# Webserver SSL config using openssl generated key & cert

**URL:** <https://forum.inductiveautomation.com/t/webserver-ssl-config-using-openssl-generated-key-cert/99711>\
**Category:** Ignition\
**Created:** [December 11, 2024, 8:29pm UTC](https://forum.inductiveautomation.com/t/webserver-ssl-config-using-openssl-generated-key-cert/99711 "2024-12-11T20:29:43Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jason\_Bender](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Jason\_Bender](https://forum.inductiveautomation.com/u/Jason_Bender)\
**Post date:** [December 11, 2024, 8:29pm UTC](https://forum.inductiveautomation.com/t/webserver-ssl-config-using-openssl-generated-key-cert/99711/1 "2024-12-11T20:29:43Z")

</div>

I created a CA, a CSR, and the ignition gateway key/cert using openssl on linux (WSL).

I ran into a problem when using Config -\> Networking -\> Web Server -\> Setup SSL/TLS. I dropped each file into the web interface - but after dropping in the last file (CA cert), the page content goes blank. Error log shows:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/4/3443cff22b283aefe3fbe92f78426e80ab75dff7.png)

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [December 11, 2024, 8:34pm UTC](https://forum.inductiveautomation.com/t/webserver-ssl-config-using-openssl-generated-key-cert/99711/2 "2024-12-11T20:34:26Z")

</div>

Can you share the CA and end-entity certs?

---

<div class="post-metadata">

**Author:** ![Jason\_Bender](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Jason\_Bender](https://forum.inductiveautomation.com/u/Jason_Bender)\
**Post date:** [December 11, 2024, 8:48pm UTC](https://forum.inductiveautomation.com/t/webserver-ssl-config-using-openssl-generated-key-cert/99711/3 "2024-12-11T20:48:04Z")

</div>

Maybe this helps. I'm not sure what exactly might be sensitive info - so most of it is missing 🙂

(removed)

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [December 11, 2024, 8:55pm UTC](https://forum.inductiveautomation.com/t/webserver-ssl-config-using-openssl-generated-key-cert/99711/4 "2024-12-11T20:55:14Z")

</div>

You'll have to share the unredacted PEM files. Other than some names there's nothing in there that should be considered sensitive, it's only the public side of the keypairs.

If you can't do that then just give support a call instead.

---

<div class="post-metadata">

**Author:** ![Jason\_Bender](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Jason\_Bender](https://forum.inductiveautomation.com/u/Jason_Bender)\
**Post date:** [December 11, 2024, 9:04pm UTC](https://forum.inductiveautomation.com/t/webserver-ssl-config-using-openssl-generated-key-cert/99711/5 "2024-12-11T21:04:22Z")

</div>

I can make up sample certs with generic names and send those intact. Likely tomorrow. Thanks for the help!

---

<div class="post-metadata">

**Author:** ![Jason\_Bender](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Jason\_Bender](https://forum.inductiveautomation.com/u/Jason_Bender)\
**Post date:** [December 12, 2024, 2:03pm UTC](https://forum.inductiveautomation.com/t/webserver-ssl-config-using-openssl-generated-key-cert/99711/6 "2024-12-12T14:03:21Z")

</div>

Here is a full sample with all cert's and keys. Dropping those files into the ignition SSL setup page results in a blank page for me.  
[sampleCA.zip](https://forum.inductiveautomation.com/uploads/short-url/sq372xcfB3Jy9XDmCpRa76XymSC.zip) (22.2 KB)

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [December 12, 2024, 2:36pm UTC](https://forum.inductiveautomation.com/t/webserver-ssl-config-using-openssl-generated-key-cert/99711/7 "2024-12-12T14:36:38Z")

</div>

Ok, actually already have a ticket for this bug.

The Authority Key Identifier extension on your CA cert is missing the "Key Identifier" component, which results in an uncaught error and internal HTTP 500, which is why you get the blank page.

Although all components of the AKI are technically optional:

```python
   AuthorityKeyIdentifier ::= SEQUENCE {
      keyIdentifier [0] KeyIdentifier OPTIONAL,
      authorityCertIssuer [1] GeneralNames OPTIONAL,
      authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }

```

Ignition currently expects the key identifier. I'm not sure if the ticket I mentioned will change this assumption or just fix the error handling when a certificate can't be validated.

---

<div class="post-metadata">

**Author:** ![Jason\_Bender](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Jason\_Bender](https://forum.inductiveautomation.com/u/Jason_Bender)\
**Post date:** [December 12, 2024, 5:04pm UTC](https://forum.inductiveautomation.com/t/webserver-ssl-config-using-openssl-generated-key-cert/99711/8 "2024-12-12T17:04:29Z")

</div>

That did it.  
Changed line 16 of sampleCA.conf to

```python
authorityKeyIdentifier = keyid:always,issuer:always

```

to include that field in the AKID and make ignition happy!