Importing a Digicert Wildcard Certificate into eDirectory

The time to update my SSL certs has come around again. Based on positive reviews by Leo Laporte and Steve Gibson ( http://twit.tv/sn ), I decided to look into Digicert. Their wildcard certs really caught my eye. When you need to have ssl certs for apache, IM servers, spamfilters, and others, paying for each can get really expensive and a pain to manage. This go around, I decided to get the Digicert Wildcard SSL Certificate and import it into eDirectory.

There seems to be a lot of info in various places on how to do it. After combing through about 12 different pages, I settled on two different ones that seems to have worked just fine. The two pages in order of use are:

1. http://www.novell.com/support/viewContent.do?externalId=3033173&sliceId=1
2. http://support.novell.com/docs/Tids/Solutions/10098796.html

The first walks you through getting the cert from an external entity - the TID has Verisign but it works fine with Digicert. There were a couple of confusing spots.

• In order, add the Location, State and Country attributes the subject line when creating the cert in eDirectory.  The resulting subject line will look like this:

CN=*.domain.com.O=organization name.L=city.S=state.C=COUNTRY

• In step C3, it is the certificate that you get back from Digicert and not the one you created with iManager. It seems to me like it was asking for the one you created in the first steps.
• Do check the box that states "Waive subject name in certificate" because Digicert does modify it.

Following the openssl TID worked perfectly for creating the Apache2 certs.

If you want to use the certificates with an eDirectory controlled app like GroupWise PO, then you need to keep the password protected version of the private key from step 7 of the 2nd TID and use it in the eDirectory configs. I tried to use one without a password but the GroupWise agents wouldn't load and complained about the use of no password (Warning - Failure in SSL startup (891D)).

I hope this helps someone else sometime :-)