load certificate on server

Question

I have a certificate that I signed with our CA and now I need to load the certificate onto each of our servers. Where is the correct location that should be placed so that we do not get any certificate warnings when connecting to the server with the that is using the certificate?

EDIT

I have a web server that is using the certificate and key to broadcast over SSL on 8443. I now need to install the certificate on any server that is connecting to it so that they do not get a certificate error when connecting, via CURL or wGET or anything else.

EDIT 2

socket: Bad file descriptor
connect:errno=9
no peer certificate available
No client certificate CA names sent
SSL handshake has read 0 bytes and written 0 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated

thanks,

Answer 1

If you signed your own CA (Certificate Authority), the proper location to install this depends on how you configured your CRL. (Certificate Revocation List).

A CRL is where provide connected client an information on Certificate Revocation List from your CA (your server) over a simple http connection. Since you want every client to connect and automatically get information about the certificate without error, a proper location would be your public_html/ folder http://ca.domain.com/ca.pem http://ca.domain.com/crl.pem

You really don't have to install the certificate on every server, however hosting your own certificate as Your own CA requires that you host your CA and CRL or a server, thus all clients can get information on any Certificate that is issued by your CA automatically by connecting to your CA Server.

How it works!

Client negotiate secure connection and presented your CRL to check if the certificate presented is revoked or active? if revoked, error will occur, otherwise connection would be granted securely.

I'm assuming that:

1. You've installed the certificate on your web server correctly.
2. You've tested it by connecting to your web using web browser with no error

if the above are correct, what are you currently using? Apache, Nginx other?

I can only provide the right configuration for a web server, however you must let us know which server you currently installed this on and if you are not getting error when connected.

Use openssl command to troubleshoot any certificate error

openssl s_client -connect yourweb:port -prexit

What is the output of the above command ?

For example

openssl s_client -connect facebook.com:443 -prexit | less


CONNECTED(00000003)
---
Certificate chain
 0 s:/C=US/ST=California/L=Menlo Park/O=Facebook, Inc./CN=*.facebook.com
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIH5DCCBsygAwIBAgIQDACZt9eJyfZmJjF+vOp8HDANBgkqhkiG9w0BAQsFADBw
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMS8wLQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNz
dXJhbmNlIFNlcnZlciBDQTAeFw0xNjEyMDkwMDAwMDBaFw0xODAxMjUxMjAwMDBa
MGkxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
ZW5sbyBQYXJrMRcwFQYDVQQKEw5GYWNlYm9vaywgSW5jLjEXMBUGA1UEAwwOKi5m
.....
.....

-----END CERTIFICATE-----
subject=/C=US/ST=California/L=Menlo Park/O=Facebook, Inc./CN=*.facebook.com
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
---
No client certificate CA names sent
---
SSL handshake has read 3718 bytes and written 421 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES128-GCM-SHA256
Server public key is 256 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-ECDSA-AES128-GCM-SHA256
    Session-ID: 2982CFE50313F69D515BA388D61828E3AAD1BC39BF5250CB6EF46E527D844E46
    Session-ID-ctx:
    Master-Key: E3065199482B00183847DB54408736B87164BAAA15E10A22DA0AAD2941252FC2CED1C05D46E33083A1452C11093CF6C7

Rule of thumb:

if you cannot connect test your server:port then you will not be able to connect to it from anywhere.