I am setting up a file server in Yosemite and am trying to remove vulnerabilities so my organization's IT dept will approve. I acquired a trusted SSL certificate and installed it with all of the intermediates to complete the chain of trust.
The IT dept's vulnerability scan showed that port 311 was using a self-signed certificate. I then used keychain to switch the servermgrd identity to use the correct certificate as explained in How do I get com.apple.servermgrd to use a non-self-signed SSL certificate?.
Now the vulnerability scan no longer shows the self-signed certificate being used for port 311 - good - but it still reports the certificate as being untrusted. The trust chain is intact for server domain, but not the servermgrd. Also, the servermgrd certificate in keychain still shows the wrong private key, even though the servermgrd identity is using the correct cert.
Anyone know how to address this? Could this require different intermediate certs than the server itself? Should the servermgrd certificate that is using the wrong private key be replaced?