Hyland Connect

jeffreyman · ‎02-10-2021

Hi,

I use alfresco-ssl-generator to generate certificates for repository, solr and client. However, the generated certificates show "This certificate has an invalid digital signature" error. I have no idea how to fix it. Please help.

jeffreyman · ‎02-10-2021

Hi Sufo,

After install the new CA cert in local user, the certificates look good. I think it is a viewing problem, not certificate itself.

Thanks a lot.

View answer in original post

angelborroy · ‎02-10-2021

Attaching the certificate should help to find out the problem.

Hyland Developer Evangelist

jeffreyman · ‎02-10-2021

Hi,

I don't know how to attach file. Here is text format.

angelborroy · ‎02-10-2021

This is the public part of the certificate.

It seems to be ok.

$ openssl x509 -in cert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4096 (0x1000)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=UK, L=Maidenhead, O=Alfresco Software Ltd., OU=Unknown, CN=Custom Alfresco CA
        Validity
            Not Before: Feb 10 12:23:29 2021 GMT
            Not After : Feb  8 12:23:29 2031 GMT
        Subject: C=GB, ST=UK, O=Alfresco Software Ltd., OU=Unknown, CN=Custom Alfresco Repository
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:a8:cb:ad:e7:94:33:91:d7:52:6d:28:11:f4:1b:
                    17:39:67:b2:03:75:b5:c5:c1:16:56:eb:76:56:f5:
                    2c:c4:f7:53:36:fc:06:30:63:08:1b:98:eb:71:1d:
                    24:ce:3e:33:da:74:b0:76:04:42:80:15:c5:d7:c8:
                    bc:cf:1f:86:d8:93:1c:7d:4e:5f:3f:2c:d5:c3:76:
                    96:b8:a7:fd:76:73:62:44:b5:c9:78:5f:d7:81:7a:
                    e1:24:78:50:0d:68:e6:f9:81:d7:8d:ad:84:84:48:
                    d3:df:d5:15:ce:6e:8c:9c:78:98:a8:15:a4:06:16:
                    fa:00:24:4a:07:68:fe:36:ef
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Cert Type:
                SSL Server
            Netscape Comment:
                OpenSSL Generated Server Certificate
            X509v3 Subject Key Identifier:
                6C:EA:9C:9C:9C:5A:E3:5B:B3:35:EE:CB:8C:B7:11:5E:29:55:44:1D
            X509v3 Authority Key Identifier:
                keyid:94:27:EA:72:F9:20:DC:E3:2C:A8:17:8F:D9:1A:A7:B7:62:22:FF:25
                DirName:/C=GB/ST=UK/L=Maidenhead/O=Alfresco Software Ltd./OU=Unknown/CN=Custom Alfresco CA
                serial:69:BB:16:AF:C9:1E:C4:69:1D:AE:DB:D4:1A:6A:56:9A:93:3B:FE:95

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Alternative Name:
                DNS:localhost
    Signature Algorithm: sha256WithRSAEncryption
         7b:38:f8:bc:2a:27:f6:21:2c:79:33:b6:37:f1:1d:ce:9c:60:
         b0:5d:c3:c8:df:5f:f4:7d:7d:1f:f6:1e:c0:b9:b2:cb:4c:a1:
         1e:85:96:16:52:f0:65:e0:d5:5b:cf:dd:db:37:1e:24:da:c4:
         4a:9d:e6:b6:52:04:6f:a8:80:3a:f3:9e:cf:42:53:2b:9b:56:
         c6:ce:68:4d:88:2c:00:28:db:04:6c:0a:7b:94:84:63:a1:61:
         d7:40:95:49:c1:92:41:bb:68:18:08:61:24:7f:be:87:96:36:
         99:f5:b5:99:0c:d4:48:6b:41:e7:cf:fc:77:b6:d3:cc:57:f7:
         20:62

Not sure if the private part has some problem...

Hyland Developer Evangelist

jeffreyman · ‎02-10-2021

Hi,

Why it show error when viewing the certificate in windows?

A few months ago, I generate the certificates (same method) that do not have such error.

jeffreyman · ‎02-10-2021

this is the old certificate I generate using alfresco-ssl-generator

sufo · ‎02-10-2021

Can you paste also new CA certificate?
Little difference between two screenshots is that CA name for old one is full DN and for new one is only the CN.

jeffreyman · ‎02-10-2021

Hi,

here is CA cert.

jeffreyman · ‎02-10-2021

Hi

I found that the CA cert which sign the cert is 1024 bits. However, when I view "ca.cert.pem" (change to ca.cert.cer), the cert is 2048 bits. Also, the valid period is always starting from 24 Jun 2020. But the "ca.cert.pem" is starting from when I run the tool.

It seems that the alfresco-ssl-generator tool does not use the generated CA cert (i.e. ca.cert.pem) for signing.

sufo · ‎02-10-2021

You are right. Certificate is signed with different CA cert:

            X509v3 Authority Key Identifier:
                keyid:94:27:EA:72:F9:20:DC:E3:2C:A8:17:8F:D9:1A:A7:B7:62:22:FF:25
                DirName:/C=GB/ST=UK/L=Maidenhead/O=Alfresco Software Ltd./OU=Unknown/CN=Custom Alfresco CA
                serial:69:BB:16:AF:C9:1E:C4:69:1D:AE:DB:D4:1A:6A:56:9A:93:3B:FE:95

CA cert that you appended seems to have different serial number:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            67:01:18:b7:bb:76:ad:e3:25:84:5b:e6:6a:c1:40:a7:38:1b:58:97
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=UK, L=Maidenhead, O=Alfresco Software Ltd., OU=Unknown, CN=Custom Alfresco CA
        Validity
            Not Before: Feb 10 12:40:41 2021 GMT
            Not After : Feb  5 12:40:41 2041 GMT
        Subject: C=GB, ST=UK, L=Maidenhead, O=Alfresco Software Ltd., OU=Unknown, CN=Custom Alfresco CA

Can you try with clean directory structure? I mean 'ca' directory.

Hyland Connect

Invalid Digital Signature of generated certificates