SSL certificates are used to encrypt and authenticate connections to web servers

learn more… | top users | synonyms

1
vote
2answers
121 views

Do I need wildcard SSL for the www subdomain

I own example.com, example.net, and example.biz. I use Apache to rewrite example.net and example.biz to example.com. Based on this rewriting, it is my understanding that I would only need a ...
-1
votes
1answer
73 views

intermediate certificate not sent by WAMP

I have a strange problem that noone can help me with. I will really appreciate any help figuring this out. I have a wamp installation running apache 2.4.4 and latest openssl (which i downloaded and ...
0
votes
0answers
44 views

Unable to get private key, path is correct, file readable

When testing Cyrus IMAPs connection, the connection fails with: May 12 21:03:16 mail cyrus/imaps[25758]: executed May 12 21:03:16 mail cyrus/imaps[25758]: accepted connection May 12 21:03:16 mail ...
6
votes
2answers
530 views

How to find out if an OpenSSL certificate was created by a certain private key?

I have an OpenSSl certificate. I also need the private key. I was told it is located somewhere on the server, and true enough, I found multiple SSL key files. Before I try them all by brute force: Is ...
-1
votes
1answer
38 views

ssl address mismatch on purchased ssl cert [closed]

i've bought a "Protect 1 Website" ssl from godaddy http://www.godaddy.com/ssl/ssl-certificates.aspx , and requested and downloaded a cert for domain "example.com", but when i access dev.example.com, ...
1
vote
1answer
56 views

Issuer Subject Policy in Self-Signed CA Certificate

When I build a self-signed certificate for an internal CA, should I make the issuer DN match the DN in the request, should they be different, or is there no convention for one or the other?
0
votes
0answers
42 views

Using SSLCACertificatePath in httpd

I am trying to use the SSLCACertificatePath directive in httpd to point to a collection of roots and intermediates for client certificate validation. I am able to use a full, concatenated ...
0
votes
0answers
609 views

SSL verification error with git (on github) on Ubuntu 14.04

I'm trying to clone the atom repository that just went fully open-source and I've run into some trouble. Attempting to git clone the repository is producing an SSL error: wug@wugputer:/src/test$ git ...
1
vote
1answer
84 views

If I get an invalid public key error does that mean I have an incorrectly installed certificate

I have created an API (running on an nginx server, let me know if there are any details that you think are relevant) for a client and they received this error when trying to call my service: Notice: ...
0
votes
1answer
58 views

Why do we need to list our CAS servers as SANs in Exchange 2010's UCC certificate?

We currently have a few CAS/Hub servers behind a hardware balancer. We were told by Microsoft and Digicert that we may not need them listed as SANs in our UCC cert since we do not publicize their ...
1
vote
1answer
39 views

SSL Certificate Not Getting Refreshed

I am trying to change the SSL Certificate for my website. I got the new certificate issued by Comodo and installed it on my web servers. My servers are running IIS7.0. I also binded the https ...
9
votes
1answer
120 views

Find out how many browsers reject SSL certificate

I'd like to find out how many browsers reject our SSL certificate when making HTTP requests to our webserver. We're using a free CA which now seems to be recognised by most modern browsers, but I'd ...
-2
votes
1answer
55 views

Heartbleed - Centos 6.5, Apache - should I recreate pair of default certificate and key [duplicate]

I am using Centos 6.5, Apache 2.2.15 with SSL. Due to heartbleed I have updated openssl to release 16.el6_5.7 and I have restarted the httpd service. I am using default Apache certificate and key: ...
0
votes
1answer
49 views

How to use SSL Name Based Vhosts without SNI

I need to host a handful of web applications over SSL using name based virtual hosting. Apache documentation indicates this is possible (https://wiki.apache.org/httpd/NameBasedSSLVHosts) if all sites ...
0
votes
0answers
30 views

CLOUDFRONT - Site host name, https://media.domainname.com, does not match your SSL certificate Subject Name

I woke up this morning to an email from Google Webmaster Tools saying the following: We have noticed that the host name of your site, https://media.domainname.com, does not match any of ...
6
votes
1answer
81 views

Does Apache needs to know about intermediate certificates for client authentication?

I have a following hierarchy of certificates. And I need to do a client authentication on Apache. . └── root (CA) - self signed ├── intermediate 1 (CA) | ├── client1 | ├── client2 ...
1
vote
1answer
78 views

Are XMPP certificates different than “regular” ones?

StartSSL offers special XMPP certificates in addition to their "regular" web server certs. Can anyone tell me if XMPP certificates are special in any way? Isn't it possible to operate an ejabberd with ...
1
vote
1answer
58 views

Apache2 has errors while starting after reinstalling SSL Certificate?

I recently purchased and set up a VPS, and one of the first steps I took was to purchase and install an SSL Certificate. I had issues getting everything set up, but after quite a bit of research and ...
1
vote
0answers
82 views

ldapmodify TLS: certificate is not valid - error -8179:Peer's Certificate issuer is not recognized

In trying to connect to an MS active directory server over ssl, I am trying to run this: ldapmodify -vv -H 'ldaps://abc.def.com:636' -D 'cn=user,cn=Users,dc=abc,dc=def,dc=com' -f test.ldif -w ...
0
votes
2answers
430 views

RDS 2012 R2: An authentication error has occurred (Code: 0x607)

I've set up an RDS 2012 R2 host farm, but have problems. When I try to log on from an outside client, then I get this error... "An authentication error has occurred (Code: 0x607)" I've tried google ...
0
votes
0answers
174 views

Postfix STARTTLS certificate not working in Thunderbird

I just replaced my expired cerificates for SMTP communication on Postfix server but I am no more able to send emails through Thunderbird. I created a new key and the signing request: openssl req ...
1
vote
3answers
386 views

Remote desktop certificate error - how to connect anyways?

I have a remote server that I can only access through RDP. It uses a proper SSL certificate from godaddy for RDP, not a self signed one. The server is 2008R2, and I believe is set to the default of ...
1
vote
1answer
39 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
2
votes
2answers
115 views

Can't use (self-signed wildcard) SSL Certificate in Windows Azure Website (WAWS)

I want to secure an azure website with a custom domain via SSL. The website is in the "Standard" Tier, as required. I've been able to upload my self-signed wildcard certificate, but when I want to ...
2
votes
2answers
87 views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
0
votes
1answer
28 views

postfix master.cf configuration from database

I am wondering if it is possible to configure postfix master.cf file from database. Same as, for example, in main.cf one can set alias_maps = pgsql:/etc/postfix/pgsql-aliases.cf What I'm ...
2
votes
1answer
21 views

Certificate Authority - Issuing Authority Confusion

This is a bit of a newbie question, but my head is fried after reading various differing article on how CA's work. Are most certificates issued by an 'intermediate CA' where the chain eventually ...
-1
votes
1answer
60 views

Generate CSR for SSL [duplicate]

I need to add SSL to a Apache/Linux sever. Do I have to generate CSR from the same server which I need to add SSL? Also when I add SSL in Apache sever, can I omit mentioning key file like below? ...
0
votes
0answers
52 views

Failed to Configure CA Certificate chain after Rebuilding/Re-Installing OS

I got my free ssl at startssl.com and it works really fine. My site is working with https://. After I configure LAMP and VSFTP and broke something in there, I decided to re-install UBUNTU 12.04 OS to ...
0
votes
1answer
40 views

Understanding XP users accessing a UCC certificate on IIS8

I have a single IIS website which hosts 3 different websites all using the same UCC SSL certificate. (The code of my site examines the host header itself to decide which variation of the site to ...
1
vote
1answer
111 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
1
vote
0answers
180 views

Maven - resolving “java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors”

I am attempting to build/install this project on an Ubuntu 12.04 box: https://bitbucket.org/petermr/pdf2svg However: mvn clean install Fails to build due to getting errors like this: ...
1
vote
0answers
541 views

Understanding the output of openssl s_client

Ever since our email provider changed their SSL certificate, a POP3 client based on mono refuses to connect to their secure POP server to download emails. Other clients do not have an issue; e.g. ...
5
votes
1answer
184 views

How to find out which server generated a CSR

I sent a client a CSR a few months ago and now they finally sent me back the CA response. However, there are multiple Windows 2008R2 servers and I don't remember which one I used to generate the CSR ...
1
vote
1answer
59 views

Linxu Forward proxy for client authentication

I need to use a simple HTTP forward proxy proxy for linux to do mutual SSL authentication The proxy needs to attach a client certificate to HTTP request and then upgrade HTTP to HTTPS. I have tried ...
0
votes
1answer
45 views

Exchange Server - How to use existing certificate without CSR?

I have some SSL certificates problem. We have an Exchange 2010 server hosting mailboxes for mydomain.com, otherdomain.com and thirddomain.com. It's internal name is myserver.mydomain.local. When ...
0
votes
1answer
564 views

SSLCertificateChainFile Deprecation Warning on Apache 2.4.8+

We have an SSL Certificate for our website from Network Solutions. After upgrading Apache/OpenSSL to version 2.4.9, I now get the following warning when starting HTTPD: AH02559: The ...
0
votes
0answers
145 views

Can't seem to get Apache SSL client certificate authentication working with an intermediate CA

I'm restructuring my personal CA system and trying to add an intermediate CA into the mix. I have a self-signed root CA whose certificate is imported into all appropriate browsers/OSes. I seem to be ...
3
votes
2answers
76 views

Use DNSSEC for secure connections

From my understanding DNSSEC allows me to create a public key and sign my DNS records. There appears to be multiple ways to have a certificate record (such as DANE see ...
0
votes
1answer
82 views

SSL Certificate implementation for a stack that has varnish and multiple NGINX webservers

My current stack has Varnish -> NGINX (2 servers) running Drupal -> MySql. All static content is cached and served by Varnish over HTTP. However when a user signs-up and wants to purchase a plan the ...
8
votes
3answers
943 views

Do I have to update my snakeoil certificate after updating openssl (heartbleed)?

I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed. I do support SSL on my server, but only with a snakeoil certificate. I was just ...
1
vote
2answers
489 views

How do I rotate an SSL Certificate as requested by AWS

Amazon AWS sent an email today that users using Elasic Load Balancing (ELB) service with SSL certificates should "Rotate" them for precaution (Heartbleed bug). How exactly do I rotate an ssl ...
0
votes
1answer
470 views

Heartbleed testing tools do not recognize reissued certificates (PositiveSSL Wildcard + Amazon ELB)

In response to the Heartbleed news, I have upgraded OpenSSL on my production server and am now trying to reissue the SSL certificate. I am using a PositiveSSL Wildcard certificate on an Amazon ELB. I ...
1
vote
1answer
53 views

Replacing SSL Cert Apache

I am replacing our SSL cert on our Apache web server. This is the first time I have done this, with my 2 colleagues being on holiday, and an urgent need to replace our SSL cert(due to the openssl ...
5
votes
1answer
653 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
0
votes
1answer
41 views

How to re-check SSL certificate even with exeption in browsers

My SSL certificate has expired. I created a new one for my domain but after a few days. Certificate is now online and working but there is a problem at users side. When the certificate expired, users ...
1
vote
1answer
205 views

Proper config for Couchdb + SSL Ubuntu. Getting error: curl: (35) Unknown SSL protocol error in connection to 127.0.0.1:6984

I'm looking to use CouchDB with SSL and nodejs and I have just switched from self signed certificates (which were working for over a month) to a real SSL certificate and now I'm running into ...
0
votes
0answers
14 views

PKI subjectAltName OID for custom, internal data

If I had a business who wants to act as a root authority for the purpose of authenticating subordinate certificates, is there a subjectAltName OID that I can use to also store some arbitrary ...
0
votes
3answers
189 views

Some users receive untrusted SSL certificate warnings

I've been getting reports of users visiting our site getting "this certificate is not trusted" errors when visiting our site via https. I don't seem to ever have any problems, but two separate people ...
3
votes
1answer
140 views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...