Hi Guys, I'm using a platform called Manage Engine Service Desk MSP to run an IT Helpdesk, but I am having an issue getting the SSL certificate into a format that it will take. I think the PFX is being built right, but I am seeing an issue in the logs saying Certificate Chain is not Valid & Key Pro…

I'm definitely not a Java expert, but I didn't think a Java KeyStore file was the same as a PFX (PKCS12) file. Their docs def talk about using Java's keytool to manipulate keystore files. https://www.manageengine.com/products/service-desk-msp/help/installation-guide/documents/install-ssl.html But …

Try: openssl pkcs12 -export \ -out /home/certificate.pfx \ -inkey /etc/letsencrypt/live/support.wellconnected.it/privkey.pem \ -in /etc/letsencrypt/live/support.wellconnected.it/fullchain.pem \ -passout pass:$$$$$$$$$$$$$$$

Hey @rmbolger , It's strange, they've got multiple different documentation locations - this one is the one we used for our Windows install that worked well. What is PFX and how to install PFX certificate in ServiceDesk Plus MSP PFX is the file format to store public and private key cer…

It's quite possible I just stumbled onto an old version of the doc. I've read newer versions of Java do support PKCS12 and no longer default to the old keystore formats. But I'd also think that if they were on a newer version, they'd support most of the relatively modern algorithms and key sizes. S…

It worked for this topic: [image] Intermediate chain missing on Azure, please help Help T…

@rg305 Unfortunately the same error, even using the fullchain as the in file. I wonder if it's maybe on the Certbot side that's causing the issue? Even if I import the certificates into my Windows machine, and then re-export and try and import them onto the Linux box via the GUI the process dies. …

[image] wellconn: Manage Engine Service Desk MSP My (complete!) guess would be that your system doesn't trust the root certificate (.e.g. it doesn't have ISRG Root X1 in it's trust store, and if it has DST Root CA X3 then it doesn't like the fact that's expired). See the Installing the Root …

@webprofusion Good guess, just checked and there is no DST Root, and the ISRG X1 is in the cert store. So I don't believe it's a trust thing from that POV.

It may not be useful to you but here is how we recommend doing it for Tomcat 9.x on Windows using Certify The Web : Apache Tomcat | Certify The Web Docs - I don't know which version of Tomcat Manage Engine is using. Basically we just give it the pfx (which we've already built) and set the specific o…

@webprofusion can I say, your solution CertifyTheWeb is hands down one of the best and easiest pieces of software to use. It was great when I was playing around with things on a Windows box. I may get CTW to generate the certificate and see if I can import it using the GUI, and then hopefully aft…

PKCS12 Generated but Certificate Chain Not valid

Help

rg305 January 12, 2022, 11:27pm 6

It worked for this topic:

Topic		Replies	Views
Creating p12 file for keystore - Error unable to get issuer certificate getting chain Help	18	5314	May 18, 2021
PKCS12 Certificate conversion stopped working Server	16	4811	September 5, 2018
How convert pem to pfx and also generate intermidiate certificates chain Help	3	1671	January 15, 2025
Java Socket, JKS Problem Help	6	991	July 9, 2021
Certificate Chain (V2) - How to create pfx file Client dev	11	6840	August 27, 2018

PKCS12 Generated but Certificate Chain Not valid

Related topics