HCL Notes and Domino 9.0 Social Edition Forum

Nov 12, 2014, 5:56 PM

94 Posts

That is a warning, not an error

Some third party CAs will not send you their self-signed root certificate on the assumption that all of your clients are web browsers who already have their root certificate pre-installed. If this is the case, then you should be able to operate successfully without that final self-signed root certificate.

Some clients will operate better if your server can send the entire certificate chain, including the final self-signed root. If your server falls into this category, then you should acquire the third party CA's root certificate off their web site and append it to the end of your "serverall.txt" file. That will make the final WARNING message go away.

~Bella Xankrozenetsi

Nov 13, 2014, 8:52 AM

21 Posts

I think I solved it

Thank you,

I tried to import the certificates one by one with the kyrtool.

First the private key followed by the two intermidiate trusts and last the certificate itself. They all where imported succesfully and the site now presents itself as secure when you browse to it.

Commands:

kyrtool import keys

kyrtool import roots

kyrtool import certs

ref: http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=DF9FD827D1E2BC1A85257D850077FCAD&action=openDocument&mode=original

~Anita Minasterings

Nov 18, 2014, 11:08 AM

90 Posts

That was my approach, a few questions for you?

I also have the Rapid SSL. Did you find a set of intermediate certs. that were all SHA-2? When I go to http://ssllabs.com/ssltest I get downgraded since one of my RapidSSL certs was SHA-1.

Also, not sure if you imported the top level root or not. I did the first time and got some warnings so I repeated the import of the roots with only the two intermediates and that worked fine.

Howard

By Role

SHA-2 and kyrtool