I am a systems integrator using a system designed for bringing HVAC data up to a common interface; this system/software platform is called Niagara AX. The combination of the customer's network setup and requirements for a project have brought together the following scenario:
- All systems providing said data must communicate to the consumer of that data via a web browser with HTTPS
- There is a centralized virtual server that must be the access point through which other systems are accessed, and sub-system access must be via HTTPS
- The customer has provided a Microsoft Active Directory certificate authority and certificate signing tool
- Certificates generated by the HVAC systems are signable by the customer's signing tool and are accepted by the HVAC systems and work correctly in web browsers for direct connections to all systems, including the central server and all sub-systems
- The HVAC software platform provides built-in options only for HTTP tunneling and using HTTPS
I have managed to get my system working correctly on all points except where the sub-systems must be accessed through the centralized server. Direct HTTPS access works correctly in all instances. From what I can see, my only option given the customer's setup and requirements is to use HTTPS tunneling which uses a specialized syntax specific to this HVAC system (e.g., https://cent-server/tunnel/127.32.41.8/file/px/Floorplan.px). At this point, any number of things usually happen, including 404s with silent redirect to a nonsense page, or "waiting for cent-server" that just eventually times out.
I have been told that the fix involves "combining" my SSL certificates into a single large certificate and having this "common" certificate in place on all systems involved. My question is this: how can I accomplish this?
Let my systems be labeled C - centralized server, A - sub-system A, B - sub-system B, R - root certifying authority (highly simplified). Attempting to combine the signed certificate portions of certs A and B into the public + private PEM for cert C and then importing into the certificate manager in C results in an error CertPathValidatorException claiming "Intermediate certificate lacks BasicConstraints". I'm not sure what other combination options I have available when putting my PEM together, although I know that it doesn't make sense to just insert the public-side of certs A and B into the section where this system expects cert-chain pieces to be.