Pfx file bug?

[drewdunlop]

I'm following the example code in the readme for the V2 API. When using the code to obtain a wildcard cert and then save it as a PFX cert (for use in .Net Core Kestrel HTTP server) I can't seem to get a valid PFX certificate.

Kestrel throws this error: "Uncaught exception from the OnConnectionAsync method of an IConnectionAdapter." From investigating this seems to occur when a bad PFX is ingested.

I've used certutil on Windows to dump out the info on the PFX there are some problems. I'm not an expert on this so it isn't clear what the problem is.

Interestingly I can import the PFX into Windows Cert Manager and then re-export to PFX. The newly created PFX works with Kestrel and also certutil has no errors.

Also if I manually write out a PEM file (for the cert and private key) and then use openssl to create the PFX everything works fine.

Any help is much appreciated. I've attached the output of CertUtil for both the cert that was created with Certes, as well as the exported cert. I've also attached the code used to generate the cert (minus the DNS validation bits). If I could use the PEM format in .Net Core I would, however all API's I could find want to use the PFX format.

LetsEncryptCertRequest.txt
testing_dump.txt
testing_export_dump.txt

[webprofusion-chrisc]

I can confirm we also have this issue, programmatic install causes an issue accessing private keys but re-importing using windows certificate manager works ok. Played around with openssl to try to diagnose but didn't get anywhere. Most likely related to the recent commit that added the full certificate chain?

[fszlin]

@webprofusion-chrisc , I think you are correct. The certificate chain seems bugged right now.

[webprofusion-chrisc]

Thanks, saw you've added a fix. I'll check it out.

[fszlin]

Thanks for looking into it. I just realized this is also making Azure rejects my web app deployment, and it's working fine now.

Tested the result PFX with Kestrel, and seems fine too.

[drewdunlop]

I can confirm that with your latest fix this issue is resolved. Thanks for the quick help.