11-09-2017 01:12 AM - edited 02-21-2020 06:41 AM
hi
I'm trying to import server certifacate issued by our corporate CA to FMC, but i always get error "Unable to verify certificate."
In /var/log/httpd/httpsd_error_log i see errors:
[Thu Nov 09 08:59:37.040550 2017] [cgi:error] [pid 27221] [client 10.12.91.238:33111] AH01215: No such file or directory:/etc/sf/crl.conf at /usr/local/sf/lib/perl/5.10.1/SF/X509Certificates.pm line 919.: /usr/local/sf/htdocs/admin/https_cert.cgi, referer: https://fmc.isd.lamoda.tech/admin/https_cert.cgi [Thu Nov 09 08:59:37.040652 2017] [cgi:error] [pid 27221] [client 10.12.91.238:33111] AH01215: (Unable to verify certificate.) in /usr/local/sf/htdocs/admin/https_cert.cgi:163 at /usr/local/sf/lib/perl/5.10.1/SF.pm line 120.: /usr/local/sf/htdocs/admin/https_cert.cgi, referer: https://fmc.isd.lamoda.tech/admin/https_cert.cgi
I checked directory /etc/sf/ and there is no crl.conf in it.
What might be a reason?
12-07-2017 10:35 AM
I'm using OpenSSL for this. In OpenSSL, I have a config file:
/root/ca/intermediate/openssl.cnf
This file has the following extension block, in which I find basicConstraints:
[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
#basicConstraints = CA:FALSE
basicConstraints = critical, CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
crlDistributionPoints = <REMOVED>
authorityInfoAccess = OCSP;URI:<REMOVED>
I prepended "critical," and save the file.
When signing the CSR with OpenSSL, I used this command:
openssl ca -config intermediate/openssl.cnf -extensions server_cert -days 375 -notext -md sha256 -in intermediate/csr/fmc.mydomain.net.csr.pem -out intermediate/certs/fmc.mydomain.net.cert.pem
I was then able to import the certificate.
02-14-2018 08:12 AM
I'm having this same issue and after modifying the cert to use basicConstraints = critical, CA:FALSE, I was able to import the certificate without getting the "unable to verify certificate" error message. But after the import I still don't see the new cert under HTTPS Certificate; even after a reboot I still only show the self signed cert as the current https server cert. What am I missing?
02-14-2018 10:11 AM
This sounds like a question for TAC, but what you can do is to go to expert mode and manually check /etc/ssl/server.* files.
I’m assuming that they were not replaced. In that case you can manually edit them and paste identity certificate and private, unencrypted key there. After that you need to restart httpsd process by:
pmtool RestartById httpsd
command.
From that point, management interface should display this new certificate.
Regards,
Raden
02-14-2018 02:28 PM
02-22-2018 10:57 AM
I had the same problem where it would finally take the certs without error, but would continue to show the old one. I went and checked the config file via the CLI under /etc/httpd/ssl_certificates.conf
and noticed there were different values loaded to the SSLCertificateFile and SSLCertificateKeyFile fields. I cleared the old values and replaced them with the following:
SSLCertificateFile /etc/ssl/server.crt
SSLCertificateKeyFile /etc/ssl/server.key
Restart the httpsd service with this command to enforce the new values: pmtool RestartByID httpsd
02-22-2018 11:55 AM
Hello Everyone,
As some of you have mentioned, the current behavior is a bug. It was not actually fixed on 6.2.2.1.
I have resolved this issue for other customer by performing the import of the certificate thru the CLI.
The steps are not complicated, but they are not intuitive either. It will be required to have a certificate, and the private key used for that certificate.
The below steps are used when creating a new certificate and private key thru the cli.
If you have a cert and private key from an Internal CA, then you could copy and paste that information into two files.
vi /etc/ssl/InternalCACertificate.crt
vi /etc/ssl/InternalCAKey.key
Then you can move to around step 6.
CSCvf42713- cannot import web UI HTTPS server certificate on Firepower Management Center or 7000/8000 Series
The workaround that needs to be performed is below.
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Code []:
State or Province Name []:
Locality Name []:
Organization Name []:
Organizational Unit Name []:
Common Name []:
Email Address []:
admin@Luna:~/Mark$ ls
CSR.csr server.key
TAC.key crl openssl.cnf server.conf server.crt.new server.crt.older server.crt.original server.key.new server.key.original
02-23-2018 11:18 AM
This process work for me!
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: