0

I recently installed SSL on my RPi..

after using a few different tutorials.. I finally got the https:// url to resolve into showing the webpage content.

However..

  • I had to 'ignore' the SSL warning (via browser/page link)
  • I am now seeing a red-line (strike) through the HTTPS:// portion of the URL...

but the content IS displaying... (where as before my failed SSL attempts wouldnt show any content if https:// was in the url)

Everything I have read about this, only seems to talk about the date/time being 'off'.. (which mine is not, so apparently NOT the issue?)

After some digging around in the Chromium browser under dev tools > security > I see a warning/error message saying: net::ERR_CERT_AUTHORITY_INVALID ???

This ONLY for LOCAL (127.0.0.1) content.. the RPi (in the end) will NOT have any internet/intranet access

Running this:

sudo apache2ctl configtest

I see these results:

Syntax Ok

Running this:

sudo nano /var/log/apache2/error.log

I see these results: (not sure how to interpret them?)

[Mon Dec 28 06:25:07.706640 2020] [ssl:warn] [pid 1197] AH01906: 127.0.0.1:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Mon Dec 28 06:25:07.707433 2020]

[mpm_prefork:notice] [pid 1197] AH00163: Apache/2.4.10 (Raspbian) OpenSSL/1.0.1t configured -- resuming normal operations

[Mon Dec 28 06:25:07.707475 2020] [core:notice] [pid 1197] AH00094: Command line: '/usr/sbin/apache2'

But I am not sure on how to fix this current 'hurdle'?

Again.. this project will NOT be use on-line.. just locally served up contact from the local LAMP install.... but my understanding is that I need to get SSL working correctly..

My last step is to install an Apache mod to act as an Adobe Policy Server on PORT: 843 to return the policy request: (here is the url I followed last time for the Policy Server stuff: http://www.beamartyr.net/articles/adobepolicyfileserver.html that I will be following again, hopefully!)

I'm not sure if this red-line (strike) through needs to be fixed before moving on to this step? or if it doesnt matter?) but figured be patient and not jump ahead until I get feedback from those much more knowledgeable than I am in this area.

In case it matters for resolution/troubleshooting..

OS: Jessie Browser: Chromium v56

By design, for this particular project...normally just use the latest and greatest OS, ...(but because of old project requirements, Jessie/Chromium versions are needed)

  • Yes I know Jessie is old, and Flash is dead..etc.. I am trying to re-create an old project that got a corrupted SD card somehow. its a standalone, non-internet connected project, please lets not debate about "FLASH".. and lets stick to the technical questions! Thanks! :)

Appreciate ALL focused feedback! :)

7
  • Are you using a self-signed certificate? If so, that error is normal.
    – mikem
    Dec 28, 2020 at 20:25
  • Yes, I believe so. I am following the steps here: web.archive.org/web/20200714132048/https://… So there is no fix for this? Is SSL working or not then? (I guess I'm not clear?) if so, then move ahead to the Adobe Policy Server stuff.. and dont worry about the SSL stuff anymore? (I still need to get SSL working on port: 843 again for the Adobe Policy Server stuff)
    – whispers
    Dec 28, 2020 at 20:31
  • The error is normal - browsers stick to a list of certified authorities regarding acceptable SSL certificates. You either go ahead with "accept security risk" in the browser and ignore it or you create the Pi (or another local server) as local CA root and manually add it as trusted CA in the browsers of your local PCs.
    – FelixJN
    Dec 28, 2020 at 20:37
  • Will ignoring it, cause any issues in my next step of adding the Apache mod for serving up the Adobe Security Policy on port: 843 ? (my next step?). Is there a tutorial for using the RPi as the local "CA root" stuff you mention? Really in the end, all I care about is the Adobe Policy Server stuff on port:843 so I can make connection with an XMLSocket (in Flash app) and SOCAT on port:7777 listening on ttyACM0
    – whispers
    Dec 28, 2020 at 20:42
  • So it is just a warning? and can be ignored? Or is there truly no SSL going on for my 127.0.0.1 url?
    – whispers
    Dec 28, 2020 at 21:50

1 Answer 1

0

For myself.. and this particular project at least (RPi/Chromium)

The following actions seemed to fix my issues for a LOCAL self-signed certificate.

(now showing up as GREEN/Secure, on port:443 at least) :)

https://stackoverflow.com/questions/7580508/getting-chrome-to-accept-self-signed-localhost-certificate?page=1&tab=active#tab-top

Specifically:

Become a CA:

Import server.crt as an Authority in your Chrome settings (Settings > Manage certificates > Authorities > Import) (select the server.crt file you created (or .pem version)

I then typed: chrome://restart into address bar.. rebooted, and life was good!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .