Currently I am working with SSL certificates inside a Ruby on Rails application.
I am storing the certificates in a database along with the corresponding dhparam, and chain. At some point I want to render these fields into real files and publish them to a server.
Although the published certificates work in the client's browser we got in massive trouble with a couple of other apps (including golang services, amazon cloudfront, ...) telling us that the certificate is not correct (e.g. x509: certificate signed by unknown authority
).
So I had a look at the certificates that were rendered. The only difference I was able to find is that Ruby's OpenSSL library returns the certificate with a different carriage return than I was used to:
-----BEGIN CERTIFICATE-----\n
MIIDhDCCBWygAwIBAgIQDyh/z7hUIji7pFcz+75NWTANBgkqhkiG9w0BAQsFADCB\n
kDER ...
but the original, raw string looks like this:
-----BEGIN CERTIFICATE-----\r\n
MIIDhDCCBWygAwIBAgIQDyh/z7hUIji7pFcz+75NWTANBgkqhkiG9w0BAQsFADCB\r\n
kDER ...
And here's how I rendered the certificate:
certificate = OpenSSL::X509::Certificate.new '<raw certificate>'
certificate.to_pem # => This returns the \n formatted certificate
Could the different format of the CRLF be the root of the problem? Are both formats valid?