CloudHub 2.0 - Private Space Degraded after Adding or Updating the TLS Context.

Verify the Certificate Chain:

You can verify the Certificate chain in various methods of your choice, also with the following OpenSSL commands

openssl verify -verbose -show_chain -CAfile <Root Certificate> -untrusted <Intermediate Certificate> <Leaf / Domain Certificate>

Example: 

openssl verify -verbose -show_chain -CAfile root/rootCA.crt -untrusted intermediate/intermediateCA.crt server/muletest.crt
Server/muletest.crt: OK
Chain:
depth=0: C=IN, ST=Tel, L=Hyd, O=SFDC, OU=Mulesoft Leaf Certificate, CN=*.muletest.com (untrusted)
depth=1: C=IN, ST=TN, L=CHN, O=Salesforce, OU=Mulesoft, CN=Mulesoft Intermedaite CERT , emailAddress=ak@muletest.com (untrusted)
depth=2: C=IN, ST=TEL, L=HYD, O=Salesforce.com, OU=Mulesoft, CN=Mulesoft Self Signed ROOT CERT , emailAddress=akshay@mulestest.com

The example shown above illustrates a successful certificate chain verification.

For the unsuccessful certificate chain output, please verify the following example.

openssl verify -verbose -show_chain -CAfile root/rootCA.crt -untrusted wrong_intermediate/intermediateCA.crt server/muletest.crt
C=IN, ST=Tel, L=Hyd, O=SFDC, OU=Mulesoft Leaf Certificate, CN=*.muletest.com
error 20 at 0 depth lookup: unable to get local issuer certificate
error server/muletest.crt: verification failed

How to upload the SSL/TLS certificate to the CH2.0 Private Space:

Upload your Leaf or Server Certificate in the Public Certificate Option, and upload the respective Private Key for your Leaf/Server Certificate in the Keystore Settings.

Provide the Key password if you have one, or if you don't have one, you can ignore this (it is recommended to have a Key Password for additional security) and make sure no characters are added into the provided Text Box if the key password is not available.

The Intermediate Certificates and the root certificates (if any are available) must be added to the CA Path Certificate(Optional).

Note: If you have multiple intermediate and root certificates, please create a single PEM file using any Plain text editor and combine the certificates in the order below. After saving the file, upload it to the CA Path Certificate(Optional).

-----BEGIN CERTIFICATE-----
(Intermediate certificate 1 - issuer of your Primary Leaf or Server certificate, which has been uploaded to the Public Certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE----- 
(Intermediate certificate 2 - issuer of the Intermediate certificate 1 ) 
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE----- 
(root certificate  - issuer of the Intermediate certificate 2 ) 
-----END CERTIFICATE-----

After adding the certificates, the page should resemble the example below. 

After verifying the certificates page, please proceed with adding/updating the TLS Context by clicking the “Create TLS Context” / "Update TLS Context" Option, which will be available at the bottom of the page.

Verify the Private space Status:

After adding the correct TLS Context to the private space, it should return to an “Active” status, and all applications deployed in CH2.0 Private Space should be accessible. If issues persist, please contact Mulesoft Support.