You receive a certificate expired or certificate not found error on startup
Issue: When starting up the IMS service the HTTPS services stop working or provide a certificate expired error.
Applies To:
OpenIZ Immunization Management Server
Symptoms:
When starting up the IMS you see a log file which lists a certificate not found or certificate is invalid error
When navigating directly to the IMSI or AMI services (or any other service secured with a certificate) you notice a red address bar in the browser.
Cause: The primary cause of this error is either the certificate installed is not complete (does not have the private key), is expired (expiry time has passed), is not a valid SSL certificate for HTTP traffic (i.e. is a code signing certificate), or is not installed on the server.
Solution:
Verify the certificate is installed on the machine and has a private key: 1. Launch a new Microsoft Management Console by pressing Windows + R and typing mmc 2. Select File > Add / Remove Snap-In
If the certificate is not installed, you can import it. 1. Ensure that you acquire a PFX file from your certification authority. 2. Right click on the Personal folder in the administration console and select All Tasks > Import
Register the certificate in the configuration file 1. In the MMC panel (if you have not opened it see above) locate the certificate you want to secure your service with. Double click on the certificate and select the details tab. Locate the serial number attribute and copy the value.
Locate the appropriate <behavior> element. If necessary add the <serviceCredentials> element (if it is present do no add another entry, simply update the existing). Paste the copied serial number to the findValue attribute ensuring to remove any hidden characters or spacing between digits:
Open a command prompt as a Windows Administrative user.
Generate a random UUID for your registry entry (you can use https://www.uuidgenerator.net/)
Run the following command to reserve the SSL certificate substituting ipport with the public IP of the machine (or 0.0.0.0 for all IP addresses) and port the service is listening on, substituting certhash with the copied findValue from step #3.
Restart the OpenIZ host process with
net stop openiz
net start openiz
Last updated