DCE issue adding Server Access SSL Certificate

[ysancoms]

Having issues add a server SSL Access cert to create secure access to web ui. Getting error message "cannot install the certificate because the private key does not match the provided certificate".

Created CSR in DCE. .csr was generated using OpenSSL and then signed by CA. When adding .cer file issued by CA into DCE, error msg appears. I have verified that the keys match using OpenSSL.

Running DCE software version 7.8.1.35. 

[GraceSmith99]

It seems like you are encountering an issue with adding a server SSL access certificate to Schneider Electric's StruxureWare Data Center Expert (DCE) due to a private key mismatch error.

This error typically occurs when the private key associated with the SSL certificate does not match the one stored in the DCE software. Here are some steps you can take to troubleshoot and resolve this issue:

1. Verify Private Key Matching:
Double-check that the private key used during the CSR generation matches the one associated with the SSL certificate provided by the CA. You can use OpenSSL commands to verify this:
```
openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa -noout -modulus -in private.key | openssl md5
```
- If the MD5 hashes of the certificate and private key do not match, there is a key mismatch issue that needs to be resolved.

2. Reissue the Certificate:
- If the private key mismatch persists, consider reissuing the SSL certificate from the CA using the correct private key. Ensure that the private key is securely stored and accessible during the certificate issuance process.

3. Check Certificate Format:
- Ensure that the certificate file (.cer) provided by the CA is in the correct format and includes the full certificate chain if necessary. Some systems may require the certificate chain to be included in the same file.

4. Import Certificate Chain:
- If the CA provided an intermediate or root certificate along with the server certificate, make sure to import the entire certificate chain into DCE. The SSL certificate chain should include the server certificate, any intermediate certificates, and the root certificate.

5. Use OpenSSL to Convert Formats:
- If needed, convert the certificate file format to PEM or other supported formats using OpenSSL commands. This can help ensure compatibility with DCE.
```
openssl x509 -inform DER -in certificate.cer -out certificate.pem -outform PEM
```

6. Contact Schneider Electric Support:
- If the issue persists after trying the above steps, it may be beneficial to contact Schneider Electric's technical support for further assistance. They can provide specific guidance based on the software version and configuration.

By following these steps and ensuring that the private key and certificate match, you should be able to successfully add the server SSL access certificate to your Data Center Expert software.

[Cory_McDonald · Accepted solution]

Hello @ysancoms,

I am assuming at this point that you have gotten this issue resolved, but I wanted to add additional context in case anyone else runs into this issue.

Data Center Expert certificate signing requests (CSRs) must be generated from within the desktop client.  This will use the servers current Private Key, which is not user manageable.  In older version of DCE, the private key would change on a reboot if a certificate was not installed that used it.  If you received the private key mismatch after going through the CSR process, it is possible that this may be the cause.

It is recommended to upgrade to the most recent version of DCE before performing a CSR request for this reason.  You can reach out to technical support if you do not have access to upgrade files within the EcoStruxure IT Entitlements portal.

Information on generating a CSR and how to import it back in can be found within the following knowledge base: https://www.apc.com/us/en/faqs/FA407973/

Kind Regards,

Cory