Skip to content

SSL certificate usage

Important things to remember

  1. Certificate chain order matters!
    1. Start with domain certificate
    2. Continue with intermediate certificate(s)
    3. End with root certificate
  2. Even if a browser trusts the new certificate (looks like it's working and valid), other sources may not trust it, since they may not support any root CA's by default. It's important to validate the certificate chain after applying it.
  3. Certificates and their validity can be viewed with openssl s_client -connect mydomain.com:443

You can view the contents of an SSL certificate with this command:

echo | openssl s_client -showcerts -servername aholadigital.com -connect aholadigital.com:443 2>/dev/null | openssl x509 -inform pem -noout -text

Aholadigital.com certificates

www.aholadigital.com * Managed by Cloudflare aholadigital.com * Managed by Cloudflare *.aholadigital.com * Managed by Ahola IT * Usage in TMS: * vault-hetzner stable and nightly

Aholatransport.com certificates

TODO!

Attracs.com certificates

  • Managed by Ahola IT
  • Used in almost all services

Troubleshooting

Read certificate details, including validity: * openssl s_client -connect mydomain.com:443 The most important parts of this command are: 1. The beginning which tells the order and selection of certificates present in the certificate chain

$ openssl s_client -connect vault-hetzner.aholadigital.com:443
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
verify return:1
depth=0 C = FI, L = Kokkola, O = Ahola Digital Oy Ab, CN = *.aholadigital.com
verify return:1
---
Certificate chain
 0 s:C = FI, L = Kokkola, O = Ahola Digital Oy Ab, CN = *.aholadigital.com
   i:C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jan 29 00:00:00 2025 GMT; NotAfter: Mar  1 23:59:59 2026 GMT
 1 s:C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Mar 30 00:00:00 2021 GMT; NotAfter: Mar 29 23:59:59 2031 GMT
  1. Verification check:
---
SSL handshake has read 3555 bytes and written 412 bytes
Verification: OK
---
  1. and the second verification check:
Post-Handshake New Session Ticket arrived:
SSL-Session:
    ...
    Verify return code: 0 (ok)
    ...