-
Title
The web user interface is not accessible because of certificate error SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION -
Description
After uploading a new server certificate for the web user interface, it is no longer accessible because of certificate error SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION. -
Cause
The web service does not start or the web portal gives an error because of incorrect certificate.
- The certificate has an unknown critical extension.
The browser gives the following error: SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION - The certificate is RSA PSS signed generated in Microsoft Active Directory Certificate Services.
- The certificate has an unknown critical extension.
-
Resolution
1. Generate a new not RSA PSS signed certificate.
2. Copy the new certificate in PEM format to the directory /mnt/firmware/root.
3. Log in to the core-shell.
4. Overwrite the old certificate with the new one .
cp /root/NEW_CERTIFICATE /etc/lighttpd/server.pem
5. Restart web service.
systemctl restart lighttpd
6. Log in to web user interface.
7. Upload the new certificate again at Basic Settings --> Management --> SSL certificate --> Server X.509 certificate.
8. Press Commit.
9. To test the new certificate, open a different browser and check if the authentication form appears correctly and can log in with a different user.
10. The issue was fixed in both products. Upgrade to the latest version available.
11. Upload the required RSA PSS signed certificate, that should be work properly after upgarding.