DSEE 6.3.1 and 2048-bit SSL certificates

Question

Related to my previous post, I'm standing up a new 6.3.1 proxy server and directory server instance that are being added to my existing environment. We use GoDaddy for SSL certificates and they require 2048-bit CSRs, which cannot be generated with 6.3.1 software. That being the case I generated the CSR for each host using openssl with the command:
openssl req -new -newkey rsa:2048 -nodes -out ldp05_domain_com.csr -keyout ldp05_domain_com.key -subj "/C=us/ST=Massachusetts/L=Cambridge/O=My Corp/OU=Network Operations/CN=ldp05.domain.com"I then took the CSR and received a new signed 2048-bit cert from GoDaddy. I added the GoDaddy root bundle certs into my CA cert chain and then attempted to add the server cert.
On the directory server I have the problem:
# dsadm add-cert /usr/local/ds/domain/ ldp05.domain.com /tmp/ldp05.domain.com.crt
Unable to find private key for this certificate.
Failed to add the certificate.I get the same error when attempting to add the certificate through DSCC.
I have a different problem with the 2048-bit certificate on the proxy server. I added the CA cert and that was fine. However, when I add the server cert, it shows up in the CA cert chain.
# dpadm add-cert /usr/local/dps/domain/ dps05.domain.com /tmp/dps05.domain.com.crt
# dpadm list-certs /usr/local/dps/domain/
Alias             Valid from       Expires on       Self-signed? Issued by                          Issued to    
defaultservercert 2011/02/25 10:08 2013/02/24 10:08 y            CN=dps05.domain.com:389 Same as issuer
1 certificate found.
# dpadm list-certs -C /usr/local/dps/domain/|grep dps05
dps05.domain.com     2011/02/25 11:43 2014/02/25 11:43 n         SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US      CN=dps05.domain.com, OU=Domain Control Validated, O=dps05.domain.comHas anyone successfully added 2048-bit CA signed certificates to both DPS and DS instances? Is there a limitation on the size of a certificate that can be imported as a non CA cert in directory proxy server 6.3.1?

Answer 1

Sadly after opening a case with Oracle support I was told that the hotfix wasn't built for Linux (which I'm running) and would take 1-2 weeks to complete. I have managed to solve 99% of the issue on my DPS host thus far and have only one remaining issue which is upon adding the cert.
In order to generate the 2048-bit CSR I had to run the following:
# cd /usr/local/dps/domain/alias
# modutil -changepw "NSS Certificate DB" -dbdir .
# certutil -R -s "CN=dps05.domain.com,OU=Network Operations,O=My Corp,L=City,ST=State,C=US" -o /tmp/dps05.domain.com.csr -d /usr/local/dps/domain/alias -a -g 2048For reference, running the dpadm command to set the cert db password didn't work.
# dpadm stop /usr/local/dps/domain
# dpadm get-flags /usr/local/dps/domain
# dpadm set-flags /usr/local/dps/domain/ cert-pwd-prompt=onOnce I had the properly sized CSR I had the cert issued and attempted to add the root certs to the CA chain and the server cert to the server certificates:
# dpadm add-cert /usr/local/dps/domain gd-root-bundle gd_bundle.crt
# dpadm list-certs -C /usr/local/dps/endeca |grep -i daddy
- This shows the Go Daddy root cert bundle in the CA cert chain
# dpadm add-cert /usr/local/dps/domain dps05.domain.com dps05.domain.com.crt
# dpadm list-certs /usr/local/dps/domain
- Shows only the defaultservercert
# dpadm list-certs -C /usr/local/dps/endeca |grep -i daddy
- The server cert now shows up in the CA chain.Does anyone have any idea how I can properly add the new cert to the server cert list so it can be used by the server?