EPO - Server Cert Error - The server certificate could not be updated since the uploaded private key

[rlrenne]

I am trying to update the Server Cert.  EPO 5.10 Upd  15.  

We Use in house Venafi to generate our certs. I generated the Cert and downloaded the PKCS-8 choosing separate CRT/KEY files.

I used OPENSSL to remove the Key Password and verified it by opening in Wordpad where it says 

"-----BEGIN PRIVATE KEY-----" at teh top.

When I try to upload them into EPO and hit save I get the error:

"The server certificate could not be updated since the uploaded private key file did not contain a valid private key."

I have an open SR with Mcafee Support and per their request.....today uploaded the Orion Log after trying the Cert Upload while EPO was in Debug mode.  

HELP!!!!  I have spent alot of time messing with this.  This should NOT be this difficult.  Any tips of tricks we are missing here to get this to work?

KB72477 is not helpful.

[cdinet]

You have to follow the section in kb72477 where it tells you to convert pkcs8 to pkcs1.  Read the section on if you have openssl version 3.x.

For OpenSSL version 3.x, use the commands below:

NOTE: This step is critical when using a higher version of OpenSSL or any method that generates the key in pkcs8 format. Currently, we don't support pkcs8 for the browser certificate, so it's necessary to convert the pkcs8 key to pkcs1. Both the commands need to be executed.

openssl pkcs8 -in c:\ssl\keys\mcafee.key -topk8 -nocrypt -out c:\ssl\keys\pkcs8mcafee.pem

openssl pkcs8 -in c:\ssl\keys\pkcs8mcafee.pem -traditional -nocrypt -out c:\ssl\keys\unsecured.mcafee.pem

To tell the difference between a pkcs8 and pkcs1 private key:

• PKCS#1 files specify the below algorithm:

-----BEGIN RSA PRIVATE KEY-----

• PKCS#8 files don't show the algorithm, and might also be encrypted:

-----BEGIN PRIVATE KEY-----

or

-----BEGIN ENCRYPTED PRIVATE KEY-----

[cdinet]

send me your SR number also please in private chat