What password does OSX Server use when importing SSL certificates? I am migrating my website away from my home OSX server to a virtual Linux server, hosted within a proper data centre, and I have a problem with the SSL certificates I imported into OSX Server.

It appears to have stored the certificates into /etc/certificates however I don't know the passphrase it used to encrypted the key file.  It's not my normal account/keychain password, so I've no idea what passphrase it, or I, chose at the time.

(I have tried to get the original SSL certificates but that's not proving so easy either, but might be my only hope).

Could someone tell me how this works so I can untangle myself and use the certificates on the new website please?
It looks like OP's problem has been solved, but for the record it's actually fairly easy to get the keys from OS X Server, as long as you have admin access to the server. I'll give you two ways to do it:


Run the Keychain Access utility on the server, select "System" from the Keychains list, then "My Certificates" from the Category list under that. Select the relevant certificate on the right side of the window, then from the File menu choose "Export Items. In the export dialog, make sure the file format is set to "Personal Information Exchange (.p12)" to export both the private key and (public) certificate. It will ask for your admin name &amp; password to get access to the keychain, then ask for a new password to encrypt the exported file with.
The certificate and associated private key are also stored (as you said) in /etc/certificates. Make sure you get both the certificate (filename ending ".cert.pem") and matching private key (".key.pem"); you might also need the cert chain (".chain.pem"), which includes your certificate and the supporting certificates that vouch for its authenticity.

The private key file will be encrypted with a randomly-generated password. No problem; in order for server services to use this key, its password is stored (in the system keychain, actually) in a retrievable form. With admin rights, you can retrieve it the same way the web server does. Use this command (replacing server.example.com with the actual domain name):

sudo /Library/Server/Web/Config/apache2/getsslpassphrase server.example.com:443 RSA


It'll require your admin password, then spit out what looks like a GUID. That's the encryption password for the .key.pem file.

(Note: in older versions of OS X Server, getsslpassphrase was in /etc/apache2/ instead of /Library/Server/Web/Config/apache2/. Adjust as needed.)