0

I've installed certificates before within Windows and Ubuntu [server] and it works normally, but today I tried to install certificates on Ubuntu Desktop 21.10 over RDP + AD user, and it does not work as expected:

  • I installed the CA certificates via: 
    sudo mv euro-ca.crt euro-sub-ca.crt /usr/share/ca-certificates/
sudo update-ca-certificates
  • I checked the certificate and it gives me this output, but it does not work in Chrome/Firefox; I cleared cache, cookies, rebooted Ubuntu, and logged in as another user [local admin]: 
    openssl s_client -connect firewall.euro.adroot:443 -CApath /etc/ssl/certs

  CONNECTED(00000003)
  depth=2 CN = euro-ca, C = FR, ST = *************  verify return:1
  depth=1 CN = euro-sub-ca, C = FR, *************  verify return:1
  depth=0 CN = firewall.euro.adroot, *************  verify return:1
  ---

  ---
  Post-Handshake New Session Ticket arrived:
  SSL-Session:
      Protocol  : TLSv1.3
      Cipher    : TLS_AES_256_GCM_SHA384
      Session-ID: ******************************
      Session-ID-ctx: 
      Resumption PSK: *************************************
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      TLS session ticket lifetime hint: 600 (seconds)
      TLS session ticket:
      0000 - 63 af b7 *************************23 **   c.. ..I*****..#.
      0010 - 37 cf ***********************8 42 4f **   7..#*******..BO.

      Start Time: 1640439082
      Timeout   : 7200 (sec)
      Verify return code: 0 (ok)
      Extended master secret: no
      Max Early Data: 0
    Screenshot
JW0914
  • 7,052
  • 7
  • 27
  • 48
Adouani Riadh
  • 101
  • 1
  • Chrome and Firefox have their own CA stores on Linux systems. You need to import the CA in each of these browsers. – Steffen Ullrich Dec 25 '21 at 19:02
  • I tried same config in centos and it works without importing certificates into browser root certificates. Maybe it is an issue with ubuntu? – Adouani Riadh Dec 25 '21 at 19:56
  • Is the euro-sub-ca being delivered by the server? If not, then you'll need to install/trust it, as well. – leeharvey1 Dec 25 '21 at 21:38
  • Yes, and I installed both euro-ca && euro-sub-ca. As I said I made the same configuration in centos and it works but not in ubuntu – Adouani Riadh Dec 25 '21 at 22:35

0 Answers0