Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What does the vService do if the certificate I uploaded has an error?
Short answer
It depends on the type of error. An unrecognized format, a wrong PFX or key password or a corrupt key is rejected during saving and the vService is not affected. For a Manual certificate, if the certificate and the key do not match, the record is created, but the vService configuration cannot be loaded and a configuration error warning appears on the vService. An expired certificate or a certificate with a missing chain is presented as is and clients see a trust error. If no certificate is selected on the vService, the encrypted rows listen unencrypted.
By Error Type
| Error | What happens |
|---|---|
| Unrecognized format (not PEM, PKCS#7/P7B or DER), wrong or empty PFX password, wrong key password, corrupt key | No record is created, the form gives an error (e.g. unrecognised certificate format: expected PEM, PKCS#7/P7B or DER); the vService is not affected |
| The certificate uploaded with Upload a re-signed certificate, Upload the signed certificate or the Certificate Content field of the CSR record does not belong to the key in the record | The upload is rejected (certificate does not match this record's key — is this the certificate issued for the downloaded CSR?); the previous certificate continues to be presented |
| Certificate Content and Key Content mismatch in a Manual certificate | The record is created (the match is not checked on saving); the configuration of the vService that uses the certificate cannot be loaded and the configuration error(s) warning appears in the vService preview |
| Expired certificate or certificate with a missing chain | Presented as is; the client sees a trust error |
| Certificate with no content (e.g. not yet obtained with ACME.SH) or no certificate selected on the vService at all | No certificate is presented; if there is no other certificate with content on the vService, the encrypted rows listen unencrypted |
Precautions
- Before a Manual upload, it is checked that the certificate and the key match; the outputs of the two commands must be the same:
openssl x509 -noout -pubkey -in sertifika.pem | openssl sha256andopenssl pkey -pubout -in anahtar.pem | openssl sha256. - After saving, the Chain tab of the certificate and the Valid Until column in the list are checked (How do I add the intermediate certificate chain?).
- After the certificate is assigned to the vService, it is verified that there is no configuration warning in the vService preview and that the correct certificate is presented with
openssl s_client -connect 203.0.113.10:443 -servername www.example.com. - On an L7 TCP vService, a TCP + TLS row saved without a certificate selected listens as unencrypted TCP (L7 TCP vService · Certificate); on an HTTP vService too, an Encrypted (HTTPS) row can be saved without a certificate and listens unencrypted. The Certificate field must be filled in on every encrypted row.
Common Misconceptions
- "TR7 warns when the wrong key is saved." In the Manual type, the match is not checked on saving; the error appears in the configuration warning of the vService. In CSR and re-signing uploads, however, the match is checked.
- "TR7 does not present an expired certificate." It continues to present it; the certificate needs to be renewed (How do I filter certificates that have expired or are about to expire (Expiry Health)?).
- "If the certificate is faulty, the vService falls back to another certificate." The vService presents only the certificates selected for it; the problem does not go away until the faulty certificate is fixed or replaced.
How it is done in the documentation
