Invalid Digital Signature of generated certificates

[jeffreyman]

Hi,

I use alfresco-ssl-generator to generate certificates for repository, solr and client. However, the generated certificates show "This certificate has an invalid digital signature" error. I have no idea how to fix it. Please help.

 

[jeffreyman]

Hi,

I have tried to re-download the tool and clean all folder inside "ssl-tool-win". However, the result is same, that is invalid digital signature.

Do you have expereience on alfresco-ssl-generator tool?

[sufo]

One quick idea. Did you remove old CA certificate from Trusted Root CAs? You have to import new CA certificate into the Trusted Root CAs in Windows. It depends if you installed in your user store or computer store. This may help you: https://www.thesslstore.com/knowledgebase/ssl-install/how-to-import-intermediate-root-certificates-u...

[jeffreyman]

Hi,

To my understanding, it seems not relate to windows certificate manager. It is stored in the keystore/truststore. Attached is the windows trust root ca.

[sufo]

Go to the ca\certs directory and copy ca.cert.pem to ca.cert.crt. Double-click on ca.cert.crt and you should see that it is not trusted. You have to ad it to trusted certificates. I think that you have added previous CA certificate to your personal store not the computer store. Check it too.
 

[jeffreyman]

HI,

I haved added the CA cert into local machine. I can see the generated cert is using new CA cert. However, the cert is still invalid digital signature. Any idea?

[sufo]

But, did you remove the old CA cert from trusted certificates? I think that this is the issue.

Run this command in the directory where you have run.cmd:

openssl verify -CAfile ca\certs\ca.cert.pem certificates\repository.cer

[jeffreyman]

Hi,

Here is result.

certificates/repository.cer: OK

[jeffreyman · Accepted solution]

Hi Sufo,

After install the new CA cert in local user, the certificates look good. I think it is a viewing problem, not certificate itself.

Thanks a lot.