Differences

This shows you the differences between two versions of the page.

--- public:radio:2025:yaddnet_ssl_renewal [15/03/25 07:09 GMT] – [15/03/25 : SSL certificates] john
+++ public:radio:2025:yaddnet_ssl_renewal [13/10/25 07:00 BST] (current) – [UPDATE ON TWO INTERMEDIATE CERTIFICATES 5/7/25] john
@@ Line 2: / Line 2: @@
-====== Yaddnet VPS SSL Renewal ======
+====== YaDDNet : VPS SSL Renewal ======
 ** Renewed SSL certificates for 2025/6 **
+<note important>Read the final part about combining the 2 intermediate certificates!</note>
 ===== 15/03/25 : SSL certificates =====
@@ Line 25: / Line 26: @@
       * ''/usr/local/ssl/ca.pem.1''
       * ''/usr/local/ssl/ca.pem.2''
-      * copy ''ca.pem.1'' -> ''ca.pem''
+      * copy ''ca.pem.2'' -> ''ca.pem''
     * Restart Apache
       * ''service apache2 restart''
@@ Line 32: / Line 33: @@
       * check site security
-{{:public:radio:2025:screenshot_2025-03-15_064708.png?400|}}
+{{:public:radio:2025:screenshot_2025-03-15_072557.png?400|}}
-  * swap ''ca.pem'' files (copy ''ca.pem.2'' -> ''ca.pem'')
+  * swap ''ca.pem'' files (copy ''ca.pem.1'' -> ''ca.pem'')
   * Restart Apache
   * browse to [[https://www.yaddnet.org/index.php?]]
@@ Line 44: / Line 45: @@
 I used openssl to inspect the two different //intermediate// certificates
-for ca.pem.1
+<code>gm4slv@yaddnet2:~ $ openssl x509 -in ca.pem -noout -text > /home/gm4slv/capemold.txt</code>
+  * for ca.pem.1
 <code>
@@ Line 61: / Line 65: @@
 </code>
-For ca.pem.2
+  * or ca.pem.2
 <code>
@@ Line 77: / Line 81: @@
 </code>
-and for completeness the //old// original ca.pem from prior to the renewal
+  * and for completeness the //old// original ca.pem from prior to the renewal
 <code>
@@ Line 93: / Line 97: @@
 </code>
+It appears that the certificate (ca.pem.2) from "Sectigo" has the longest validity, and that this is the more recent/appropriate one, so I've made it the certificate in use
+''sudo cp ca.pem.2 ca.pem''
+''sudo service apache2 restart''
+===== UPDATE ON TWO INTERMEDIATE CERTIFICATES 5/7/25 =====
+<note important>I've discovered that the 2 Intermediate Certificates are necessary to complete the //chain// of authority.
+</note>
+What should be done is to join them together into one //ca.pem// file (and in the correct order.... )
+**Don't rename the 2 files as ''ca.pem.1'' and ''ca.pem.2'' per the above  **
+Transfer them both with their **//original//** names and then ''cat'' them together
+<code bash>
+[root@yaddnet2:/home/g4slv/ssl]# cat 397A66CC2756362E0DAA87CA6EABE3B1.cer 7D5B5126B476BA11DB74160BBC530DA7.cer > ca.pem
+[root@yaddnet2:/home/g4slv/ssl]# cp ca.pem /usr/local/ssl
+[root@yaddnet2:/home/g4slv/ssl]# systemctl restart apache2
+</code>
+Check correct SSL operation at [[https://www.ssllabs.com/ssltest/analyze.html]]
@@ Line 102: / Line 136: @@
-{{tag>}}
+{{tag>yaddnet radio}}