Hi Dan,

Every time I get into trouble with this, I email the cert authority (Comodo usually) and ask them to take the 30 minutes or so, to include IntraWeb's needs into account, as an option in the "Web Server" type selection. Those guys are experts. IntraWeb's needs are very similar to Apache. But why should I have to muck around with renaming files and splitting/joining files... all of which have similar and slightly cryptic names (at least to those not in the SSL business).

Dear Dan(s)

I think just being able to complain about it to you guys helped. Comodo was kind enough to give me a refund on my first attempt, so I tried again. Now more familiar with the naming conventions, I was able to successfully:

- Generate a CSR, with password, for the correct common name (domain name)
- Submit to Comodo, (got a 3 year this time) and select "Other" as the server type
- Simply rename the .key file generated by OpenSSL along with the CSR. to "key.pem"
- Rename the ".......Root.crt" file from Comodo to "root.pem"
- Rename the ".....<domain named file>.crt" to "cert.pem"

All the .pem files need to be in the same folder as the IntraWeb SA .exe

What was throwing me off was all the old instructions floating around that had me splitting and joining files and converting file types... all unnecessary.

My IntraWeb SA server is now alive and well. Thanks for being there for me in my time of need.

First step in more detail: (Always use the latest OpenSSL version)

To generate a CSR using OpenSSL

openssl req -nodes -newkey rsa:2048 -keyout <desired_file_name>.key -out server.csr

Last step in more detail:
To generate the Bag attributes, which allow Java (on mobiles) to see the cert chain and accept the certificate:
This assumes you have renamed your .crt as cert.pem

openssl x509 -in cert.pem -subject -issuer -out certout.pem > bag.txt

Open the file bag.txt and copy the text to the top of the cert.pem, add the extra lines shown, and make it look like this:

Bag Attributes
friendlyName: <your desired friendly name>
localKeyID: 00 ed 19 12 er 1b ef 2f 37 5s ab 52 4u 2y eq f9 13
subject= /OU=Domain Control Validated/OU=COMODO SSL/CN=<your domain name>
issuer= /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
-----BEGIN CERTIFICATE-----
...

The "localKeyID" is obtained by using Internet Explorer, Tools/Internet Options/ Content/ Certificates/ double click on your cert, look for the "Serial Number" field, copy the number shown.

Last step is to edit the Key file, then put part of the Bag Attributes at the start of the file, as shown :

Bag Attributes
friendlyName: JETLYT
localKeyID:00 ed 19 12 er 1b ef 2f 37 5s ab 52 4u 2y eq f9 13
Key Attributes: <No Attributes>
-----BEGIN PRIVATE KEY-----
...

This seems to work for me, on desktops and mobiles. Any better suggestions would be appreciated.