Validate the assigned certificate through the shell and OpenSSL to ensure the Okta Access Gateway (OAG) application presents the correct certificate. End users may not see the configured certificate for an application, requiring administrators to verify the certificate configuration and presentation.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)
• Certificate Management

How is the presented certificate validated using OpenSSL?

Execute the OpenSSL command from the client or directly on the appliance shell to view the presented certificate.

1. Run the following command from the client or the appliance shell.

openssl s_client -showcerts -connect <oag_server_ip>:443 -servername <Oag_app_public_domain>

Validate the certificate from the application configuration file.

Locate the application configuration file using labels, retrieve the associated certificate-key pair, and validate the certificate content to ensure it displays the correct domain values.

1. Locate the application configuration file using labels.

grep label /opt/oag/configs/nginx/conf.d/* | grep "<label>"

NOTE: For example, Okta Access Gateway displays the following output for an application labeled "Header Test".

$ grep label /opt/oag/configs/nginx/conf.d/* | grep "Header Test" 
/opt/oag/configs/nginx/conf.d/icsgw_app_374d0c61-6599-43f9-8f64-77a7d3c27e7d.active.conf:    set $label "Header Test";

2. Find the associated certificate-key pair using the retrieved filename.

grep ssl /opt/oag/configs/nginx/conf.d/<file_name_from_above>

NOTE: Referring to the previous example, Okta Access Gateway displays the following output.

$ grep ssl /opt/oag/configs/nginx/conf.d/icsgw_app_374d0c61-6599-43f9-8f64-77a7d3c27e7d.active.conf
    ssl_certificate_key "/opt/oag/nginx/ssl/%_domain_tld.key";
    ssl_certificate "/opt/oag/nginx/ssl/%_domain_tld.crt";

3. Validate the certificate content to ensure it displays the correct domain values. Okta Access Gateway stores all certificate-key pairs under /opt/oag/configs/nginx/ssl.

openssl x509 -noout -text -in <cert_file_name>

NOTE: Using the previous example, Okta Access Gateway displays the following output.

$ openssl x509 -noout -text -in /opt/oag/nginx/ssl/%_domain_tld.crt
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            19:<redacted>:e9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: <redacted>
        Validity
            Not Before: Jun  7 17:11:57 2024 GMT
            Not After : Jun  6 17:11:57 2026 GMT
        Subject: <redacted>

Investigate mismatched certificate values.

Review the NGINX cluster nodes or the front-end load balancer to identify the source of the incorrect certificate representation.

• If the associated certificate displays correct domain values but OpenSSL does not, an issue with the NGINX reload on the appliance may exist. Occasionally, one node in the cluster encounters this problem intermittently, resulting in the incorrect representation of the certificate.
• If both validation steps display the correct certificate, the front-end load balancer may present the old certificate. Refer to Old Certificate Still Being Presented for OAG Application for further troubleshooting.

Related References

• Old Certificate Still Being Presented for OAG Application