nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Invalid Digital Signature of generated certificates

jeffreyman

Hi,

I use alfresco-ssl-generator to generate certificates for repository, solr and client. However, the generated certificates show "This certificate has an invalid digital signature" error. I have no idea how to fix it. Please help.

Find more posts tagged with

Alfresco Content Services

Accepted answers

jeffreyman

Hi Sufo,

After install the new CA cert in local user, the certificates look good. I think it is a viewing problem, not certificate itself.

Thanks a lot.

All comments

angelborroy

Attaching the certificate should help to find out the problem.

jeffreyman

Hi,

I don't know how to attach file. Here is text format.

angelborroy

This is the public part of the certificate.

It seems to be ok.

$ openssl x509 -in cert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4096 (0x1000)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=UK, L=Maidenhead, O=Alfresco Software Ltd., OU=Unknown, CN=Custom Alfresco CA
        Validity
            Not Before: Feb 10 12:23:29 2021 GMT
            Not After : Feb  8 12:23:29 2031 GMT
        Subject: C=GB, ST=UK, O=Alfresco Software Ltd., OU=Unknown, CN=Custom Alfresco Repository
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:a8:cb:ad:e7:94:33:91:d7:52:6d:28:11:f4:1b:
                    17:39:67:b2:03:75:b5:c5:c1:16:56:eb:76:56:f5:
                    2c:c4:f7:53:36:fc:06:30:63:08:1b:98:eb:71:1d:
                    24:ce:3e:33:da:74:b0:76:04:42:80:15:c5:d7:c8:
                    bc:cf:1f:86:d8:93:1c:7d:4e:5f:3f:2c:d5:c3:76:
                    96:b8:a7:fd:76:73:62:44:b5:c9:78:5f:d7:81:7a:
                    e1:24:78:50:0d:68:e6:f9:81:d7:8d:ad:84:84:48:
                    d3:df:d5:15:ce:6e:8c:9c:78:98:a8:15:a4:06:16:
                    fa:00:24:4a:07:68:fe:36:ef
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Cert Type:
                SSL Server
            Netscape Comment:
                OpenSSL Generated Server Certificate
            X509v3 Subject Key Identifier:
                6C:EA:9C:9C:9C:5A:E3:5B:B3:35:EE:CB:8C:B7:11:5E:29:55:44:1D
            X509v3 Authority Key Identifier:
                keyid:94:27:EA:72:F9:20:DC:E3:2C:A8:17:8F:D9:1A:A7:B7:62:22:FF:25
                DirName:/C=GB/ST=UK/L=Maidenhead/O=Alfresco Software Ltd./OU=Unknown/CN=Custom Alfresco CA
                serial:69:BB:16:AF:C9:1E:C4:69:1D:AE:DB:D4:1A:6A:56:9A:93:3B:FE:95

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Alternative Name:
                DNS:localhost
    Signature Algorithm: sha256WithRSAEncryption
         7b:38:f8:bc:2a:27:f6:21:2c:79:33:b6:37:f1:1d:ce:9c:60:
         b0:5d:c3:c8:df:5f:f4:7d:7d:1f:f6:1e:c0:b9:b2:cb:4c:a1:
         1e:85:96:16:52:f0:65:e0:d5:5b:cf:dd:db:37:1e:24:da:c4:
         4a:9d:e6:b6:52:04:6f:a8:80:3a:f3:9e:cf:42:53:2b:9b:56:
         c6:ce:68:4d:88:2c:00:28:db:04:6c:0a:7b:94:84:63:a1:61:
         d7:40:95:49:c1:92:41:bb:68:18:08:61:24:7f:be:87:96:36:
         99:f5:b5:99:0c:d4:48:6b:41:e7:cf:fc:77:b6:d3:cc:57:f7:
         20:62

Not sure if the private part has some problem...

jeffreyman

Hi,

Why it show error when viewing the certificate in windows?

A few months ago, I generate the certificates (same method) that do not have such error.

jeffreyman

this is the old certificate I generate using alfresco-ssl-generator

sufo

Can you paste also new CA certificate?
Little difference between two screenshots is that CA name for old one is full DN and for new one is only the CN.

jeffreyman

Hi,

here is CA cert.