I'm trying to implement Stud as an SSL termination point before HAProxy as a proof of concept for WebSockets routing. My domain registrar Gandi.net offers free 1-year SSL certs.
Through OpenSSL, I generated a CSR which gave me two files:
domain.key
domain.csr
I gave domain.csr to my trusted authority and they gave me two files:
domain.cert
GandiStandardSSLCA.pem (I think this is referred to as the intermediary cert?)
This is where I encountered friction: Stud, which uses OpenSSL, expects there to be an "rsa private key" in the "pem-file" - which it describes as "SSL x509 certificate file. REQUIRED."
If I add the domain.key to the bottom of Stud's pem-file, Stud will start but I receive the browser warning saying "The certificate is self-signed." If I omit the domain.key Stud will not start and throws an error triggered by an OpenSSL function that appears intended to determine whether or not my "pem-file" contains an "RSA Private Key".
At this point I cannot determine whether the problem is:
Free SSL cert will always be self-signed and will always cause browser to present warning
I'm just not using Stud correctly
I'm using the wrong "RSA private key"
The CA domain cert, the intermediary cert, and the private key are in the wrong order.
