I’m trying to install a GoDaddy SSL certificate on a new load balancer I’m setting up on Amazon AWS. I originally created the certificate at Godaddy using the keytool program for direct installation on a Glassfish 3.1 server (Amazon linux ami). I had no problems getting that setup directly on the server. I now need to move the certificate from the web server to the new load balancer. Amazon requires the private key and certs to be in PEM format, so I used the “rekey” tool at GoDaddy to create new certs. When I load those in the load balancer setup screen on AWS Mgmt Console, I get the error message: “Public Key Certificate and Private Key doesn’t match.”
Here is how I’m creating the keys:
$ openssl genrsa -des3 -out private.key 2048
$ openssl req -new -key private.key -out apps.mydomain.com.csr
I then submit the .csr file to GoDaddy during the “rekey” process. Once the rekey is complete, I download the 2 newly created certs (apps.mydomain.com.crt & gd_bundle.crt). I download them selecting (Apache) as the type of server (I’ve also tried “other” and “Cpanel” but the all look to be the same).
At this point, I remove the encryption from the private.key file by using the following command:
$ openssl rsa -in private.key -out private.pem
At this point, I go back into the AWS Mgmt console, create the load balancer, add the secure server redirect and put the contents of the following files in the respective fields on the screen where it asks to setup the ssl certificate:
private.pem --> Private Key
apps.mydomain.com.crt --> Public Key Certificate
gd_bundle.crt --> Certificate Chain
When I click the “continue button” I get the error “Error: Public Key Certificate and Private Key doesn’t match.”
-Is there a way that I can test that I’m getting a valid error message from Amazon? It seems odd to me that the keys wouldn’t match when I’m following GoDaddy’s instructions pretty closely.
I’ve tried creating the private.key file without RSA encryption prior to creating the .csr and that doesn’t seem to make any difference.
I’m also assuming that the .crt files I’m downloading from GoDaddy are in .PEM format, but I’m not sure how to verify this.
Any ideas?
Looks like the issue was the way in which I was copying the contents of the key and certs into the AWS Management console. I was using an Ubuntu desktop running in Virtual Box on a Windows 7 desktop; copy and pasting the values from a gedit screen into the browser running on the Windows box. Once I opened the key and cert files on the same box as the web browser (Windows in this case) the certs went through just fine. I’m guessing some parts of the file aren’t making it over correctly when using the shared clip board between Virtual Box client and host. Case closed.