1

Hello all,

I have set up Spiceworks on Ubuntu 18.04.5 and I have a public Certificate from DigiCert’s, that I don’t know how to set up.

I surfed the internet looking for a guideline on how to apply public certificate on a Linux server, I could not find any. All available information is related to Windows and VMware.

If there is any instructions or guideline about this, would be great if you could share it with me. The certificate extensions are as follows.

Mycompany.key DigiCertCA.crt myCompany.crt

Thanks in advance.

4 Spice ups
2

You need to provide a bit more info. The certificate I assume is for a single domain and not wildcard, right (not much of a difference, but just to confirm). The assumption is based on the cert file names - Mycompany.key DigiCertCA.crt myCompany.crt. Otherwise they are named differently.
I’ve never installed SW on Linux (actually it was like more than 10 years since my last SW installation), but I assume that the install script is downloading some of the two web servers - Apache or NGINX. If not, then you have to find in the SW documentation, how and where to configure the path to the cert files (all 3 of them).

Cheers,
-Tiho

3

I would like to see instructions on how to spit out an appropriate certificate for this using Microsoft PKI. I assume you’d need to generate a CSR on Ubuntu and submit it via Web Enrollment or certutil, and then transfer the cert over to Ubuntu and then register it with the web server there … nginx, right? Anybody already have that documented?

4

You can have you CSR, right from your Ubuntu (or other Linux flavor) distro. No need to involve M$ for such a trivial step (or any other step).
Here is an example: openssl req -new -newkey rsa:2048 -nodes -keyout mydomain.key -out mydomain.csr

Edit: I had to read the post twice :slight_smile:
On M$, you can generate that CSR, right from the IIS console - IIS 10: CSR Creation & SSL Certificate Installation

Cheers,
-Tiho

5

@bmt-team ​ you need to involve Microsoft if the goal is to get a cert from your already-trusted on-prem Microsoft PKI. Sometimes the application (here nginx) is picky about the properties of the cert - you might have to create a template with the right values and specify that template in the request, for example. So it is always nice to be able to look at the details of something somebody else got working.

6

Chris,
Can you please give me an example for a case where nginx (or other web server) had a problem working with such cert? I am asking just to get some experience with different cases/topologies.
So far (long time ago… neah Lucas Arts may jump in…) my experience with IIS and getting working cert from MS was pretty trivial. No drama or what so ever (no matter if it is a single domain or wildcard certificate. The usage was: mail server, web server and TLS communication between backup agent and the server).

Cheers,
-Tiho

7

Not really, because I’ve not worked with nginx before, which is why I’m looking for guidance. vCenter had some very specific requirements for setting up a template to provide certs for that product. And my firewalls - Fortigate, Sonicwall. Yes, certs from Microsoft to Microsoft products are pretty trivial …

1 Spice up
8

Thanks for your response Vlahovski,

Based on your feedback Spiceworks run on nginx web server, not apache or custom web server. I have applied wildcard certificate on Apache, but not on nginx. I don’t even know where the configuration file is located to do that.

I have tried to locate the service (Diamond) of nginx under /etc/inint.d, but there were none. The service is running as you can see from the screenshot below. But I don’t know where the configuration file is, how to check the status of the service, since (service nginx status), returns service not found.

tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 1392/nginx

9

Hello,
I just installed the SW on a new server (wanted to give it a try and see if it is working).
Here is the end of the install script:

69d2ff67-22db-4e8b-ba2e-1dacea486a56-Screenshot_from_2021-08-25_14.28.43.png
69d2ff67-22db-4e8b-ba2e-1dacea486a56-Screenshot_from_2021-08-25_14.28.43.png800×533 161 KB

Give it a try with the provided command and see how it goes. Of course you need to upload the cert files on your server in a location that is reachable (mostly permissions).

Cheers,
-Tiho

10

Thank Vlahovski for your support,

I have applied the command, that is after miring the private key and crt file. Apartently it works and an SSL certificate appeared next to the URL link. However, I could not log in anymore, I know very strange. After restarting the server, although the service was running, the web page break and could not come back to live.

I will try once more and try to find the root cause of the issue.

Again thanks for your help.

11

Check the log (not sure where SW is sending the messages) but start with syslog or error that might give you a clue about that problem

Cheers,
-Tiho