- This topic is empty.
-
Posts
-
We are using WTOS 7.1_0122 on our V10L(E)/T10 terminals to connect to our VDI connection broker. We used to have a self signed certificate, users needed to “accept” the warning before they could connect to the connection broker.
After installing a wildcard certificate (*.domain.tld) from Thawte we cannot connect to the connection broker. It simply says the certificate is invalid and the root is untrusted. Even after installing the Thawte root and SSL intermediate certificates it still says the host name does not match and the root is not trusted.
How can I get our clients to connect using the new wildcard certificate? It is very annoying that a self signed certificate works, but a “real” certificate does not!
How did you import the new certificates to the unit? What format does the certs have?
Is the timeserver configured?CG
@ConfGen wrote:
How did you import the new certificates to the unit? What format does the certs have?
Is the timeserver configured?CG
The certificates where imported with the following lines in wnos.ini:
;AddCertificate=thawtePrimaryRootCA.cer
;AddCertificate=ThawteSSLCA.cer
;AddCertificate=ourwildcardcertificate.cerHowever, it does not see the certification path. It says “certificate authority is incorrect” and “hostname does not match”. When I look at the certificate details I just see *.unigarant.nl and not the intermediate or the root certificates in the path…
When I look in the certificate store however, the path IS correct… 😕
The time is correct and updates from our domain controller.
@ConfGen wrote:
Remove these certs, rename them to *.crt and reimport.
CG
Already tried that, does not work. I think ThinOS just does not support wildcard certificates yet. Does anyone have a wildcard certificate working?
I am thinking about creating a server called * . That way the hostname should be correct for *.ourdomain.nl 😉
Missed that. You are right. Wildcard certs are not supported.
CG
@ConfGen wrote:
Missed that. You are right. Wildcard certs are not supported.
CG
Strange thing is: it should be supported since _122, at least that is stated in the release notes…
- You must be logged in to reply to this topic.