Facebook
TwitterI am trying to replace an obsolete wildcard certificate that is currently being uses as the "default"-certificate in plesk.
All configured domains have been changed to use a new certificate issued by Let's Encrypt using the default plugin.
The appropriate Let's Encrypt certificate has also been configured to "secure plesk". All is working well so far.
When connecting to a TLS-enabled port without using SNI, I still get the obsolete default certificate. Instead of delivering a misleading obsolete certificate, I want to present a self-signed "snakeoil" certificate. I understand that this needs to be the "default" certificate.
This is how I generated such a snakeoil-certificate:
openssl genrsa -out /etc/ssl/private/snakeoil-key.pem 4096
openssl req -key /etc/ssl/private/snakeoil-key.pem -x509 -out /etc/ssl/certs/snakeoil-ca.pem -subj "/CN=snakeoil" -config <(cat /etc/ssl/openssl.cnf)
openssl req -new -key /etc/ssl/private/snakeoil-key.pem -out /etc/ssl/certs/snakeoil-req.pem -subj "/CN=snakeoil" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:snakeoil,DNS:snake.oil"))
openssl x509 -req -days 3600 -in /etc/ssl/certs/snakeoil-req.pem -CA /etc/ssl/certs/snakeoil-ca.pem -CAkey /etc/ssl/private/snakeoil-key.pem -CAcreateserial -out /etc/ssl/certs/snakeoil-cert.pem -extensions v3_ca -extfile <(printf "\n[v3_ca]\nbasicConstraints = CA:FALSE\nkeyUsage = digitalSignature, keyEncipherment\nextendedKeyUsage = serverAuth,clientAuth\nsubjectAltName=DNS:snakeoil,DNS:snake.oil")
I cannot upload this certifcate. Providing three files (key, cert, ca) in PEM Format via upload-form is not working. Neither is copy&pasting the PEM-encoded certifcates into the upload-form. I tried to provide the name: "snakeoil". When uploading, i get an error:
Error: "Unable to find row with id 0 in certificates table."
I have checked the mysql-psa-database and indeed there is no row with id '0' in the table 'certificates. Although I am not sure why that matters - I performed a cross-check and uploaded another random certificate, as received from RapidSSL. Upload works without problems here.
So I am wondering what is missing with my snakeoil-certifiacte or what may be causing the error.
In Adding SSL Certificate doesn't work it has been suggested to run
# plesk repair db
Did that, some repairs have been done, but the issue with my certificate still persists.
EDIT: Using Obsidian Version 18.0.38 on Debian 9.13.
All configured domains have been changed to use a new certificate issued by Let's Encrypt using the default plugin.
The appropriate Let's Encrypt certificate has also been configured to "secure plesk". All is working well so far.
When connecting to a TLS-enabled port without using SNI, I still get the obsolete default certificate. Instead of delivering a misleading obsolete certificate, I want to present a self-signed "snakeoil" certificate. I understand that this needs to be the "default" certificate.
This is how I generated such a snakeoil-certificate:
openssl genrsa -out /etc/ssl/private/snakeoil-key.pem 4096
openssl req -key /etc/ssl/private/snakeoil-key.pem -x509 -out /etc/ssl/certs/snakeoil-ca.pem -subj "/CN=snakeoil" -config <(cat /etc/ssl/openssl.cnf)
openssl req -new -key /etc/ssl/private/snakeoil-key.pem -out /etc/ssl/certs/snakeoil-req.pem -subj "/CN=snakeoil" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:snakeoil,DNS:snake.oil"))
openssl x509 -req -days 3600 -in /etc/ssl/certs/snakeoil-req.pem -CA /etc/ssl/certs/snakeoil-ca.pem -CAkey /etc/ssl/private/snakeoil-key.pem -CAcreateserial -out /etc/ssl/certs/snakeoil-cert.pem -extensions v3_ca -extfile <(printf "\n[v3_ca]\nbasicConstraints = CA:FALSE\nkeyUsage = digitalSignature, keyEncipherment\nextendedKeyUsage = serverAuth,clientAuth\nsubjectAltName=DNS:snakeoil,DNS:snake.oil")
I cannot upload this certifcate. Providing three files (key, cert, ca) in PEM Format via upload-form is not working. Neither is copy&pasting the PEM-encoded certifcates into the upload-form. I tried to provide the name: "snakeoil". When uploading, i get an error:
Error: "Unable to find row with id 0 in certificates table."
I have checked the mysql-psa-database and indeed there is no row with id '0' in the table 'certificates. Although I am not sure why that matters - I performed a cross-check and uploaded another random certificate, as received from RapidSSL. Upload works without problems here.
So I am wondering what is missing with my snakeoil-certifiacte or what may be causing the error.
In Adding SSL Certificate doesn't work it has been suggested to run
# plesk repair db
Did that, some repairs have been done, but the issue with my certificate still persists.
EDIT: Using Obsidian Version 18.0.38 on Debian 9.13.
