1
vote
1answer
57 views

How to debug certificate chains with OpenSSL?

I am completely new to OpenSSL and I'm reading a tutorial on OpenSSL programming to connect to a server: www.rtfm.com/openssl-examples/part1.pdf www.rtfm.com/openssl-examples/part2.pdf Somehow ...
-1
votes
1answer
110 views

Failed to bind to: /0.0.0.0:443 [closed]

I am having problems starting my play framework server on port 443,i am using scala play 2.20 and my play server running fine on port 9443 by following command ./start -Dhttps.port=9443 ...
0
votes
1answer
44 views

Extract key from JKS keystore to use with apache2 and tomcat

I have a keystore in JKS format and I want to use that with apache2. How can I export the key and the certificates (that i already chained) out the JKS in a easy way? I found many answers out there ...
0
votes
3answers
92 views

Install godaddy ssl certificate on amazon ec2

I'm new to setting up ssl certificate and csr, i want to use public ip instead domain name in ssl. i created a csr file using following command and info openssl req -new -newkey rsa:2048 -nodes ...
0
votes
0answers
174 views

Unable to complete secure transaction - Nginx Opera browser

i have this nginx.conf file worker_processes 4; worker_priority 15; error_log logs/error.log notice; pid logs/nginx.pid; events { use kqueue; # event method, kqueue ...
1
vote
1answer
17 views

Extract Certs from Apache

Recently I've had to uninstall a single Self-Signed SSL Certificate from one of my Apache boxes, specifically for an outside party. That's not really a problem for me, since it was easy. What ...
1
vote
1answer
1k views

Postfix and OpenSSL: “Unable to get local issuer certificate”

I bought a certicifate for my mail server and configured it in Postfix like so: smtpd_tls_security_level=may smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtpd_tls_cert_file = ...
0
votes
0answers
78 views

Unable to get private key, path is correct, file readable

When testing Cyrus IMAPs connection, the connection fails with: May 12 21:03:16 mail cyrus/imaps[25758]: executed May 12 21:03:16 mail cyrus/imaps[25758]: accepted connection May 12 21:03:16 mail ...
6
votes
2answers
565 views

How to find out if an OpenSSL certificate was created by a certain private key?

I have an OpenSSl certificate. I also need the private key. I was told it is located somewhere on the server, and true enough, I found multiple SSL key files. Before I try them all by brute force: Is ...
1
vote
1answer
82 views

Issuer Subject Policy in Self-Signed CA Certificate

When I build a self-signed certificate for an internal CA, should I make the issuer DN match the DN in the request, should they be different, or is there no convention for one or the other?
1
vote
0answers
1k views

SSL verification error with git (on github) on Ubuntu 14.04

I'm trying to clone the atom repository that just went fully open-source and I've run into some trouble. Attempting to git clone the repository is producing an SSL error: wug@wugputer:/src/test$ git ...
1
vote
1answer
43 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
2
votes
2answers
114 views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
1
vote
1answer
118 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
1
vote
0answers
1k views

Understanding the output of openssl s_client

Ever since our email provider changed their SSL certificate, a POP3 client based on mono refuses to connect to their secure POP server to download emails. Other clients do not have an issue; e.g. ...
8
votes
3answers
973 views

Do I have to update my snakeoil certificate after updating openssl (heartbleed)?

I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed. I do support SSL on my server, but only with a snakeoil certificate. I was just ...
1
vote
2answers
520 views

How do I rotate an SSL Certificate as requested by AWS

Amazon AWS sent an email today that users using Elasic Load Balancing (ELB) service with SSL certificates should "Rotate" them for precaution (Heartbleed bug). How exactly do I rotate an ssl ...
5
votes
1answer
669 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
0
votes
0answers
21 views

PKI subjectAltName OID for custom, internal data

If I had a business who wants to act as a root authority for the purpose of authenticating subordinate certificates, is there a subjectAltName OID that I can use to also store some arbitrary ...
0
votes
1answer
257 views

StartSSL.com SSL Class2 Certificate and Postfix

currently my Postfix 2.11 instance runs TLS on a GoDaddy SSL Certificate but as i would like to be able to access my server from smtp.example.com as well as imap.example.com, example.com or ...
9
votes
2answers
483 views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...
-2
votes
1answer
210 views

Why openssl s_client and gnutls-cli deliver different certificates (own server)

on my server i have multiple virtual hosts with apache2. Some with domain *.example-one.org and some whith *.example-two.org. Each domain has it's own wildcard certificate. When I fetch the ...
1
vote
1answer
381 views

version 0.9.7a of openssl reports “certificate signature failed”, but version 0.9.8e is happy

I am trying to construct an openssl certificate chain that will work with a standard CentOS 4 install as client. (I know it's very old, but it's what our client is using so we need to support it). ...
0
votes
1answer
927 views

Restart of nginx service fails because of /etc/nginx/nginx.conf test failure

Installing 3rd party SSL on DigitalOcean Droplet, Apache running Ubuntu 12.10. Following the instructions here: AlphaSSL on Apache Self signed SSL instructions from DigitalOcean So everything ...
0
votes
0answers
865 views

openssl s_client -connect: 20 error with server signed certificate for client

What I want I want to connect to a server using a given signed certificate (by the company running the server) What I have Ubuntu 12.04 LTS My key and CSR files A signed certificate. It was signed ...
0
votes
3answers
39 views

Detect unencrypted SSL keys

I have an OpenVPN server installed on a Debian machine. Is there a way to find which of the keys have been created without being encrypted with a password, so as to replace them?
1
vote
1answer
69 views

Configuration of root ssl certificates

I wanted to install an SSL certificate for a domain. So I googled up and did some R&D and found this link https://www.symantec.com/page.jsp?id=roots. It says we can download and use without any ...
1
vote
1answer
32 views

Is it less secure to use a passphrase-removed key with apache?

I have a simple website with an ssl certificate and I noticed that when I would reboot apache was asking for the passphrase (causing the server to halt essentially). I did the following to remove it ...
0
votes
0answers
64 views

Generating an own CA for internal use

I want to create a CA for internal use in our office. I created the CA like the following: openssl genrsa -out rootCA.key 2048 openssl genrsa -out rootCA.key 2048 -des3 openssl req -x509 -new -nodes ...
1
vote
0answers
88 views

Unable to generate a Bundle of CA Root Certificates (failed to create symbolic link)

I am trying to generate a Bundle of CA Root Certificates. Similar to what Facebook has done for its PHP SDK (https://github.com/facebook/facebook-php-sdk/blob/master/src/fb_ca_chain_bundle.crt). I ...
0
votes
0answers
49 views

What is causing HTTPS handshake not to occur?

I have two systems, running an application that does web service calls over HTTPS. I run a test by trying to log in to the HTTPS over webservice and one system works with HTTPS but the other does not. ...
0
votes
1answer
59 views

openssl generate .key from CSR

A customer sent me a CSR and the .CER of a certificate for a linux server that I host. The customer does not have access to this machine. Is this enough data to generate a valid certificate? Is it ...
0
votes
1answer
138 views

How to convert a SSL certificate and private key to a PFX for import in IIS?

Certificate name is: mycert.crt My CSR converted to PEM (RsA) Private key is: private.key I want to create mycert.pfx so I can use it in IIS. When I run this command: openssl pkcs12 -export -out ...
0
votes
1answer
166 views

Generate SSL certificate using Keytool

I have a question about SSL certificates. I use Openssl to generate the certificate: I followed this tutorial. My goal is to generate: .crt .key .pem Is possible to obtain the same files using ...
0
votes
0answers
25 views

Generate a use a Openssl certificate in Tomcat

I need to enable SSL on my Tomcat and Apache so I need to generate the (self-signed) certificate using Openssl tool end, about Tomcat, I need to import the certificate using keytool. I know that is ...
0
votes
2answers
230 views

“Issued certificate not yet valid.” with wget?

I am getting the following error when using wget to fetch a file: Issued certificate not yet valid. To connect to www.atlassian.com insecurely, use ‘--no-check-certificate’. Testing with openssl ...
0
votes
1answer
343 views

Apache cannot read certificate file

I use self-signed certificates with no issue but today I have tried to create a SSL certificate for commercial use. But apache doesn't start and gives the following error: Notice: I have confirmed ...
0
votes
1answer
48 views

OpenSSL not using CA directory

OpenSSL will not verify a cert $openssl s_client -connect <host>:443 ... Verify return code: 21 (unable to verify the first certificate) However, if we figure out the location of the store $ ...
0
votes
1answer
88 views

RapidSSL nginx Certificate issuer is me

I have baught the SSL certificate from RapidSSL. I have concatenated the chain files of RapidSSL CA and GeoTrust Global CA But when I check it on http://www.sslshopper.com/ I have this : The ...
1
vote
3answers
331 views

How can I find out the type of an SSL certificate?

I received by email from my certification authority a certificate that begins like that: -----BEGIN CERTIFICATE----- MIAGCSqGSIb3DQEHAqCAMIACAQExADALBgkqhkiG9w0BBwGggDCCBWMwggRLoAMC and ends like ...
0
votes
0answers
31 views

While Checking the expiry date of newly installed ssl it showing custom errr?

Am fully new to this site before setting this question as duplicate or hold read this. I am just installing sslcertificate which is in .pem for enabling APplePush Notification but the newly installed ...
-1
votes
1answer
114 views

Create self signed SSL certificate - nginx

I want to create a self signed SSL sertificate for my website. I will not use it for accessing the website itself but for other services i am going to be using (roundcube, phpmyadmin etc). I want to ...
1
vote
1answer
2k views

SSL Library Error: X509_check_private_key:key values mismatch

I installed a new SSL certificate signed by our own Certificate Authority. Apache will not start, with the error: SSL Library Error: 185073780 error:0B080074:x509 certificate ...
3
votes
1answer
49 views

Can an ssl certificate be modified?

Is there any way to modify a ssl certificate? I don't want to change any of sections relating to authentication, only some of the surrounding data, e.g. Issuer or X509v3 Key Usage. Is there any tool ...
2
votes
2answers
2k views

Dovecot error: ssl enabled, but ssl_cert not set

I've been trying to get Postfix and Dovecot set up for days and I think I have resolved all problems except for one that just came up. When I try to restart Dovecot I get the following error message: ...
3
votes
1answer
1k views

Openssl error 19: “Self signed certificate in certificate chain” when keyed by GoDaddy

Can someone help me understand how to verify that my SSL cert is installed properly (or troubleshoot why it isn't)? I installed GoDaddy SSL certificate on my Apache server. Some users are still ...
0
votes
1answer
189 views

SSL Certificate Domain Name Mismatch

Retina is complaining that the SSL certificate running on my Tomcat server does not return the fully qualified domain name (fqdn) but rather the IP. I connected to my Tomcat server on port 443 using ...
1
vote
1answer
168 views

Node.js SSL: Invalid Certificate

I am trying to apply SSL layer to a node.js server. Following are the steps I have done Created all the ssl resources using this blog Followed the instructions given in here to start my node.js ...
1
vote
1answer
4k views

SSL Error: self signed certificate in certificate chain

EDIT: AS the following documents describes http://www.novell.com/support/kb/doc.php?id=7002392 i've concatenated thos files like this at domain.key domain.crt sf_bundle.crt >> domain.pem and ...
0
votes
3answers
115 views

Can I create a wildcard ssl cert for a subdomain?

I have created my own CA cert, and created a wildcard ssl cert for *.domain.com. But we use a lot of sub-domains of the form abc.xyz.domain.com, and I can't seem to create a wild card that will work ...