Did Apple Change how/where private keys are stored for SSL Certificates?

[rns3@psu.edu]

Today I had to reissue an SSL certificate for one of the multiple SSL domains I serve using OS X Server 10.4.10.

In the past, when you would create a Certificate entry in ServerAdmin under the certificates tab, a number of files would be generated in the directory /etc/certificates.

For the site sslsite.psu.edu the following would be created:

-rw-r--r--   1 root  wheel       1143 Oct  1 10:36 sslsite.psu.edu.chcrt 
-rw-r--r--   1 root  wheel       1135 Oct  1 10:36 sslsite.psu.edu.crt
-rw-r-----   1 root  certuser    2098 Oct  1 10:36 sslsite.psu.edu.crtkey
-rw-r-----   1 root  certuser     963 Oct  1 10:36 sslsite.psu.edu.key

.chcrt file contains a copy of the crt key, but the value is not the same as that in the .crt file.
.crt file contains the certificate that you upload from your certificate granting agency (Thawte)
.crtkey file contains both the Private Key and the certificate granting agency (Thawte)
.key file contains the Pirvate Key

But today when I created a new site called newssl.psu.edu only these three files were created.

-rw-r--r--   1 root  wheel          0 Oct 29 13:30 newssl.psu.edu.crt
-rw-r-----   1 root  wheel        753 Oct 29 13:31 newssl.psu.edu.csr
-rw-r--r--   1 root  wheel          0 Oct 29 13:30 newssl.psu.edu.key

Note the file size of the .key and .crt files (zero).

This creates a real problem for me, since I need to point to the private key file (newssl.psu.edu.key) in order to use CoSign. Since the new site has an empty .key file, CoSign is not able to work.

Since you never actually have access to the private key file if you use the server admin gui tool to create the CSR, how do you locate this file to use it for other such as CoSign?

Has anyone else noticed this change? Is there any documentation on this?

Please note, this is under 10.4.10.

Thanks in advance for any suggestions.

[Author]

Posts