Can you install a trusted SSL certificate on the NAS?

FYI: have been able to install a trusted certificate on my NV+ much more simply than instructed previously

My domain registrar offers an 'auto csr' function from Globlsign that generates both a certificate and key file. By downloading those and 2 other certificate files from Globalsign I was able to install the certificate by adding the following settings to the apache configuration file and restarting apache:

SSLCACertificateFile <Globalsign root certificate from globalsign.com>
SSLCertificateChainFile <Globalsign intermediate certificate from globalsign.com>
SSLCertificateFile <mydomain certificate>
SSLCertificateKeyFile <my private key file>

Guys I've just installed a Godaddy SSL which is working after following the instructions above. Question on SSL renewal, does the entire process have to be repeated or is there a shorter process?

Trial_Master wrote:
Guys I've just installed a Godaddy SSL which is working after following the instructions above. Question on SSL renewal, does the entire process have to be repeated or is there a shorter process?

Anyone have some experience with SSL renewal process on ReadyNAS?

The "[ CA_default ]" section of the openssl config is only used if you are using the ca function in openssl, the generation of a private key and CSR has nothing to do with this.

The "[ req ]" section deals with certificate request/public cert.

The line with "openssl genrsa" is creating the private key. The creation of the CSR only relies on the private key and the cert Subject info either from the command line of the openssl.cnf file being used, nothing about the Certificate Authority's certificate chain.

Once the CSR (Certificate Signing request) is generated this is submitted to the CA (Certificate Authority) like Verisign, GoDaddy or what ever CA you are going to use. Once the CA signs the CSR you get back your public cert signed by the CA.

This signature on your public cert links it to the CA. This is where the CA's certificate chain/bundle comes in. The certificate chain is used by the web server to give the browser the info establishing it validity.

With these three files you define in Apache SSLCertificateFile pointing to the public cert you get back from the CA, SSLCertificateKeyFile pointing to the private key file you first generated and SSLCertificateChainFile pointing to the CA's certificate chain/bundle.

With this set up when you connect with a browser this is what happens.
1) The browser makes a connection to the server/NAS and initiates an SSL handshake.
2) The server presents its public key and the CA certificate chain.
3) The browser validates your public certificate by looking in its trust store using to see if your public cert or one of the certs in the chain is.
4) If it is trusted the browser generates a temporary key that it send back to the server encrypting it with your public key.
5) The server/NAS decrypts the public key the browser sent using your private key and responds to the browser with a message encrypted with the temporary browser public cert.
6) At this point you have established a SSL connection from the browser to the server/NAS.
7) The browser now continues the normal HTTP request over this SSL connection.
With the certificate that is generated by default on the NAS it fails at step 3.

As for renewing a certificate all you need to do is generate a new CSR from the existing private key and submit it to your CA of choice. Once you get the cert back from the CA make a copy of your existing cert and then replace the original with the new cert and restart Apache or force a reload by sending a HUP signal to its process.

That's brilliant thanks Charles. One question, following the instructions in this thread I didn't use the intermediate.crt but I see it mentioned in other documents. Should I be referring to it in openssl.cnf?

If so is it used as part of the signing process?

You should not need to worry about the intermediate certificate unless you are going to issue your own certificates that are to be trusted through the CAs chain of trust. You can actually buy your own issuing certificate signed by the CAs intermediate certificate.

With a CA you usually have 3 certificates. Their root cert, intermediary cert and issuing certificate. If they only had a root certificate there would be a big issue with either having to replace your certificates signed by them every time the CA cert expired or risk their authority being hacked and the trust of their identity invalidated. What they do to minimize this hassle is to use their root certificate to sign a intermediate certificate and then use the intermediate certificate to sign an issuing certificate. This issuing certificate is used to sign your certificate.

Since the browser trusts the root cert and if it can walk the certificate chain from your certificate back to the root it will trust the server cert.

So the issuing certificate and intermediate certificate are there just to make the link from your certificate to the CA root certificate that is in your browsers certificate Trust store.

Okay I think I get all of that. Everything seems to work fine without an intermediate certificate so I might leave things as they are.

You have been very, in fact extremely helpful and I have learnt a lot from your posts. Thank you very much I feel less stressed about my upcoming renewal process now I understand what need to be done.

Hi Charles

Since I purchased an iPad2 I have noticed I get a security warning when logging into my ReadyNAS. From what I can find on the subject Apple uses the intermediate.crt. I would like to see if i can remove the security prompt on my iPad2 but I have no idea what additional steps are required to introduce a intermediate.crt.

I followed the steps in this thread to get my SSL cert installed and working and customised for Godaddy.
viewtopic.php?p=128092#p128092
viewtopic.php?p=143857#p143857

Are you in a position to assist? I have gd_intermediate which i think is the one required?

The only thing I can think of to do is for you to email the GoDaddy Intermediate cert to your self and open it on the iPad. It should ask if you want to install it.

I'll try that this evening. Thanks for your time.