2

I am migrating my website away from my home OSX server to a virtual Linux server, hosted within a proper data centre, and I have a problem with the SSL certificates I imported into OSX Server.

It appears to have stored the certificates into /etc/certificates however I don't know the passphrase it used to encrypted the key file. It's not my normal account/keychain password, so I've no idea what passphrase it, or I, chose at the time.

(I have tried to get the original SSL certificates but that's not proving so easy either, but might be my only hope).

Could someone tell me how this works so I can untangle myself and use the certificates on the new website please?

Improve this question

2 Answers 2

Reset to default
2

The actually "certificate" itself is not encrypted. Your private key, which is used with the certificate, is usually encrypted. It is encrypted with the passphrase you chose when you created the private key. You might have done that a while earlier than creating this specific certificate, if you have multiple certificates - so be sure to try "old passwords" if you have them.

If you cannot remember the passphrase for your private key, you're out of luck. You will not be able to use that specific certificate anymore. The certificate issuer will not be able to provide you with a copy of the private key, as they haven't got it.

Usually you will be able to revoke your existing certificate and get your issuer to give you a new one - depending on your issuer that might come with a charge.

As you can buy new SSL certificates for less than 10$ today, it might not be worth the hassle to try and get the old one working. Just buy a new one.

Improve this answer
2
  • +1 OK, so you have confirmed that the pass phrase was chosen by me and not by the system. That will give me something to work with.
    – trojanfoe
    Commented May 14, 2014 at 14:35
  • OK problem solved. Found a copy in a backup I had, which was unlocked. So it's strange how it got locked by OSX Server using a passphrase I supplied, which I have since forgotten. That doesn't normally happen to me :-$
    – trojanfoe
    Commented May 14, 2014 at 14:52
4

It looks like OP's problem has been solved, but for the record it's actually fairly easy to get the keys from OS X Server, as long as you have admin access to the server. I'll give you two ways to do it:

  1. Run the Keychain Access utility on the server, select "System" from the Keychains list, then "My Certificates" from the Category list under that. Select the relevant certificate on the right side of the window, then from the File menu choose "Export Items. In the export dialog, make sure the file format is set to "Personal Information Exchange (.p12)" to export both the private key and (public) certificate. It will ask for your admin name & password to get access to the keychain, then ask for a new password to encrypt the exported file with.

  2. The certificate and associated private key are also stored (as you said) in /etc/certificates. Make sure you get both the certificate (filename ending ".cert.pem") and matching private key (".key.pem"); you might also need the cert chain (".chain.pem"), which includes your certificate and the supporting certificates that vouch for its authenticity.

    The private key file will be encrypted with a randomly-generated password. No problem; in order for server services to use this key, its password is stored (in the system keychain, actually) in a retrievable form. With admin rights, you can retrieve it the same way the web server does. Use this command (replacing server.example.com with the actual domain name):

    sudo /Library/Server/Web/Config/apache2/getsslpassphrase server.example.com:443 RSA

    It'll require your admin password, then spit out what looks like a GUID. That's the encryption password for the .key.pem file.

    (Note: in older versions of OS X Server, getsslpassphrase was in /etc/apache2/ instead of /Library/Server/Web/Config/apache2/. Adjust as needed.)

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .