The "PAS test server" certificate which is shipped with the product does not set the 'CA' basic constraint.

Create a new "PAS test server" self-signed certificate with the ‘CA' basic constraint set to 'true’. Note: The "PAS test server" self-signed certificate or any test certificates provided by Progress should not be used in a production environment.

The following steps are provided as an example on how to create a self-signed certificate to be used exclusively in a test environment:

• Follow step A2 from the following KB article: How to configure and test a PASOE instance for secure communications . Under the “[ v3_req ]” section, replace “basicConstraints = CA:FALSE” with “basicConstraints = CA:TRUE”.
• Start a Proenv session using the “Run as administrator” option and run the commands below.
• Go into the %DLC%\keys folder (or any other folder of choice): cd /D %DLC%\keys
• Generate a new private key: sslc genpkey -algorithm RSA -out private-key.pem
• Generate a certificate signing request (CSR): sslc req -new -key private-key.pem -out certificatesigningrequest.pem -subj "/O=Progress Software Corporation/OU=OpenEdge/CN=PAS test server"
• Generate self-signed certificate:

OpenEdge 12.8 or later
sslc x509 -req -days 3650 -copy_extensions=copyall -in certificatesigningrequest.pem -signkey private-key.pem -out self-signed.pem

OpenEdge 11.7 and 12.2
sslc x509 -req -days 3650 -extfile %DLC%\keys\policy\pscpki.cnf -extensions v3_req -in certificatesigningrequest.pem -signkey private-key.pem -out self-signed.pem

• Convert the certificate into a PKCS#12 (.p12) keystore and enter "password" as the export password: sslc pkcs12 -export -in self-signed.pem -inkey private-key.pem -out tomcat-keystore.p12 -name test
• Replace the <PASOE Instance>\conf\tomcat-keystore.p12 with the newly created “tomcat-keystore.p12” keystore.
• On machines that have .NET Open Client applications:
  • Import the new certificate into the “Current User\Trusted Root Certification Authorities\Certificates” Windows keystore (the optional -Enterprise parameter prevents the confirmation pop-up):

%WINDIR%\system32\certutil -Enterprise -user -addstore "Root" self-signed.pem

• On machines that have other OpenEdge clients:
  • Import the new certificate into the OpenEdge keystore:

%DLC%\bin\certutil -import self-signed.pem

• If the PASOE instance is managed through OpenEdge Explorer / OpenEdge Management, then import the certificate into the AdminServer's truststore:

procertm -i self-signed.pem %DLC%\certs\psccerts.jar

References to Other Documentation:

Release note OCTA-58716:
https://docs.progress.com/bundle/openedge-product-notes/page/Known-issues-in-OpenEdge-11.7.20.html

Release Note OCTA-58716:
https://docs.progress.com/bundle/openedge-product-notes/page/Known-issues-in-OpenEdge-12.2.16.html

Release Note OCTA-52510:
https://docs.progress.com/bundle/openedge-product-notes/page/Known-issues-in-OpenEdge-12.8.2.html

Progress Article(s):
How to configure and test a PASOE instance for secure communications
Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation