wanting to use a signed certificate with ssl

[Ndolam]

(I tried e-mailing the list, but it doesn't seem to have showed up, nor did I get an acknowledgment. So I try here...)

I have radicale 1.1.1 working with a self-signed certificate (thanks to everyone who has put effort into radicale). A client I am using refuses to talk to the server because its certificate is self-signed.

I obtained a signed certificate, but I haven't figured out how to configure radicale to use it.

So could I either submit
(1) documentation bug: does not explain how to set up the config file to use a signed certificate,
or
(2) feature request: could radicale be enhanced to allow the use of signed certificates?

Thanks.

[liZe]

I'm not sure to understand your problem. Using a self-signed certificate or a certificate signed by an external authority relies on the same configuration keys. If you managed to make Radicale work with your self-signed certificate, it shouldn't be a problem to use another certificate.

[Ndolam]

On Mon, Mar 21, 2016 at 02:20 (-0700), Guillaume Ayoub wrote: I'm not sure to understand your problem. Using a self-signed certificate or a certificate signed by an external authority relies on the same configuration keys. If you managed to make Radicale work with your self-signed certificate, it shouldn't be a problem to use another certificate.

Thanks for getting back. I should point out that I have zero experience configuring certificates for servers, just in case you think something obvious to you is obvious to me. When I asked for a signed certificate, I got two .crt files back, plus a README (for Apache, which I am not using) which said To correctly install your certificate, it is important to configure the server to use the intermediate DigiCertCA.crt file in addition to xxxx.crt. I tried replacing the working (for clients that are OK with self-signed certificates) certificate = .../server.crt with certificate = .../xxxx.crt This caused my client to whine Error while saving radicale. [2] SSL certificate problem: unable to get local issuer certificate While it seemed unlikely to me that I should try certificate = .../DigiCertCA.crt I gave it a try, and the client said Error while saving radicale. [2] error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure So while the README is for Apache, I considered that maybe I have to somehow tell Radicale about both of the certificates. But I don't know if that makes sense, and if it does, I don't know how to do it. Does this better explain the problem? Thanks.

[liZe]

I should point out that I have zero experience configuring
certificates for servers, just in case you think something obvious to
you is obvious to me.

OK, no problem :).

The errors you get are due to the fact that your certificate need one or many intermediate certificates. Here is some documentation about Intermediate certificate authorities and how to use them in Python.

Short answer: you need to concatenate server.crt and DigiCertCA.crt into a single file.

[Ndolam]

On Tue, Mar 22, 2016 at 12:02 (-0700), Guillaume Ayoub wrote:

I should point out that I have zero experience configuring
certificates for servers, just in case you think something obvious to
you is obvious to me.

OK, no problem :).

The errors you get are due to the fact that your certificate need
one or many intermediate certificates. Here is some documentation
about Intermediate certificate
authorities
and how to use them in
Python.
Thanks for those pointers.

Short answer: you need to concatenate server.crt and
DigiCertCA.crt into a single file.
And thanks for the quick instructions.
I include this just for people who come after with the same problem
and find this: I think you may have meant to say "xxxx.crt" as opposed
to "server.crt"; at least, that is what worked for me.

In summary, korganizer is now happily communicating (in one direction,
anyway) with the server. (It saves events to the remote calendar, but
doesn't pick up new events saved to radicale by other clients. I
assume this is more configuration issues at my end, but that is
another problem.)

Cheers.
Jim

[liZe]

Cool!