Here's the openssl dump of ca-cert.pem: Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: O=juju, CN=juju-generated CA for environment "rsyslog" Validity Not Before: Jan 28 05:24:43 2015 GMT Not After : Feb 4 05:24:43 2025 GMT Subject: O=juju, CN=juju-generated CA for environment "rsyslog" Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (1024 bit) Modulus: 00:c4:9d:e0:4d:cb:66:f8:cf:b3:a4:7c:d9:51:fe: cb:6b:fe:71:cc:16:6e:64:38:c0:dc:ae:57:ed:82: 41:eb:95:80:e7:ab:29:b9:bd:82:0b:71:82:1e:62: 91:5e:2e:f9:c5:a8:8f:8b:c0:e1:97:28:47:65:e2: 69:20:d8:86:17:ca:18:96:63:78:9a:d3:6b:1b:45: 90:ab:c4:d1:60:a0:09:82:84:66:05:93:82:e2:9d: 36:96:f8:e3:48:b9:59:ce:fd:54:d9:b9:41:bb:39: 61:ad:ab:92:01:eb:50:eb:b8:ef:2a:31:7f:7e:d9: bc:6a:1a:31:f1:80:20:0b:cd Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment, Certificate Sign X509v3 Basic Constraints: critical CA:TRUE X509v3 Subject Key Identifier: 8B:AE:D9:4E:D2:DA:89:E1:F6:3F:4F:F9:F1:25:48:D2:E6:BF:81:2F X509v3 Authority Key Identifier: keyid:8B:AE:D9:4E:D2:DA:89:E1:F6:3F:4F:F9:F1:25:48:D2:E6:BF:81:2F Signature Algorithm: sha1WithRSAEncryption 32:78:0e:53:05:7d:60:db:7b:33:63:4c:8c:c5:c5:64:10:fa: 9b:29:26:24:85:ab:35:b1:01:24:37:48:79:59:5c:a8:36:ea: 0d:1a:83:71:6e:4e:12:1c:7a:93:7f:72:b9:e0:be:c9:a8:49: 68:61:1f:a8:fb:b1:e3:83:6f:62:5d:2e:90:91:e7:94:6c:9c: f9:65:4a:c4:d8:c7:d0:81:4e:74:14:cd:f5:ae:c9:99:06:2e: 34:e0:70:03:71:4b:e6:3e:9c:11:11:62:a0:ad:31:5e:4a:13: 8d:29:f9:ce:a1:d9:4f:d1:e7:cd:46:46:9a:f0:61:de:4c:2e: 08:9e Here's the corresponding dump of rsyslog-cert.pem: Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: O=juju, CN=juju-generated CA for environment "rsyslog" Validity Not Before: Jan 28 05:01:18 2015 GMT Not After : Feb 4 05:01:17 2025 GMT Subject: O=juju, CN=* Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (1024 bit) Modulus: 00:ae:5f:ea:b1:34:28:32:bc:bd:4e:dd:97:46:5f: 4c:c6:57:9d:1a:fb:d3:3f:01:07:22:b5:45:9b:ba: b9:79:d2:5e:0a:cb:5a:c5:b0:53:bf:9c:e7:0d:2a: 72:1b:c3:e2:2d:90:b4:7c:b7:6d:5e:df:5d:ac:50: 67:bc:63:18:f1:35:7e:42:8b:41:48:28:a5:6d:36: c0:b7:35:ab:a4:02:28:14:e1:a6:be:69:fd:fa:6a: d7:6c:d3:7c:96:55:97:1d:f1:f8:a7:86:a0:d2:61: 27:7d:55:86:98:ab:20:97:75:f1:36:5c:60:18:37: ec:a6:bb:4f:8d:1f:3e:53:af Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment, Key Agreement X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 Subject Key Identifier: AF:BE:43:E3:57:E1:46:D4:27:1F:50:B3:11:FE:4B:4D:CB:89:AE:43 X509v3 Authority Key Identifier: keyid:5A:33:85:06:E7:42:0B:FF:1A:A5:AC:9E:E7:71:67:1F:CB:AD:E9:42 X509v3 Subject Alternative Name: DNS:rasalhague.lcy03.canonistack, DNS:*, IP Address:10.49.4.0, IP Address:FE80:0:0:0:2E76:8AFF:FEB0:7320, IP Address:FE80:0:0:0:2E76:8AFF:FEB0:7320, IP Address:FE80:0:0:0:2E76:8AFF:FEB0:7320, IP Address:FE80:0:0:0:2E76:8AFF:FEB0:7320, IP Address:FE80:0:0:0:E45D:39FF:FE10:45B, IP Address:FE80:0:0:0:5401:BEFF:FEF4:3126, IP Address:FE80:0:0:0:E45D:39FF:FE10:45B, IP Address:FE80:0:0:0:60D0:18FF:FE74:1E62, IP Address:FE80:0:0:0:CCF1:82FF:FECA:3024 Signature Algorithm: sha1WithRSAEncryption 74:f3:5b:c3:80:af:a9:8b:95:98:fc:b2:0d:06:78:52:77:d7: 3c:30:39:ad:ae:73:37:0c:dd:a5:4d:5b:83:ac:1f:57:38:3c: b0:34:89:31:47:52:84:69:90:c0:f5:29:8a:41:49:54:1c:1c: 64:89:5f:25:0c:53:4f:c9:0f:98:fc:74:b7:c6:a0:79:9c:30: 51:b0:09:79:44:bd:13:67:d3:c9:fb:2b:4f:dc:28:11:d8:20: 38:bf:14:2e:51:8e:a6:09:ef:85:ff:cd:f7:3f:34:c9:48:48: 33:58:3c:6b:df:bc:fe:52:36:8d:70:17:3e:08:85:4c:ae:95: 03:64