Ok.. just to close the loop on this a little bit.. this was a bug in mono.. I'm posting this here and in the sonarr.tv forums in case others run into issues and look in either place.
I found a repository that has up to date mono releases built.. I did jump through some hoops before I found this out, so what I'm outlining below isn't the exact process I went through.. but it is what I think will work for someone else if anyone is having SSL troubles w/ nzbdrone.
Add this repo to debian/ubuntu:
sudo add-apt-repository ppa:inizan-yannick/mono
sudo apt-get update
sudo apt-get upgrade
That should update mono to 3.10 (or newer) (which looks older than the stock ubuntu package, but apparently the decimal system doesn't mean anything in versioning.. 3.10 is > 3.2 believe it or not..
Then you can TRY firing up nzbdrone and seeing if openssl reports a proper cert via this test:
openssl s_client -host localhost -port <sslport>
As mentioned before, this is not the exact path I took.. so if that doesn't work right off the bat, you can try these two things..
1) rerun the httpcfg step @
https://github.com/NzbDrone/NzbDrone/wi ... inux--os-x to see if the updated mono/httpcfg will fix your cert install
OR
2) follow the linux instructions on
http://help.screenconnect.com/SSL_certi ... stallation which is just another application that uses "mono" and had similar issues.. they patched their version of mono (which you just did above) and then they run this exe from
http://help.screenconnect.com/images/f/ ... urator.zip, which is a package of CMD scripts that needs to be run on a Windows box. To run that, drop your private key in your current directory (on windows) and name it ScreenConnectPrivateKey.key and have your third party signed cert in the same current directory named with a .CER extension (not .CERT or anything else).. then follow the script's prompts to set your current directory and doing the linux path and then the 3rd step to build a linux package for your cert. I forget how they worded it exactly. You'll end up with a ScreenConnectSslFiles.tar.gz tarball that you can transfer back to your linux box and untar it, then rsync (or whatever recursive copy/move method you desire) the .mono subdirectory out of the App_Runtime/etc/ path prefix over to where ever your nzbdrone/sonarr .mono directory tree is.. if you run nzbdrone on a port other than 443, you'll need to go rename the two port files in .mono/httplistener from 443.* to whatever.*..
That should be it.. just restart nzbdrone/sonarr afterwards and rerun the openssl test.. It worked for me.. I did the ScreenConnect script step first and it didn't work because my mono version was too old.. then after upgrading mono, it works wonderfully. If you have/had this issue, please report back if you had to do the ScreenConnect step or not.