7

I have received a valid SSL certificate for my Mountain Lion Server (10.8.2 Build 12C3104) and have installed that cert for use by all services (and SSL and other services do not pop up the "Verify Certificate" dialog - only Server seems to be still using a self-signed cert.

Each time I connect remotely using Server App 2.2.1 (169) as follows:

Verify Certificate --- *Server can't verify the identity of the server* You're connecting to a server whose indentity certificate isn't valid. It could be a Mac server with a self-signed certificate. It also might be a server that's pretending to be ... which could put your confidential information at risk. Would you like to connect to the server anyway?

Did I miss a step where I need to install a different cert for com.apple.servermgrd to use or do I need a second configuration step past making the current certificate selected in Server app and rebooting the server? I'd rather use a valid certificate to authenticate rather than have to "always trust" this self-signed cert when connecting to manage my server.

Improve this question
3
  • 1
    I know the article applies to 10.6, but have you tried this: support.apple.com/kb/HT3930 ? The certificate seems to be stored in the System keychain in Aplications>Utilities>Keychain Access, also in Mountain Lion Server 10.8.
    – jaume
    Commented Mar 15, 2013 at 9:08
  • @jaume You nailed it. Not all the follow up steps about Server Admin are relevant on 10.8, but you should get the bounty and credit for the actual answer.
    – bmike ♦
    Commented Mar 15, 2013 at 13:27
  • I'm glad to read that it still applies to 10.8, I've added an answer. I don't use Server.app so feel free to modify those follow up steps that don't apply to ML Server anymore.
    – jaume
    Commented Mar 15, 2013 at 22:04

4 Answers 4

Reset to default
12
+50

Apple KB article HT3930 explains how to configure SSL for servermgrd, the Server Admin web interface.

It applies to Mac OS X Server 10.6 so until Apple updates this article part of the steps are confusing / obsolete.

Luckily, on Mountain Lion Server (10.8) servermgrd's certificate is stored in the same location as on Mac OS X Server Snow Leopard: in the System keychain of Aplications>Utilities>Keychain Access.

Here is what is needed on Mountain Lion (taken from the article)

  1. While logged into the OS X where Server is set up to run services, open Keychain Access.
  2. Select the System keychain.

  3. Double click the com.apple.servermgrd identity preference (credit: picture borrowed from here):

    enter image description here

  4. Select your valid SSL certificate. You will have to import your SSL certificate first as explained in KB article PH7297.

  5. Authenticate as an administrator if prompted.
  6. As root, restart servermgrd for the changes in Keychain Access to take effect with this Terminal command: sudo killall servermgrd (authenticate with your administrator password if prompted).
Improve this answer
7
  • When I double click on com.apple.servermgrd, I don't see anywhere to select any certificates. Is this still valid in 10.8.2?
    – BM5k
    Commented Sep 2, 2013 at 1:21
  • 1
    Yes, bmike's question applies to 10.8.2. Note that you should double click the com.apple.servermgrd identity preference, not the certificate entry. I've added a picture to my answer to make that clear. If you still don't see any certificates I'm afraid that I can't help you as I don't use Server.app myself.
    – jaume
    Commented Sep 2, 2013 at 6:59
  • 1
    This answer continues to be a reference - thanks so much jaume for the tip and the excellent screenshot.
    – bmike ♦
    Commented Oct 9, 2013 at 1:58
  • 1
    Aha! The sudo killall servermgrd was the part that I was missing! Thanks! I can confirm this still works for 10.9.5 server. AskDifferent strikes again.
    – TJ Luoma
    Commented Oct 9, 2014 at 14:09
  • 1
    Note that this appears to be broken on Yosemite (10.10 with Server 4). See this thread over at apple's discussion forum (discussions.apple.com/thread/6604031) I'm not aware of a workaround at this time.
    – Daniel J. Luke
    Commented Oct 19, 2014 at 18:20
1

I have confirmed this technique also works for a Mac running OS X 10.9.0 Mavericks with Server app version 3.0.1 (after renewing an SSL fallback certificate which renewal process was self-signed, I had to toggle it to a valid certificate signed by a trusted CA).

From another (administrative Mac) on the same subnet which is running OS X 10.9.1, I can launch Server app 3.0.2, then select "Other Mac", then select the Mac mentioned above as the target Mac to log into and administrate. Doing so works fine (the certificate is trusted and there is no alert panel generated warning about distrusting com.apple.servermgrd etc.).

Improve this answer
1

One thing to check, if jaume's procedure is still not working for you. Look at the access control list for the identity certificate that you want servermgrd to use. Make sure that the servermgrd binary is on the list.

In later versions, the process listening on port 311 is called servermgr-listener so you may need to add that binary to the ACL as well.

and also change your killall command to:

sudo killall servermgr-listener
Improve this answer
1

So for all the folks that are dealing with the issue of macOS Server application not respecting the change when you add your 3rd party SSL cert in order to avoid the tiresome pop-up on every App launch, I think I found the issue while searching for the answer to an unrelated problem (or so I thought). If you follow the steps in this page, it fixes the issue. Even though servermgrd is already listed as an allowed app.

https://support.apple.com/en-us/HT203731

Thanks, David

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .