TLS Cert NOT VALIDATED: unable to get local issuer certificate

[abdulhadizamri]

Hello everyone,

My customer complained that their TLS cert not validated :

Checked on the checktls.com and found that Cert OK = Fail

	Pref	Con- nect	All- owed	Can Use	TLS Adv	Cert OK	TLS Neg	Sndr OK	Rcvr OK
	10	OK (262ms)	OK (500ms)	OK (262ms)	OK (260ms)	FAIL	OK (2,169ms)	OK (354ms)	OK (262ms)
	20	OK (338ms)	OK (716ms)	OK (363ms)	OK (350ms)	FAIL	OK (2,910ms)	OK (1,049ms)	OK (282ms)
		100%	100%	100%	100%	0%	100%	100%	100%

Kindly need your advice about this error. Thanks.

[Jernej Vodopivec]

Hi, ESA by default uses self signed certificates for SMTP conversations.

Install SSL certificate from trusted root CA for TLS/SSL SMTP connections.

[abdulhadizamri]

Hi Jernej,

I have install the cert that received from CA on ironport. 

We have follow the guide from link below:

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118844-technote-esa-00.html

Is there anything else that i have missed?

[Jernej Vodopivec]

Hi, have you solved the problem?

Did you check the hostname specified on GUI->Network->IP interface that correlates to Listener->Certificate that it matches hostname specified in the certificate as Libin suggested?

Also double check you uploaded complete certificate chain (root CA + intermediate CA): GUI->Network->Certificates.

[Libin Varghese]

Hi Abdul,

When using checktls.com, you can click on More detail to display details of the certificates being used and why they could not be validated.

Validation can fail due to multiple reasons, one would be the device is using certificates not signed by a trusted CA, another could be chained certificates not installed in a correct order.

Reviewing the certificate details on checktls.com should give you more information on that.

Thanks

Libin Varghese

[abdulhadizamri]

Hi Libin,

Cert NOT VALIDATED: unable to get local issuer certificate
[001.929] this may help: What Is An Intermediate Certificate
[001.930] So email is encrypted but the domain is not verified
[001.930] Cert Hostname DOES NOT VERIFY (hq.test.com != test.com)
[001.930] So email is encrypted but the host is not verified
[001.931]

This details have been highlight when im using checktls.

Could you advice me, what else that missing in our TLS configuration.

Thanks,

Abdul Hadi

[Libin Varghese]

Hi Abdul,

The error mentioned above suggests that the hostname on the certificate did not match the hostname on the certificate.

Cert Hostname DOES NOT VERIFY (hq.test.com != test.com)

This would fail verification when the hostnames are compared for verification.

Thanks

Libin

[abdulhadizamri]

Hi Libin,

i have try to change the hostname on the ironport interface to the test.com but still got a same result.

This certificate is used for two domains. (test.com and test1.com)

i also have reupload the cert signed certificate and intermediate certificate.

is there anything else should i take a look?

Thanks,

Hadi

[dmccabej]

Hello Hadi,

The CN of the certificate should match your IP Interface hostname, which should also match your MX record. If you have multiple domains/hostnames and/or MX records, you should obtain a SAN certificate and include all of those.

Thanks!

-Dennis M.

[abdulhadizamri]

Hello Dennis,

My cert Information:

Common Name: test.com

Subject Alternative Name: test.com, test1.com

I have multiple hostname (3 appliance):

hq01test.hq.org ,  hq02test.hq.org , hq03test.hq.org

I have 2 MX record:

1. HQ.test.com

2. DR.test.com

Appliance Certificates status : Active

Based on information above, kindly advice where should i change?

Thanks,

Hadi

[Jernej Vodopivec]

Hi Hadi,

"A records" needs to match. Do you have three corresponding A records named

hq01test.hq.org,  hq02test.hq.org and hq03test.hq.org?

If you have them then you have two options:

1. Add SAN names hq01test.hq.org,  hq02test.hq.org and hq03test.hq.org to certificate - you'll need to regenerate it.

2. Get wildcard certificate for hq.org

[abdulhadizamri]

Hello Jernej,

The following hostnames: hq01test.hq.org,  hq02test.hq.org and hq03test.hq.org are tied which internal DNS (hq.org).

Is it possible to add these records in SAN names to certificate? Kindly advise.

Thanks.

Hadi

[dmccabej · Accepted solution]

Hello Hadi,

You'll normally want to use publicly resolvable hostnames on your interface that accepts incoming external mail, and you'll then match that to your MX records, which then matches to an 'A' record and one of the SAN's names on your certificate.

IE: 

Public domain : test.com

ESA interface/s : smtp1.test.com / smtp2.test.com / smtp3.test.com

MX records : smtp1.test.com / smtp2.test.com / smtp3.test.com

A records : smtp1.test.com points to X.X.X.X / smtp2.test.com points to X.X.X.X / smtp3.test.com points to X.X.X.X

Certificate SAN names : smtp1.test.com / smtp2.test.com / smtp3.test.com