Certificates are a Public Key and Identifying Information

learn more… | top users | synonyms (1)

380
votes
3answers
355k views

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I Google for tutorials and beat away until it finally works. However, in my searches ...
31
votes
2answers
13k views

How can I work around problems with certificate configuration in Remote Desktop Services?

I am setting up a Remote Desktop Services farm, and am having trouble configuring certificates for it to use. A demonstration of the problem I'm seeing can be found in Step #4. At this point I am ...
29
votes
4answers
4k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact ...
25
votes
2answers
9k views

Can I build my own Extended Validation SSL certificate?

I can create by own CA and generate a self signed SSL certificate this way. But what does it take to make the browser show the certificate as being an "Extended Validation SSL certificate" ? Can I ...
22
votes
7answers
19k views

Wildcard SSL certificate for second-level subdomain

I'd like to know if any certificates support a double wildcard like *.*.example.com? I've just been on the phone with my current SSL provider (register.com) and the girl there said they don't offer ...
22
votes
3answers
5k views

How do I create the identity certificate required to setup Mobile Device Management on an iOS device?

I'm trying to provision an iOS device to be managed using the Apple MDM capabilities. Using the iPhone Configuration Utility, I'm trying to create a configuration profile. Under the Mobile Device ...
20
votes
9answers
13k views

Multiple domains with SSL on same IP

I know that a dedicated IP is needed for setting up SSL. What happens if we add SSL for domains sharing an IP ? (Namevirtualhost)
19
votes
6answers
9k views

Can I be my own trusted CA via an signed intermediate certificate?

Can I get a certificate from a root CA that I can then use to sign my own web server certificates? I would, if possible, use a signed certificate as an intermediate to sign other certs. I know that I ...
18
votes
8answers
29k views

IIS7: can't set host name on site with SSL cert and port 443

Consider a Win 2008 SP2 machine with IIS7. The task is to apply a certificate and host name to the one and only Site on this machine. The site's host headers need to be abc.123.mysite.com The first ...
17
votes
4answers
1k views

Where do companies typically store SSL certificates for future use?

We recently bought a wildcard SSL cert for our domain. We converted all of the certs to a Java keystore, but now we are asking ourselves where we should store these for later use. Do people use ...
15
votes
1answer
55k views

How do I view the details of a digital certificate .cer file?

I am using Windows and have been given a .cer file. How can I view the details of it?
15
votes
1answer
16k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
13
votes
2answers
18k views

How to Grant IIS 7.5 access to a certificate in certificate store?

In Windows 2003 it was simple to do and one could use the winhttpcertcfg.exe (download) to give "NETWORK SERVICE" account access to a certificate. I'm now using Windows Server 2008 R2 with IIS 7.5 ...
13
votes
3answers
16k views

IIS 7.0 - SSL certificate - renew or new?

One of my SSL certificates (simple domain verification only) is about to expire on windows 2003 IIS 7.0 server. I got better offer from another vendor, and the guys who originally issued my ...
12
votes
3answers
1k views

How do I keep the ssl key for our website confidential?

I want to keep our SSL key for our website confidential. It's stored on 2 USB sticks, one in a safe deposit box and one I keep secure. And then I'm the only one who applies it to the web server so ...
12
votes
2answers
13k views

Outlook security alert - The name on the security certificate is invalid or does not match the name of the site

SBS 2008 running Exchange 2007 and IIS6.0 CompanyA has two other companies that operate under the same roof. To accommodate email, we have 3 Exchange accounts per user to manage this. All users use ...
12
votes
2answers
3k views

Does reissuing an SSL certificate invalidate the previously-issued certificate?

I used the "reissue certificate" functionality at a SSL certificate vendor (RapidSSL, FWIW) to get a new certificate - in doing so, I created and used a new private key and pass phrase. Will the ...
12
votes
4answers
14k views

Add a custom certificate authority to Ubuntu

I have created a custom root certificate authority for an internal network, example.com. Ideally, I would like to be able to deploy the CA certificate associated with this certificate authority to my ...
11
votes
5answers
6k views

Do any well-known CAs issue Elliptic Curve certificates?

Background I've seen that Comodo has an elliptic curve root ("COMODO ECC Certification Authority"), but I don't see mention of EC certificates on their web site. Does Certicom have intellectual ...
11
votes
4answers
956 views

differences of SSL certificates?

What are differences of SSL certificates for web server, such like extended validation, Smart Seal, wildcards, single root? What certificates are appropriate for what needs?
11
votes
4answers
14k views

How to avoid lftp Certificate verification error?

I'm trying to get my Pelican blog working. It uses lftp to transfer the actual blog to ones server, but I always get an error: mirror: Fatal error: Certificate verification: subjectAltName does not ...
10
votes
5answers
1k views

Can I use the same wildcard certification for *.domain.com and domain.com

You can make an SSL certificate by using *.domain.com as the name. But unfortunately, this doesn't cover https://domain.com Is there any fix for this?
10
votes
2answers
2k views

Cost of getting in-house certificate authority trusted

My company has an in-house certificate authority that is currently self-signed. Since we want to start using it for external SSL and secure email to our customers, we need to get it trusted. Does ...
10
votes
1answer
207 views

How do SAN Certs degrade performance?

I have heard that when lots of names get added to a single SAN Cert (Subject Alternative Name) performance starts to degrade. Can someone explain how SAN certs are processed so I understand what ...
9
votes
3answers
10k views

How to add multiple dns names to my puppetmaster?

my puppet.conf on the master [master] certname = myname.mydomain.com ca_server = myname.mydomain.com certdnsnames = puppet;puppet.local;myname.dyndns.org;hivemind.local; for my understanding with ...
9
votes
4answers
5k views

What host name should the SSL certificate for an SMTP server contain?

I have a server foo.example.com at 192.0.2.1 It runs exim to receive e-mail for several of my domains. My domains each have an MX record pointing to mx.example.com, which resolves to 192.0.2.1 If I ...
9
votes
2answers
11k views

How do I deploy an internal certificate authority?

IE7 aggressively warns about certificate failure; we have some internal sites that run over HTTPS and thus need a valid cert. We appear to have an certificate authority on the intranet that can sign ...
8
votes
3answers
6k views

Can Https work without a certificate?

Recently our infrastructure team told our development team that you do not need a certificate for https. They mentioned that the only benefit of buying a certificate was to give the consumer peace of ...
8
votes
3answers
6k views

Generate self signed SSL certificate for apache

I want to create self signed certificate for the website. The old certificate expired few days ago. There are more than one NameVirtualHosts hosted on systems. The commands I am using to create ...
8
votes
1answer
4k views

Certificate does not have a name

I've successfully managed to install an ssl-certificate in IIS, however the 'Name' column is showing as blank even though I entered a friendly name. Is there any way to rectify this? The screenshot I ...
8
votes
2answers
589 views

Is this SSL certificate chain broken and how to fix it?

For the SSL cert on the domain example.com, some tests tell me that the chain is incomplete and since Firefox keeps its own certificate store, it might fail on Mozilla (1, 2, 3). Others tell me it is ...
8
votes
3answers
10k views

How can I use the same key for SSH and SSL (https)

I'm trying to install the development tools for a small team, and I can't get the authentication right. Since we are a distributed team, the server is on the internet. And I'd like to have SSO+zero ...
8
votes
5answers
11k views

How to create a multi-domain self-signed certificate for Apache2?

I've got a little private webserver where I have several virtualhosts. I know that it's impossible to assign a certificate to each individual virtualhost, because the server finds out which ...
8
votes
2answers
4k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?
8
votes
2answers
3k views

How can I verify/read an IIS7 SSL renewal CSR with OpenSSL

I have the privilege of handling ~5 SSL CSRs per week, checking their validity before passing them off to our CA for action. I use OpenSSL on an Ubuntu machine to check that they are valid, testing ...
7
votes
4answers
804 views

Have I messed up buying the wrong SSL certificate for my domain?

I have just purchased an SSL certificate from Go Daddy. I setup the certificate to be: www.mydomainname.com (I changed the domain as you can tell.) I setup Apache and it is working. So when I ...
7
votes
3answers
511 views

Can I use a trusted CA certificate on multiple sites?

Are there any technical/legal/contractual limitations to using a CA certificate on multiple sites that are running on a single machine? multiple machines? Or are the certificates to be used on ...
7
votes
3answers
281 views

Does a CA require a full-time administrator?

At my place of employment, we have skated by over the years without having an internal Certificate Authority. This has worked for us because there was no visible impact by not having trusted entities. ...
7
votes
2answers
11k views

IIS 7.5 Creating self signed certificates with validation date of more than a year

I am creating self-signed SSL certificates in IIS 7.5 for internal use. The problem I have is that I want to create them so that they last for 10 years as it is only a dev environment. I can't see an ...
7
votes
1answer
8k views

Apache SSL VirtualHosts on a single IP using UCC/SAN certificate

I need to host several Apache virtual hosts with SSL from a single IP. Now - I understand that because SSL wraps around the HTTP request, there's no way to know which host is being requested until a ...
7
votes
1answer
11k views

How do I set up an sftp user to login with a password to an EC2 ubuntu server?

I have an Ubuntu Server running on an EC2 instance. To login to that server I use a certificate file without any password. I've installed and configured vsftpd and created a user (let's call him ...
7
votes
2answers
475 views

Enable Certificate Enrollment Policy and Request a Cert using PowerShell

Right now, I'm doing the following to request a cert from a CEP server: Open gpedit.msc Under Computer Configuration > Windows Settings > Security Settings > Public Key Policies, double click ...
7
votes
4answers
2k views

Why is Windows 2012 R2 not trusting my self-signed certificate?

In a testing environment, I'm currently being held up from testing some things that need to be deployed soon (actually already, but you know how deadlines go...) because Windows refuses to trust the ...
6
votes
7answers
2k views

What are the benefits of a self signed certificate on a live site?

Are there any benefits of a self signed certificate on a live site? I know in IIS 7 you have the ability to self sign a certificate and I was wondering if using that as a precurser to buying one from ...
6
votes
2answers
860 views

Certificate authority expiration

When a certificate authority expires, is it gone for good? Is there a way to renew it? Or should I just generate a new certificate? I don't really want to make a new one because this certificate ...
6
votes
3answers
5k views

Self generate SSL Certificate for IIS6?

Hi guys is it possible to create your own SSL cert for IIS 6? If so does anyone have a link to a good guide on the web? Thank! John
6
votes
3answers
21k views

How to create certificate .cer file?

I would like to work with certificates and the third part authority send me values: -----BEGIN CERTIFICATE----- [...]Many letters and digits[...] -----END CERTIFICATE----- -----BEGIN RSA PRIVATE ...
6
votes
3answers
4k views

Cannot create self-signed SSL certificate with IIS 7

I'm trying to create a self-signed certificate from within the IIS 7 snap-in, with little luck. When prompted for a friendly name for the certificate, I type in the name, and click OK, but then I am ...
6
votes
1answer
224 views

What does this intention with lots of numbers mean in a SSL certificate?

I was looking at this site, and out of interest, I was having a look at the certificate in Chrome 32, on Windows 8.1, and I had a look at the certificate. I saw this really strange intention, Apart ...
6
votes
1answer
1k views

HTTPS and Certification for dummies

I had never used https on a site and now want to try it. I did some research, but not sure that I understood everything. Answers and corrections are greatly appreciated. Here we go: To use https I ...