wildcard ssl

Question

Level 1

8 points

wildcard ssl

So our company has a Wildcard SSL Certificate that we use for most of our websites, and I've just setup a new 10.8 server for the use of profile manager. I've added our Wildcard SSL certificate to the systems keychain and trusted in but for the life of me I can't get the SSL Cert to take. I see it listed in the Server manager and select it and save the changes, but then I open up the SSL Cert again and there is nothing selected.

Any ideas?

Thanks in advance.

Mac mini, OS X Mountain Lion (10.8.2)

Posted on Oct 2, 2012 3:24 PM

Reply

Answer 1

Oct 2, 2012 6:30 PM in response to eysfilm

I use a wild card for mine..

Where did you get your cert? If its from Go daddy you need a intermediate cert.

Reply

Answer 2

Oct 2, 2012 6:49 PM in response to stephen.willis.smith

So in server app go to

Hardware>Settings then click edit beside SSL certificate

Click manage certs and hit the + and create certificate identity

On the first page of the wizard you want to check "override defaults" step through the rest of the wizard (pretty straight forward) until you get to the Subject Alternate Name extension. in the dNSName you want to enter *.mydomain.com. Finish the wizard and allow it access to your keychain.

Then use that cert and "generate certificate signing request (CSR) and use that to create your SSL. Download your certs. Go back into server app

Hardware>Settings then click edit beside SSL certificate

Select the cert you made and click on the gear "Replace Certicate with signed or renewed Cert" and drag in your server.mydomain.com.crt cert (the one you downloaded).

Next open up keychain access app and select:

System

Certificates

then drag in the intermediate cert (need to enter your local admin password)

That should link your cert up

Let me know if that makes sense

Reply

Answer 3

eysfilm Author

Level 1

8 points

Oct 2, 2012 8:10 PM in response to stephen.willis.smith

Thanks Stephen for the information. It is a GoDaddy cert and I did import their intermediate cert too.

Still no luck.

The additional steps you provided are for requesting a new cert, but I can't do this as we use the wildcard on a bunch of other servers. I've just eported our main wildcard cert and import that into our required web hosts.

It imports fine on to the Mac, but for whatever reason it's not taking in the server setting (Hardware > Settings > SSL).

Any other suggestions?

Thanks.

Reply

Answer 4

Oct 3, 2012 3:16 AM in response to eysfilm

Unfortunately that is the extent of my limited knowledge....

I have not had any issues as long as I follow the steps.

Are you getting any kind of an error?

Reply

Answer 5

eysfilm Author

Level 1

8 points

Oct 3, 2012 11:21 AM in response to stephen.willis.smith

No error message, which is the strange this. I select the Wilcard SSL, Apply it and then open it back up and 'none' is selected.

Stragne stuff.... Only thing I can think of is that the SSL name starts with * (*.domain.com). Maybe Apple doesn't like that?

Reply

Answer 6

Mark23

Level 4

994 points

Oct 3, 2012 12:08 PM in response to eysfilm

A certificate is a certificate, wildcard or not, Apple takes it all. Although I did have problems with a certificate not installing.

Try restarting the server. I think the Comodo Wildcard certificates work best in my case.

Reply

Answer 7

Oct 3, 2012 12:52 PM in response to Mark23

My SSL Cert is *.mydomain.com and I have no issues.

You might try clicking on edit by the SSL select the cert and go down to custom and select each service individually and see if that works.

Reply

Answer 8

eysfilm Author

Level 1

8 points

Oct 4, 2012 7:34 PM in response to stephen.willis.smith

Thanks for the tips. I was doing the custom options. The wildcard SSL actually works for the other options, but just not the websites. I'm not too sure what's going on.

I'm kind of abonding ship with this. I'll just use our company's internal signed certs for now. Stops the errors internally atleast, but extrnal use still has the errors.

Thanks everyone for the help.

Reply

Answer 9

Oct 29, 2012 3:31 PM in response to eysfilm

I had the same issue but got it resolved. The problem was that I had added my wildcard certificate to the keychain before installing Server. This meant that the key file wasn't present in /etc/certificates - if you look in /etc/certificates you will see only 3 files for your wildcard cert (cert, chain and concat) but no 4th (key) file.

Here's how I fixed it:

Reverse the bad import:

1. Server -> Hardware -> Settings -> SSL Certificate: Edit -> Manage Certificates -> select wildcard certificate -> Remove

2. Open Keychain and remove the matching Private key

Import again correctly:

1. Server -> Hardware -> Settings -> SSL Certificate: Edit -> Manage Certificates -> Import a Certificate Identity -> drag in certificate file(s)

Now when you look in /etc/certificates you will see 4 files for your wildcard cert and Server.app will happily assign it to all services.

Reply

Answer 10

Angus Fox

Level 2

153 points

Dec 11, 2012 1:14 AM in response to eysfilm

I had to get Server Manager back to 'Not Configured' before it would accept my Wildcard Cert for all services. iChat service was 'stuck' using my self signed certificate. I had to manually set iChat to 'None' then enable and disable iChat to clear it. Note that I was not using iChat before. I still had to enable and disable it to clear its certificate.

I could not get my wildcard certificate to work until I did this.

Reply

Answer 11

DSHJ

Level 1

45 points

Dec 18, 2012 1:12 AM in response to stephen.willis.smith

So... Did things change in Server 2.2? I don't see what you're referring to in the Certificates area. It's as though Apple has completely disabled the ability to issue a wildcard request.

Reply

Answer 12

Miggl

Level 1

89 points

Dec 27, 2012 12:52 PM in response to DSHJ

Double-click on your certificate that you want to create a CSR for, then click the Renew button. I was flumoxed by this at first as well. There appears to be a bug where you are required to enter the Department name in the form, I just entered "n/a", and everything went through fine.

~Mike

Reply

Answer 13

DSHJ

Level 1

45 points

Jan 9, 2013 11:24 AM in response to Miggl

I tried to renew, and it still won't let me enter an * for the subdomain. Everything else is filled out in the form. Any ideas?

Reply

Answer 14

aw_mpls

Level 1

0 points

Feb 10, 2013 3:59 PM in response to DSHJ

Mac OS X Server 10.8 GUI does not support creation of wildcard CSRs. The workaround is to create one through the terminal using openssl as described here:

http://www.digicert.com/csr-creation-apache.htm

Reply

Answer 15

qurt

Level 1

0 points

Apr 9, 2013 7:02 AM in response to eysfilm

I had the same problem today.

Turns out that the '+' sign in the certificates tab of server app has a menu.

This menu allows you to import the certificate.

Then it works.

The problem is:

Server app 2.2.1 has a bug.

The menu will not show up most of the time...

Reply