How to Replace the Self-Signed SSL Certificate in Securden Password Vault for Enterprises¶

By default, Securden Password Vault for Enterprises uses a self-signed SSL certificate. This article explains how to replace it with a Certificate Authority (CA)-signed certificate.

It covers the standard PKCS#12 (.pfx) certificate extraction process, along with more scenarios including legacy OpenSSL compatibility, manual certificate chaining, .p7b certificate conversion, certificate and private key verification, and an end-to-end example using a GoDaddy-issued certificate.

Prerequisites:

Install OpenSSL and ensure it is available from the command line.
Obtain the SSL certificate and its corresponding private key.
Before replacing the certificate, back up the existing files in the Securden installation's conf directory.

Phase 1: Prepare Your Certificate Files¶

Before replacing the self-signed SSL certificate, ensure that OpenSSL is installed and its bin directory is included in your system's PATH environment variable.

The steps required to prepare your certificate files depend on the format in which your Certificate Authority (CA) has provided them. Refer to the scenario that matches your certificate package.

Scenario 1: Standard .pfx File Extraction

Use this method if your CA has provided a standard PKCS#12 (.pfx) file containing both the SSL certificate and the corresponding private key.

Scenario 2: Legacy .pfx File Extraction (RC2-40-CBC Error)

Use this method if extracting a legacy .pfx file results in an RC2-40-CBC or unsupported algorithm error while using OpenSSL 3.x.

Scenario 3: Manual Certificate Chaining

Use this method if your CA provides the server certificate, intermediate certificate(s), and root certificate as separate files. In this scenario, you must manually create the certificate chain before deploying it in Securden.

Scenario 4: Converting a .p7b Certificate to .pem

Use this method if your CA has issued the certificate in PKCS#7 (.p7b) format. The certificate must first be converted to PEM format before it can be used with Securden.

The following sections describe each scenario in detail.

Scenario 1: Extracting the Certificate and Private Key from a Standard .pfx File¶

Securden requires the SSL certificate and its corresponding private key as separate files. If your Certificate Authority (CA) has provided the certificate in PKCS#12 (.pfx) format, follow the steps below to extract them.

Note

A .pfx (PKCS#12) file contains both the SSL certificate and its associated private key.

Step 1: Install OpenSSL

If OpenSSL is not already installed on your system, download and install it from:

http://www.slproweb.com/products/Win32OpenSSL.html

After installation, ensure that the bin directory under the OpenSSL installation path is included in your system's PATH environment variable.

Step 2: Copy the .pfx File

Copy your PKCS#12 certificate file (for example, certificate.pfx) to a location from which you can execute the OpenSSL commands.

Step 3: Extract the Private Key

Run the following commands to extract the private key from the .pfx file

openssl pkcs12 -in <certificate>.pfx -nocerts -out securden-key.pem -nodes

openssl rsa -in securden-key.pem -out securden-key.pem

Step 4: Extract the SSL Certificate

Run the following command to extract the SSL certificate:

openssl pkcs12 -in <certificate>.pfx -nokeys -out securden-cert.pem

Result:

After completing the above steps, you will have the following files:

securden-cert.pem -- SSL certificate
securden-key.pem -- Corresponding private key

These files are required to replace the self-signed certificate in Securden.

Scenario 2: Extract the Certificate and Private Key from a Legacy .pfx File¶

If you encounter the following error while extracting a PKCS#12 (.pfx) file using the standard procedure,

0308010C:digital envelope routines::unsupported

the .pfx file is likely encrypted using a legacy algorithm (such as RC2-40-CBC) that is disabled by default in OpenSSL 3.x. In such cases, use the OpenSSL legacy provider to extract the certificate and private key.

Step 1: Configure the OpenSSL Legacy Provider

Create a new System Environment Variable named OPENSSL_MODULES and set its value to your OpenSSL installation directory (for example, C:\ProgramFiles\OpenSSL-Win64\bin).

Open a new Command Prompt with administrative privileges and verify that the environment variable has been configured correctly.

echo %OPENSSL_MODULES%

Step 2: Extract the Private Key

Run the following command to extract the private key using the OpenSSL legacy provider.

openssl pkcs12 -provider default -provider legacy -in <certificate>.pfx -nocerts -out securden-key.pem -nodes

Step 3: Convert the Private Key

Convert the extracted private key to PEM format.

openssl rsa -in securden-key.pem -out securden-key.pem

Step 4: Extract the SSL Certificate

Run the following command to extract the SSL certificate using the legacy provider.

openssl pkcs12 -provider default -provider legacy -in <certificate>.pfx -nokeys -out securden-cert.pem

Important

Use the legacy provider only for extracting certificates and private keys from legacy .pfx files. Do not use it when creating or exporting new PKCS#12 (.pfx) files.

Result:

After completing the above steps, you will have the following files:

securden-cert.pem -- SSL certificate
securden-key.pem -- Corresponding private key

You can now use these files to replace the self-signed certificate in Securden.

Scenario 3: Manually Create a Certificate Chain¶

Some Certificate Authorities (CAs) provide the server certificate, intermediate certificate(s), and root certificate as separate files instead of bundling them into a single PKCS#12 (.pfx) file. In such cases, you must manually create the certificate chain before deploying it in Securden.

Important

The certificate chain must be arranged in the following order:

Server certificate

Intermediate certificate(s)

Root certificate

Step 1: Convert the CA Certificates to PEM Format

If your root or intermediate certificates are in .cer format, convert them to PEM format using the following commands.

Note

If the certificates are DER-encoded, include the -inform DER option.

   openssl x509 -in <trusted_ca>.cer -out trusted_ca.pem
   openssl x509 -in <root_ca>.cer -out root_ca.pem

Step 2: Create the Certificate Chain

Concatenate the server certificate with the intermediate and root certificates in the correct order using PowerShell.

Get-Content <clientcert>.pem, <trusted_ca>.pem, <root_ca>.pem | Set-Content clientcertchain.pem

This creates a single certificate chain file (clientcertchain.pem) containing the server certificate followed by the intermediate and root certificates.

Step 3: Create a PKCS#12 (.pfx) File

Ensure that you have the private key corresponding to the server certificate. This is typically the same private key that was generated when the Certificate Signing Request (CSR) was created.

Combine the certificate chain with the corresponding private key to create a PKCS#12 (.pfx) file.

openssl pkcs12 -export -inkey cert-key.pem -in clientcertchain.pem -out clientcertchain.pfx

Once the .pfx file has been created, follow the steps described in Scenario 1 to extract the SSL certificate (securden-cert.pem) and private key (securden-key.pem).

Scenario 4: Convert a .p7b Certificate to .pem¶

If your Certificate Authority has issued the SSL certificate in PKCS#7 (.p7b) format, you must first convert it to PEM format before using it with Securden.

Important

A PKCS#7 (.p7b) file contains only the SSL certificate and the certificate chain. It does not contain the corresponding private key.

To deploy the certificate in Securden, you must use the private key that was originally generated when creating the Certificate Signing Request (CSR) or obtain it from an existing PKCS#12 (.pfx) file or the server where the certificate was originally installed.

If the private key is unavailable, it cannot be recovered from the certificate or the .p7b file. In such cases, you must generate a new private key and CSR, and request your Certificate Authority to reissue the certificate.

Step 1: Convert the .p7b File to PEM Format

If the .p7b file is Base64 encoded, run:

openssl pkcs7 -in <cert>.p7b -print_certs -out cert.pem

If the .p7b file is DER encoded, run:

openssl pkcs7 -in <cert>.p7b -inform DER -print_certs -out cert.pem

Step 2: Prepare the Certificate for Deployment

If your Certificate Authority has also provided intermediate and root certificates, create the certificate chain as described in Scenario 3.

Once the certificate chain has been created, combine it with the corresponding private key to create a PKCS#12 (.pfx) file. You can then follow the steps described in Scenario 1 to extract the SSL certificate (securden-cert.pem) and private key (securden-key.pem) required for deployment in Securden.

Phase 2: Verify the Certificate and Private Key¶

Perform the below verification steps before copying the certificate files to the Securden server. Identifying issues such as an invalid private key, mismatched certificate, or incorrect certificate chain at this stage helps avoid service startup failures after deployment.

Step 1: Verify the Private Key¶

Run the following command to verify the integrity of the private key:

openssl rsa -check -noout -in securden-key.pem

If the key is valid, OpenSSL will report that the RSA key is valid.

Verify That the Private Key Is Not Encrypted

Open securden-key.pem in a text editor such as Notepad and verify that it begins with:

-----BEGIN PRIVATE KEY-----

and not:

-----BEGIN ENCRYPTED PRIVATE KEY-----

Important

Securden requires an unencrypted private key. If the private key is encrypted, it must be decrypted before deployment.

Step 2: Verify the SSL Certificate¶

To verify that the certificate is valid, temporarily rename securden-cert.pem to securden-cert.cer and open it in Windows.

If the certificate opens successfully and the certificate details are displayed, rename the file back to securden-cert.pem before proceeding.

Step 3: Verify That the Certificate and Private Key Match¶

Run the following commands:

openssl x509 -noout -modulus -in securden-cert.pem | openssl md5 

openssl rsa -noout -modulus -in securden-key.pem | openssl md5

Compare the output of both commands.

Important

The MD5 hash values must be identical. If the values differ, the certificate and private key do not belong to the same key pair and cannot be used together.

Phase 3: Apply the Certificate in Securden¶

After verifying the certificate and private key, deploy them to your Securden server.

Step 1: Copy the Certificate Files¶

Locate the following files:

securden-cert.pem
securden-key.pem

Step 2: Replace the Existing Certificate¶

Copy both files to the conf directory located under your Securden installation folder, replacing the existing certificate and private key.

Note

It is recommended to back up the existing certificate and key files before replacing them.

Step 3: Restart the Securden Service¶

Open the Windows Services console (services.msc) and restart the Securden VAULT service.

Once the service starts successfully, the new SSL certificate will be used for all HTTPS connections to Securden.

Troubleshooting Tips¶

Error 1: "Expecting: ANY PRIVATE KEY" Error¶

If the Securden service fails to start with the "Expecting: ANY PRIVATE KEY" error, the specified private key file is either invalid or does not contain an unencrypted private key.

Verify that:

securden-key.pem contains a valid private key.
The private key is not encrypted.
The certificate and private key belong to the same key pair (refer to the MD5 verification step in Phase 2).

Error 2: Unable to Extract the Certificate or Private Key from a .pfx File¶

Ensure that the original certificate file is a valid PKCS#12 (.pfx) archive containing both the SSL certificate and the corresponding private key.

If the extraction fails due to an unsupported algorithm or RC2-40-CBC error, follow the instructions in Scenario 2: Legacy .pfx File Extraction.

Error 3: Certificate Chain Issues¶

If your Certificate Authority has provided separate server, intermediate, and root certificates, ensure that the certificate chain has been created correctly as described in Scenario 3 before deploying the certificate.

Need Additional Assistance?¶

If the issue persists after completing the steps in this document, contact support@securden.com with the following information:

The certificate format (.pfx, .p7b, .cer, .crt, etc.)
The OpenSSL commands executed
The complete error message returned by OpenSSL or the Securden service

Example: Configuring a GoDaddy-Issued SSL Certificate¶

This example demonstrates how to prepare and deploy an SSL certificate issued by GoDaddy for use with Securden Password Vault for Enterprises.

Important

GoDaddy (and other Certificate Authorities) do not generate or provide the private key for your SSL certificate. The private key is created locally when you generate the Certificate Signing Request (CSR) and must be retained securely. It will be required later to deploy the certificate in Securden.

Part 1: Generate the Private Key and CSR¶

Before requesting a certificate from GoDaddy, generate the private key and Certificate Signing Request (CSR) on the system where the certificate will be deployed.

Option 1: Generate a New Private Key and CSR (Recommended)

Use this option when requesting a new SSL certificate.

Run the following command:

  openssl req -new -newkey rsa:2048 -nodes -keyout securden.key -out securden.csr

This command creates two files:

securden.key -- The private key. Keep this file secure and do not share it.
securden.csr -- The Certificate Signing Request that must be submitted to GoDaddy.

Open the securden.csr file in a text editor, copy the complete contents (including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines), and paste it into the CSR field when requesting the certificate through the GoDaddy SSL portal.

Option 2: Generate a CSR Using an Existing Private Key

If you already have the private key for the domain, generate a new CSR using the existing key.

openssl req -new -key existing_key.key -out new_request.csr

Part 2: Prepare the Certificate Files¶

After GoDaddy approves the certificate request, download the certificate package.

The downloaded ZIP file typically contains:

Your domain SSL certificate (*.crt)
The GoDaddy CA bundle (for example, gd_bundle-g2-g1.crt)

Convert the Certificates to PEM Format (If Required)

Some GoDaddy certificate files are already in PEM format. If the downloaded files are not in PEM format, convert them using the following commands:

    openssl x509 -in <domain>.crt -out domain.pem 

    openssl x509 -in <gd_bundle-g2-g1>.crt -out bundle.pem

Create the Certificate Chain

Combine the domain certificate and the CA bundle into a single certificate chain.

Important

The domain certificate must appear first, followed by the GoDaddy CA bundle.

Get-Content <domain>.pem, <bundle>.pem | Set-Content securden-cert.pem

At this stage, you should have:

securden-cert.pem -- Certificate chain (domain certificate + GoDaddy CA bundle)
securden.key -- The private key generated while creating the CSR

Part 3: Verify and Deploy the Certificate¶

Before deploying the certificate:

Verify that the certificate and private key belong to the same key pair by following the instructions in Phase 2: Verify the Certificate and Private Key.
Rename securden.key to securden-key.pem.
Copy securden-cert.pem and securden-key.pem to the conf directory in your Securden installation.
Restart the Securden VAULT service.

Security Best Practices¶

The private key generated while creating the CSR never leaves your system unless you explicitly copy or share it. Store this file securely and maintain an encrypted backup.

Important

If the private key is lost, it cannot be recovered from the issued certificate or the GoDaddy certificate bundle. You must generate a new private key and CSR, and request GoDaddy to reissue the certificate.