Okta Access Gateway Does Not Support Password-Protected SSL Certificates
Last Updated:
Overview
Okta Access Gateway (OAG) does not support password-protected Secure Sockets Layer (SSL) certificates. Uploading a password-protected certificate causes the service to fail upon restart because it requires manual password entry. Generate and upload a certificate that does not require a password to restore service functionality. Uploading a password-protected certificate prompts Okta to request a password. While the initial upload succeeds when providing the password, a subsequent service restart or system reboot requires the password again. Without the password, the service fails and Okta generates the following error:
Enter PEM pass phrase: service: [emerg] cannot load certificate key "test.key": PEM_read_bio_PrivateKey() failed (SSL: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error error:0907B00D:PEM routines:PEM_read_bio_PrivateKey:ASN1 lib)
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Access Gateway (OAG)
Cause
Okta Access Gateway requires an uninterrupted startup process. A password-protected certificate interrupts this process by prompting for a password during a service restart or system reboot. The service fails to start when the password prompt times out or when no input is provided.
Solution
How is the password-protected certificate issue resolved?
Generate and use a certificate that does not require a password. Because Okta Access Gateway does not generate signed certificates, work directly with the issuing certificate authority to obtain a certificate without password protection.
Access the Okta product documentation to review the requirements and process for obtaining a valid certificate.
