SRX

 View Only

  • 1.  HTTPS Post request failed. 2002 – unable to get issuer certificate ( Wildcard)

    This message was posted by a user wishing to remain anonymous
    Posted 27 days ago
    This message was posted by a user wishing to remain anonymous

    Hello,

    we are experiencing an issue on an SRX345 when using a wildcard certificate with Juniper Secure Connect for SSL VPN access.

    When users attempt to connect, the client fails during certificate validation and returns the following error:

    "HTTPS Post request failed. 2002 – unable to get issuer certificate"

    The problem occurs only when we use a wildcard certificate (*.domain.com) issued by a trusted public CA. If we replace it with a self-signed certificate generated directly on the SRX345, the VPN connection works correctly.

    The wildcard certificate and private key were successfully imported on the device and correctly associated with the SSL VPN gateway. The certificate is valid and not expired, and the FQDN used by clients matches the certificate CN/SAN. When accessing the same FQDN via a web browser, there are no certificate warnings.

    Do the intermediate CA certificates need to be manually imported and bound, or are there specific requirements for installing the certificate chain for SSL VPN on the SRX345?

    We followed the instructions in the following article to upload the certificate on the SRX345:

    https://supportportal.juniper.net/s/article/SRX-How-to-load-a-PKI-X-509-certificate-using-J-Web-for-secure-web-access

    Thank you in advance.



    -------------------------------------------


  • 2.  RE: HTTPS Post request failed. 2002 – unable to get issuer certificate ( Wildcard)

    Posted 26 days ago

    It's been a while since I've had anything web-based enabled on the SRX but if I recall correctly, for publicly-trusted certs, I'd the entire chain in the same PEM file. I certainly don't remember the sequence though -- either the root cert is on top, following by the intermediary and then the device, or the device, then intermediary and then the root.

    Also, I'm pretty sure I cheated a little bit -- importing only the device certificate to avoid errors, and then editing the PEM in shell manually to make it include the entire chain. After thrashing around with different configuration manuals and recommendations, that's how I was able to get the web server in the SRX to provide the full cert chain to clients. Check out https://www.ssllabs.com/ssltest/ for testing.



    ------------------------------
    Nikolay Semov
    ------------------------------

    Original Message


  • 3.  RE: HTTPS Post request failed. 2002 – unable to get issuer certificate ( Wildcard)

    Posted 26 days ago

    I'm also seeing this issue for secure connect VPN  - HTTPS Post request failed. 2002  - if I use a self signed it works fine...  ( for the https) but not for a  3rd party signed cert  - any input as this subject seems to very light on the Juniper site...  

    -------------------------------------------

    Original Message


  • 4.  RE: HTTPS Post request failed. 2002 – unable to get issuer certificate ( Wildcard)

    Posted 25 days ago

    Do use this and the corresponding code as per Juniper?

    pki {

            ca-profile Xfinity-EAP {

                ca-identity c-xx-xx-xx-xx.hsd1.xx.comcast.net;

                revocation-check {

                    disable;

                }

            }

            ca-profile MySRX300-x-EAP {

                ca-identity MySRX300-x.hsd1.xx.comcast.net;

                revocation-check {

                    disable;

                }

            }

       }



    ------------------------------
    Adrian Aguinaga
    B.S.C.M. I.T.T. Tech
    (Construction Management)
    A.A.S. I.T.T. Tech
    (Drafting & Design)
    ------------------------------

    Original Message


  • 5.  RE: HTTPS Post request failed. 2002 – unable to get issuer certificate ( Wildcard)

    Posted 19 days ago

    This usually happens when the full certificate chain isn't installed on the SRX. Even though the wildcard cert works fine in a browser, the Juniper Secure Connect client doesn't fetch intermediate certificates automatically like browsers do. If the intermediate CA certs aren't imported and properly linked on the SRX345, you'll get the "unable to get issuer certificate" error. Since the self-signed cert works, your VPN config is probably fine. I'd recheck that the intermediate CA certificate(s) are manually imported and that the SRX is presenting the full chain during the SSL handshake. That's almost always the cause in this scenario.



    ------------------------------
    AL Ahlee
    ------------------------------

    Original Message