topic Re: Invalid Digital Signature of generated certificates in Alfresco Forum

Invalid Digital Signature of generated certificates

jeffreyman — Wed, 10 Feb 2021 12:03:24 GMT

Hi,

I use alfresco-ssl-generator to generate certificates for repository, solr and client. However, the generated certificates show "This certificate has an invalid digital signature" error. I have no idea how to fix it. Please help.

Re: Invalid Digital Signature of generated certificates

angelborroy — Wed, 10 Feb 2021 12:14:20 GMT

Attaching the certificate should help to find out the problem.

Re: Invalid Digital Signature of generated certificates

jeffreyman — Wed, 10 Feb 2021 12:25:36 GMT

Hi,

I don't know how to attach file. Here is text format.

Re: Invalid Digital Signature of generated certificates

angelborroy — Wed, 10 Feb 2021 13:08:30 GMT

This is the public part of the certificate.

It seems to be ok.

$ openssl x509 -in cert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4096 (0x1000)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=UK, L=Maidenhead, O=Alfresco Software Ltd., OU=Unknown, CN=Custom Alfresco CA
        Validity
            Not Before: Feb 10 12:23:29 2021 GMT
            Not After : Feb  8 12:23:29 2031 GMT
        Subject: C=GB, ST=UK, O=Alfresco Software Ltd., OU=Unknown, CN=Custom Alfresco Repository
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:a8:cb:ad:e7:94:33:91:d7:52:6d:28:11:f4:1b:
                    17:39:67:b2:03:75:b5:c5:c1:16:56:eb:76:56:f5:
                    2c:c4:f7:53:36:fc:06:30:63:08:1b:98:eb:71:1d:
                    24:ce:3e:33:da:74:b0:76:04:42:80:15:c5:d7:c8:
                    bc:cf:1f:86:d8:93:1c:7d:4e:5f:3f:2c:d5:c3:76:
                    96:b8:a7:fd:76:73:62:44:b5:c9:78:5f:d7:81:7a:
                    e1:24:78:50:0d:68:e6:f9:81:d7:8d:ad:84:84:48:
                    d3:df:d5:15:ce:6e:8c:9c:78:98:a8:15:a4:06:16:
                    fa:00:24:4a:07:68:fe:36:ef
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Cert Type:
                SSL Server
            Netscape Comment:
                OpenSSL Generated Server Certificate
            X509v3 Subject Key Identifier:
                6C:EA:9C:9C:9C:5A:E3:5B:B3:35:EE:CB:8C:B7:11:5E:29:55:44:1D
            X509v3 Authority Key Identifier:
                keyid:94:27:EA:72:F9:20:DC:E3:2C:A8:17:8F:D9:1A:A7:B7:62:22:FF:25
                DirName:/C=GB/ST=UK/L=Maidenhead/O=Alfresco Software Ltd./OU=Unknown/CN=Custom Alfresco CA
                serial:69:BB:16:AF:C9:1E:C4:69:1D:AE:DB:D4:1A:6A:56:9A:93:3B:FE:95

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Alternative Name:
                DNS:localhost
    Signature Algorithm: sha256WithRSAEncryption
         7b:38:f8:bc:2a:27:f6:21:2c:79:33:b6:37:f1:1d:ce:9c:60:
         b0:5d:c3:c8:df:5f:f4:7d:7d:1f:f6:1e:c0:b9:b2:cb:4c:a1:
         1e:85:96:16:52:f0:65:e0:d5:5b:cf:dd:db:37:1e:24:da:c4:
         4a:9d:e6:b6:52:04:6f:a8:80:3a:f3:9e:cf:42:53:2b:9b:56:
         c6:ce:68:4d:88:2c:00:28:db:04:6c:0a:7b:94:84:63:a1:61:
         d7:40:95:49:c1:92:41:bb:68:18:08:61:24:7f:be:87:96:36:
         99:f5:b5:99:0c:d4:48:6b:41:e7:cf:fc:77:b6:d3:cc:57:f7:
         20:62

Not sure if the private part has some problem...

Re: Invalid Digital Signature of generated certificates

jeffreyman — Wed, 10 Feb 2021 13:15:32 GMT

Hi,

Why it show error when viewing the certificate in windows?

A few months ago, I generate the certificates (same method) that do not have such error.

Re: Invalid Digital Signature of generated certificates

jeffreyman — Wed, 10 Feb 2021 13:26:47 GMT

this is the old certificate I generate using alfresco-ssl-generator

Re: Invalid Digital Signature of generated certificates

sufo — Wed, 10 Feb 2021 14:10:49 GMT

Can you paste also new CA certificate?
Little difference between two screenshots is that CA name for old one is full DN and for new one is only the CN.

Re: Invalid Digital Signature of generated certificates

jeffreyman — Wed, 10 Feb 2021 14:33:10 GMT

Hi,

here is CA cert.

Re: Invalid Digital Signature of generated certificates

jeffreyman — Wed, 10 Feb 2021 14:49:17 GMT

I found that the CA cert which sign the cert is 1024 bits. However, when I view "ca.cert.pem" (change to ca.cert.cer), the cert is 2048 bits. Also, the valid period is always starting from 24 Jun 2020. But the "ca.cert.pem" is starting from when I run the tool.

It seems that the alfresco-ssl-generator tool does not use the generated CA cert (i.e. ca.cert.pem) for signing.

Re: Invalid Digital Signature of generated certificates

sufo — Wed, 10 Feb 2021 15:11:35 GMT

You are right. Certificate is signed with different CA cert:

            X509v3 Authority Key Identifier:
                keyid:94:27:EA:72:F9:20:DC:E3:2C:A8:17:8F:D9:1A:A7:B7:62:22:FF:25
                DirName:/C=GB/ST=UK/L=Maidenhead/O=Alfresco Software Ltd./OU=Unknown/CN=Custom Alfresco CA
                serial:69:BB:16:AF:C9:1E:C4:69:1D:AE:DB:D4:1A:6A:56:9A:93:3B:FE:95

CA cert that you appended seems to have different serial number:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            67:01:18:b7:bb:76:ad:e3:25:84:5b:e6:6a:c1:40:a7:38:1b:58:97
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=UK, L=Maidenhead, O=Alfresco Software Ltd., OU=Unknown, CN=Custom Alfresco CA
        Validity
            Not Before: Feb 10 12:40:41 2021 GMT
            Not After : Feb  5 12:40:41 2041 GMT
        Subject: C=GB, ST=UK, L=Maidenhead, O=Alfresco Software Ltd., OU=Unknown, CN=Custom Alfresco CA

Can you try with clean directory structure? I mean 'ca' directory.

Re: Invalid Digital Signature of generated certificates

jeffreyman — Wed, 10 Feb 2021 15:13:42 GMT

Hi,

I have tried to re-download the tool and clean all folder inside "ssl-tool-win". However, the result is same, that is invalid digital signature.

Do you have expereience on alfresco-ssl-generator tool?

Re: Invalid Digital Signature of generated certificates

sufo — Wed, 10 Feb 2021 15:30:21 GMT

One quick idea. Did you remove old CA certificate from Trusted Root CAs? You have to import new CA certificate into the Trusted Root CAs in Windows. It depends if you installed in your user store or computer store. This may help you: https://www.thesslstore.com/knowledgebase/ssl-install/how-to-import-intermediate-root-certificates-using-mmc/

Re: Invalid Digital Signature of generated certificates

jeffreyman — Wed, 10 Feb 2021 15:39:30 GMT

Hi,

To my understanding, it seems not relate to windows certificate manager. It is stored in the keystore/truststore. Attached is the windows trust root ca.

Re: Invalid Digital Signature of generated certificates

sufo — Wed, 10 Feb 2021 15:57:56 GMT

Go to the ca\certs directory and copy ca.cert.pem to ca.cert.crt. Double-click on ca.cert.crt and you should see that it is not trusted. You have to ad it to trusted certificates. I think that you have added previous CA certificate to your personal store not the computer store. Check it too.

Re: Invalid Digital Signature of generated certificates

jeffreyman — Wed, 10 Feb 2021 16:13:42 GMT

HI,

I haved added the CA cert into local machine. I can see the generated cert is using new CA cert. However, the cert is still invalid digital signature. Any idea?

Re: Invalid Digital Signature of generated certificates

sufo — Wed, 10 Feb 2021 18:05:35 GMT

But, did you remove the old CA cert from trusted certificates? I think that this is the issue.

Run this command in the directory where you have run.cmd:

openssl verify -CAfile ca\certs\ca.cert.pem certificates\repository.cer

Re: Invalid Digital Signature of generated certificates

jeffreyman — Thu, 11 Feb 2021 01:39:02 GMT

Hi,

Here is result.

certificates/repository.cer: OK

Re: Invalid Digital Signature of generated certificates

jeffreyman — Thu, 11 Feb 2021 02:49:52 GMT

Hi Sufo,

After install the new CA cert in local user, the certificates look good. I think it is a viewing problem, not certificate itself.

Thanks a lot.