Installing a WebAuth Certificate for local authentication

[rasmus.elmholt]

Hi

I am having some problems with installing a star-certificate for WebAuth on a WLC 3504.

I have configured the WLC for local webauth and clients will get the webauth page, but gets a SSL error.

I have configured the virtual interface to using a FQDN as descibed here: https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_010011101.html

Then I converted the star certificate from pfx format to pem(using openssl version 0.9.8) and appended the intermediate and root CA certificate in the file from:https://knowledge.digicert.com/generalinformation/INFO4033.html

Just as they describe in Step 2 - Option B here:

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html

But when I tried to upload the certificate I keep getting an error:

TFTP receive complete... Installing Certificate.
*sshpmLscTask: Nov 09 20:04:19.297: sshpmLscTask: LSC Task received a message 4 
*TransferTask: Nov 09 20:04:24.265: Add WebAuth Cert: Adding certificate & private key using password ******
*TransferTask: Nov 09 20:04:24.265: Add ID Cert: Adding certificate & private key using password ******
*TransferTask: Nov 09 20:04:24.265: Add Cert to ID Table: Adding certificate (name: bsnSslWebauthCert) to ID table using password *******
*TransferTask: Nov 09 20:04:24.265: Add Cert to ID Table: Decoding PEM-encoded Certificate (verify: YES)
*TransferTask: Nov 09 20:04:24.265: Decode & Verify PEM Cert: Cert/Key Length was 0, so taking string length instead
*TransferTask: Nov 09 20:04:24.265: Decode & Verify PEM Cert: Cert/Key Length 6261 & VERIFY
*TransferTask: Nov 09 20:04:24.267: Decode & Verify PEM Cert: X509 Cert Verification return code: 0
*TransferTask: Nov 09 20:04:24.267: Decode & Verify PEM Cert: X509 Cert Verification result text: unable to get local issuer certificate
*TransferTask: Nov 09 20:04:24.267: Decode & Verify PEM Cert: Error in X509 Cert Verification at 0 depth: unable to get local issuer certificate
*TransferTask: Nov 09 20:04:24.268: Add Cert to ID Table: Error decoding (verify: YES) PEM certificate
*TransferTask: Nov 09 20:04:24.268: Add ID Cert: Error decoding / adding cert to ID cert table (verifyChain: TRUE)

When I run "openssl verify final.pem" I get something like the same error but I cannot figure out why.

error 20 at 0 depth lookup:unable to get local issuer certificate

I am stuck right now so any input would be appreciated.

[Rps-Cheers]

Hi ,

its look like the intermediate CA is incorrect,maybe you can use openssl tools of other version,and retry it. i have occur the same issue before,but we cannot fixed it ...
waiting for your good news

[rasmus.elmholt · Accepted solution]

I needed to use the SHA-1 certificate ROOT for my wildcard certificate to make this work.
And now everything works as expected.
Tried the conversion both with openssl version 0.9.8 and 1.0.1t and both worked.

[Rps-Cheers]

it's a good news!

[russell.splain]

Hello There,

Thank you for stating the exact same problem I'm having, and for stating that you solved it.

Would you be able to share the exact steps you took to solve it?

I too and trying to convert a .pfx file which contains a wildcard certificate for my internal systems.  I'm running into the same exact errors you displayed in the WLC and in the OpenSSL very output.  You seem to indicate that you instead used a SHA-1 ROOT certificate, for your wildcart cert to solve this.  Can you describe exactly what was involved in that?  Do I abandon trying to use the .pfx file which contains my wildcard cert, or are you implying that we go about producing the .pxf file (wildcard cert) using a different process?  Tank you for any insights or steps you can display. -Russ