/usr/bin/php5-cli
<?
    $dn = array(
    "countryName" => "UK",
    "stateOrProvinceName" => "Somerset",
    "localityName" => "Glastonbury",
    "organizationName" => "The Brain Room Limited",
    "organizationalUnitName" => "PHP Documentation Team",
    "commonName" => "domain.com",
    "emailAddress" => "wez@example.com"
    );

        // Generate a new private (and public) key pair
        $key = openssl_pkey_new();

    $key_res = openssl_get_privatekey( $key );
    $csr_res = openssl_csr_new( $dn, $key_res );

    if( $csr_res !== false ) {
      openssl_csr_export( $csr_res, $csr );
      openssl_pkey_export( $key_res, $key );
    }

echo $key."
";
echo $csr;

$outcsr="./carat-hosting.csr";
$outkey="./carat-hosting.priv.key";
if( $csr_res !== false ) {
      openssl_csr_export_to_file( $csr_res, $outcsr );
      openssl_pkey_export_to_file( $key_res, $outkey );
    }


?>

give this and provides two files with the private key and the csr

./generate.php

I think it should be fine, no ?

Maybe it is best you pass your time on the last release than on this kind of pbm

IWorx-Socheat · May 17, 2007, 7:26am

Yes, those should be fine. Just make sure to write them to the proper files (domain.com.priv.key and domain.com.csr). I’d also generate a new private key and keep that one a secret, since you just posted the private key here.

IWorx-Socheat · May 17, 2007, 7:28am

Ah, I see that you did write them to the correct file names. Nevermind.

system · May 17, 2007, 7:30am

ha ha ha yes of sure

It was just example !!!

Thanks Socheat I’ll use this script to buy the wildcard cert.

Pascal

system · May 17, 2007, 7:46am

Just to let you know that

? SSL Data was successfully migrated
There is an SSL certificate installed on the domain: *.carat-hosting.com. You have the following options available:

Thanks again Socheat for your help

Pascal