Install wildcard certificate

[abzsol]

Hi guys,

I've installed the Let's Encrypt certificate on my Mail Gateway, but I also have a wildcard certificate (PFX file) and I would like to install it instead of Let's Encrypt.
How can I do so? I've tried to search but I have not seen how to do so with a PFX file.

Thanks in advance and sorry for my inexperience.
Best regards.

 

[fabian]

you need to upload the certificate (and key) in PEM format

 

[abzsol]

I've found out the PEM file, but I've this error

Parameter verification failed. (400)

key: invalid format - not a valid PEM-formatted string

But the certificate is valid :/

 

[fabian]

did you maybe enter the certificate PEM string into the private key field?

 

[abzsol]

did you maybe enter the certificate PEM string into the private key field?

This is what I get



I have got PFX, CER and PEM files, nothing else.

 

[fabian]

yeah - the PEM certificate file goes into the 'Certificate Chain' field, the PEM key goes into the 'Private Key' field. you can leave out the key if you renew the certificate later and re-use the key..

 

[abzsol]

Unluckily I cannot find the private key, but I've got it installed on one IIS server.
Is it possible to get the key from there?
Thanks!

 

[fabian]

sure. openssl can convert most key formats into PEM if it is in another format.

 

[abzsol]

sure. openssl can convert most key formats into PEM if it is in another format.

Sorry, I'm totally inexpert in this thing.
What can I do for installing it? Have you got any docs/guide?

 

[fabian]

I don't know in which format the key is at the moment on your other server. you can copy it to the PMG host (e.g. with scp) and then see what the 'file' command says about it.

 

[BruceX]

I got the same error and then realized "key" was talking about the private key which means it wasn't really optional. Uploaded fine, after too much time debugging, once I included the private key.

 

[fabian]

the key is optional, if you renew the certificate using the same key and just upload the renewed certificate. it is required if the existing key and the uploaded certificate don't match.

 

[BruceX]

the key is optional, if you renew the certificate using the same key and just upload the renewed certificate. it is required if the existing key and the uploaded certificate don't match.

How about displaying “a key is required” instead of trying to parse an empty input and displaying a parse error? Also maybe change the “optional” label to “optional for renewals”. Simple things can save hours of debugging and keep proxmox feeling easy to use and logical to understand.

 

[Ivan L.]

Thanks @BruceX! The key isn't optional even if you do renewal: spent a half of the day on this thinking it's an optional (as it's written there in interface) but it's really mandatory. Took my new cert and key from the previous one (as it's really not changed), put all of them together into appropriate fields et voila, I have my certs renewed.
Something wrong with the logic of renewal maybe? I was doing that thru Upload custom certificate button and putting cert into the 'cert' field then. Did I do something wrong?