need help with SSL

[npereira]

hi,

I have setup a ubuntu CA server and created a CA root (server is pki.nelsonlab.local) which i loaded in the trusted root certificate of my windows 10 station

I also created and signed a csr for a web server with subject alternative as web1.nelsonlab.local


I added the instructions for the apache default virtual host as:
SSLEngine on
SSLCertificateKeyFile /etc/ssl/web1.nelsonlab.local.key
SSLCertificateFile /etc/ssl/web1.nelsonlab.local.crt

then restarted the web server

When going to the web page https://web1.nelsonlab.local i am still getting a certificate error and dont understand why this is happening.

everything to me looks fine i just don't understand why it's still giving me cert error.

Can anyone explain why this is?

[ActionParsnip]

Does the cert also contain the root? you need both the cert from the authority and the root ca in the same file, then the key file as you expect. Make sure you also distribute your root CA cert to the "Trusted Root Authority" folder in the client system so that it trusts the chain

[npereira]

hmmm, not sure what you mean by that, but this is the command i did on the CA server :



openssl x509 -req -in web1.nelsonlab.local.csr -CA ca.cert.pem -CAkey ca.key -CAcreateserial -out web1.nelsonlab.local.crt -days 825 -sha256 -extfile web1.nelsonlab.local.ext

[halogen2]

created a CA root (server is pki.nelsonlab.local) which i loaded in the trusted root certificate of my windows 10 station

What web browser are you using? Some browsers, such as Firefox or Chrome, use their own certificate stores independent of the OS store, so you would need to import your CA root certificate as an authority in your browser's settings.

[ActionParsnip]

What OS is the client system?

[npereira]

im using edge and the root ca is there see attached

[npereira]

Windows 10 as mentioned in the original post

[ActionParsnip]

OK and does the cert file on y website have the root in it as well as the certificate from the CA?

[npereira]

here is the webserver cert

[npereira]

hmmm... I rebooted the station and now it's working....