Skip to main content

Two Cpanel servers, same issue

Alfaman

I'm trying to install Cpanel issued Server SSL certificates.

Both servers are getting this issue:

Certificate verification failed! The system did not find the Certificate Authority Bundle that matches this certificate. Contact “cPanel, LLC” to obtain the Certificate Authority Bundle for “cPanel ECC Domain Validation Secure Server CA 3”.

 

Certificate and Private Key boxes are populated. 

Certificate Authority bundle has this message: CA Bundle #1: The system could not parse the certificate because of an error: Ignoring non-RSA key of type id-ecPublicKey

If I delete the message the server does not retrieve the CA bundle from the public repository. 

Where an I download the CA bundle?

Comments

27 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  When you say "cPanel issued" can you get me more details on that?  Is this a certificate you purchased through the interface or was this issued by AutoSSL?

    0
  • Alfaman

    Autossl through WHM interface, shows issuer as CPanel.

    0
  • Alfaman

    Why is my reply pending approval since 2 days ago? I have two servers with Cpanel licences. One through Leaseweb and the other through Eukhost.

    0
  • cPRex Jurassic Moderator

    Alfaman - the Forums aren't monitored over the weekend, so it didn't get approved until this morning.

    Could you submit a ticket on this?  I don't understand why an AutoSSL certificate needs to be "installed" since that entire process is automated.  Are you trying to install an AutoSSL certificate on a different domain maybe?

    0
  • Alfaman

    It's the Cpanel issued certificate for the server domain, for example server.cpanel.com.

    I'll open a ticket, I've got the same issues on two servers.

    0
  • cPRex Jurassic Moderator

    If you can post the ticket number here I'd be happy to follow along!

    0
  • Alfaman

    I'd really appreciate your help, as the support I've received via the ticket so far is non existent.

    Ticket: 95435779

    0
  • cPRex Jurassic Moderator

    Thanks for linking that ticket number.  Your OS is too old to properly validate new SSL certificates, which is why it can't be issued.  Your version of cPanel has been end of life since November 2020.

    The only way to properly fix this would be to have your hosting provider update the machine.

    0
  • did-vmonroig

    Hi, cPRex.

    It's really so difficult for cPanel support to paste the new CA Bundle in plain text so the ancient servers still not migrated could be working with SSL for another year?

    Regards,

    0
  • cPRex Jurassic Moderator

    I'm confused about what the CA bundle would have to do with the SSL renewal process.  Is the SSLs can't be generated, the CA Bundle likely isn't going to help.

    The root certificate is the same for all domains as they all eventually go to the "ISRG ROOT X1" certificate, good until 2035. 

     

    -----BEGIN CERTIFICATE-----
    MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
    TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
    cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
    WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
    ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
    MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
    h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
    0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
    A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
    T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
    B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
    B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
    KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
    OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
    jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
    qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
    rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
    HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
    hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
    ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
    3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
    NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
    ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
    TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
    jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
    oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
    4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
    mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
    emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
    -----END CERTIFICATE-----

     

    Is that what you're looking for?

    0
  • did-vmonroig

    Hi cPRex. Thanks for your reply, but this is not what I'm looking for as this is for ISRG ROOT X1.

    I'm trying to use a certificate issued by "cPanel ECC Domain Validation Secure Server CA 3, cPanel, LLC" for my old server. This certificate is generated by /usr/local/cpanel/bin/checkallsslcerts command, but as I'm on an ancient version, the latest part of downloading CA Bundle certificate from repository, fails. Nevertheless, the certificate is available if I use the Change Service SSL Host option in WHM, but I need to paste the forementioned "cPanel ECC Domain Validation Secure Server CA 3, cPanel, LLC" certificate.

    0
  • cPRex Jurassic Moderator

    Can you paste the public portion of your certificate here?  Not the private key, just the certificate data, so that way I know specifically what you're trying to use?

    0
  • cPRex Jurassic Moderator

    It would also be good to know your cPanel version and OS.

    0
  • did-vmonroig
    • Edited

    This ancient server is running cPanel v86.0.40 on CentOS 6.10. I know it’s way out of support, but there are some old websites running outdated PHP scripts that I’d rather not migrate at this time. Here is the certificate:

    -----BEGIN CERTIFICATE-----
    .
    .
    .
    -----END CERTIFICATE-----
    0
  • Alfaman

    I'm stuck in exactly the same position and too be brutally honest if I have to go through the pain of a major upgrade it won't be with Cpanel again. I'll switch all my servers over to Plesk and save a bucket load of money. I'm having to upgrade purely for the Server SSL cert which is a bit ridiculous imho.

    0
  • cPRex Jurassic Moderator

    Can you try this one and see if that's a match for you?

    -----BEGIN CERTIFICATE-----
MIIF8TCCA9mgAwIBAgIRAPAdS+57fKN7PAVmrAWXJFgwDQYJKoZIhvcNAQEMBQAw
gYUxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMSswKQYD
VQQDEyJDT01PRE8gUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE1MDUx
ODAwMDAwMFoXDTI1MDUxNzIzNTk1OVowcjELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
AlRYMRAwDgYDVQQHEwdIb3VzdG9uMRUwEwYDVQQKEwxjUGFuZWwsIEluYy4xLTAr
BgNVBAMTJGNQYW5lbCwgSW5jLiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIteAVa57GsR70jpQ56byLpTkaW9
qyr6Xjo14Q1cNepSqJk0KA9+WStIa+e010t9L4PP/osmw1l5H2Chaaday583Ie8Y
vZv9Qet1fLeW2V6GyyoS4qf3A+TO5gX3QZsevNL20WZpUQzete08CyfPiI4gPeNO
lY8VNMYmy/c/ZOn1MCV9zak5mz/qemkri8R9C/hWk7Zrlsrsz9J7vUO+0/WJ2k10
SSHEvfUwvLxJqWUVs9b/vx2QlJwIJbatz/zH2ftV1RnQSr9iRuUk7Y++ZJgMalGe
eoBzIKm02b9Dap4QrSugzWStQDnS4rjbwvI6o+K3FpcfHvbP3zweWOkAB2sCAwEA
AaOCAWwwggFoMB8GA1UdIwQYMBaAFLuvfgI9+qbxPISOre44mOzZMjLUMB0GA1Ud
DgQWBBR+A1plQWunfgrhuJ0I6h2OHWrHZTAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0T
AQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwIgYD
VR0gBBswGTANBgsrBgEEAbIxAQICNDAIBgZngQwBAgEwTAYDVR0fBEUwQzBBoD+g
PYY7aHR0cDovL2NybC5jb21vZG9jYS5jb20vQ09NT0RPUlNBQ2VydGlmaWNhdGlv
bkF1dGhvcml0eS5jcmwwcQYIKwYBBQUHAQEEZTBjMDsGCCsGAQUFBzAChi9odHRw
Oi8vY3J0LmNvbW9kb2NhLmNvbS9DT01PRE9SU0FBZGRUcnVzdENBLmNydDAkBggr
BgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBDAUA
A4ICAQAQn6BgCIF0oaCEeGBMOTnaZHfvGQpyOSOUO5F9fzSLl1hOWQotaMMQQrCg
eoGMe6sxMiA55CJz4N7JF12DxXUt4RFHWQGeXcD03RJq0G0wIOizyk/fmuCnF58a
L4d+61DhU/P4R9mMYPLJZWWc8NoB5rLy2AeYh983iZhVEkLJ5C3eLb6qZJRO2S7m
wtXywObp6hk+NwuJX8k6+E9HQD6vGn+i9oUBiBc2tSPquf66a0gLAiA5rsNh65Wl
oXPHHF9UM3NXSzaLm1so4z6xC3hcaxSnEMzl2j+66dayLR1wVLpeq31PKYkQ4DqQ
BMXuuY5DouNjWH9Ji3E+V2IjQNFdlmQiYVaflmdHh7zlACCkaOLBoIF7aHMIxG1O
cHno3VXXCVy5nQqVpgzZ2+KKVeu54eealRRMWAZBwRCqqrE64qVKSuDZyR/CoJe7
Bu8ZANsCvpbx+1SPk5r6MCI2qXcmH5Qok+kTPUXROjVIHpgNgnDAC1ooh6F4UT+1
p1ymkSIAQky5gBWAKrEtiU/3uh4YxIxZHnNJo6h7vB/3Vk1Qn2cWp8cXSOdtVFd2
bpdYW3hkpO1itAA7Bn55uFhfboTWQ7xP2zmqKPDBiQnF++MYRLflsotdlfkjWgty
92k61leL4en0YL7EUSsRrP5Is3JzyhNQcw0EdsoB4ULC1yHP+Q==
-----END CERTIFICATE-----

    I definitely wouldn't think about it as upgrading for *only* the certificate system, but many other things on the server will be painfully out of date with security issues.  CentOS 6 has been EOL for 5 years now.

    0
  • Alfaman

    Thanks, but same error.

    0
  • Alfaman

    0
  • cPRex Jurassic Moderator

    Can you let me know specifically *how* you're even getting an SSL without a CA bundle on the server?  That's the part that doesn't make any sense to me.

    0
  • cPRex Jurassic Moderator

    And you're getting that screenshot even after manually copy pasting the CA bundle into WHM?

    -1
  • Alfaman

    This is a Cpanel issued SSL certificate for server.youdomain.com

    Go to install it via 'Install an SSL Certificate on a Domain'.

    0
  • Alfaman

    0
  • cPRex Jurassic Moderator

    There really isn't anything we can do in this situation - these systems are just too old to be properly secured.

    0
  • did-vmonroig

    May I know why it is so difficult to paste a simple CA Bundle here? Are there any security implications, or is there some kind of support policy that forbids you from doing it? If I'm not mistaken, with that certificate pasted there, we could proceed with our servers SSL, whose licenses are still active and billed monthly.

    0
  • cPRex Jurassic Moderator

    As I understand it, the CA bundle for those old certificates is no longer valid.

    0
  • did-vmonroig

    Those aren't old certificates. As you can see, they are generated recently with check-allsslcerts. In the example certificate I pasted before you can see cPanel, LLC is the issuer. In https://support.cpanel.net/hc/en-us/community/posts/26884027819543/comments/28068351231511 other user pasted a CA Bundle but maybe it's outdated.

    0
  • cPRex Jurassic Moderator

    I know this isn't the news you want to hear, but there just isn't going to be a way to get this working.  Both the cPanel version and the OS have been end of life for 5 years now, and placing SSL certificates on a domain would be the least of the security concerns.

    It would be best to move these accounts to a more modern system.

    Since we're just going in circles here I'm going to lock this thread.

    0

Post is closed for comments.

Didn't find what you were looking for?

New post