Verifying private key with cert and fullchain

TOPPOT · November 28, 2024, 1:03pm

I am trying to figure out why my private key doesn't match the certificates I got not does it match the CA certificates publicly available on my client. The keys are being used on a StrongSwan server. Domains and other information has been changed.

I ran:

certbot certonly --key-type rsa --rsa-key-size 4096 --email melville@moby.edu --agree-tos -d firm.mattress.es

I tried to verify that the private key match the cert and fullchain certs:

root@dorothy:/etc/ipsec.d/ca# openssl x509 -in ../cert/cert.pem -pubkey -outform pem | sha256sum
472ce7b06b1fbb51f5132371c85672b488c7bee8d9cbc9680cb70d32a01ea90c -
root@dorothy:/etc/ipsec.d/ca# openssl x509 -in ../ca/fullchain.pem -pubkey -outform pem | sha256sum
472ce7b06b1fbb51f5132371c85672b488c7bee8d9cbc9680cb70d32a01ea90c -
root@dorothy:/etc/ipsec.d/ca# openssl rsa -in ../private/privkey.pem -pubout -outform pem | sha256sum
writing RSA key
bd9e3ed8b0a3fe3527fcce2cf3cf85171f82e793618c742302a8f6ef4bc911fe -

The key doesn't match the certificates and when used with my VPN, the key does not match any certificate authorities.

These certs and key are being used with StrongSwan and are soft links from the /etc/letsencrypt directory to the ipsec.d directory in the appropriate locations.

certbot 2.9.0

MikeMcQ · November 28, 2024, 3:19pm

Would you show output of below command? Because I do not see any history of you getting a Let's Encrypt cert for that domain name. Thanks

sudo certbot certificates

rg305 · November 28, 2024, 3:41pm

cert.pem in /cert/ and privkey.pem in /private/ makes sense [to me].
But... fullchain in /ca/ doesn't make much sense [to me].
[perhaps you could try using chain.pem instead]

TOPPOT · November 28, 2024, 10:15pm

How will that change the hashes to agree which is the problem to be resolved?

Bruce5051 · November 28, 2024, 10:21pm

Maybe try some OpenSSL commands of this form

openssl pkey -in privateKey.key -pubout -outform pem | sha256sum
openssl x509 -in certificate.crt -pubkey -noout -outform pem | sha256sum
openssl req -in CSR.csr -pubkey -noout -outform pem | sha256sum

TOPPOT · November 28, 2024, 11:51pm

No change in the result:

root@dorothy:/etc/ipsec.d# openssl pkey -in private/privkey.pem -pubout -outform pem | sha256sum
bd9e3ed8b0a3fe3527fcce2cf3cf85171f82e793618c742302a8f6ef4bc911fe -
root@dorothy:/etc/ipsec.d# openssl x509 -in cert/cert.pem -pubkey -outform pem | sha256sum
472ce7b06b1fbb51f5132371c85672b488c7bee8d9cbc9680cb70d32a01ea90c -

I didn't bother with the csr as in my VPN application the cert and the private key agreement is what the logs are complaining about.

TOPPOT · November 28, 2024, 11:54pm

certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Found the following certs:
Certificate Name: firm.mattress.es
Serial Number: 4789e5a75878b4b582a9f6e7f273cced780
Key Type: RSA
Domains: firm.mattress.es
Expiry Date: 2025-02-26 11:34:29+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/firm.mattress.es/fullchain.pem
Private Key Path: /etc/letsencrypt/live/firm.mattress.es/privkey.pem

fqdn has been changed for posting in public spaces.

rg305 · November 29, 2024, 2:09am

Then use an FQDN from "example.com|net|org"
[that is a valid domain]

Bruce5051 · November 29, 2024, 4:03am

I would say that the private key does not have the same public key portion that the certificate has,
thus they are not a match.

Edit

Also this is the private key and hopefully paired certificate (in the fullchain) that should match.

TOPPOT · November 29, 2024, 5:19am

Yes it bears further investigation. When I get home I'll look into it and post the results.

I wonder how these things work on my websites with a strange private key.

TOPPOT · November 29, 2024, 9:54am

It is starting to get through my thick skull what is going on and what I think is supposed to be going on. The ACME client should generate the private key on my server during the certificate installation process, then it creates a key signing request and sends that and the certificate associated with the private key to LE to sign. The fullchain.pem should contain the signed key and the chain back to the CA. So in my thinking the cert at the top of the fullchain file should match up to the private key, and it doesn't. So where did the cert come from that I got back?

TOPPOT · November 29, 2024, 1:39pm

Your advice is noted.

Bruce5051 · November 29, 2024, 5:18pm

OK; so here is an example with one of my test domains (yes, that is the real FQDN).
I am tying to show that I get a match between the private key and the certificate in the fullchain.pem

$ sudo certbot --version
certbot 2.11.0

$ sudo certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: petrifiedhaggis.us.kg
    Serial Number: 4bf7128903c15f6efcde100e5ef26fd1b10
    Key Type: ECDSA
    Domains: petrifiedhaggis.us.kg *.petrifiedhaggis.us.kg
    Expiry Date: 2025-02-26 17:14:24+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/petrifiedhaggis.us.kg/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/petrifiedhaggis.us.kg/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

$ sudo openssl pkey -in /etc/letsencrypt/live/petrifiedhaggis.us.kg/privkey.pem -pubout -outform pem | sha256sum
c48f4da1a746a5322d80533338d4cbe0fb912a6fe10c8755268dbe3315f22ba2  -

$ sudo openssl x509 -in /etc/letsencrypt/live/petrifiedhaggis.us.kg/fullchain.pem -pubkey -noout -outform pem | sha256sum
c48f4da1a746a5322d80533338d4cbe0fb912a6fe10c8755268dbe3315f22ba2  -

$ sudo cat /etc/letsencrypt/live/petrifiedhaggis.us.kg/fullchain.pem

Topic		Replies	Views
Private key does not match with my certificate Help	14	7124	May 17, 2018
Key and Cert do not match? WTH? Help	5	3065	November 10, 2016
SSL: CERTIFICATE_VERIFY_FAILED with Lets encrypt Server	5	11730	May 12, 2017
Error verifying certificate with OpenSSL Help	8	3568	March 6, 2017
Openssl verify: unable to get issuer certificate Help	4	7499	April 1, 2020

Verifying private key with cert and fullchain

Edit

Related topics