Contents

Introduction

Prerequisites

Requirements

Components Used

Prepare and backup

Configure

Verify the certificates

Install the certificates on CMX

Troubleshoot

Introduction

This article will give an example on how to get a free SSL certificate and the way to install it on CMX. The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- A domain name which can be resolved externally

- Basic linux skills

- Basic knowledge of PKI (Public Key Infrastracture)

Components Used

The information in this document is based on these software and hardware versions:

- CMX 10.5

Prepare and backup

Web certificate is located in the following folder:

[root@cmxtry ssl]# pwd

/opt/haproxy/ssl

Backup the old certificate and key:

[cmxadmin@cmxtry ssl]$cd /opt/haproxy/ssl/

[cmxadmin@cmxtry ssl]$su root

Password: (enter root password)

[root@cmxtry ssl]# mkdir ./oldcert

[root@cmxtry ssl]# mv host.* ./oldcert/

[root@cmxtry ssl]# ls ./oldcert/

host.key  host.pem

In case you are not very familiar with Linux, the above commands can be interpreted in the following way:

[cmxadmin@cmxtry ssl]$cd /opt/haproxy/ssl/

[cmxadmin@cmxtry ssl]$su root

Password: (enter root password)

[root@cmxtry ssl]# mkdir /opt/haproxy/ssl/oldcert

[root@cmxtry ssl]# mv host.pem /opt/haproxy/ssl/oldcert/

[root@cmxtry ssl]# mv host.key /opt/haproxy/ssl/oldcert/

[root@cmxtry ssl]# ls /opt/haproxy/ssl/oldcert/

host.key  host.pem

Configure

Generate a private key:

openssl genrsa -out cmxtry.com.key 2048

[root@cmxtry ssl]# openssl genrsa -out cmxtry.com.key 2048

Generating RSA private key, 2048 bit long modulus

............

...............

e is 65537 (0x10001)

[root@cmxtry ssl]# ls

cmxtry.com.key  oldcert

Generate a CSR (Certificate Sign requests) using the private you key generated in the previous step.

[root@cmxtry ssl]# openssl req -new -sha256 -key cmxtry.com.key -out cmxtry.com.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:BE

State or Province Name (full name) [Some-State]:

Locality Name (eg, city) []:DIEGEM

Organization Name (eg, company) [Internet Widgits Pty Ltd]:CMXTRY

Organizational Unit Name (eg, section) []:CMXTRY

Common Name (e.g. server FQDN or YOUR name) []:cmxtry.com

Email Address []:avitosin@cisco.com

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:Cisco123

An optional company name []:CMXTRY

[root@cmxtry ssl]# ls

cmxtry.com.csr  cmxtry.com.key  oldcert

Display the CSR:

[root@cmxtry ssl]# cat cmxtry.com.csr

-----BEGIN CERTIFICATE REQUEST-----

MIIDZTCCAk0CAQAwgY0xCzAJBgNVBAYTAkJFMRMwEQYDVQQIDApTb21lLVN0YXRl

MQ8wDQYDVQQHDAZESUVHRU0xDzANBgNVBAoMBkNNWFRSWTEPMA0GA1UECwwGQ01Y

VFJZMRMwEQYDVQQDDApjbXh0cnkuY29tMSEwHwYJKoZIhvcNAQkBFhJhdml0b3Np

bkBjaXNjby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCkEIg0

AxV/3HxAxUu7UI/LxkTP+DZJvvuua1WgyQ+tlD4r1+k1Wv1eINCJqywglCKt9vVg

aiYp4JAKL28TV7rtSKqNFnWDMtTKoYRkYWI3L48r9Mu9Tt3zDCG09ygnQFi6SnmX

VmKx7Ct/wIkkBXfkq1nq4vqosCry8SToS1PThX/KSuwIF6w2aKj1Fbrw3eW4XJxc

5hoQFrSsquqmbi5IZWgH/zMZUZTdWYvFc/h50PCBJsAa9HTY0sgUe/nyjHdt+V/l

alNSh41jsrulhWiPzqbaPW/Fej9/5gtPG5LReWuS20ulAnso4tdcST1vVletoXJw

F58S8AqeVrcOV9SnAgMBAAGggZEwFQYJKoZIhvcNAQkCMQgMBkNNWFRSWTAXBgkq

hkiG9w0BCQcxCgwIQ2lzY28xMjMwXwYJKoZIhvcNAQkOMVIwUDAJBgNVHRMEAjAA

MBcGA1UdEQQQMA6CDF9fSE9TVE5BTUVfXzAdBgNVHSUEFjAUBggrBgEFBQcDAQYI

KwYBBQUHAwIwCwYDVR0PBAQDAgOoMA0GCSqGSIb3DQEBCwUAA4IBAQCBslfRzbiw

WBBBN74aWm6YwkO0YexpR2yCrQhcOsxWTujPVvzNP9WaDNxu1rw6o3iZclGi6D61

qFsKtchQhnclvOj7rNI8TInaxIorR2zMy0lF2vtJmvY4YQFso9qzmuaxkmttEMFU

Fj0bxKh6SpvxePh6+BDcwt+kQExK5aF3Q6cRIMyKBS2+I5J5eddJ0cdIqTfwZOGD

5dMDWqHGd7IZyrend8AMPZvNKm3Sbx11Uq+A/fa7f9JZE0O2Q9h3sl3hj3QIPU6s

w1Pyd66/OX04yYIvMyjJ8xpJGigNWBOvQ+GLvK0ce441h2u2oIoPe60sDOYldL+X

JsnSbefiJ4Fe

-----END CERTIFICATE REQUEST-----

Copy the CSR (include the beginning of certificate request line and end of certificate request line).

In case of my lab, I was using the free certificate from Comodo (https://www.instantssl.com/)

￼

You paste the CSR in the window and select RedHat as software used to generate the CSR:

You have to validate the domain using either an e-mail address or other ways to validate the domain, such as DNS CNAME entry.

When you did complete the process of validation, you will be able to download a certificate from here:

When you download the certificate, you have to upload it to CMX box:

[ avitosin > ~/Desktop/cmxtry_com ] ls

cmxtry_com.ca-bundle  cmxtry_com.crt

[ avitosin > ~/Desktop/cmxtry_com ] scp ./* cmxadmin@cmxtry.com:/home/cmxadmin

Warning: the ECDSA host key for 'cmxtry.com' differs from the key for the IP address '64.103.12.134'

Offending key for IP in /Users/avitosin/.ssh/known_hosts:8

Matching host key in /Users/avitosin/.ssh/known_hosts:10

Are you sure you want to continue connecting (yes/no)? yes

cmxadmin@cmxtry.com's password:

/etc/profile.d/lang.sh: line 19: warning: setlocale: LC_CTYPE: cannot change locale (UTF-8): No such file or directory

cmxtry_com.ca-bundle                          100% 4103     4.0KB/s   00:00

cmxtry_com.crt                                100% 2236     2.2KB/s   00:00

[ avitosin > ~/Desktop/cmxtry_com ]

Verify the certificates

Verify that the certificate was successfully copied to CMX:

[root@cmxtry ssl]# cd /home/cmxadmin/

[root@cmxtry cmxadmin]# ls

cmxtry_com.ca-bundle  cmxtry_com.crt

[root@cmxtry cmxadmin]#

Public certificate:

[root@cmxtry cmxadmin]# cat cmxtry_com.crt

-----BEGIN CERTIFICATE-----

MIIGRzCCBS+gAwIBAgIRALKbdelOe0O7sSYMBFBhFPwwDQYJKoZIhvcNAQELBQAw

gZAxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO

BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTYwNAYD

VQQDEy1DT01PRE8gUlNBIERvbWFpbiBWYWxpZGF0aW9uIFNlY3VyZSBTZXJ2ZXIg

Q0EwHhcNMTgwODA4MDAwMDAwWhcNMTgxMTA2MjM1OTU5WjBLMSEwHwYDVQQLExhE

b21haW4gQ29udHJvbCBWYWxpZGF0ZWQxETAPBgNVBAsTCEZyZWUgU1NMMRMwEQYD

VQQDEwpjbXh0cnkuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA

oVRQ9cBGBNbcIIiVovDXUw0TRXjrCplro9bx22kGAnJPNenymETTdJ4m+7Rs19BI

ob09Wqo4CKWCxgdViJWQDohfGbElvdELcOD7+HgZroYHoY24wzU+q2WCFW9z3Dca

RZMJagjsXPZ5XhACvlKb+lNoYTgTkf0xVAnNphTGgtOGNaQ/PHqX9ITC4iwTmFWD

UEZR/SIwb5MjIQZsMGi5cW7q4STKrydFVDXmJzNySK2hq9s9yc8cBN2Lp2HJsaA4

qtQb1KWOLnzVxUaAMVN+sObVvYV/sOmJLtFvKKU9Pg2cuSo2LhPBVtTpdbHkSDuz

NlWHhYC9Uxu2+wwvTwGjQQIDAQABo4IC3jCCAtowHwYDVR0jBBgwFoAUkK9qOpRa

C9iQ6hJWc99DtDoo2ucwHQYDVR0OBBYEFPvwN4lSs4oKd5AaG+j6xhDEtfL7MA4G

A1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMB

BggrBgEFBQcDAjBPBgNVHSAESDBGMDoGCysGAQQBsjEBAgIHMCswKQYIKwYBBQUH

AgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5jb20vQ1BTMAgGBmeBDAECATBUBgNV

HR8ETTBLMEmgR6BFhkNodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9SU0FE

b21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3JsMIGFBggrBgEFBQcBAQR5

MHcwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JT

QURvbWFpblZhbGlkYXRpb25TZWN1cmVTZXJ2ZXJDQS5jcnQwJAYIKwYBBQUHMAGG

GGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTAlBgNVHREEHjAcggpjbXh0cnkuY29t

gg53d3cuY214dHJ5LmNvbTCCAQMGCisGAQQB1nkCBAIEgfQEgfEA7wB1AO5Lvbd1

zmC64UJpH6vhnmajD35fsHLYgwDEe4l6qP3LAAABZRmIfAUAAAQDAEYwRAIgdU0n

octPP7c7dR3MSMq2NQDA1rgP1hSGtB4qkectDp4CIBHBdS9cuu6Pwjb9OAHtKIDh

BGFm51btA2NflzDLKmpVAHYA23Sv7ssp7LH+yj5xbSzluaq7NveEcYPHXZ1PN7Yf

v2QAAAFlGYh7cwAABAMARzBFAiBDUjKNvINiwH1hgA+4Oipjhv7oGxLEsDiz+e7j

/oa3qQIhAKoTXC41fbcAZSH3zWE/LBYthUkA4qaP3Q2en7QanEv7MA0GCSqGSIb3

DQEBCwUAA4IBAQAwoZfOdE1QuzJqssnAWxoI2uTc9R15clVq3X7qiYLv3ItijFUL

stuKQXf7VqYqKHcjX8Ue5TMfcJYNlRc5Knj3r6fusLuaO33W++g3TDnQuN/CT5Y4

nrgor7UsquZHGoY6RHh2ZDA53Ep80YtsO36eLN8qkDB/OvxqJmYj9URTLfWRqfhh

sGE1odIjW4lbSka+CR09DlBkhzOTqDCnWcKicn/kSfJexKVs0LRrNXfvUEdbPohl

plPeiyKMXUtV2Q67UwiYpC9JzkG8a09q5JdUL4Le/xn0gvz4jq+2rtHnNctg6ShD

laqU7wA5HRag2zJsIK/d2Agymk8u3AypzW4T

-----END CERTIFICATE-----

Chain of trust:

[root@cmxtry cmxadmin]# cat cmxtry_com.ca-bundle

-----BEGIN CERTIFICATE-----

MIIGCDCCA/CgAwIBAgIQKy5u6tl1NmwUim7bo3yMBzANBgkqhkiG9w0BAQwFADCB

hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G

A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV

BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQwMjEy

MDAwMDAwWhcNMjkwMjExMjM1OTU5WjCBkDELMAkGA1UEBhMCR0IxGzAZBgNVBAgT

EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR

Q09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZh

bGlkYXRpb24gU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP

ADCCAQoCggEBAI7CAhnhoFmk6zg1jSz9AdDTScBkxwtiBUUWOqigwAwCfx3M28Sh

bXcDow+G+eMGnD4LgYqbSRutA776S9uMIO3Vzl5ljj4Nr0zCsLdFXlIvNN5IJGS0

Qa4Al/e+Z96e0HqnU4A7fK31llVvl0cKfIWLIpeNs4TgllfQcBhglo/uLQeTnaG6

ytHNe+nEKpooIZFNb5JPJaXyejXdJtxGpdCsWTWM/06RQ1A/WZMebFEh7lgUq/51

UHg+TLAchhP6a5i84DuUHoVS3AOTJBhuyydRReZw3iVDpA3hSqXttn7IzW3uLh0n

c13cRTCAquOyQQuvvUSH2rnlG51/ruWFgqUCAwEAAaOCAWUwggFhMB8GA1UdIwQY

MBaAFLuvfgI9+qbxPISOre44mOzZMjLUMB0GA1UdDgQWBBSQr2o6lFoL2JDqElZz

30O0Oija5zAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNV

HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgG

BmeBDAECATBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNvbW9kb2NhLmNv

bS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcB

AQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9E

T1JTQUFkZFRydXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21v

ZG9jYS5jb20wDQYJKoZIhvcNAQEMBQADggIBAE4rdk+SHGI2ibp3wScF9BzWRJ2p

mj6q1WZmAT7qSeaiNbz69t2Vjpk1mA42GHWx3d1Qcnyu3HeIzg/3kCDKo2cuH1Z/

e+FE6kKVxF0NAVBGFfKBiVlsit2M8RKhjTpCipj4SzR7JzsItG8kO3KdY3RYPBps

P0/HEZrIqPW1N+8QRcZs2eBelSaz662jue5/DJpmNXMyYE7l3YphLG5SEXdoltMY

dVEVABt0iN3hxzgEQyjpFv3ZBdRdRydg1vs4O2xyopT4Qhrf7W8GjEXCBgCq5Ojc

2bXhc3js9iPc0d1sjhqPpepUfJa3w/5Vjo1JXvxku88+vZbrac2/4EjxYoIQ5QxG

V/Iz2tDIY+3GH5QFlkoakdH368+PUq4NCNk+qKBR6cGHdNXJ93SrLlP7u3r7l+L4

HyaPs9Kg4DdbKDsx5Q5XLVq4rXmsXiBmGqW5prU5wfWYQ//u+aen/e7KJD2AFsQX

j4rBYKEMrltDR5FL1ZoXX/nUh8HCjLfn4g8wGTeGrODcQgPmlKidrv0PJFGUzpII

0fxQ8ANAe4hZ7Q7drNJ3gjTcBpUC2JD5Leo31Rpg0Gcg19hCC0Wvgmje3WYkN5Ap

lBlGGSW4gNfL1IYoakRwJiNiqZ+Gb7+6kHDSVneFeO/qJakXzlByjAA6quPbYzSf

+AZxAeKCINT+b72x

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

MIIFdDCCBFygAwIBAgIQJ2buVutJ846r13Ci/ITeIjANBgkqhkiG9w0BAQwFADBv

MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk

ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF

eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow

gYUxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO

BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMSswKQYD

VQQDEyJDT01PRE8gUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkq

hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAkehUktIKVrGsDSTdxc9EZ3SZKzejfSNw

AHG8U9/E+ioSj0t/EFa9n3Byt2F/yUsPF6c947AEYe7/EZfH9IY+Cvo+XPmT5jR6

2RRr55yzhaCCenavcZDX7P0N+pxs+t+wgvQUfvm+xKYvT3+Zf7X8Z0NyvQwA1onr

ayzT7Y+YHBSrfuXjbvzYqOSSJNpDa2K4Vf3qwbxstovzDo2a5JtsaZn4eEgwRdWt

4Q08RWD8MpZRJ7xnw8outmvqRsfHIKCxH2XeSAi6pE6p8oNGN4Tr6MyBSENnTnIq

m1y9TBsoilwie7SrmNnu4FGDwwlGTm0+mfqVF9p8M1dBPI1R7Qu2XK8sYxrfV8g/

vOldxJuvRZnio1oktLqpVj3Pb6r/SVi+8Kj/9Lit6Tf7urj0Czr56ENCHonYhMsT

8dm74YlguIwoVqwUHZwK53Hrzw7dPamWoUi9PPevtQ0iTMARgexWO/bTouJbt7IE

IlKVgJNp6I5MZfGRAy1wdALqi2cVKWlSArvX31BqVUa/oKMoYX9w0MOiqiwhqkfO

KJwGRXa/ghgntNWutMtQ5mv0TIZxMOmm3xaG4Nj/QN370EKIf6MzOi5cHkERgWPO

GHFrK+ymircxXDpqR+DDeVnWIBqv8mqYqnK8V0rSS527EPywTEHl7R09XiidnMy/

s1Hap0flhFMCAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTvA73g

JMtUGjAdBgNVHQ4EFgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQD

AgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1UdHwQ9

MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVy

bmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6

Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAGS/g/FfmoXQ

zbihKVcN6Fr30ek+8nYEbvFScLsePP9NDXRqzIGCJdPDoCpdTPW6i6FtxFQJdcfj

Jw5dhHk3QBN39bSsHNA7qxcS1u80GH4r6XnTq1dFDK8o+tDb5VCViLvfhVdpfZLY

Uspzgb8c8+a4bmYRBbMelC1/kZWSWfFMzqORcUx8Rww7Cxn2obFshj5cqsQugsv5

B5a6SE2Q8pTIqXOi6wZ7I53eovNNVZ96YUWYGGjHXkBrI/V5eu+MtWuLt29G9Hvx

PUsE2JOAWVrgQSQdso8VYFhH2+9uRv0V9dlfmrPb2LjkQLPNlzmuhbsdjrzch5vR

pu/xO28QOG8=

-----END CERTIFICATE-----

Alternative way to take a look inside the certificate:

CHAIN OF TRUST:

[root@cmxtry cmxadmin]# openssl x509 -in cmxtry_com.ca-bundle -text -noout

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

2b:2e:6e:ea:d9:75:36:6c:14:8a:6e:db:a3:7c:8c:07

Signature Algorithm: sha384WithRSAEncryption

Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority

Validity

Not Before: Feb 12 00:00:00 2014 GMT

Not After : Feb 11 23:59:59 2029 GMT

Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

Public-Key: (2048 bit)

Modulus:

00:8e:c2:02:19:e1:a0:59:a4:eb:38:35:8d:2c:fd:

01:d0:d3:49:c0:64:c7:0b:62:05:45:16:3a:a8:a0:

c0:0c:02:7f:1d:cc:db:c4:a1:6d:77:03:a3:0f:86:

f9:e3:06:9c:3e:0b:81:8a:9b:49:1b:ad:03:be:fa:

4b:db:8c:20:ed:d5:ce:5e:65:8e:3e:0d:af:4c:c2:

b0:b7:45:5e:52:2f:34:de:48:24:64:b4:41:ae:00:

97:f7:be:67:de:9e:d0:7a:a7:53:80:3b:7c:ad:f5:

96:55:6f:97:47:0a:7c:85:8b:22:97:8d:b3:84:e0:

96:57:d0:70:18:60:96:8f:ee:2d:07:93:9d:a1:ba:

ca:d1:cd:7b:e9:c4:2a:9a:28:21:91:4d:6f:92:4f:

25:a5:f2:7a:35:dd:26:dc:46:a5:d0:ac:59:35:8c:

ff:4e:91:43:50:3f:59:93:1e:6c:51:21:ee:58:14:

ab:fe:75:50:78:3e:4c:b0:1c:86:13:fa:6b:98:bc:

e0:3b:94:1e:85:52:dc:03:93:24:18:6e:cb:27:51:

45:e6:70:de:25:43:a4:0d:e1:4a:a5:ed:b6:7e:c8:

cd:6d:ee:2e:1d:27:73:5d:dc:45:30:80:aa:e3:b2:

41:0b:af:bd:44:87:da:b9:e5:1b:9d:7f:ae:e5:85:

82:a5

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Authority Key Identifier:

keyid:BB:AF:7E:02:3D:FA:A6:F1:3C:84:8E:AD:EE:38:98:EC:D9:32:32:D4

X509v3 Subject Key Identifier:

90:AF:6A:3A:94:5A:0B:D8:90:EA:12:56:73:DF:43:B4:3A:28:DA:E7

X509v3 Key Usage: critical

Digital Signature, Certificate Sign, CRL Sign

X509v3 Basic Constraints: critical

CA:TRUE, pathlen:0

X509v3 Extended Key Usage:

TLS Web Server Authentication, TLS Web Client Authentication

X509v3 Certificate Policies:

Policy: X509v3 Any Policy

Policy: 2.23.140.1.2.1

X509v3 CRL Distribution Points:

Full Name:

URI:http://crl.comodoca.com/COMODORSACertificationAuthority.crl

Authority Information Access:

CA Issuers - URI:http://crt.comodoca.com/COMODORSAAddTrustCA.crt

OCSP - URI:http://ocsp.comodoca.com

Signature Algorithm: sha384WithRSAEncryption

4e:2b:76:4f:92:1c:62:36:89:ba:77:c1:27:05:f4:1c:d6:44:

9d:a9:9a:3e:aa:d5:66:66:01:3e:ea:49:e6:a2:35:bc:fa:f6:

dd:95:8e:99:35:98:0e:36:18:75:b1:dd:dd:50:72:7c:ae:dc:

77:88:ce:0f:f7:90:20:ca:a3:67:2e:1f:56:7f:7b:e1:44:ea:

42:95:c4:5d:0d:01:50:46:15:f2:81:89:59:6c:8a:dd:8c:f1:

12:a1:8d:3a:42:8a:98:f8:4b:34:7b:27:3b:08:b4:6f:24:3b:

72:9d:63:74:58:3c:1a:6c:3f:4f:c7:11:9a:c8:a8:f5:b5:37:

ef:10:45:c6:6c:d9:e0:5e:95:26:b3:eb:ad:a3:b9:ee:7f:0c:

9a:66:35:73:32:60:4e:e5:dd:8a:61:2c:6e:52:11:77:68:96:

d3:18:75:51:15:00:1b:74:88:dd:e1:c7:38:04:43:28:e9:16:

fd:d9:05:d4:5d:47:27:60:d6:fb:38:3b:6c:72:a2:94:f8:42:

1a:df:ed:6f:06:8c:45:c2:06:00:aa:e4:e8:dc:d9:b5:e1:73:

78:ec:f6:23:dc:d1:dd:6c:8e:1a:8f:a5:ea:54:7c:96:b7:c3:

fe:55:8e:8d:49:5e:fc:64:bb:cf:3e:bd:96:eb:69:cd:bf:e0:

48:f1:62:82:10:e5:0c:46:57:f2:33:da:d0:c8:63:ed:c6:1f:

94:05:96:4a:1a:91:d1:f7:eb:cf:8f:52:ae:0d:08:d9:3e:a8:

a0:51:e9:c1:87:74:d5:c9:f7:74:ab:2e:53:fb:bb:7a:fb:97:

e2:f8:1f:26:8f:b3:d2:a0:e0:37:5b:28:3b:31:e5:0e:57:2d:

5a:b8:ad:79:ac:5e:20:66:1a:a5:b9:a6:b5:39:c1:f5:98:43:

ff:ee:f9:a7:a7:fd:ee:ca:24:3d:80:16:c4:17:8f:8a:c1:60:

a1:0c:ae:5b:43:47:91:4b:d5:9a:17:5f:f9:d4:87:c1:c2:8c:

b7:e7:e2:0f:30:19:37:86:ac:e0:dc:42:03:e6:94:a8:9d:ae:

fd:0f:24:51:94:ce:92:08:d1:fc:50:f0:03:40:7b:88:59:ed:

0e:dd:ac:d2:77:82:34:dc:06:95:02:d8:90:f9:2d:ea:37:d5:

1a:60:d0:67:20:d7:d8:42:0b:45:af:82:68:de:dd:66:24:37:

90:29:94:19:46:19:25:b8:80:d7:cb:d4:86:28:6a:44:70:26:

23:62:a9:9f:86:6f:bf:ba:90:70:d2:56:77:85:78:ef:ea:25:

a9:17:ce:50:72:8c:00:3a:aa:e3:db:63:34:9f:f8:06:71:01:

e2:82:20:d4:fe:6f:bd:b1

[root@cmxtry cmxadmin]#

PUBLIC CERTIFICATE:

[root@cmxtry cmxadmin]# openssl x509 -in cmxtry_com.crt -text -noout

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

b2:9b:75:e9:4e:7b:43:bb:b1:26:0c:04:50:61:14:fc

Signature Algorithm: sha256WithRSAEncryption

Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA

Validity

Not Before: Aug  8 00:00:00 2018 GMT

Not After : Nov  6 23:59:59 2018 GMT

Subject: OU=Domain Control Validated, OU=Free SSL, CN=cmxtry.com

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

Public-Key: (2048 bit)

Modulus:

00:a1:54:50:f5:c0:46:04:d6:dc:20:88:95:a2:f0:

d7:53:0d:13:45:78:eb:0a:99:6b:a3:d6:f1:db:69:

06:02:72:4f:35:e9:f2:98:44:d3:74:9e:26:fb:b4:

6c:d7:d0:48:a1:bd:3d:5a:aa:38:08:a5:82:c6:07:

55:88:95:90:0e:88:5f:19:b1:25:bd:d1:0b:70:e0:

fb:f8:78:19:ae:86:07:a1:8d:b8:c3:35:3e:ab:65:

82:15:6f:73:dc:37:1a:45:93:09:6a:08:ec:5c:f6:

79:5e:10:02:be:52:9b:fa:53:68:61:38:13:91:fd:

31:54:09:cd:a6:14:c6:82:d3:86:35:a4:3f:3c:7a:

97:f4:84:c2:e2:2c:13:98:55:83:50:46:51:fd:22:

30:6f:93:23:21:06:6c:30:68:b9:71:6e:ea:e1:24:

ca:af:27:45:54:35:e6:27:33:72:48:ad:a1:ab:db:

3d:c9:cf:1c:04:dd:8b:a7:61:c9:b1:a0:38:aa:d4:

1b:d4:a5:8e:2e:7c:d5:c5:46:80:31:53:7e:b0:e6:

d5:bd:85:7f:b0:e9:89:2e:d1:6f:28:a5:3d:3e:0d:

9c:b9:2a:36:2e:13:c1:56:d4:e9:75:b1:e4:48:3b:

b3:36:55:87:85:80:bd:53:1b:b6:fb:0c:2f:4f:01:

a3:41

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Authority Key Identifier:

keyid:90:AF:6A:3A:94:5A:0B:D8:90:EA:12:56:73:DF:43:B4:3A:28:DA:E7

X509v3 Subject Key Identifier:

FB:F0:37:89:52:B3:8A:0A:77:90:1A:1B:E8:FA:C6:10:C4:B5:F2:FB

X509v3 Key Usage: critical

Digital Signature, Key Encipherment

X509v3 Basic Constraints: critical

CA:FALSE

X509v3 Extended Key Usage:

TLS Web Server Authentication, TLS Web Client Authentication

X509v3 Certificate Policies:

Policy: 1.3.6.1.4.1.6449.1.2.2.7

CPS: https://secure.comodo.com/CPS

Policy: 2.23.140.1.2.1

X509v3 CRL Distribution Points:

Full Name:

URI:http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl

Authority Information Access:

CA Issuers - URI:http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt

OCSP - URI:http://ocsp.comodoca.com

X509v3 Subject Alternative Name:

DNS:cmxtry.com, DNS:www.cmxtry.com

CT Precertificate SCTs:

Signed Certificate Timestamp:

Version   : v1(0)

Log ID    : EE:4B:BD:B7:75:CE:60:BA:E1:42:69:1F:AB:E1:9E:66:

A3:0F:7E:5F:B0:72:D8:83:00:C4:7B:89:7A:A8:FD:CB

Timestamp : Aug  8 12:34:59.717 2018 GMT

Extensions: none

Signature : ecdsa-with-SHA256

30:44:02:20:75:4D:27:A1:CB:4F:3F:B7:3B:75:1D:CC:

48:CA:B6:35:00:C0:D6:B8:0F:D6:14:86:B4:1E:2A:91:

E7:2D:0E:9E:02:20:11:C1:75:2F:5C:BA:EE:8F:C2:36:

FD:38:01:ED:28:80:E1:04:61:66:E7:56:ED:03:63:5F:

97:30:CB:2A:6A:55

Signed Certificate Timestamp:

Version   : v1(0)

Log ID    : DB:74:AF:EE:CB:29:EC:B1:FE:CA:3E:71:6D:2C:E5:B9:

AA:BB:36:F7:84:71:83:C7:5D:9D:4F:37:B6:1F:BF:64

Timestamp : Aug  8 12:34:59.571 2018 GMT

Extensions: none

Signature : ecdsa-with-SHA256

30:45:02:20:43:52:32:8D:BC:83:62:C0:7D:61:80:0F:

B8:3A:2A:63:86:FE:E8:1B:12:C4:B0:38:B3:F9:EE:E3:

FE:86:B7:A9:02:21:00:AA:13:5C:2E:35:7D:B7:00:65:

21:F7:CD:61:3F:2C:16:2D:85:49:00:E2:A6:8F:DD:0D:

9E:9F:B4:1A:9C:4B:FB

Signature Algorithm: sha256WithRSAEncryption

30:a1:97:ce:74:4d:50:bb:32:6a:b2:c9:c0:5b:1a:08:da:e4:

dc:f5:1d:79:72:55:6a:dd:7e:ea:89:82:ef:dc:8b:62:8c:55:

0b:b2:db:8a:41:77:fb:56:a6:2a:28:77:23:5f:c5:1e:e5:33:

1f:70:96:0d:95:17:39:2a:78:f7:af:a7:ee:b0:bb:9a:3b:7d:

d6:fb:e8:37:4c:39:d0:b8:df:c2:4f:96:38:9e:b8:28:af:b5:

2c:aa:e6:47:1a:86:3a:44:78:76:64:30:39:dc:4a:7c:d1:8b:

6c:3b:7e:9e:2c:df:2a:90:30:7f:3a:fc:6a:26:66:23:f5:44:

53:2d:f5:91:a9:f8:61:b0:61:35:a1:d2:23:5b:89:5b:4a:46:

be:09:1d:3d:0e:50:64:87:33:93:a8:30:a7:59:c2:a2:72:7f:

e4:49:f2:5e:c4:a5:6c:d0:b4:6b:35:77:ef:50:47:5b:3e:88:

65:a6:53:de:8b:22:8c:5d:4b:55:d9:0e:bb:53:08:98:a4:2f:

49:ce:41:bc:6b:4f:6a:e4:97:54:2f:82:de:ff:19:f4:82:fc:

f8:8e:af:b6:ae:d1:e7:35:cb:60:e9:28:43:95:aa:94:ef:00:

39:1d:16:a0:db:32:6c:20:af:dd:d8:08:32:9a:4f:2e:dc:0c:

a9:cd:6e:13

[root@cmxtry cmxadmin]#

Install the certificates on CMX

CMX requires the certificate in the following format:

+++PRIVATE KEY+++

+++PUBLIC CERTIFICATE+++

+++CHAIN OF TRUST CERTIFICATE+++

The Private Key - your_domain_name.key

The Primary Certificate - your_domain_name.crt

The Intermediate Certificate - issuer-certificate.crt

The Root Certificate - TrustedRoot.crt

Basically we have the following situation:

cmxtry.com.key contains the Private Key

cmxtry_com.crt contains the Primary Certificate

cmxtry_com.ca-bundle - the Intermediate Certificate and the Root Certificate

All of those have to be concatenated together to form .PEM certificate:

[root@cmxtry cmxadmin]# cat cmxtry.com.key cmxtry_com.crt cmxtry_com.ca-bundle > cmxtry_com.pem

Next step will be changing the ownership of the certificate:

[root@cmxtry cmxadmin]#chown cmx:cmx /opt/haproxy/ssl/cmxtry_com.pem

[root@cmxtry cmxadmin]#chmod 744 /opt/haproxy/ssl/cmxtry_com.pem

When this is done, you can rename the certificate to host.pem (considering the backup of the certificate was done beforehand):

[root@cmxtry cmxadmin]#mv ./cmxtry_com.pem ./host.pem

Now enabling the sslmode:

[root@cmxtry ssl]# cmxctl node sslmode enable

Enabling SSL

SSL enabled

Restarting Haproxy

Verified SSL by restarting Haproxy.

[root@cmxtry ssl]#

Troubleshoot

If you do not see the COMODO (other vendor) certificate in the CMX GUI after enabling the SSL using the above command, try rebooting the CMX device.