0
votes
0answers
27 views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
1
vote
0answers
33 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
0
votes
0answers
25 views

APNS server side Entrust certificate installation process

To ensure you can continue to validate your server's connection to the Apple Push Notification service, you will need to update your push notification server with a copy of the 2048-bit root ...
1
vote
2answers
266 views

How to change root CA certificate?

I am running an own CA for my network, just to have it installed into the browser, so that I can see if a server still has the certificate I created (vulgar: having the green lock). Of course I just ...
0
votes
1answer
49 views

How should I structure my CA hierarchy?

My current setup involved a self signed root CA, which has then signed my SSL/TLS CA and my OpenVPN client CA. The SSL/TLS CA signs the certificates of my servers, and the OpenVPN client CA signs the ...
3
votes
2answers
203 views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
0
votes
0answers
47 views

How to get/build a CA bundle file from a local OpenSSL CA

If I establish a standard OpenSSL CA directory structure and presence (such as by using "CA.sh -newca"), how do I get/build a CA bundle for it? I don't have anything that resembles something like the ...
1
vote
0answers
74 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
0
votes
1answer
49 views

OpenSSL not using CA directory

OpenSSL will not verify a cert $openssl s_client -connect <host>:443 ... Verify return code: 21 (unable to verify the first certificate) However, if we figure out the location of the store $ ...
2
votes
1answer
77 views

Openvpn signing certificates with wrong CA

I have a working (until now) ubuntu openvpn server. I think that my server is using a wrong CA to sign client CRTs. E.g: I use "source ./vars" followed by "./build-key john.doe" and it all works ...
0
votes
1answer
125 views

OSX doesn't recognize certificate's signing authority

I have my own root certificate that I have imported into my OSX 'login' keychain and told it to trust across the board. I am now creating a certificate for S/MIME. I create the CSR in Keychain Access ...
3
votes
2answers
264 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
0
votes
1answer
467 views

Generating SAN SSL Certificate that works for firefox and chrome

I am trying to generate a SSL certificate that after being signed by my own CA will work for multiple domains. My openssl configuration file looks like this: [ req ] default_bits = 2048 ...
1
vote
0answers
115 views

How to properly replace CA certificate when clients get it bundled in PKCS#12 containers?

I'm about to regenerate a certificate of my CA (maintained by OpenSSL) used mostly to provide OpenVPN access to the intranet for my clients. My question is related to this one — "Certification ...
0
votes
0answers
58 views

Combining CA's into a single PEM

I have been wondering if it is possible to combine two CA certificates into a single .pem, then use that pem to allow clients with certs signed by either CA to create TLS connections with an LDAP ...
0
votes
1answer
215 views

Can't get self-signed CA cert to request corresponding client cert; Apache

I'm running Apache 2.2 on Windows, and have mod_ssl working fine for delivering a commercially signed server cert. (A wildcard cert, though I don't think it matters.) I'm trying to get the server, ...
2
votes
4answers
3k views

Nginx and client certificates from hierarchical OpenSSL-based certification authorities

I'm trying to set up root certification authority, subordinate certification authority and to generate the client certificates signed by any of this CA that nginx 0.7.67 on Debian Squeeze will accept. ...
1
vote
2answers
3k views

Can't make httpd use correct SSL

I have a signed CA, issued by my university. I generated my CSR using their public key file as so: openssl genrsa -out myservername.key 2048 (new key) openssl req -new -key myservername.key -out ...
1
vote
1answer
209 views

How to extract CRL location from x509 certificate using OpenSSL utility

I need to extract the crl location from a certificate authority so I can use that in verifying certificates. Is this possible using the openssl utility other than using the -text option and attempting ...
2
votes
2answers
166 views

“Countersigning” a CA with openssl

I'm pretty used to creating the PKI used for x509 authentication for whatever reason, SSL Client Verification being the main reason for doing it. I've just started to dabble with OpenVPN (Which I ...
2
votes
1answer
787 views

openssl req sets wrong “not after” date (overflow bug?)

I tried to gernerate my own root CA with a validity of 40 years as follow: openssl req -new -newkey rsa:4096 -x509 -days 10950 -extensions v3_ca -keyout myca.key -out myca.crt -config ...
2
votes
1answer
211 views

How do I set up my own CA for certs and begin importing it in my Computers and/or browsers

I'd like to set up my own Certificate Authority to sign things that are only used internally. Does anyone have any steps they've used to set up their own CA and begin signing certs. I'd also like to ...
2
votes
1answer
2k views

Sign an OpenSSL .CSR with Microsoft Certificate Authority

I'm in the process of building a Debian FreeRadius server that does 802.1x authentication for domain members. I would like to sign my radius server's SSL certificate (used for EAP-TLS) and leverage ...
1
vote
2answers
4k views

apache Client Certificate Authentication errors: Certificate Verification: Error (18): self signed certificate

So I have been following instructions on setting up Client Certificate Authentication in Apache2 w/ mod_ssl. This is solely for the purpose of testing an application against CAA, not for any sort of ...
2
votes
1answer
910 views

Why might Windows falsely claim a self-signed root CA certificate is revoked?

I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various ...
1
vote
1answer
287 views

Linux Certification Authority signing Windows 2003 Server certificate requests

I've had some success using a Windows 2003 Server running as a Certification Authority signing certificates used in secure communications between Ubuntu Linux and Active Directory on Windows 2003 ...
20
votes
4answers
11k views

Certification authority root certificate expiry and renewal

In 2004, I set up a small certification authority using OpenSSL on Linux and the simple management scripts provided with OpenVPN. In accordance with the guides I found at the time, I set the validity ...
0
votes
1answer
124 views

Generating SSL certificates

I use following commands to create certificates and private keys: ./CA.pl -newca ./CA.pl -newreq-nodes ./CA.pl -signreq And I set newcert.pem and newkey.pem as local certificate and private key ...
0
votes
3answers
3k views

SSL troubles - Generate .key from .crt? (AlphaSSL)

This is greatly troubling me, I have generated a .csr and .key file to send to dynadot (which sends that to AlphaSSL) with this command: openssl req -out foo.com.csr -new -newkey rsa:2048 -nodes ...
0
votes
1answer
269 views

Creating an MS Certificate Authority using CA Root Certificate created with OpenSSL

Using the guide here: http://www.davidpashley.com/articles/cert-authority.html I have create a certificate authority using OpenSSL. However I would now like to use the Microsoft CA instead. The ...
15
votes
2answers
2k views

Can MS Certificate Services be a Subordinate to CA created with OpenSSL

I want to setup a enterprise certification authority for my domain. So I can issue certificates for various purposes. I would like to follow the best practice of having an offline CA as the root, ...