Certificates are a Public Key and Identifying Information

learn more… | top users | synonyms (1)

0
votes
1answer
17 views

Subject not considered in a certificate with SAN

I have here a certificate with the subject "server01.department.company.com" and two subject alternative names "app1" and "app2". When I connect with app1 or app2 to the server all is fine. But when I ...
1
vote
1answer
36 views

Puppet revokes OpenSSL certificates

I'm experiencing some certification revokations in the puppet master and this behavior seems to be random. I just checked one of the CA certificates and I found this: # openssl crl -text -in ...
5
votes
2answers
255 views

How to allow login to a SMTP server better than with password?

I'm planning on creating a mail server, but I don't want to use passwords at all. They seem a wrong security choice to me. I'd love to use a certificate to login. This seems easy to do in HTTP, but I ...
5
votes
2answers
57 views

Outlook 2010 Warning About Old Cert that No-longer Exists on Exchange 2007 server

We've recently made a change to the Internal URLs of many of our Exchange Virtual Directories. Following that change, we're seeing end-users report errors from Outlook stating that the certificate ...
1
vote
1answer
24 views

Office365 Cert renewal

Do you need to purchase and renew a certificate for a hybrid setup of Exchange and Office365. We have multiple exchange servers setup on site for authentication but none of them have any specific cert ...
0
votes
2answers
67 views

Authenticating Client Certificates from Different Issuer

Ok, here's the scenario. A company called "Corp" issues SSL certificates to all their employees for accessing Corp's web resources. Corp also provides a certificate for their Certificate Authority so ...
3
votes
1answer
27 views

How well does haproxy scale for handling client certificate authentication?

My IoT company would like to use client certificate authentication to secure communications between each "thing" and a central server. We deploy about 30K things per year, and they have about a 5-year ...
3
votes
2answers
39 views

Are Windows internal CA-issued certificates compatible with Mac clients?

I am looking into deploying an internal CA to replace the GlobalSign certificates we use for our internal email encryption: Internal CA would be set up using ADCS in a two-tier hierarchy, no other ...
1
vote
0answers
68 views

Is it possible to use certificate from public CA for IKEv2 without importing intermediate cert?

I have configured ikev2 vpn on a strongswan server and a Windows 10 client, and it works fine. The authorization method is leftauth=pubkey and rightauth=eap-mschapv2. Because the leftcert to ...
1
vote
1answer
73 views

Find certificate file expiration with powershell

I know how to do this normally, but the problem is all of the certs in question are not installed on my local machine. I have a source control directory where they all sit, and I need to iterate over ...
0
votes
0answers
453 views

ASA Certifiate does not match the server name

I am trying to install a certificate on my Cisco ASA 5515, It has my local windows 2012 CA as a trusted CA. The domain has also had this CA applied to their trusted root. When ever i try and connect ...
1
vote
0answers
76 views

apache mod_proxy call back to content server with client certificate

Setup ServerA Apache running a HTTPS site, which requires a client certificate to connect. see infos below regarding /etc/apache2/sites-available/secure.site.conf and ...
1
vote
1answer
26 views

Are default parameters to 'openssl genpkey' sufficiently secure? [closed]

I know very little about openssl so I'm wondering whether the default parameters to openssl genpkey are sufficiently secure. If I run openssl genpkey -algorithm rsa I get a private key. But is it fine ...
0
votes
1answer
37 views

Associate a specific certificate to a specific local user with OpenVPN

Set up: OpenVPN 2.3 on centos server. Multiple clients (windows, osx, linux). Encyrption using certificates PER device (easy-rsa), and added authentication using the openvpn-plugin-auth-pam.so ...
2
votes
1answer
34 views

Puppet Agent - cert clean vs. fqdn duplicate

I couldn't find any answer to what happened in my puppet environment, that's why I hope somebody will explain it to me here. ENV: Foreman (Puppet CA), Puppet Master, Puppet Agent I have an oracle vm ...
1
vote
1answer
269 views

Verifying S/MIME signed message with OpenSSL without checking the certificate's purpose

The problem: When I sign a message with a certificate which is used for a HTTPS webserver, OpenSSL does not want to verify it back. Signing a message: echo "TestMessage" | openssl smime \ ...
2
votes
2answers
320 views

Access Denied Importing Certificate on Remote Machine

I'm trying to come up with a way to push out a certificate for install on multiple machines. The method I came up with is: Invoke-Command ServerName {Import-Certificate -FilePath "path" ` ...
2
votes
1answer
180 views

AD Certificate template - Enroll on behalf of

I'm trying to setup S/MIME for a few users, which requires certificates. I'm not using smartcards, and not using autoenrollment for these certificates. Server is running 2012R2. I created a ...
0
votes
1answer
148 views

OCSP ERROR in ssllabs output

I just renewed my certificate on https://wemarsh.com/ . After I thought I had everything working I did some online SSL tests, just as a routine check that everything is configured properly. Some of ...
1
vote
1answer
20 views

Offical signed certificate is not accepted from curl via repository commit

I have a signed certificate installed on my server. It is working fine, with the webserver. But if I am trying to commit something to a repository, I get the following error message: Warning: ...
0
votes
1answer
72 views

WSO2 Governance Registry: Cannot add Active Directory user store with certificates

I'am using wso2 governance registry 5.0.1 and have a problem to add an active directory user store. I succesfully added my certifactes (.crt files) to the JVM's truststore but have this error: [Root ...
1
vote
1answer
255 views

Chrome: Repeated “Your connection is not private” messages (self signed certificate)

We have a set of internal (dev/test/QA/ORT/preprod LAMP servers that we use self signed certificates for. Normally this isn't a problem - we just click the exception ("Proceed to w.x.y.z.(unsafe)") ...
1
vote
0answers
23 views

Impossible to send events from more than one non-domain windows server (2008, 2003) to WinRM collector (windows 2012)

We have problem with non-domain servers using certificates. We created certificates (through CA), installed one on collector (with good CN), second on first source server, third on second source ...
2
votes
1answer
204 views

Unable to sign certificates as CA using pkitool and easy-rsa script for OpenVPN .csr file

OpenVPN server on Ubuntu 14.04. Easy-rsa on the certificate authority server on Ubuntu 14.04. Done this way because I want the ca.key file to be separate from the machine that acts as the openvpn ...
0
votes
1answer
46 views

Is RRAS SSTP VPN using publicly signed certificate a bad idea?

Most guides for deploying SSTP on RRAS recommend setting up a private CA using AD CS, with all the necessary steps that come with that to issue a server authentication certificate and have it trusted ...
-1
votes
1answer
24 views

Validate the original certificate template [closed]

I need to verify from what template was copied a certificate template y have searched in all the tabs for info but i have found anything about what was the original certificate template. **the ...
2
votes
2answers
36 views

IIS 8.5 with Exchange 2013 creates and sends old intermideate certificate to client

I have a problem with strange behavior of IIS 8.5. The server hosts Exchange with configured SSL of course. The problem started when I replaced an intermediate certificate of StartCom from SHA1 to ...
0
votes
1answer
229 views

What are Best Practices for setting a https node server via a reverse-proxy without using Apache or Nginx

I am trying to get a Node https server accessed through a node proxy. I bought certificates and got a standalone https server working fine. Initially there were some hiccups because of multiple certs ...
2
votes
1answer
58 views

How does SSL client authentication work with changing IP address?

From what I understand about SSL authentication, the FQDN of the party I trust has to match the common name or one of the subject alternate names. Does this apply for client certificates as well? So ...
0
votes
0answers
25 views

Distribute a certificate within an organisation

I want to distribute a certificate (.cer file) to users within an OU. It is used to encrypt .pdf files so that only company machines with said certificate installed can view the file. I created the ...
0
votes
2answers
67 views

auto-accept SSL certificates in Windows

we use some software that will ssh to a bunch of machines and do something. The problem is in our test lab, the vm's are re-new (destroy and re-created) very often, so the software will treat the vm ...
0
votes
1answer
128 views

Why is a user getting a “proxy server isn't responding” message and causing HTTP 408 errors to be logged?

I have a user who can't get to my web site hosted on AWS EC2. This user is behind a corporate proxy server, and when they enter my URL, they get a "The proxy server isn't responding" message in IE and ...
0
votes
1answer
555 views

How to make Apache trust a client certificate using an unknown CA, without validating the CA

I am in the following situation. I need to set up a 2-way integration with an external system. The admin of the external system required me to send two CSRs, one to be used to generate a client ...
1
vote
1answer
202 views

How to make Apache trust a client certificate using an unknown CA, without validating the CA

I am in the following situation. I need to set up a 2-way integration with an external system. The admin of the external system required me to send two CSRs, one to be used to generate a client ...
0
votes
1answer
146 views

For 802.1x PEAP RADIUS Authentication, do you use a different certificate per server?

Consider an environment that uses 802.1x PEAP authentication via RADIUS. Typically, this is to authenticate wireless clients. In this environment there are multiple RADIUS servers and clients will be ...
0
votes
2answers
9k views

'openssl verify' outputs 'unable to get local issuer certificate'

In /etc/ssl, when I do sudo openssl verify mywebsite.pem I get a message stating mywebsite.pem: OU = GT46830179, OU = See www.rapidssl.com/resources/cps (c)15, OU = Domain Control Validated - ...
-1
votes
1answer
27 views

Windows certificate export vs Cert download in browser

We have a https ssl cert on our IIS server. Is there any difference between certificates that one exports (without private key) from certmgr vs the cert that one sees in the browser address bar? I ...
0
votes
1answer
180 views

Sonicwall SSLVPN Godaddy Certificate Trust Issues

Okay, I have a Sonicwall E5500 I'm trying to get SSLVPN working with my Godaddy SSL wildcard certificate. It seems to only throw errors when I try to use this certificate for the SSLVPN port. ...
3
votes
2answers
2k views

StartSSL cert doesn't work with Dovecot/OpenSMTPD

I've an issue with my StartSSL certificate. When I try to use it to activate SSL encryption on Dovecot, I get the following error in my log when a client attempt a connection to the imap server : ...
0
votes
1answer
378 views

Nginx proxying http to https with client certificate

We have an application that is not client-certificate aware and must consume a client-certificate authenticated web-service. To fix this, we're trying to use Nginx to reverse proxy a local (http) url ...
1
vote
1answer
51 views

Create a self-signed certificate to exchange SSL in W2003 SB

I'm doing a migration of some accounts in a local exchange server (W2003 server SB). Because of a limitation of O365 that seems to need SSL 993 connection to perform the IMAP migration, i need to ...
0
votes
0answers
28 views

EFS can decrypt a file but not re-encrypt after modification

I have a Windows 2008 R2 server with a shared folder containing an encrypted subfolder (EFS) for each user with important files. For security reasons 2 additional DRA's have been configured on the ...
0
votes
0answers
47 views

How to disable some ciphers in nsSSL3ciphers command?

Referring to Sun Directory Server Man Page Reference, can anybody tell whether - or + is really needed for scenario? I need to: enable only TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, and disable ...
2
votes
1answer
232 views

Tomcat two way SSL with APR loses client certificate after a few requests

I found that when accessing a web application that uses client certificate authentication run on Tomcat/APR (on Windows) with Firefox or Chrome, the client cert is "lost" after a short while. To the ...
0
votes
1answer
532 views

How to create a SSL certificate using SSL certificate text?

I have received a certificate from StartSSL for my domain in pure text which looks somewhat like: -----BEGIN CERTIFICATE----- [...]Many letters and digits[...] -----END CERTIFICATE----- I'm trying ...
0
votes
1answer
68 views

What is the Difference Between An Immediate Signing Certificate and an Intermediate Certificate?

I am doing some work with AWS, and in the process of uploading my certificate to AWS, the certificate chain I am uploading is throwing an error that says, The certificate chain must start with ...
0
votes
2answers
36 views

How to get CSR Value from KeyChain Access

So...probably a dumb question but I followed the instructions here And I'm trying to upload my CSR to digicert where the format is suppose to look like this -----BEGIN CERTIFICATE REQUEST----- ...
1
vote
1answer
142 views

Group policy removes certificate from personal store

We have a Code Signing certificate that is issued by our enterprise CA. We are using a group policy to deploy this certificate to the Trusted Publishers store on our domain computers. This works as ...
0
votes
0answers
225 views

Unable to load Cert into OpenLDAP userCertificate attribute

I having troubles to add particular cert into userCertificate attribute (DER encoded certificate) in standard scheme of openldap-servers-2.4.39-3.el7.x86_64 running on Centos7 Slapd uses: include ...
0
votes
1answer
44 views

Certification Authority CPS VS certificate template crypyography

I'm really confused,When I choose cryptography service provider for certification authority (RSA # microsoft software key storage provider), why again should I choose rsa algorithm at new ...