Problem: Check validity of SSL certificates

ssl
diagnostic
certificates
systemdiagnose

#1

Problem:

You ran the systemdiagnostic and got the following message:

root@slave:/usr/local/share/ca-certificates# univention-run-diagnostic-checks -t 02_certificate_check
Domain Admin Login:Administrator
Password:

You can find the logging messages of the diagnostic modules at /var/log/univention/management-console-module-diagnostic.log


############################
## Check failed: 02_certificate_check - Überprüfe Gültigkeit der SSL Zertifikate
Ungültiges Zertifikat '/etc/schein/ssl/schein-me.pem' gefunden:
error /etc/schein/ssl/schein-me.pem: verification failed

Siehe {sdb} für Informationen zum Erneuern von Zertifikaten.
########### End #############

Investigation:

Find the issuer in the certificate and check if this is in /etc/ssl/certs

openssl x509 -in /etc/schein/ssl/schein-me.pem -text -noout | grep -Ei "(issuer|subject)"
       Issuer: C = TLD, O = Security Cert Org, OU = Central Certification Authority, CN = Central Domain Validation CA SHA2
        Subject: C = DE, CN = *.schein-me.de  
        Subject Public Key Info:
                CA Issuers - URI:http://repository.secert.tld/myIssuerCA.cer <--
            X509v3 Subject Key Identifier:
            X509v3 Issuer Alternative Name:
            X509v3 Subject Alternative Name:

ls -lah /etc/ssl/certs/ |grep “Certum Domain Validation”
→ not found
Look in /usr/local/share/ca-certificate as well.

ls -l
lrwxrwxrwx 1 root staff 36 Apr 20  2017 ucsCA.crt -> /etc/univention/ssl/ucsCA/CAcert.pem

You will have there at least this one. The CA of your issuer should be here as well.

Solution

Get the CA from the issuer:

# /usr/local/share/ca-certificates# wget http://repository.certum.pl/myIssuerCA.cer
# file myIssuerCA.cer
myIssuerCA.cer: data

Convert the data to pem

# openssl x509 -inform der -in myIssuerCA.cer -out myIssuerCA.pem
# file myIssuerCA.pem
myIssuerCA.pem: PEM certificate

Rename it into the expected ending
# mv myIssuerCA.pem myIssuerCA.crt
and update the data

# /usr/local/share/ca-certificates# update-ca-certificates
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.

closed #2