0

I'm trying to setup a keychain on Apache Tomcat that contains a server certificate that was signed by a custom root ca certificate. (not sure if custom is the right word here, but it's a root certificate that I created myself and that I want to trust). The idea behind this is that all certificates signed by this CA should be considered trusted.

Here's the steps I did

Create the root certificate (that I will trust in my keychain)

openssl req -new -x509 -sha512 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf

Create a server key and a certificate signing request

openssl req -new -nodes -sha512 -out name-req.pem -keyout private/name-key.pem -days 365 -config ./openssl.cnf

Sign the request with the CA created in step 1 and generate a certificate

openssl ca -out name-cert.pem -days 365 -config ./openssl.cnf -infiles name-req.pem

Create the PKCS12 file

openssl pkcs12 -sha512 -export -in name-cert.pem -inkey private/name-key.pem -certfile cacert.pem -name "[friendly name]" -out name-cert.p12

Setup a PKCS12 keystore for Tomcat

openssl pkcs12 -export -in name-cert.pem -inkey private/name-key.pem -out mycert.p12 -name tomcat -CAfile cacert.pem -caname root -chain

I've installed the keystore in tomcat correctly and I can access the HTTPS connector

I installed the CA certificate in my keychain where it is marked as trusted for all users.

However, when I access the page using a browser (Firefox / Safari) I'm still seeing this:

Why is it that this certificate (issued by "CA", and "CA" being a certificate marked as trusted for all users) is still throwing an error ?

Improve this question

1 Answer 1

Reset to default
1

There are not much details about your certificate itself, but I assume that you are connecting to an IP address and you are trying to use the IP address as the common name inside the certificate. As far as I know this is not supported by Safari. Instead it requires the IP addresses to be specified inside the SAN section (subject alternative names) of the certificate as type IP.

Which means this is not a problem of the CA, but a problem of the certificate itself.

See also https://serverfault.com/questions/550313/safari-7-ssl-error-if-using-ip-adress and also RFC2818:

In some cases, the URI is specified as an IP address rather than a hostname. In this case, the iPAddress subjectAltName must be present in the certificate and must exactly match the IP in the URI.

Improve this answer
7
  • I think it's a problem with the certificate / keystore. Safari issues a "host name mismatch" error when using an IP address. Here it's a different issue. Chrome also complains. I've got it working with a JKS keystore now and will update the question with that info in a couple of minutes... What additionai info about the certificate would you need ?
    – ddewaele
    Commented Nov 1, 2014 at 20:33
  • I think I may have found the issue. When the message digest was set to use MD5 with RSA encryption it fails. When using SHA-1 with RSA encryption it works. (took the openssl.cnf from a tutorial where it stated default_md=md5. Changed it to default_md=sha1 and it started working.
    – ddewaele
    Commented Nov 1, 2014 at 22:18
  • 1
    MD5 is no longer supported by current browsers because it is just too unsafe. Practical MD5 collision attacks were already shown 2008 and they were also used in the Stuxnet Attack. Please note that browsers move away from SHA-1 too, so you better use SHA-256. BTW, maybe you see why I've recommended you to get a professional on board in security.stackexchange.com/a/72122/37315.
    – Steffen Ullrich
    Commented Nov 2, 2014 at 6:37
  • You should better make yourself familiar with the requirements by the CA/Browser forum, see cabforum.org/baseline-requirements-documents
    – Steffen Ullrich
    Commented Nov 2, 2014 at 6:43
  • There is a security professional on board. I'm just familiarising myself and trying some stuff out over the weekend. I hope it's ok for you that I'm asking some questions here. I thought that that was the reason why we had sites like this.
    – ddewaele
    Commented Nov 2, 2014 at 9:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .