Closed johannes73 closed 7 years ago
Check the haproxy certificate directory. I think you'll find there's two certs. Delete the one that is not /data/haproxy/ssl.d/mail1.smartnet.se.pem
, as that's your self-signed one. Restart haproxy and try again.
When I check in /data/haproxy/ssl.d/ there is only one file, mail1.smartnet.se.pem, with 4 parts.
First part is the private key, then follows 3 certs (1-3). Cert 1 and 2 are identical (CN of the mail server, issuer Let's Encrypt). Cert 3 is the Let's Encrypt cert with issuer DST Root CA X3.
When checking this file on https://tools.keycdn.com/ssl, it complains about chain issues. But when I test with only certs 2 and 3, is says the chain is fine.
Hm... not sure how best to proceed.
root@mail1:/usr/home/johannes # cd /data/haproxy/ssl.d/
root@mail1:/data/haproxy/ssl.d # ls
mail1.smartnet.se.pem
root@mail1:/data/haproxy/ssl.d # less mail1.smartnet.se.pem
-----BEGIN RSA PRIVATE KEY-----
[...]
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
[ cert 1 ]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[ cert 2 ]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[ cert 3 ]
-----END CERTIFICATE-----
Ahah, closing in on the problem.
Check the haproxy config and look at the directory configured for SSL certs.
frontend http-in
bind *:80
bind *:443 ssl crt /etc/ssl/private
Change /etc/ssl/private
, the default location, to /data/ssl.d
Update, I fixed the target path in the above comment to /data/ssl.d
Thank you, Matt. Works fine now.
Expected behavior
https to server without "invalid cert" warning.
Observed behavior
The self-signed cert from the initial steps of the install is used, which renders a "invalid cert" warning in the browser. The letsencrypt cert seems not to be sent to the browser.
During the install I used the "provision letsencrypt".
Testing a bit: less /root/.acme.sh/mail1.smartnet.se/fullchain.cer
When I take the contents (two certs) and enter them om https://tools.keycdn.com/ssl, the chain looks great. But it does not seem to be sent to the browser?
Problem persists after restart of server and client.
Steps to reproduce
Fresh FreeBSD 10.3 + MT6 install (all steps, excluding manual install of bought certs, as we use "provision letsencrypt")