Importing Certificate

[Steven]

I got a certificate from startssl.com, and converted it into PFX format.

 

I then started the Dashboard and brought up the "Network" dialog.

I brought up the "SSL Certificates Management"  dialog, clicked on the "Import Cert." button, and opened my PFX certificate.

 

It asked for the private key password, which I know I typed correctly, because it gave an error when I typed the wrong password on purpose. It then asked me "Would you like to import this certificate", and I answered "Yes".

 

At this point it brought up a confusing popup that said only:

 

! /CONF/ISYKS.SRV

 

After clicking that away, the certificate information showed what I expected:

 

Issuer: StartCom Class 1 Primary Intermediate Server CA

Host Name: (My dynamic DNS host name to my home router)

Country: US

Fingerprint: (A long hex string)

Key Strength: 2048

 

At this point it was not clear what to do next. I closed the dialog, and the documentation implied that the ISY would restart, but it didn't, so I rebooted it myself.

 

However, when it came back up, it was still using the self-signed isy.universal-devices.com certificate.

 

How do I get my certificate onto the box?

 

It's an ISY 994i running 4.0.5.

 

[Michel Kohanim]

Hi Steven,

 

4.0.5 didn't support SHA2 signatures. Please upgrade to 4.2.10 (including the dashboard) and retry:

http://forum.universal-devices.com/topic/13892-release-4210-rc4-is-now-available/

 

With kind regards,

Michel

[Steven]

I upgraded to 4.2.10. Now I get this error:

 

Socket Open Failed javax.net.ssl.SSLException: java.security.ProviderException: java.security.NoSuchAlgorithmException: SunTlsKeyMaterial KeyGenerator not available

[Steven]

By the way, here are the details of the certificate I'm attempting to import:

 

        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)

        X509v3 extensions:
            X509v3 Basic Constraints:
            CA:FALSE
            X509v3 Key Usage:
            Digital Signature, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage:
            TLS Web Server Authentication
            X509v3 CRL Distribution Points:
            URI:http://crl.startssl.com/crt1-crl.crl

            Authority Information Access:
            OCSP - URI:http://ocsp.startssl.com/sub/class1/server/ca
            CA Issuers - URI:http://aia.startssl.com/certs/sub.class1.server.ca.crt

            X509v3 Issuer Alternative Name:
            URI:http://www.startssl.com/

 

    Signature Algorithm: sha1WithRSAEncryption

[LeeG]

Is this a 994i or 994i Pro?

 

I do not think the 994i supports 2048 bit encryption.

 

See the security guide - page 2

 

http://www.universal-devices.com/docs/ISY994%20Series%20Network%20Security%20Guide.pdf

[Michel Kohanim]

Hi Steven,

 

You are probably trying to do this over an SSL connection. Please try it on a regular http connection.

 

Hi LeeG, ISY does indeed support 2048 bit RSA keys.

 

With kind regards,

Michel

[Steven]

You are probably trying to do this over an SSL connection. Please try it on a regular http connection.

 

Whoo hoo! That got me much further. Now, I have another issue (to which I suspect the answer may be that I need the PRO version):

 

The certificate got imported to the ISY-994i, but the browser (Firefox in this case) doesn't have the intermediate certificates. Firefox gives this error:

The certificate is not trusted because no issuer chain was provided. (Error code: sec_error_unknown_issuer)

I was able to work around this with a per-browser solution by importing the intermediate certificate from www.startssl.com/certs/sub.class1.server.ca.pem. It would be nice to have this stored on the ISY-994i.

 

I understand that multiple certificates (for example, the main certificate and the intermediate certificate) can be put into one PFX file. I tried that, but it didn't seem to make a difference, but that could be because I did it wrong.

 

Question: Does the ISY-944i read multiple certificates from a PFX file, and does it send all the certificates to an incoming SSL connection?

[Michel Kohanim]

Hi Steven,

 

Unfortunately not. At the moment, intermediate certificates must be installed in the browser.

 

With kind regards,

Michel

[Steven]

Unfortunately not. At the moment, intermediate certificates must be installed in the browser.

 

Please take that as a feature request.