[f-nsp] problems binding new key and cert on ADX

Jonas Frey (Probe Networks) jf at probe-networks.de
Tue Nov 10 05:13:17 EST 2015


Hi Jethro,

using 12.5.02d here without any problems for a while.  (note 12.5.02e is
available).
12.5.02x finally has TLS 1.2 and SNI, so you will want this.

As for the ca-cert-file: No, this is not for verifing the connecting
clients, it really is what the name says, this is where your CA-Cert
chain will be loaded.

Maybe your chaining has worked (for some reason) while including the
chain with your certificate for now. However i guess you now also have a
SHA256 cert and this probably is the reason this no longer works.
ca-cert-file has been there for some time and this is the recommended
method.

Also i think you are using ssl-proxy incorrect in this setup, from the
CLI:

SSH at lb-test(config-vs-www.xyz.com)#port ssl ssl-?
  ssl-proxy                     SSL on both client-side and server-side

SSH at lb-test(config-vs-www.xyz.com)#port ssl ssl-proxy ?
  ASCII string   Name of the SSL profile to be associated with this
virtual port for traffic towards clients
                
SSH at lb-test(config-vs-www.xyz.com)#port ssl ssl-proxy testing ?
  ASCII string   Name of the SSL profile to be associated with this
virtual port for traffic towards real servers


So if you are using
port ssl ssl-proxy nemo-toclients entrust2048-server

then you will authenticate with "nemo-toclients" to your external
clients - which is fine. However this does not include the cert chain.
Furthermore you send the SSL requests to your internal
"entrust2048-server" only with your cert chain as the profile
"entrust2048-server" only includes the chained cert.

Please try using the ca-cert-file option. I am sure it works (atleast it
does for us :-)


Cheers,
Jonas





Am Montag, den 09.11.2015, 20:14 +0000 schrieb Jethro R Binks:
> On Mon, 9 Nov 2015, Jonas Frey (Probe Networks) wrote:
> 
> > Hi Jethro,
> > 
> > first of all: 12.5.01g is really old and is vulnerable to POODLE and a
> > few others. You really want to update this.
> 
> Can't disagree with that!  What would you currently recommend as stable?
> 
> > I assume you combined the intermediate cert into the regular cert file?
> > This will not work.
> 
> That's funny, it is what I've always done, has always worked, and that's 
> what the documentation tells me to do in 12501 Security Guide:
> 
> "
> Step 1: Import server certificate and intermediate CA certificates
> 
> ...
> 
> The order is important. The server certificate should be imported before 
> the intermediate CA certificate.
> 
> The same file name should be used (chain2cert in this example) when 
> importing both the server and intermediate CA certificate."
> 
> > You need to use:
> > 
> > ssl profile www.something.com
> >  keypair-file yourkey.key
> >  certificate-file yourcert.crt
> >  ca-cert-file your-cert-ca-chain.crt
> >  enable-certificate-chaining
> 
> As I understand it, ca-cert-file is only required for verifying the certs 
> of connecting clients, which I am not doing.
> 
> My process has worked fine for various other certs and CAs.  This one is 
> different in that it is the first signed by this CA.  I have also uploaded 
> the CA root cert for use in the ssl-proxy line.  I have re-downloaded from 
> the CA the intermediate cert for inclusion (I had some trouble getting 
> that uploaded, I think perhaps a missing newline at the end was causing 
> the problem).
> 
> An example of a working config for us is:
> 
> ssl profile nemo-toclients
>  keypair-file nemo_2015.key
>  certificate-file nemo_chain_2015.crt
>  cipher-suite all-cipher-suites
>  enable-certificate-chaining
>  session-cache off
> 
> ssl profile entrust2048-server
>  cipher-suite all-cipher-suites
>  disable ssl2 ssl3
>  ca-cert-file entrust2048-ca.crt
>  session-cache off
> 
> server virtual ex2010-cas-lb ...
>  predictor round-robin
>  port ssl sticky
>  port ssl ssl-proxy nemo-toclients entrust2048-server
>  port ssl csw-policy "exch2010a"
>  ...
> 
> where nemo_chain_2015.crt contains the server cert and the intermediate, 
> and entrust2048-ca.crt is the CA root which issued.  The clients get the 
> cert + intermediates.
> 
> Replicating this for this new certificate/intermediate and CA is what is 
> failing for me.
> 
> Danke or the thoughts, but I'm not sure it has helped yet.
> 
> Jethro.
> 
> 
> 
> > 
> > 
> > Cheers,
> > Jonas
> > 
> > 
> > 
> > Am Montag, den 09.11.2015, 16:05 +0000 schrieb Jethro R Binks:
> > > Hi,
> > > 
> > > I'm banging my head against a wall here and looking for some help.
> > > 
> > > One virtual service is having a cert change due to expiry, and I've got 
> > > the .pfx as exported from Windows.  I have extracted the key and cert from 
> > > this.  I have the intermediate and root certs.
> > > 
> > > I can upload all, the key to the keyfile, and the host cert then the 
> > > intermediate to the cert file using scp.  Done this some number of times 
> > > in the past routinely.
> > > 
> > > I can use the show commands to view the cert chain, and see the host's 
> > > cert plus the intermediate.
> > > 
> > > However what I can't do is the actual bind of the cert into the ssl 
> > > profile:
> > > 
> > > SSH at sender(config)#ssl profile tcnemo-toclients
> > > SSH at sender(config-ssl-profile-tcnemo-toclients)#keypair-file tcnemo_2015.key
> > > SSH at sender(config-ssl-profile-tcnemo-toclients)#certificate-file tcnemo_chain_2015.crt
> > > SSH at sender(config-ssl-profile-tcnemo-toclients)#Error key and certificate mismatch 
> > > Please delete the key and re-add the right key and certificate
> > > SSL profile : tcnemo-toclients
> > > Certificate file : \usb0\certstor\tcnemo_chain_2015.crt.cert
> > > Key file : \usb0\certstor\tcnemo_2015.key.key
> > > 
> > > The only help I can get from Dr Google is the suggestion from the 
> > > documentation that this key does not match the certificate.  But both came 
> > > from the exported PFX, and I've verified them manually in various ways.  
> > > Now totally stuck as to what to do next (and time is ticking for the 
> > > previous cert expiry :).
> > > 
> > > Anyone any ideas?
> > > 
> > > ADX 12.5.01g
> > > 
> > > Jethro.
> > > 
> > > .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .
> > > Jethro R Binks, Network Manager,
> > > Information Services Directorate, University Of Strathclyde, Glasgow, UK
> > > 
> > > The University of Strathclyde is a charitable body, registered in
> > > Scotland, number SC015263.
> > > _______________________________________________
> > > foundry-nsp mailing list
> > > foundry-nsp at puck.nether.net
> > > http://puck.nether.net/mailman/listinfo/foundry-nsp
> > 
> 
> .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .
> Jethro R Binks, Network Manager,
> Information Services Directorate, University Of Strathclyde, Glasgow, UK
> 
> The University of Strathclyde is a charitable body, registered in
> Scotland, number SC015263.
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://puck.nether.net/pipermail/foundry-nsp/attachments/20151110/8ba39d7c/attachment-0001.sig>


More information about the foundry-nsp mailing list