Error /etc/univention/ssl/foobar.de/foobar.de.crt: verification failed

[tafkaz]

Hi,
we have globalsign wildcard certificate running here, and it seems working perfectly, as the corresponding services (apache, dovecot, postfix) show valid certification.
However the univention self ckeck insists, that we do have an issue:

univention-run-diagnostic-checks -t 02_certificate_check

############################ Start 02_certificate_check ###########################
## Check failed: 02_certificate_check - Überprüfe Gültigkeit der SSL Zertifikate ##
Ungültiges Zertifikat '/etc/univention/ssl/foobar.de/foobar.de.crt' gefunden:
error /etc/univention/ssl/foobar.de/foobar.de.crt: verification failed

openssl x509 -in /etc/univention/ssl/foobar.de/foobar.de.crt -noout -issuer
shows the following output:
issuer=C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2

So following this solution:

Problem: SSL Certificate Error in System Diagnostic

Kudos @Moritz_Bunkus Problem In system diagnostic you see an error about an invalid certificate. It might occur after having renewed your certificates based on this article. Or you have installed external certificates based on this article. [grafik] Solution Step 1 root@ucs:~# univention-run-diagnostic-checks -t 02_certificate_check Domain Admin Login:Administrator Password: You can find the logging messages of the diagnostic modules at /var/log/univention/management-console-module-diagnos…

these steps should resolve that:

/usr/local/share/ca-certificates# wget https://secure.globalsign.com/cacert/gsalphasha2g2r1.crt
update-ca-certificates

However…it doesn’t, we still get the same error when running the certificate_check.

Maybe we’re downloading an inappropriate CA file, but i can’t find any more fitting than this.

Or maybe we’re doing something wrong?

thanks for your help
Sascha