SAN Service overwrites "Common Server Certificate"

[hhs_admin]

When preparing OES2015SP1 for OES2018 upgrade the "Common Server Certificate" as shown by YaST gets "lost" ... overwritten by SAN service.
Exported eDirectory server cert is not accepted for import as "Common Server Certificate".

Steps tested:

1. Create Server Certificate with YaST CA and install as Common Server Certificate. Result: SAN service overwrites /etc/ssl/servercerts/... on next reboot. These cert and key are o.k. (delivered by Apache) and include the full chain, but "Common Server Certificate" ist empty 😞
   
2. Export SSL CertificateDNS via iManager to cert.pfx. Rename to cert.p12 --> Can not be imported via YaST as Common Server Certificate
   
3. 
   
   
   Thus I can't upgrade to OES2018, as "5.3.5 Ensuring That the Server Has a Server Certificate" in Installation Guide isn't fullfilled.
   
   Klaus

[mathiasbraun]

Did you by chance miss this part?
---snip---
IMPORTANT:Most OES servers have either an eDirectory certificate or a third-party certificate installed.
These instructions only apply when that is not the case.
---end-of-snip---

[mrosen]

On 09.04.2018 12:34, hhs admin wrote:
>
> When preparing OES2015SP1 for OES2018 upgrade the "Common Server
> Certificate" as shown by YaST gets "lost" ... overwritten by SAN
> service.
> Exported eDirectory server cert is not accepted for import as "Common
> Server Certificate".
>
> Steps tested:
>
> - Create Server Certificate with YaST CA and install as Common Server
> Certificate. Result: SAN service overwrites /etc/ssl/servercerts/...
> on next reboot. These cert and key are o.k. (delivered by Apache) and
> include the full chain, but "Common Server Certificate" ist empty 😞
> - Export SSL CertificateDNS via iManager to cert.pfx. Rename to
> cert.p12 --> Can not be imported via YaST as Common Server
> Certificate
> -
>
>
> Thus I can't upgrade to OES2018, as "5.3.5 Ensuring That the Server Has
> a Server Certificate" in Installation Guide isn't fullfilled.

There's a lot of confusion here, which isn't surprising.

I a simple, single sentence: Never touch Yast > Server Certificates on
an OES Server. It is totally detached from OES certificates and will
wreak havoc on you. On a default OES server, you'll never have to touch
certs manually.

CU,
--
Massimo Rosen
Micro Focus Knowledge Partner
No emails please!
http://www.cfc-it.de

[mrosen]

On 09.04.2018 12:34, hhs admin wrote:
> 5.3.5 Ensuring That the Server Has
> a Server Certificate

The *really* important part of this section:

"IMPORTANT:Most OES servers have either an eDirectory certificate or a
third-party certificate installed.

These instructions only apply when that is not the case"

....which is almost never the case, and if you would know it.

CU,
--
Massimo Rosen
Micro Focus Knowledge Partner
No emails please!
http://www.cfc-it.de

[hhs_admin]

mathiasbraun;2478790 wrote:
Did you by chance miss this part?
---snip---
IMPORTANT:Most OES servers have either an eDirectory certificate or a third-party certificate installed.
These instructions only apply when that is not the case.
---end-of-snip---

Oh. Yes ... I missed it 😞 Sorry.

But when starting the upgrade, ignoring the missing Commen Server Certificate later on I get on error message like Root Certificate not found and the upgraded server isn't functional (i.e. no iManager)