SSL Install Issues...

[Matthew_K]

Hi, I did a search and only found 1 thread that addressed this type of issue.

I just started using LS and I'm coming from a service that did everything for me on the server side. I finally started working on my own website that was too large for any services out there to handle. So now I have a cluster.

I'm using LS Load Balancer, with 2 server running LS Web server, an SQL server and a storage server. All separate physical servers.

The http part of the site currently works, but the 443 doesn't.

I purchased a Unified Communications Cert from DigiCert and have 3 cert files.
Edit: The files are: DigiCertCA.cer, <mysite>.cer, and TrustedRoot.cer

I setup a 443 listener with secure set to yes.
I setup the SSL for that listener.
- The key file is the request file I created with OpenSSL.
- The Cert file is the main file that DigiCert sent back.
- Chained is set to Not Set
- CA Cert path is set to the absolute path where my Certs are stored (outside of the web-root)
- CA Cert is pointed at the CA Cert file from DigiCert.

I pointed the 443 at the correct virtual host (only one is setup on these servers)

I did a graceful restart of the server.

When I got to the site using "https" protocol, I get an error in FireFox that says:

"Firefox cannot connect securely to <my site> because the site uses a security protocol that is not enabled."

I tried setting the SSL version to all three and neither worked.
I also tried setting the encryption level to Medium. Each change I made to the server, I did a graceful restart.

Any ideas?

 

[mistwang]

The key file should be the private key created with OpenSSL, not the certificate request file.
No need to set "CA Cert path" when "CA Cert" is set.

Please check error log see if the certificate has been loaded successfully or not.

I can take a quick look if you PM me the LSWS console login.

 

[Matthew_K]

It is the key file.. Sorry I wasn't clear about that. The reqest file was sent to the CA and the key file is set as the key file.

I'll pm you with my login info.

Thanks,
Matt.

 

[mistwang]

Another choice for you is to follow the instruction for Zeus to build a chained certificate.
http://www.digicert.com/ssl-certificate-installation-zeus.htm

You only need to set "Key file", "cert file" and "chained".

 

[Matthew_K]

Thanks... I've got a few more things to figure out. But the SSL is working.

Quick question, does the SSL need to be setup on the Web servers too?

 

[mistwang]

No, load balancer will forward decrypted request to backend web server.

 

[Matthew_K]

Fantastic. Thanks.