Certificate upload failed on v4.20.0

[sandabot]

I'm trying to set up a ssl cert for the console urls, following this tutorial

I set up a *.console.company.com A consoleproxyIP record in the DNS zone, I bought a wildcard ssl , but whenever I try to upload the cert&private key I get this error.

I also tried with cmk, same thing. The wildcard cert is bought from ssls.com (not an ad) . The private key is in the right PKCS#8 format but I don't think that's the issue, cloudstack can't parse the certificate. I tried writing some random strings in the fields but I get the same thing. Is it a 4.20.0 bug?

[SviridoffA]

@sandabot In the ROOT certificate field, you must insert the CA certificate from the issuing CA where you issued your certificate instead of the "wildcard". You may also need to insert an intermediate certificate (button below).

[sandabot]

Yeah, embarassingly easy sollution, thank you!

Got confused by the placeholder and info card that stated otherwise, but makes total sense now.

And weird enough, after adding the domain and activating the ssl in the global settings, it just works, console links are working at https://console.company.com/resource/noVNC.....

Could this be done without the wildcard ssl? only with a console.company.com ssl?
Also, After uploading the cert, is there a place in the UI to manage it? Or at least be aware of it's presence that's uploaded and running?

[SviridoffA]

Could this be done without the wildcard ssl? only with a console.company.com ssl?

CloudStack has three configuration options. Take a look at this quote from the ShapeBlue article; it's also in the documentation somewhere, but I can't find it quickly.

The URL configurations can take three formats – and these also determine what kind of TLS certificate is required.

Blank: if left blank / unconfigured the URLs used for CPVM and SSVM will simply be passed as the actual public IP addresses of the system VMs.
Static URL: e.g. console.mydomain.com or ssvm.mydomain.com. In these cases CloudStack rely on external URL load balancing / redirection and/or DNS resolution of the URL to the IP address of the CPVM or SSVM. This can be achieved in a number of different ways through load balancing appliances or scripted DNS updates.
This configuration relies on:
The same URL used for both CPVM and SSVM, or
a multi-domain certificate provided to cover both URLs if different ones are used for CPVM and SSVM.
Dynamic URL: e.g. *.mydomain.com. In this case CloudStack will redirect the connections to the CPVM / SSVM to the URL “a-b-c-d.mydomain.com” where a/b/c/d represent the IP address, i.e. a real world URL would be 192-168-34-145.mydomain.com.
This relies on two things:
DNS name resolution configured for the full public system VM IP range, such that all combinations of “a-b-c-d.mydomain.com” can be resolved. Please note in CloudStack version 4.11 the public IP range used purely by system VMs can be limited by reserving a subrange of public IP addresses just for system use.
An TLS wildcard certificate covering the full “mydomain.com” domain name.

You can find this article here: https://www.shapeblue.com/securing-cloudstack-4-11-with-https-tls/

Also, After uploading the cert, is there a place in the UI to manage it? Or at least be aware of it's presence that's uploaded and running?

As far as I know, you can't, but you can always check it via the browser's address bar. There might be some ways to do it through cloudmonkey, but I haven't used this way, so I can't say for sure.