Replies: 4 comments 7 replies
-
|
This looks like an issue with your TLS client certificate that you need to use in your web browser when you login as an adinnistrator and/or the configuration of which CA to trust for it. Please make sure you have a SSL/TLS client certificate and key installed into your web browser. It could for instance be a PKCS#12/PFX file that you got from EJBCA or an other CA software and which you have installed in the web browser. Also check that there is a file TrustedCA.pem in the same folder as you run the docker command from and that it contains a PEM encoded certificate. That certificate should the CA certificate that issued your TLS client certificate (or the root CA of that certificate chain). Please also make sure that file can be read properly by your user that you run docker with. You can also paste the first part of the output from the container as that will show any errors in reading your TrustedCA.pem which internally in the container is called ManagementCA.crt. Cheers, |
Beta Was this translation helpful? Give feedback.
-
|
Thanks a lot for your kind help. I was using a self-signed certificate for testing. I couldn't find any guide on this. |
Beta Was this translation helpful? Give feedback.
-
|
What could be this issue? |
Beta Was this translation helpful? Give feedback.
-
|
This could for instance mean that the TrustedCA.pem file is not found or that it can not be read by Docker. In your command when you start the container you have this Can you try this before starting the container and provide the output: |
Beta Was this translation helpful? Give feedback.
-
|
Following is the output. `root@sign:~/ssl# docker run -it --rm --name signserver -p 80:8080 -p 443:8443 -v $(pwd)/TrustedCA.pem:/mnt/external/secrets/tls/cas/ManagementCA.crt -h sign.***** primekey/signserver-ce:5.2.0 2022-08-31 09:09:45,969+0000 INFO [/opt/primekey/bin/start.sh] (process:1) External hostname env.HTTPSERVER_HOSTNAME is set to 'sign.*****'.
|
Beta Was this translation helpful? Give feedback.
-
|
First it looks good:
But in the output posted now I can not see the original error message mentioned Not sure exactly what is going on here. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks a lot. The given error only appears when I click on the "Administration Web" link. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I had to deploy a CA server (ejbca) and generate a ManagementCA.pem to work the signserver properly as self-signed certificate did not work. Thank you very much for your kind help. Best regards. |
Beta Was this translation helpful? Give feedback.
-
|
Good to hear that you got it working and thanks for sharing the solution. Cheers! |
Beta Was this translation helpful? Give feedback.
-
|
Excuse me, could you please tell me how to correctly generate these two certificates through EJBCA, and what is the relationship between these two certificates |
Beta Was this translation helpful? Give feedback.
-
|
Hi Laimujun, the EJBCA community gave you 2 cert files, one is CA certificate (ManagementCA.pem) and one is p12 file which includes your public key and your cert. Whenever you access to signserver you need cert from p12 to gain access |
Beta Was this translation helpful? Give feedback.
-
Hi,
I just deployed the signserver 5.2 docker image for testing before production and when I go to adminweb, the following error shows. And nothing happens when clicking the 'Use TLS client certificate'.
I am using the following command to run the docker.
docker run -it --name signserver -p 80:8080 -p 443:8443 -v $(pwd)/TrustedCA.pem:/mnt/external/secrets/tls/cas/ManagementCA.crt -h sign.xxxxxxxxxxx primekey/signserver-ce:5.2.0The ubuntu terminal shows the following error:
I am really new to signserver and docker. Please help me to solve the issue. Thank you,
Beta Was this translation helpful? Give feedback.
All reactions