Certificates setup in server / keychain

Question

I have a server running OS-X Server 4.1. I had to reinstall completely and need to set up my SSL Certificates the right way.
A) Since I am new to Certificates I think I might have messed up something. Since it did not work immediately and since I had te reinstall everything I tried to install all certificates I received everywhere: LOGIN + SYSTEM.
In LOGIN I now have:
Certificate hostname (issued by StartCom Class 1 Primary Intermediate Server CA)
Certificate StartCom Certification Authority
Certificate StartCom Class 1 Primary Intermediate Server CA
Certificate StartCom Class 3 Primary Intermediate Server CA
IN SYSTEM I have
Certificate hostname (issued by IntermediateCA … OS-X Open Directory) + 2x public + 2x private keys
Certificate hostname (issued by StartCom Class 1 Primary Intermediate Server CA)
Certificate StartCom Certification Authority
Certificate StartCom Class 1 Primary Intermediate Server CA
Open Directory Server = hostname I don’t know if this is causing trouble, because I ended up with two certificates with the same name in keychain?
I learned that I don't need the underlined entries in LOGIN, but on "Symantec SSL checker" website it recommends for best practices to remove the self-signed root from the server. Is this right? How do I do this? At the same website it says:
"Multiple certificates were found with the same common name.
The certificate installation checker cannot determine which certificate is correct. Remove the incorrect certificate and try again."
Is this a problem? Why is this so? Maybe because SSL certificate and OD certificate have the same name?
B) In OS-X Server I now have two certificates listed:
     1. Certificate: hostname - issued by StartCom Class 1 Primary Intermediate Server CA
     2. Certificate: hostname - hostname OD Intermediate CA
I understand I need to use 1 (issued by SSL provider) to secure services? Could you use also the OD certificate?
C) When I try to manage the server from a client and try to connect via SERVER APP I get a message saying:
          'Server can't verify the identity of the server "server-hostname".'
Why is the connection not secured with my SSL certificate? I saw that you have KEYs and CERTIFICATEs in the Keychain in 4 different levels: Login, iCloud, System, System-Root. Sometimes you have "IDENTITY PREFERENCE". I guess that in identity preference you can choose which certificate to use for a particular service.
In the Identity Preference for COM.APPLE.SERVERMGRD I have 18 certificates listed. 3 of them have the name of my SERVER. 2 of them where issued by my SSL CA and one belongs to OPEN DIRECTORY. Are the 2 SSL CA issued Certificates the reason why SSL checker reports multiple certificates? How can I solve this? I only see one instance of Certificate hostname (issued by StartCom Class 1 Primary Intermediate Server CA) in SYSTEM Keychain?
If I try to change the Identity Preference for COM.APPLE.SERVERMGRD to one of the two Certificate hostname (issued by StartCom Class 1 Primary Intermediate Server CA) and try to login it does not get recognised on the client and is declared as self assigned CERTIFICATE.
Can someone help?

Answer 1

Hi Mikey,
I am not sure why you have kept the corporate network under the dmz zone. In general security practice we use to keep the dmz zone/dmz firewall for having the server/hosting environment where external parties requires access to those.... for example web server / application server.....
So your design requires some change in order to have a better architecture....
internet
|
router
|
external SW
|
internet facing firewalls
|
DMZ SW and Junp Server / Application Server (DMZ Interface of the Firewall).
Internet facing Firewall
|
LAN Interface SW (Inside Interface of the firewall)
|
LAN FW (If you really want to keep it)
|
Corporate Network
Regards
Karthik