Signed by a trusted certificate authority ( This should be fine, it was signed by LE )
Exported as a password-protected PFX file. ( It has a password )
Contains private key at least 2048 bits long ( openssl rsa -in privkey.pem -text -noout says Private-Key: (2048 bit, 2 primes))
Contains all intermediate certificates in the certificate chain ( NOT SURE )
Must be SHA2 enabled; SHA1 support is being removed from popular browsers ( openssl rsa -in privkey.pem -text -noout says Signature Algorithm: sha256WithRSAEncryption )
PFX file must be encrypted with TripleDES encryption; Power Pages doesn't support AES-256 encryption ( NOT SURE )
Contains an Extended Key Usage for server authentication (OID = 1.3.6.1.5.5.7.3.1). ( NOT SURE )
But when importing I get an "Server error", so something must be wrong.
My question is, this, with the way I generated the PFX, does it have does requirements?
I tried to add -des3 to the openssl command but it sais Warning: output encryption option -des3 ignored with -export
My guess is that's what is missing, the TripleDES encryption, but I can't figure out how to do it using openssl.
Well, it'd be more helpful if it could tell you what was wrong.
If you actually need it to be an RSA key, then you should add --key-type RSA to your certbot command. Certbot (and most of the rest of the world) has moved on to ECDSA being the default.
Hmm. Did it prompt you for a password when doing the export? If so, I would expect that it would have been what you were looking for.
Really, though, this whole process of manually updating things and converting formats is probably the most convoluted way of doing what you're looking for. It should be possible to have whatever system you're trying to secure request the certificates itself, or use some software that already knows how to integrate with it. I haven't used that system myself, but in general I thought Microsoft "cloud" systems could handle managing their own certificates.
Really, though, this whole process of manually updating things and converting formats is probably the most convoluted way of doing what you're looking for. It should be possible to have whatever system you're trying to secure request the certificates itself, or use some software that already knows how to integrate with it. I haven't used that system myself, but in general I thought Microsoft "cloud" systems could handle managing their own certificates.
Haha, my thoughts exactly, but no, they manage the SSL with their domains, if you want to add your own, they ask for a PFX certificate. I don't know why, it's such a pain.
Well, it'd be more helpful if it could tell you what was wrong.
All it says is SSL binding record could not be create because of a Server error. Please try again.
If you actually need it to be an RSA key, then you should add --key-type RSA to your certbot command. Certbot (and most of the rest of the world) has moved on to ECDSA being the default.
Requirement says Contains private key at least 2048 bits long, I don't see anything about RSA though.
Hmm. Did it prompt you for a password when doing the export? If so, I would expect that it would have been what you were looking for.
-descert
Encrypt the certificates using triple DES. By default the private key and the certificates are encrypted using AES-256-CBC unless the ‘-legacy’ option is used. If ‘-descert’ is used with the ‘-legacy’ then both, the private key and the certificates are encrypted using triple DES.
I have tried the key from below and sais The password entered is incorrect or the encryption method used by the certificate is not supported.. So this one is worse than the other one, at least there it let me get over entering the password. Maybe because it's not SHA2?
Renewal configuration file /etc/letsencrypt/renewal/subdomain.domain.com.conf produced an unexpected error: '_RSAPublicKey' object has no attribute 'verifier'. Skipping.
When I run certbot certificates
// If it was by me, I would not go for Microsoft ever.
If I'm understanding the openssl options properly (which I might not be), -descert encrypts the certificate in addition to the private key. Not sure if that's what your requirements are looking for or not.
SHA1 support in certificates ended a long time ago; you assuredly have an SHA2 certificate.
As an aside you can also generate one of these using https://certifytheweb.com quite easily (no scripting or command line) if you use the DNS validation option, you just need to set your preferred PFX password under Certificate > Advanced > Signing & Security, all the other defaults will match and the output is PFX. You can add an Export Certificate task to copy the PFX to wherever you want it.
SHA2 is typically anything that's not SHA1, most apps will generate SHA 256 or higher by default when generating a PFX. The TripleDES vs AES-256 (private key encryption algorithm) thing is surprisingly nuanced as some versions of windows will only cope with TripleDES.
