Environment
ConsoleOne 1.3.6h
Apache 2.0.52
Apache 2.0.63
eDirectory 8.7.3
eDirectory 8.8
Situation
Apache not listening on port 443.
Resolution
Open or import the .cer file from the 3rd-party certificate provider. In either Firefox or Internet Explorer (IE) it is possible to view the Certification Path which shows the root certificate that the 3rd-party certificate refers to for trust purposes. With the customer's certificate the root certificate was "Equifax Secure Certificate Authority" which is present in major browsers today under the browser's security settings. This root certificate, however, has a Certificate Revocation List which cannot be found because this is the wrong type of certificate. There are two certificates that are valid from Equifax and they are named "Equifax Secure eBusiness CA-1" and "Equifax Secure Global eBusiness CA-1". These are GeoTrust certificates in this example.
The fix was obtained by requesting a new certificate from the proper root certificate from the 3rd-party certificate provider. With this new certificate ConsoleOne and iManager validated the certificate and Apache would start properly.
Although the validation fails using either
ConsoleOne or iManager, it does not necessarily mean that the
certificate will not work provided the customer is willing to
accept lower security. This certificate may be used
provided that clients, e.g. browsers, are either configured
so that they do not check the server
certificate's CRL (less secure) or ignore this type of
CRL DistributionPoint. If you do configure the browser to not
check the CRL, that is less secure and not compliant with RFC
2459/3280 -- See RFC 3280 Section 6.3 and 6.3.3.a. So
it is up to you to decide if this is acceptable for your
environment.
Additional Information
Some certificate providers will send a trial certificate to make sure that the customer's system will work with that certificate. This may be a worthwhile option to ensure that certificates are working properly with your system before spending money and possibly having the solution fail because of invalid certificates.
List of Equifax (and other) Trusted Root Certification Authorities. The one highlighted was eventually used to generated a proper certificate. This view is available inside Internet Explorer or Firefox under the certificates section:
Details of the invalid certificate showing the Certificate Revocation List Distribution Points. One way to resolve the error was to have a certificate without this property and whose root certificate (see above) did not have this property.
View of the certification path when opening the 3rd-party certificate. The selected certificate is the 3rd-party certificate and the one above it is the root certificate. In this case the root certificate was not valid for a web server because of its extensions including the CRL Distribution Points property (see above).
A valid CRL DP would look like the following from Entrust; notice how it has a URL referring to the Internet against which a client or server can request validation information for the certificate in question: