SSL certificates are used to encrypt and authenticate connections to web servers

learn more… | top users | synonyms (1)

1
vote
2answers
4k views

SSLCertificateChainFile Deprecation Warning on Apache 2.4.8+

We have an SSL Certificate for our website from Network Solutions. After upgrading Apache/OpenSSL to version 2.4.9, I now get the following warning when starting HTTPD: AH02559: The ...
0
votes
0answers
712 views

Can't seem to get Apache SSL client certificate authentication working with an intermediate CA

I'm restructuring my personal CA system and trying to add an intermediate CA into the mix. I have a self-signed root CA whose certificate is imported into all appropriate browsers/OSes. I seem to be ...
3
votes
2answers
195 views

Use DNSSEC for secure connections

From my understanding DNSSEC allows me to create a public key and sign my DNS records. There appears to be multiple ways to have a certificate record (such as DANE see ...
0
votes
1answer
246 views

SSL Certificate implementation for a stack that has varnish and multiple NGINX webservers

My current stack has Varnish -> NGINX (2 servers) running Drupal -> MySql. All static content is cached and served by Varnish over HTTP. However when a user signs-up and wants to purchase a plan the ...
8
votes
3answers
1k views

Do I have to update my snakeoil certificate after updating openssl (heartbleed)?

I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed. I do support SSL on my server, but only with a snakeoil certificate. I was just ...
1
vote
2answers
687 views

How do I rotate an SSL Certificate as requested by AWS

Amazon AWS sent an email today that users using Elasic Load Balancing (ELB) service with SSL certificates should "Rotate" them for precaution (Heartbleed bug). How exactly do I rotate an ssl ...
0
votes
1answer
528 views

Heartbleed testing tools do not recognize reissued certificates (PositiveSSL Wildcard + Amazon ELB)

In response to the Heartbleed news, I have upgraded OpenSSL on my production server and am now trying to reissue the SSL certificate. I am using a PositiveSSL Wildcard certificate on an Amazon ELB. I ...
1
vote
1answer
95 views

Replacing SSL Cert Apache

I am replacing our SSL cert on our Apache web server. This is the first time I have done this, with my 2 colleagues being on holiday, and an urgent need to replace our SSL cert(due to the openssl ...
5
votes
1answer
720 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
0
votes
1answer
60 views

How to re-check SSL certificate even with exeption in browsers

My SSL certificate has expired. I created a new one for my domain but after a few days. Certificate is now online and working but there is a problem at users side. When the certificate expired, users ...
1
vote
1answer
679 views

Proper config for Couchdb + SSL Ubuntu. Getting error: curl: (35) Unknown SSL protocol error in connection to 127.0.0.1:6984

I'm looking to use CouchDB with SSL and nodejs and I have just switched from self signed certificates (which were working for over a month) to a real SSL certificate and now I'm running into ...
0
votes
0answers
29 views

PKI subjectAltName OID for custom, internal data

If I had a business who wants to act as a root authority for the purpose of authenticating subordinate certificates, is there a subjectAltName OID that I can use to also store some arbitrary ...
1
vote
3answers
1k views

Some users receive untrusted SSL certificate warnings

I've been getting reports of users visiting our site getting "this certificate is not trusted" errors when visiting our site via https. I don't seem to ever have any problems, but two separate people ...
3
votes
1answer
1k views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
1
vote
1answer
49 views

Single IIS, 2 applications, 2 IP addresses, 2 Domains, 2 SSLs

I know there are many questions out there, but none seemed to address specifically what I am after. I have one instance of IIS, with two separate applications on it. Each application works on its ...
1
vote
1answer
852 views

Apache fails to start with new ssl certificate

I'm running RHEL 6.4 and my trusted certificate has expired recently, so I decided to renew it. I've obtained a new certificate from StartSSL. After downloading and putting the certificate file on the ...
0
votes
2answers
144 views

S/MIME certificate to minimize email bounce

I have a website hosted in a vps that sends informative emails to my clientes, maybe 20-40 emails per day. Since few weeks ago some sent emails are bouncing with the following error: This message ...
0
votes
0answers
126 views

Windows 2012 - Certificate Issue

My application runs as a WCF web-server in a Windows service. It uses https/ssl protocol and binds it's certificate with its port number. During the Service start, I am seeing this error in Windows ...
-1
votes
1answer
45 views

Only allow a specific client to talk to a server

I have the following situation: have a server (ubuntu) running an application. I have a client (only the one client) requesting stuff from that server. To execute the requests, the client has to ...
9
votes
2answers
3k views

Can't upload certificate to AWS

I'm doing: aws iam upload-server-certificate --server-certificate-name MysiteCertificate --certificate-body Downloads/mysite/mysite.crt --private-key mysite.pem --certificate-chain ...
0
votes
1answer
132 views

IIS 7 filling disk with millions of certificate files

I've got an ASP.NET website running on IIS 7. Using PA File Sight, I've proven that it is creating 2 to 3 new files in the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder every minute. PA ...
14
votes
1answer
705 views

How does this kind of SSL work?

"Issued to" and "Domain Name" doesn't match but still valid and accepted by all major browsers without any warning. While previewing my blog post in Blogger, I noticed that my blog was previewed via ...
0
votes
1answer
843 views

StartSSL.com SSL Class2 Certificate and Postfix

currently my Postfix 2.11 instance runs TLS on a GoDaddy SSL Certificate but as i would like to be able to access my server from smtp.example.com as well as imap.example.com, example.com or ...
3
votes
3answers
935 views

Nginx issues between vhosts and SSL

I have two sites in the same IP with the follow configuration: site1.com Multiples subdomains (ie.: foo.site1.com, bar.site1.com) Everything listening on port 80, NOTHING in 443 ...
13
votes
2answers
1k views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...
0
votes
1answer
211 views

MDM Server Apple Certificate: Certificate Signature Verification failed

I want to create a MDM server to manage my iOS devices. I have enrolled in iOS Enterprise Developer program. And executed the following openSSL commands "1. Creating Certificate Authority (CA)" ...
0
votes
1answer
423 views

How can I renew the SSL certificate used on our Exchange server?

According to the MSDN article Renew an Exchange Certificate, I'm supposed to use Get-ExchangeCertificate -Thumbprint 'AD19B141228C7CF98B5F78DCED978B7C45E15434' | New-ExchangeCertificate ...
0
votes
1answer
812 views

Config Manager 2012 Application Download stuck at 0%

We have a Config Manager 2012 R2 setup with 2 Distribution Points on remote sites. In the remote site the Applications don't get downloaded, the status remains on 'downloading (0% complete)' In the ...
-2
votes
1answer
722 views

Why openssl s_client and gnutls-cli deliver different certificates (own server)

on my server i have multiple virtual hosts with apache2. Some with domain *.example-one.org and some whith *.example-two.org. Each domain has it's own wildcard certificate. When I fetch the ...
1
vote
2answers
886 views

Does a domain computer trust certs from domain CA

I have investigated this but have been unable to find a definitive answer to my question. I have never used certificate services in active directory before so am unsure of its possible ...
1
vote
1answer
2k views

version 0.9.7a of openssl reports “certificate signature failed”, but version 0.9.8e is happy

I am trying to construct an openssl certificate chain that will work with a standard CentOS 4 install as client. (I know it's very old, but it's what our client is using so we need to support it). ...
0
votes
1answer
293 views

Will renewing a wildcard SSL certificate on one server invalidate the certificate on other servers?

We have a wildcard SSL certificate that is due to expire in a few weeks. I currently have this certificate installed on six servers. I'd like to renew it on one server first, test it out, and then ...
0
votes
2answers
3k views

Restart of nginx service fails because of /etc/nginx/nginx.conf test failure

Installing 3rd party SSL on DigitalOcean Droplet, Apache running Ubuntu 12.10. Following the instructions here: AlphaSSL on Apache Self signed SSL instructions from DigitalOcean So everything ...
0
votes
1answer
170 views

Use Wildcard SSL with Amazon EC2 instance, secure.mydomain.com -> EC2 instance

I recently purchased my first wildcard SSL certificate and I am trying to use it to secure the connection between my site (Cent OS 6 VPS) and an Amazon EC2 instance running Ubuntu 12.04. My primary ...
0
votes
1answer
39 views

Certificates/SSL via SSL-Proxy vs. real certificate for a server

While researching the different certificate types I've come across hosters that offer what they call SSL-Proxy type installations for their servers. I'm concerned about this idea, as it defeats what I ...
0
votes
1answer
284 views

SSL Cert Expire or Caching issue, don't understand [closed]

If I visit BT's site in Chrome I get this ... http://imgur.com/b05alsX It looks like the cert has expired. (Similar in Firefox) BT claim it isn't. https://twitter.com/BTCare/status/440405157999030272 ...
3
votes
2answers
10k views

Some systems cannot connect to ldap via ldaps, but others can, is it the wildcard cert?

When trying to make ldaps connections to my Novel eDirectory 8.8 server, sometimes I have to put TLS_REQCERT never in the client servers ldap.conf file. Obviously, this is a bad idea. The command I ...
2
votes
1answer
1k views

How do I properly generate a keystore for ssl?

I'm trying to get an ssl certificate from godaddy for use with jetty. These are my steps: keytool -keystore keystore -alias jetty -genkey -keyalg RSA -keysize 2048 What is your first and last name?: ...
6
votes
3answers
730 views

SNI and wildcard SSL certificates on the same server with IIS

I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...
1
vote
0answers
5k views

openssl s_client -connect: 20 error with server signed certificate for client

What I want I want to connect to a server using a given signed certificate (by the company running the server) What I have Ubuntu 12.04 LTS My key and CSR files A signed certificate. It was signed ...
1
vote
1answer
528 views

Installing StartSSL certificate in ProFTPD

I am currently experiencing some trouble installing a StartSSL certificate in ProFTPD. These are the files I have: cert.pem - certificate file cert.key - ...
0
votes
1answer
81 views

how renew a ssl certificate for exchange 2007

my certificate was expired thus I bought a new one. But when configure the panel of ssl provider it give me the following error (I mean, when I put the csr in the form): Common name is already ...
0
votes
2answers
23 views

which ssl certificate for exchange

I want buy a ssl certificate for exchange 2007. I have different choices: 1) protect 1 website 2) protect multiple websites (multiple domain ucc) Thus I have microsoft exchange on AD domain I think I ...
4
votes
2answers
3k views

Discerning GoDaddy SSL Certificate Types

I'm following these instructions for installing a GoDaddy Certificate in Apache Tomcat: ...
1
vote
0answers
229 views

Apache SSL Certificate and Basic Auth combination - password if no certificate

Is it possible, to force apache to ask for password only if user don't have client-certificate installed? I'm almost sure, that this is possible, but I'm not able to find any confirmation anywhere. ...
1
vote
1answer
41 views

When I install the certificate from a client who is using windows 2003 on my linux system the serial shows as negative

I'm not sure why I see a negative value in the serial number when I install the client's certificate. If anyone has any leads or information on this, that would help me greatly. Serial Number: ...
1
vote
2answers
164 views

Avoid Man in Middle AWS load balancer

I have a load balancer configurated with the port 443 to port 80 of the ec2 servers and with a sniffer like Burtsuite can I edit the request. How can configure the ELB to avoid this type of attack?. ...
0
votes
1answer
203 views

Check client certificate in nginx?

I can issue certificates without a problem and I can get nginx to force users to provide a certificate but how do I get nginx to give me information about the certificate? Information such as name and ...
5
votes
1answer
459 views

How do I configure AD CS to support Name Constraints (4.2.1.11 in RFC 2459)?

I am trying to figure out how to do Qualified Subordination with the critical extension set, but I'm unable to figure out how to do this in MSFT AD CS. For a given certificate, how do I make sure ...
0
votes
2answers
109 views

How to redirect from FR to COM when using HTTPS [duplicate]

I have two domains : my-domain.com and my-domain.fr I want to redirect traffic as followed : my-domain.com:80 -> my-domain.com:443 my-domain.fr:80 -> my-domain.com:443 my-domain.fr:443 -> ...