Certificate validation error

[2confirm]

Whenever I try to install an SSL certificate (PEM format) I get the error "Certificate validation error". Does anybody have any suggestions? I really love this tool as it showed me several errors in my config right away.

[taylanbakircioglu]

Hi @2confirm — the PEM certificate validation flow was significantly tightened across v1.4.0 → v1.5.2. Latest stable is v1.5.2 — please upgrade; the generic "Certificate validation error" banner has been replaced with a per-rule error that tells you exactly which check failed. Thank you for the kind words!

What "Certificate validation error" used to mean

In pre-v1.4.0 builds the PEM upload path returned the same generic banner for several distinct failure modes:

• PEM with extra leading/trailing whitespace, BOM, or CR/LF line endings
• Missing intermediate certificate(s) — the chain wouldn't build to a known root
• Mismatch between the certificate CN / SAN list and the domain you were attaching it to
• Timezone-aware expiry_date against a TIMESTAMP WITHOUT TIME ZONE column → silent INSERT failure (Issue #10)
• Private key didn't match the public key in the certificate

What landed (v1.4.0 + onwards)

In v1.4.0 (commit 07942a8) the validation pipeline was rewritten to surface which rule failed instead of a generic banner:

• Encoding sanity — whitespace / BOM / CR-LF tolerance
• Chain validation — the bundle must verify against a known root; intermediates are auto-ordered
• Key/cert pairing — RSA / EC modulus match between the private key and the certificate
• SAN / CN match — the cert is refused before HAProxy ever sees it if it can't serve the domain you're attaching it to
• Expiry sanity — already-expired or not-yet-valid certs are rejected with the exact valid-from / valid-to dates in the error
• TIMESTAMP normalisation — Issue #10 fix; tz-aware dates are normalised to UTC tz-naive before INSERT

In v1.5.0 the Site Wizard's SSL step (Issue #14) extended this with a review + dry-run step that runs the proposed config through haproxy -c before anything touches the database.

In v1.5.2 (current) the same validation runs at preview time and is cluster-scoped, so SSL references restricted by cluster RBAC fail loudly during dry-run rather than at apply time.

Install (recommended — latest stable)

docker pull taylanbakircioglu/haproxy-openmanager-backend:1.5.2
docker pull taylanbakircioglu/haproxy-openmanager-frontend:1.5.2

Full installation guide and K8s manifest bundle: https://github.com/taylanbakircioglu/haproxy-openmanager/releases/tag/v1.5.2

If the error still shows after upgrade

Once you're on 1.5.2, the validator returns a specific message for each failure mode. If it still shows a generic error, please open a new issue with:

1. Output of openssl x509 -in cert.pem -noout -subject -issuer -dates
2. Output of openssl verify -CAfile chain.pem cert.pem (if you have intermediates available)
3. The exact UI failure message (now correlation-ID tagged)

Marking this as answered — happy to dig deeper if those three outputs reveal an edge case the validator misses.