SSL Duplicate certificate

Aaron_Mitchell · August 3, 2019, 12:37am

Using ignition 8.0.3, when trying to setup SSL on the gateway I get the error “A duplicate certificate was detected” Any ideas how to identify and remote the duplicate certificate?

Kevin.Herron · August 3, 2019, 4:22pm

Which type of certificate chain are you uploading? Can you send it to me so I can take a look? (there's no private info in the chain)

There should be an error messages in the gateway logs to go along with this. Something like:

"Certificate %d is a duplicate of certificate %d"

I think maybe we're being overly strict in this case.

Aaron_Mitchell · August 4, 2019, 12:05am

Hi Kevin,

Thank-you for taking the time to reply. Below are the exact steps I take to get this error. I am just using LetsEncrypt to generate the certificates.

Select “I have all the items above”
Strangely there is a private key there already, no idea where this comes from so I then select Reset Step
Now I add the private key that was generated from the lets-encrypt process without any issues.
Next I add the server certificate without any issues
It’s not until I try to add the chain that the error is generated…

This is the error shown in the wrapper log file: Certificate 1 is a duplicate of certificate 0 route-group=config, route-path=/ssl/parse-and-validate/private-key-and-certificate-chain

Aaron_Mitchell · August 4, 2019, 12:13am

Chain contents added below, as a new user to the forum it wouldn’t let me attach it as a file.

Kevin.Herron · August 4, 2019, 12:31am

Try saving a copy without the 2nd certificate section in it and upload that as the chain.

Aaron_Mitchell · August 4, 2019, 12:46am

Same error…

Aaron_Mitchell · August 4, 2019, 12:48am

INFO | jvm 1 | 2019/08/04 10:44:24 | E [g.SslConfigRoutes ] [00:44:24]: Certificate 1 is a duplicate of certificate 0 route-group=config, route-path=/ssl/parse-and-validate/private-key-and-certificate-chain

Kevin.Herron · August 4, 2019, 1:21pm

Hmm, the chain looks okay. Can you share the server certificate from step 2?

Aaron_Mitchell · August 4, 2019, 10:19pm

Server Certificate below…

Kevin.Herron · August 5, 2019, 12:08am

It looks like the server certificate is also part of the chain. I guess the only thing left to try is upload only the other half of that original chain as the new chain.

Aaron_Mitchell · August 5, 2019, 1:02am

OK a step closer, after splitting the chain certificate into two separate certificates it accepts the bottom half but now wants a second chain certificate.

It doesnt like the top half of the chain

Kevin.Herron · August 5, 2019, 2:04am

It’s because you don’t have the full chain, you have the leaf and the intermediate and you’re missing the root cert.

Aaron_Mitchell · August 5, 2019, 3:03am

SUCCESS thanks, I ended up finding this page that allowed me to download the cross signing root CA.

Aaron_Mitchell · August 5, 2019, 3:03am

This page… https://letsencrypt.org/certificates/

Kevin.Herron · August 5, 2019, 12:13pm

Great. That shouldn’t have been so difficult, maybe we can use what happened here to improve the flow.

dajcor · January 17, 2020, 6:51pm

Thank you @Aaron_Mitchell and @Kevin.Herron for figuring this one out! Spent a week trying to get my SSL cert in Ignition. I had a 4 certificate chain and was able to use the first for the certification, the last for the intermediate, then went to the certificate authorities website to download the root certificate.

jspecht · January 17, 2020, 7:52pm

We have a ticket on our backlog to explore the possibility of automatically populating the root CA cert for you based on the roots installed on the Gateway’s trust store. This would save users from the headache of having to grab the appropriate root CA cert out-of-band for the most common root CAs (or for custom root CAs which have already been added to the Gateway’s trust store).