Wildcard certificate not working for One X Mobile Preferred 3

[atcom]

My Comodo wildcard cert works for web control (7070 & 7071) and One X (9443), but my Android mobile client comes back with "Invalid Certificate". There's a solution on Avaya Support that mentions "Offer ID Certificate Chain" must be on, but it already was. This is Virt SE 10.0.0.1

-----------------------------------

Calgary Telephone Systems, Avaya LG Asterisk (FreePBX) VOIP & TDM

 

[kyle555]

Just for yuks, can you use your android to browse to web mgmt from the browser and have the same good behavior as a desktop browser or the same bad behavior like the android preferred client? Seems like an android thing...

https://commonsware.com/blog/2013/03/04/ssl-android-basics.html

?

 

[atcom]

Ahh, very good suggestion! Your suspicion was right - the Android browser

https://host.domain.com:9443

throws an invalid certificate error as well. hmm...

-----------------------------------

Calgary Telephone Systems, Avaya LG Asterisk (FreePBX) VOIP & TDM

 

[kyle555]

easy answer - cough up for a fqdn cert
hard answer - fight with android

 

[atcom]

I'm hoping this solution will be the answer:

https://support.comodo.com/index.ph...7/37/certificate-installation-apache--mod_ssl

-----------------------------------

Calgary Telephone Systems, Avaya LG Asterisk (FreePBX) VOIP & TDM

 

[kyle555]

Maybe. But Avaya will tell you to bugger off if you start playing with your own httpd.conf and apache stuff and ask for help later. That's for "my webserver" not for "Avaya's blessed single configuration that doesn't take into account what you're trying to do".


Though, look it up in the knowledge base. There seems to be some new documentation relating to wildcard certs in release 10. You might not be left out in the cold on it, and might be able to call 'em out on a few things if it doesn't work they way it should. I always like busting their chops about stuff like this!

 

[janni78]

Is it a new certificate using SHA256?

I have a Comodo Wildcard cert, don't have an recent android phone available to test though.

"Trying is the first step to failure..." - Homer

 

[atcom]

Got it! Thanks for the input.

Had to download the SHA-2 intermediate #1, intermediate #2(domain), and root certs from Comodo here:

https://support.comodo.com/index.php?/Knowledgebase/List/Index/71

Then combine them into a single .crt file in linux:
cat comodo-int1.crt comodo-int2.crt comodo-root.crt /etc/ssl/certs/ca-bundle.crt > intermediates.crt

Then create the pk12 file:
openssl pkcs12 -export -in mydomain.com.crt -inkey mydomain.com.key -chain -CAfile intermediates.crt -out mydomain.com.pfx

And finally upload the .pfx file to the Server Edition:
Security Manager>Certificates>Set

Now I can browse to the https One-X address from a PC browser as well as an Android browser. And the mobility app doesn't spit out the certificate error either


Thanks to these two sites as well:

http://jackstromberg.com/2013/01/generating-a-pkcs12-file-with-openssl/

http://www.fourproc.com/2010/06/23/create-a-ssl-keystore-for-a-tomcat-server-using-openssl-.html

-----------------------------------

Calgary Telephone Systems, Avaya LG Asterisk (FreePBX) VOIP & TDM

 

[kyle555]

And a gentleman you are for posting the answer!