SSL Root Certificate causing issues with Slingshot
Issue:
When trying to run a Slingshot webApp on a workstation, the Slingshot utility gives the following error:
Error:
"Problem found with the Secure Sockets Layer(SSL) certificate sent by the server. Please note that self-signed certificates cannot be used."
Solution:
Most likely, the JKS keystore used by Unified Workspace contains the full SSL Certificate chain (server - intermediate - root).
To provide increased security, devices only want to be given the server and intermediate certificates, to then link them to the root certificate contained within their own certificate stores. When UW sends the root certificate as part of the certificate chain, the device uses the ones sent and therefore treating the certificate as a Self-Signed certificates. It is therefore necessary to remove the Root certificate from the certificate chain, so that only the Server and Intermediate certificate remain.
(Check your certificate chain using the Digicert SSL Installation Diagnostics Tool.)
Use the following steps to remove the Root certificate from the JKS keystore:
- Right-click on the keypair and choose View Details > Certificate Chain Details.
Verify the full certificate chain is there. The full chain should include the Root, Intermediate, and Server certificates. Depending on your CA, you might have multiple Intermediate certificates. - Right-click on the keypair and choose Edit Cert Chain > Remove Certificate.
This will remove the Root certificate from the chain, as some browsers interpret providing the certificate as being Self-signed if the root certificate is provided. - Right-click on the keypair and choose View Details > Certificate Chain Details.
Verify the certificate chain is there, minus the Root certificate. The chain should include only the Intermediate, and Server certificates. Depending on your CA, you might have multiple Intermediate certificates. - Save keystore and copy to relay to test.