Install CMX 10.5 SSL Certificate Procedure

Introduction

This document describes how to get a free SSL certificate and the way to install it on CMX

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- A domain name which can be resolved externally

- Basic linux skills

- Basic knowledge of PKI (Public Key Infrastracture)

Components Used

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

The information in this document is based on these software and hardware versions:

- CMX 10.5

Prepare and backup

Web certificate is located in the following folder:

[root@cmxtry ssl]# pwd
/opt/haproxy/ssl

Backup the old certificate and key:

[cmxadmin@cmxtry ssl]$cd /opt/haproxy/ssl/
 
[cmxadmin@cmxtry ssl]$su root
Password: (enter root password)
 
[root@cmxtry ssl]# mkdir ./oldcert
[root@cmxtry ssl]# mv host.* ./oldcert/
 
[root@cmxtry ssl]# ls ./oldcert/
host.key  host.pem

In case you are not very familiar with Linux, the commands can be interpreted in the following way:

[cmxadmin@cmxtry ssl]$cd /opt/haproxy/ssl/
 
[cmxadmin@cmxtry ssl]$su root
Password: (enter root password)
 
[root@cmxtry ssl]# mkdir /opt/haproxy/ssl/oldcert
[root@cmxtry ssl]# mv host.pem /opt/haproxy/ssl/oldcert/
[root@cmxtry ssl]# mv host.key /opt/haproxy/ssl/oldcert/
 
[root@cmxtry ssl]# ls /opt/haproxy/ssl/oldcert/
host.key  host.pem

 Configure

Generate a private key:

openssl genrsa -out cmxtry.com.key 2048

[root@cmxtry ssl]# openssl genrsa -out cmxtry.com.key 2048
Generating RSA private key, 2048 bit long modulus
............
...............
e is 65537 (0x10001)

[root@cmxtry ssl]# ls
cmxtry.com.key  oldcert

Generate a CSR (certificate signing request) using the private you key generated in the previous step.

  
[root@cmxtry ssl]# openssl req -new -sha256 -key cmxtry.com.key -out cmxtry.com.csr

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:BE
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:DIEGEM
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CMXTRY
Organizational Unit Name (eg, section) []:CMXTRY
Common Name (e.g. server FQDN or YOUR name) []:cmxtry.com
Email Address []:avitosin@cisco.com
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:Cisco123
An optional company name []:CMXTRY


[root@cmxtry ssl]# ls
cmxtry.com.csr  cmxtry.com.key  oldcert

Display the CSR:

[root@cmxtry ssl]# cat cmxtry.com.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIDZTCCAk0CAQAwgY0xCzAJBgNVBAYTAkJFMRMwEQYDVQQIDApTb21lLVN0YXRl
MQ8wDQYDVQQHDAZESUVHRU0xDzANBgNVBAoMBkNNWFRSWTEPMA0GA1UECwwGQ01Y
VFJZMRMwEQYDVQQDDApjbXh0cnkuY29tMSEwHwYJKoZIhvcNAQkBFhJhdml0b3Np
bkBjaXNjby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCkEIg0
AxV/3HxAxUu7UI/LxkTP+DZJvvuua1WgyQ+tlD4r1+k1Wv1eINCJqywglCKt9vVg
aiYp4JAKL28TV7rtSKqNFnWDMtTKoYRkYWI3L48r9Mu9Tt3zDCG09ygnQFi6SnmX
VmKx7Ct/wIkkBXfkq1nq4vqosCry8SToS1PThX/KSuwIF6w2aKj1Fbrw3eW4XJxc
5hoQFrSsquqmbi5IZWgH/zMZUZTdWYvFc/h50PCBJsAa9HTY0sgUe/nyjHdt+V/l
alNSh41jsrulhWiPzqbaPW/Fej9/5gtPG5LReWuS20ulAnso4tdcST1vVletoXJw
F58S8AqeVrcOV9SnAgMBAAGggZEwFQYJKoZIhvcNAQkCMQgMBkNNWFRSWTAXBgkq
hkiG9w0BCQcxCgwIQ2lzY28xMjMwXwYJKoZIhvcNAQkOMVIwUDAJBgNVHRMEAjAA
MBcGA1UdEQQQMA6CDF9fSE9TVE5BTUVfXzAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
KwYBBQUHAwIwCwYDVR0PBAQDAgOoMA0GCSqGSIb3DQEBCwUAA4IBAQCBslfRzbiw
WBBBN74aWm6YwkO0YexpR2yCrQhcOsxWTujPVvzNP9WaDNxu1rw6o3iZclGi6D61
qFsKtchQhnclvOj7rNI8TInaxIorR2zMy0lF2vtJmvY4YQFso9qzmuaxkmttEMFU
Fj0bxKh6SpvxePh6+BDcwt+kQExK5aF3Q6cRIMyKBS2+I5J5eddJ0cdIqTfwZOGD
5dMDWqHGd7IZyrend8AMPZvNKm3Sbx11Uq+A/fa7f9JZE0O2Q9h3sl3hj3QIPU6s
w1Pyd66/OX04yYIvMyjJ8xpJGigNWBOvQ+GLvK0ce441h2u2oIoPe60sDOYldL+X
JsnSbefiJ4Fe
-----END CERTIFICATE REQUEST-----

Copy the CSR (include the "beginning of certificate request" line and "end of certificate request" line).

In case of my lab, I was using the free certificate from Comodo (https://www.instantssl.com/)

 

You paste the CSR in the window and select RedHat as software used to generate the CSR:

You have to validate the domain using either an e-mail address or other ways to validate the domain, such as DNS CNAME entry.

When you did complete the process of validation, you will be able to download a certificate from here:

When you download the certificate, you have to upload it to CMX box:

[ avitosin > ~/Desktop/cmxtry_com ] ls
cmxtry_com.ca-bundle  cmxtry_com.crt
[ avitosin > ~/Desktop/cmxtry_com ] scp ./* cmxadmin@cmxtry.com:/home/cmxadmin
Warning: the ECDSA host key for 'cmxtry.com' differs from the key for the IP address '64.103.12.134'
Offending key for IP in /Users/avitosin/.ssh/known_hosts:8
Matching host key in /Users/avitosin/.ssh/known_hosts:10
Are you sure you want to continue connecting (yes/no)? yes
cmxadmin@cmxtry.com's password:
/etc/profile.d/lang.sh: line 19: warning: setlocale: LC_CTYPE: cannot change locale (UTF-8): No such file or directory
cmxtry_com.ca-bundle                          100% 4103     4.0KB/s   00:00    
cmxtry_com.crt                                100% 2236     2.2KB/s   00:00    
[ avitosin > ~/Desktop/cmxtry_com ]

Verify the certificates

Verify that the certificate was successfully copied to CMX: 

[root@cmxtry ssl]# cd /home/cmxadmin/
[root@cmxtry cmxadmin]# ls
cmxtry_com.ca-bundle  cmxtry_com.crt
[root@cmxtry cmxadmin]#

Public certificate:

[root@cmxtry cmxadmin]# cat cmxtry_com.crt
-----BEGIN CERTIFICATE-----
MIIGRzCCBS+gAwIBAgIRALKbdelOe0O7sSYMBFBhFPwwDQYJKoZIhvcNAQELBQAw
gZAxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTYwNAYD
VQQDEy1DT01PRE8gUlNBIERvbWFpbiBWYWxpZGF0aW9uIFNlY3VyZSBTZXJ2ZXIg
Q0EwHhcNMTgwODA4MDAwMDAwWhcNMTgxMTA2MjM1OTU5WjBLMSEwHwYDVQQLExhE
b21haW4gQ29udHJvbCBWYWxpZGF0ZWQxETAPBgNVBAsTCEZyZWUgU1NMMRMwEQYD
VQQDEwpjbXh0cnkuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
oVRQ9cBGBNbcIIiVovDXUw0TRXjrCplro9bx22kGAnJPNenymETTdJ4m+7Rs19BI
ob09Wqo4CKWCxgdViJWQDohfGbElvdELcOD7+HgZroYHoY24wzU+q2WCFW9z3Dca
RZMJagjsXPZ5XhACvlKb+lNoYTgTkf0xVAnNphTGgtOGNaQ/PHqX9ITC4iwTmFWD
UEZR/SIwb5MjIQZsMGi5cW7q4STKrydFVDXmJzNySK2hq9s9yc8cBN2Lp2HJsaA4
qtQb1KWOLnzVxUaAMVN+sObVvYV/sOmJLtFvKKU9Pg2cuSo2LhPBVtTpdbHkSDuz
NlWHhYC9Uxu2+wwvTwGjQQIDAQABo4IC3jCCAtowHwYDVR0jBBgwFoAUkK9qOpRa
C9iQ6hJWc99DtDoo2ucwHQYDVR0OBBYEFPvwN4lSs4oKd5AaG+j6xhDEtfL7MA4G
A1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMB
BggrBgEFBQcDAjBPBgNVHSAESDBGMDoGCysGAQQBsjEBAgIHMCswKQYIKwYBBQUH
AgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5jb20vQ1BTMAgGBmeBDAECATBUBgNV
HR8ETTBLMEmgR6BFhkNodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9SU0FE
b21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3JsMIGFBggrBgEFBQcBAQR5
MHcwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JT
QURvbWFpblZhbGlkYXRpb25TZWN1cmVTZXJ2ZXJDQS5jcnQwJAYIKwYBBQUHMAGG
GGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTAlBgNVHREEHjAcggpjbXh0cnkuY29t
gg53d3cuY214dHJ5LmNvbTCCAQMGCisGAQQB1nkCBAIEgfQEgfEA7wB1AO5Lvbd1
zmC64UJpH6vhnmajD35fsHLYgwDEe4l6qP3LAAABZRmIfAUAAAQDAEYwRAIgdU0n
octPP7c7dR3MSMq2NQDA1rgP1hSGtB4qkectDp4CIBHBdS9cuu6Pwjb9OAHtKIDh
BGFm51btA2NflzDLKmpVAHYA23Sv7ssp7LH+yj5xbSzluaq7NveEcYPHXZ1PN7Yf
v2QAAAFlGYh7cwAABAMARzBFAiBDUjKNvINiwH1hgA+4Oipjhv7oGxLEsDiz+e7j
/oa3qQIhAKoTXC41fbcAZSH3zWE/LBYthUkA4qaP3Q2en7QanEv7MA0GCSqGSIb3
DQEBCwUAA4IBAQAwoZfOdE1QuzJqssnAWxoI2uTc9R15clVq3X7qiYLv3ItijFUL
stuKQXf7VqYqKHcjX8Ue5TMfcJYNlRc5Knj3r6fusLuaO33W++g3TDnQuN/CT5Y4
nrgor7UsquZHGoY6RHh2ZDA53Ep80YtsO36eLN8qkDB/OvxqJmYj9URTLfWRqfhh
sGE1odIjW4lbSka+CR09DlBkhzOTqDCnWcKicn/kSfJexKVs0LRrNXfvUEdbPohl
plPeiyKMXUtV2Q67UwiYpC9JzkG8a09q5JdUL4Le/xn0gvz4jq+2rtHnNctg6ShD
laqU7wA5HRag2zJsIK/d2Agymk8u3AypzW4T
-----END CERTIFICATE-----

Chain of trust:

[root@cmxtry cmxadmin]# cat cmxtry_com.ca-bundle
-----BEGIN CERTIFICATE-----
MIIGCDCCA/CgAwIBAgIQKy5u6tl1NmwUim7bo3yMBzANBgkqhkiG9w0BAQwFADCB
hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV
BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQwMjEy
MDAwMDAwWhcNMjkwMjExMjM1OTU5WjCBkDELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR
Q09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZh
bGlkYXRpb24gU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAI7CAhnhoFmk6zg1jSz9AdDTScBkxwtiBUUWOqigwAwCfx3M28Sh
bXcDow+G+eMGnD4LgYqbSRutA776S9uMIO3Vzl5ljj4Nr0zCsLdFXlIvNN5IJGS0
Qa4Al/e+Z96e0HqnU4A7fK31llVvl0cKfIWLIpeNs4TgllfQcBhglo/uLQeTnaG6
ytHNe+nEKpooIZFNb5JPJaXyejXdJtxGpdCsWTWM/06RQ1A/WZMebFEh7lgUq/51
UHg+TLAchhP6a5i84DuUHoVS3AOTJBhuyydRReZw3iVDpA3hSqXttn7IzW3uLh0n
c13cRTCAquOyQQuvvUSH2rnlG51/ruWFgqUCAwEAAaOCAWUwggFhMB8GA1UdIwQY
MBaAFLuvfgI9+qbxPISOre44mOzZMjLUMB0GA1UdDgQWBBSQr2o6lFoL2JDqElZz
30O0Oija5zAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNV
HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgG
BmeBDAECATBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNvbW9kb2NhLmNv
bS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcB
AQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9E
T1JTQUFkZFRydXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21v
ZG9jYS5jb20wDQYJKoZIhvcNAQEMBQADggIBAE4rdk+SHGI2ibp3wScF9BzWRJ2p
mj6q1WZmAT7qSeaiNbz69t2Vjpk1mA42GHWx3d1Qcnyu3HeIzg/3kCDKo2cuH1Z/
e+FE6kKVxF0NAVBGFfKBiVlsit2M8RKhjTpCipj4SzR7JzsItG8kO3KdY3RYPBps
P0/HEZrIqPW1N+8QRcZs2eBelSaz662jue5/DJpmNXMyYE7l3YphLG5SEXdoltMY
dVEVABt0iN3hxzgEQyjpFv3ZBdRdRydg1vs4O2xyopT4Qhrf7W8GjEXCBgCq5Ojc
2bXhc3js9iPc0d1sjhqPpepUfJa3w/5Vjo1JXvxku88+vZbrac2/4EjxYoIQ5QxG
V/Iz2tDIY+3GH5QFlkoakdH368+PUq4NCNk+qKBR6cGHdNXJ93SrLlP7u3r7l+L4
HyaPs9Kg4DdbKDsx5Q5XLVq4rXmsXiBmGqW5prU5wfWYQ//u+aen/e7KJD2AFsQX
j4rBYKEMrltDR5FL1ZoXX/nUh8HCjLfn4g8wGTeGrODcQgPmlKidrv0PJFGUzpII
0fxQ8ANAe4hZ7Q7drNJ3gjTcBpUC2JD5Leo31Rpg0Gcg19hCC0Wvgmje3WYkN5Ap
lBlGGSW4gNfL1IYoakRwJiNiqZ+Gb7+6kHDSVneFeO/qJakXzlByjAA6quPbYzSf
+AZxAeKCINT+b72x
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFdDCCBFygAwIBAgIQJ2buVutJ846r13Ci/ITeIjANBgkqhkiG9w0BAQwFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow
gYUxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMSswKQYD
VQQDEyJDT01PRE8gUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkq
hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAkehUktIKVrGsDSTdxc9EZ3SZKzejfSNw
AHG8U9/E+ioSj0t/EFa9n3Byt2F/yUsPF6c947AEYe7/EZfH9IY+Cvo+XPmT5jR6
2RRr55yzhaCCenavcZDX7P0N+pxs+t+wgvQUfvm+xKYvT3+Zf7X8Z0NyvQwA1onr
ayzT7Y+YHBSrfuXjbvzYqOSSJNpDa2K4Vf3qwbxstovzDo2a5JtsaZn4eEgwRdWt
4Q08RWD8MpZRJ7xnw8outmvqRsfHIKCxH2XeSAi6pE6p8oNGN4Tr6MyBSENnTnIq
m1y9TBsoilwie7SrmNnu4FGDwwlGTm0+mfqVF9p8M1dBPI1R7Qu2XK8sYxrfV8g/
vOldxJuvRZnio1oktLqpVj3Pb6r/SVi+8Kj/9Lit6Tf7urj0Czr56ENCHonYhMsT
8dm74YlguIwoVqwUHZwK53Hrzw7dPamWoUi9PPevtQ0iTMARgexWO/bTouJbt7IE
IlKVgJNp6I5MZfGRAy1wdALqi2cVKWlSArvX31BqVUa/oKMoYX9w0MOiqiwhqkfO
KJwGRXa/ghgntNWutMtQ5mv0TIZxMOmm3xaG4Nj/QN370EKIf6MzOi5cHkERgWPO
GHFrK+ymircxXDpqR+DDeVnWIBqv8mqYqnK8V0rSS527EPywTEHl7R09XiidnMy/
s1Hap0flhFMCAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTvA73g
JMtUGjAdBgNVHQ4EFgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQD
AgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1UdHwQ9
MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVy
bmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6
Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAGS/g/FfmoXQ
zbihKVcN6Fr30ek+8nYEbvFScLsePP9NDXRqzIGCJdPDoCpdTPW6i6FtxFQJdcfj
Jw5dhHk3QBN39bSsHNA7qxcS1u80GH4r6XnTq1dFDK8o+tDb5VCViLvfhVdpfZLY
Uspzgb8c8+a4bmYRBbMelC1/kZWSWfFMzqORcUx8Rww7Cxn2obFshj5cqsQugsv5
B5a6SE2Q8pTIqXOi6wZ7I53eovNNVZ96YUWYGGjHXkBrI/V5eu+MtWuLt29G9Hvx
PUsE2JOAWVrgQSQdso8VYFhH2+9uRv0V9dlfmrPb2LjkQLPNlzmuhbsdjrzch5vR
pu/xO28QOG8=
-----END CERTIFICATE-----

Alternative way to take a look inside the certificate:

CHAIN OF TRUST:

 
[root@cmxtry cmxadmin]# openssl x509 -in cmxtry_com.ca-bundle -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2b:2e:6e:ea:d9:75:36:6c:14:8a:6e:db:a3:7c:8c:07
    Signature Algorithm: sha384WithRSAEncryption
        Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
        Validity
            Not Before: Feb 12 00:00:00 2014 GMT
            Not After : Feb 11 23:59:59 2029 GMT
        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:8e:c2:02:19:e1:a0:59:a4:eb:38:35:8d:2c:fd:
                    01:d0:d3:49:c0:64:c7:0b:62:05:45:16:3a:a8:a0:
                    c0:0c:02:7f:1d:cc:db:c4:a1:6d:77:03:a3:0f:86:
                    f9:e3:06:9c:3e:0b:81:8a:9b:49:1b:ad:03:be:fa:
                    4b:db:8c:20:ed:d5:ce:5e:65:8e:3e:0d:af:4c:c2:
                    b0:b7:45:5e:52:2f:34:de:48:24:64:b4:41:ae:00:
                    97:f7:be:67:de:9e:d0:7a:a7:53:80:3b:7c:ad:f5:
                    96:55:6f:97:47:0a:7c:85:8b:22:97:8d:b3:84:e0:
                    96:57:d0:70:18:60:96:8f:ee:2d:07:93:9d:a1:ba:
                    ca:d1:cd:7b:e9:c4:2a:9a:28:21:91:4d:6f:92:4f:
                    25:a5:f2:7a:35:dd:26:dc:46:a5:d0:ac:59:35:8c:
                    ff:4e:91:43:50:3f:59:93:1e:6c:51:21:ee:58:14:
                    ab:fe:75:50:78:3e:4c:b0:1c:86:13:fa:6b:98:bc:
                    e0:3b:94:1e:85:52:dc:03:93:24:18:6e:cb:27:51:
                    45:e6:70:de:25:43:a4:0d:e1:4a:a5:ed:b6:7e:c8:
                    cd:6d:ee:2e:1d:27:73:5d:dc:45:30:80:aa:e3:b2:
                    41:0b:af:bd:44:87:da:b9:e5:1b:9d:7f:ae:e5:85:
                    82:a5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                keyid:BB:AF:7E:02:3D:FA:A6:F1:3C:84:8E:AD:EE:38:98:EC:D9:32:32:D4
 
            X509v3 Subject Key Identifier:
                90:AF:6A:3A:94:5A:0B:D8:90:EA:12:56:73:DF:43:B4:3A:28:DA:E7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                Policy: 2.23.140.1.2.1
 
            X509v3 CRL Distribution Points:
 
                Full Name:
                  URI:http://crl.comodoca.com/COMODORSACertificationAuthority.crl
 
            Authority Information Access:
                CA Issuers - URI:http://crt.comodoca.com/COMODORSAAddTrustCA.crt
                OCSP - URI:http://ocsp.comodoca.com
 
    Signature Algorithm: sha384WithRSAEncryption
         4e:2b:76:4f:92:1c:62:36:89:ba:77:c1:27:05:f4:1c:d6:44:
         9d:a9:9a:3e:aa:d5:66:66:01:3e:ea:49:e6:a2:35:bc:fa:f6:
         dd:95:8e:99:35:98:0e:36:18:75:b1:dd:dd:50:72:7c:ae:dc:
         77:88:ce:0f:f7:90:20:ca:a3:67:2e:1f:56:7f:7b:e1:44:ea:
         42:95:c4:5d:0d:01:50:46:15:f2:81:89:59:6c:8a:dd:8c:f1:
         12:a1:8d:3a:42:8a:98:f8:4b:34:7b:27:3b:08:b4:6f:24:3b:
         72:9d:63:74:58:3c:1a:6c:3f:4f:c7:11:9a:c8:a8:f5:b5:37:
         ef:10:45:c6:6c:d9:e0:5e:95:26:b3:eb:ad:a3:b9:ee:7f:0c:
         9a:66:35:73:32:60:4e:e5:dd:8a:61:2c:6e:52:11:77:68:96:
         d3:18:75:51:15:00:1b:74:88:dd:e1:c7:38:04:43:28:e9:16:
         fd:d9:05:d4:5d:47:27:60:d6:fb:38:3b:6c:72:a2:94:f8:42:
         1a:df:ed:6f:06:8c:45:c2:06:00:aa:e4:e8:dc:d9:b5:e1:73:
         78:ec:f6:23:dc:d1:dd:6c:8e:1a:8f:a5:ea:54:7c:96:b7:c3:
         fe:55:8e:8d:49:5e:fc:64:bb:cf:3e:bd:96:eb:69:cd:bf:e0:
         48:f1:62:82:10:e5:0c:46:57:f2:33:da:d0:c8:63:ed:c6:1f:
         94:05:96:4a:1a:91:d1:f7:eb:cf:8f:52:ae:0d:08:d9:3e:a8:
         a0:51:e9:c1:87:74:d5:c9:f7:74:ab:2e:53:fb:bb:7a:fb:97:
         e2:f8:1f:26:8f:b3:d2:a0:e0:37:5b:28:3b:31:e5:0e:57:2d:
         5a:b8:ad:79:ac:5e:20:66:1a:a5:b9:a6:b5:39:c1:f5:98:43:
         ff:ee:f9:a7:a7:fd:ee:ca:24:3d:80:16:c4:17:8f:8a:c1:60:
         a1:0c:ae:5b:43:47:91:4b:d5:9a:17:5f:f9:d4:87:c1:c2:8c:
         b7:e7:e2:0f:30:19:37:86:ac:e0:dc:42:03:e6:94:a8:9d:ae:
         fd:0f:24:51:94:ce:92:08:d1:fc:50:f0:03:40:7b:88:59:ed:
         0e:dd:ac:d2:77:82:34:dc:06:95:02:d8:90:f9:2d:ea:37:d5:
         1a:60:d0:67:20:d7:d8:42:0b:45:af:82:68:de:dd:66:24:37:
         90:29:94:19:46:19:25:b8:80:d7:cb:d4:86:28:6a:44:70:26:
         23:62:a9:9f:86:6f:bf:ba:90:70:d2:56:77:85:78:ef:ea:25:
         a9:17:ce:50:72:8c:00:3a:aa:e3:db:63:34:9f:f8:06:71:01:
         e2:82:20:d4:fe:6f:bd:b1
[root@cmxtry cmxadmin]#
 

PUBLIC CERTIFICATE:

[root@cmxtry cmxadmin]# openssl x509 -in cmxtry_com.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b2:9b:75:e9:4e:7b:43:bb:b1:26:0c:04:50:61:14:fc
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
        Validity
            Not Before: Aug  8 00:00:00 2018 GMT
            Not After : Nov  6 23:59:59 2018 GMT
        Subject: OU=Domain Control Validated, OU=Free SSL, CN=cmxtry.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a1:54:50:f5:c0:46:04:d6:dc:20:88:95:a2:f0:
                    d7:53:0d:13:45:78:eb:0a:99:6b:a3:d6:f1:db:69:
                    06:02:72:4f:35:e9:f2:98:44:d3:74:9e:26:fb:b4:
                    6c:d7:d0:48:a1:bd:3d:5a:aa:38:08:a5:82:c6:07:
                    55:88:95:90:0e:88:5f:19:b1:25:bd:d1:0b:70:e0:
                    fb:f8:78:19:ae:86:07:a1:8d:b8:c3:35:3e:ab:65:
                    82:15:6f:73:dc:37:1a:45:93:09:6a:08:ec:5c:f6:
                    79:5e:10:02:be:52:9b:fa:53:68:61:38:13:91:fd:
                    31:54:09:cd:a6:14:c6:82:d3:86:35:a4:3f:3c:7a:
                    97:f4:84:c2:e2:2c:13:98:55:83:50:46:51:fd:22:
                    30:6f:93:23:21:06:6c:30:68:b9:71:6e:ea:e1:24:
                    ca:af:27:45:54:35:e6:27:33:72:48:ad:a1:ab:db:
                    3d:c9:cf:1c:04:dd:8b:a7:61:c9:b1:a0:38:aa:d4:
                    1b:d4:a5:8e:2e:7c:d5:c5:46:80:31:53:7e:b0:e6:
                    d5:bd:85:7f:b0:e9:89:2e:d1:6f:28:a5:3d:3e:0d:
                    9c:b9:2a:36:2e:13:c1:56:d4:e9:75:b1:e4:48:3b:
                    b3:36:55:87:85:80:bd:53:1b:b6:fb:0c:2f:4f:01:
                    a3:41
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                keyid:90:AF:6A:3A:94:5A:0B:D8:90:EA:12:56:73:DF:43:B4:3A:28:DA:E7
 
            X509v3 Subject Key Identifier:
                FB:F0:37:89:52:B3:8A:0A:77:90:1A:1B:E8:FA:C6:10:C4:B5:F2:FB
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6449.1.2.2.7
                  CPS: https://secure.comodo.com/CPS
                Policy: 2.23.140.1.2.1
 
            X509v3 CRL Distribution Points:
 
                Full Name:
                  URI:http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl
 
            Authority Information Access:
                CA Issuers - URI:http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt
                OCSP - URI:http://ocsp.comodoca.com
 
            X509v3 Subject Alternative Name:
                DNS:cmxtry.com, DNS:www.cmxtry.com
            CT Precertificate SCTs:
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : EE:4B:BD:B7:75:CE:60:BA:E1:42:69:1F:AB:E1:9E:66:
                                A3:0F:7E:5F:B0:72:D8:83:00:C4:7B:89:7A:A8:FD:CB
                    Timestamp : Aug  8 12:34:59.717 2018 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:44:02:20:75:4D:27:A1:CB:4F:3F:B7:3B:75:1D:CC:
                                48:CA:B6:35:00:C0:D6:B8:0F:D6:14:86:B4:1E:2A:91:
                                E7:2D:0E:9E:02:20:11:C1:75:2F:5C:BA:EE:8F:C2:36:
                                FD:38:01:ED:28:80:E1:04:61:66:E7:56:ED:03:63:5F:
                                97:30:CB:2A:6A:55
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : DB:74:AF:EE:CB:29:EC:B1:FE:CA:3E:71:6D:2C:E5:B9:
                                AA:BB:36:F7:84:71:83:C7:5D:9D:4F:37:B6:1F:BF:64
                    Timestamp : Aug  8 12:34:59.571 2018 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:20:43:52:32:8D:BC:83:62:C0:7D:61:80:0F:
                                B8:3A:2A:63:86:FE:E8:1B:12:C4:B0:38:B3:F9:EE:E3:
                                FE:86:B7:A9:02:21:00:AA:13:5C:2E:35:7D:B7:00:65:
                                21:F7:CD:61:3F:2C:16:2D:85:49:00:E2:A6:8F:DD:0D:
                                9E:9F:B4:1A:9C:4B:FB
    Signature Algorithm: sha256WithRSAEncryption
         30:a1:97:ce:74:4d:50:bb:32:6a:b2:c9:c0:5b:1a:08:da:e4:
         dc:f5:1d:79:72:55:6a:dd:7e:ea:89:82:ef:dc:8b:62:8c:55:
         0b:b2:db:8a:41:77:fb:56:a6:2a:28:77:23:5f:c5:1e:e5:33:
         1f:70:96:0d:95:17:39:2a:78:f7:af:a7:ee:b0:bb:9a:3b:7d:
         d6:fb:e8:37:4c:39:d0:b8:df:c2:4f:96:38:9e:b8:28:af:b5:
         2c:aa:e6:47:1a:86:3a:44:78:76:64:30:39:dc:4a:7c:d1:8b:
         6c:3b:7e:9e:2c:df:2a:90:30:7f:3a:fc:6a:26:66:23:f5:44:
         53:2d:f5:91:a9:f8:61:b0:61:35:a1:d2:23:5b:89:5b:4a:46:
         be:09:1d:3d:0e:50:64:87:33:93:a8:30:a7:59:c2:a2:72:7f:
         e4:49:f2:5e:c4:a5:6c:d0:b4:6b:35:77:ef:50:47:5b:3e:88:
         65:a6:53:de:8b:22:8c:5d:4b:55:d9:0e:bb:53:08:98:a4:2f:
         49:ce:41:bc:6b:4f:6a:e4:97:54:2f:82:de:ff:19:f4:82:fc:
         f8:8e:af:b6:ae:d1:e7:35:cb:60:e9:28:43:95:aa:94:ef:00:
         39:1d:16:a0:db:32:6c:20:af:dd:d8:08:32:9a:4f:2e:dc:0c:
         a9:cd:6e:13
[root@cmxtry cmxadmin]#

 Install the certificates on CMX

CMX requires the certificate in the following format:

+++PRIVATE KEY+++

+++PUBLIC CERTIFICATE+++

+++CHAIN OF TRUST CERTIFICATE+++

    The Private Key - your_domain_name.key

    The Primary Certificate - your_domain_name.crt

    The Intermediate Certificate - issuer-certificate.crt

    The Root Certificate - TrustedRoot.crt

Basically we have the following situation:

cmxtry.com.key contains the Private Key
 
cmxtry_com.crt contains the Primary Certificate
 
cmxtry_com.ca-bundle - the Intermediate Certificate and the Root Certificate

All of those have to be concatenated together to form .PEM certificate:

[root@cmxtry cmxadmin]# cat cmxtry.com.key cmxtry_com.crt cmxtry_com.ca-bundle > cmxtry_com.pem

Next step will be changing the ownership of the certificate:

[root@cmxtry cmxadmin]#chown cmx:cmx /opt/haproxy/ssl/cmxtry_com.pem
[root@cmxtry cmxadmin]#chmod 744 /opt/haproxy/ssl/cmxtry_com.pem

When this is done, you can rename the certificate to host.pem (considering the backup of the certificate was done beforehand):

[root@cmxtry cmxadmin]#mv ./cmxtry_com.pem /opt/haproxy/ssl/host.pem

Now enabling the sslmode:

[root@cmxtry ssl]# cmxctl node sslmode enable
Enabling SSL
SSL enabled
Restarting Haproxy
Verified SSL by restarting Haproxy.
[root@cmxtry ssl]#

Troubleshoot

If you do not see the COMODO (other vendor) certificate in the CMX GUI after enabling the SSL, try rebooting the CMX device.