SSL certificates are used to encrypt and authenticate connections to web servers

learn more… | top users | synonyms (1)

0
votes
0answers
12 views

CentOS 7 Automated SSL Generation from Active Directory

I have an Active Directory Server setup for Certificate Services. I am able to manually generate certs as needed. However, I need to find a way to automate the sending of the cert request to AD and ...
0
votes
1answer
39 views

How to Check if a SSL Certificate is successfully renewed

I have two web servers, one for an intranet and the other for a website. The system specs of the two are almost the same, which is as follows: CentOS 6.5 LAMP (Apache/2.2.15) + WordPress, which were ...
2
votes
0answers
128 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
4
votes
1answer
4k views

certreq.exe unable to to submit Base64 CSR - Invalid Data

I am trying to script a solution to automatically submit Base64 CSRs to a Microsoft Certificate Services CA, but keep getting tripped up. My understanding is that all I should need to specify is a ...
0
votes
2answers
21 views

NGNIX, SSL Certificates and PC-DSSI 3.1

We are going to have to pass a PCI 3.1 audit for the web application we're currently developing. It's on Amazon EC2 running NGINX under Debian. We're in contact with Symantec for certificates and ...
0
votes
1answer
1k views

ssl_crtd helpers are crashing too rapidly in squid

I am using the sslBump and Dynamic SSL Certificate Generation features of squid, below is my configuration for the sslBump sslcrtd_program /usr/lib64/squid/ssl_crtd -s ...
0
votes
1answer
33 views

How to disable catch-all on a ssl virtual host

My virtual host looks like following: <VirtualHost example.com:443> SSLEngine on SSLCertificateFile /etc/apache2/ssl-keys/example/example.crt SSLCertificateKeyFile ...
3
votes
2answers
11k views

Enabling SHA2 Certificate Support on Windows Server 2003

A little background information first. I have an SSIS package that runs inside a Windows Server 2003 SP2 32 bit environment. The package recently started failing with the following error during a ...
1
vote
1answer
21 views

Is capolicy.inf processed in full (or part) during server install, renewal, and issuing new certs

When installing a Windows CA, capol.inf confuses me. It seems that capol.inf does set defaults for the CA that can otherwise be done using certutil's registry functions (or regedit). It also ...
0
votes
0answers
56 views

Firefox users get sec_error_bad_signature over HTTPS

We've had a couple of users recently complain about not being able to connect to the HTTPS version of our website (served via Apache) from Firefox. They error they receive is: Secure Connection ...
34
votes
2answers
7k views

Should a wildcard SSL certificate secure both the root domain as well as the sub-domains?

I ask this question, because Comodo are telling me that a wildcard certificate for *.example.com will also secure the root domain example.com. So with a single certificate, both my.example.com and ...
1
vote
1answer
32 views

Unable to use builtin CA bundle to verify GoDaddy SHA2 SSL certificate

I ran into an interesting problem. We have a PHP script that contacts a LTL shipper (https://facts.dohrn.com/). That script has been failing because it can't validate the SSL certificate. I went to ...
2
votes
1answer
139 views

How do I make a Cisco Ironport appliance send “linked certificates” for HTTPS inspection?

I have a PKI tree, and the ironport is a CA at the second level of the PKI tree, (for issuing HTTPS inspection certs) Although I deployed the root certificate to all clients, and chrome/IE work ...
5
votes
2answers
5k views

openssl keeps giving me “unknown option” errors

I'm trying to create an SSL cert for the first time. I have no idea how this works and am simply following some instructions provided to me. first command works fine: openssl genrsa -des3 -out ...
1
vote
3answers
4k views

Local SSL connections are causing redirect loop (after Ubuntu update)

Following a recent Ubuntu update, my local websites are no longer serving their pages over SSL. For example, my .htaccess file attempts to ensure /sign-in is always served over HTTPS: RewriteEngine ...
0
votes
2answers
3k views

Restart of nginx service fails because of /etc/nginx/nginx.conf test failure

Installing 3rd party SSL on DigitalOcean Droplet, Apache running Ubuntu 12.10. Following the instructions here: AlphaSSL on Apache Self signed SSL instructions from DigitalOcean So everything ...
1
vote
1answer
1k views

Export SSL Cert from IIS and import into GlassFish keystore

What I need: I have an existing SSL certificate installed on IIS 6. On the same machine, I have GlassFish installed and would like to share the same certificate since they both share the same ...
6
votes
2answers
635 views

Change Key exchange mechanism in IIS 8

We are using RSA key exchange mechanism for SSL certificate. How can I change that to DHE_RSA or ECDHE_RSA? Due to using RSA, we are getting the below warning in chrome Your connection to ...
9
votes
2answers
10k views

Postfix “warning: cannot get RSA private key from file”

I just followed this tutorial to set up a postfix mailserver with dovecot and mysql as backend for virtual users. Now I got the most parts working, I can connect to POP3(S) and IMAP(S). Using echo ...
3
votes
2answers
2k views

The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it

We're using an AWS ELB to do SSL termination and are having an issue where Chrome is displaying "https" in red with a strikethrough. It says "The site is using outdated security settings that may ...
0
votes
1answer
17 views

Meaning of ssl_ciphers line on nginx.conf

What is the meaning of the following line from an nginx.conf file? ssl_ciphers HIGH:!aNULL:!MD5; I know the ssl cipher is specifying which algorithm to use to secure the server communication and ...
2
votes
2answers
20 views

Command line to set up SNI on IIS for Windows 2012

I'm trying to complete the automated build script of my web server, which runs Windows 2012 and has two SSL websites, each with its own digital certificate. I am using SNI, which works fine when I ...
0
votes
2answers
3k views

RDS 2012 R2: An authentication error has occurred (Code: 0x607)

I've set up an RDS 2012 R2 host farm, but have problems. When I try to log on from an outside client, then I get this error... "An authentication error has occurred (Code: 0x607)" I've tried google ...
1
vote
1answer
55 views

How to install SSL Certificate into Service Bus 1.1 on Windows Server

For test cases and evaluation we installed 2 nodes with "Azure Service Bus 1.1" on Windows Server 2012 R2 machines. The installation process installs the https endpoints with a self-signed ...
0
votes
0answers
53 views

How to stop Cyrus from serving root certificate?

Since changing the certificate for my cyrus instance I get the following warning whenever I sign with cyradm: cyradm --user cyrus --authz cyrus localhost verify error:num=19:self signed certificate ...
0
votes
1answer
60 views

The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it - even with SHA2

I get the above complaint from chrome. I've found The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it, but this is a non-issue ...
0
votes
0answers
22 views

Linux / Nginx - Centralized SSL Certificate Hosting

I manage about 20 virtual machines all running different web applications. The domain names of these web apps are subdomains of the same domain. I have one wildcard SSL certificate which will work for ...
0
votes
1answer
18 views

New Exchange SSL certificate now Windows XP Outlook clients won't connect

I renewed our SSL certificate for Exchange but now Outlook won't connect on any Windows XP machines. It asks for the username and password and even when the correct credentials are entered it just ...
0
votes
1answer
24 views

SSL certificate on cloned server, common name not same as server name

I've cloned a rackspace cloud server and put it into a load balancer, whilst removing the original server. The site seems to respond fine but then I have a problem with the SSL certificate, as I'm ...
2
votes
1answer
384 views

HTTPS Proxy - Is it possible to proxy a HTTPS request without having certificates setup?

HTTPS Proxy - Is it possible to proxy a HTTPS request without having certificates setup? In my case I'm still trying to workout how to do this with .NET HttpListener & HttpWebRequest. I've got ...
0
votes
1answer
38 views

Self signed certificate in certificate chain

I'm having building the correct certificate chain. My certificate issue a class 2 issued by StartSSL. Here's in order what I have put in my ssl.crt: my cert https://www.startssl.com/certs/ca.pem ...
1
vote
2answers
33 views

Do I need to include `.local` addresses when I renew a SSL certificate?

I am about to renew a SSL certificate to be used with Microsoft Exchange Server 2013. I am viewing the current SSL certificate that is about to expire to check what addresses are currently included on ...
2
votes
1answer
2k views

How do I properly generate a keystore for ssl?

I'm trying to get an ssl certificate from godaddy for use with jetty. These are my steps: keytool -keystore keystore -alias jetty -genkey -keyalg RSA -keysize 2048 What is your first and last name?: ...
5
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
3
votes
3answers
73 views

Windows server 2012 Root Enterprise Certification Authority issue certificates only with 2 years validity

I cannot make my Enterprise Root CA issue certificates with an expiration date more than 2 years. I've already set ValidityPeriodUnits and ValidityPeriod register keys with certutil.exe. I've ...
2
votes
3answers
494 views

SSL wildcard certificates and trailing 'www'

I've got a wildcard SSL certificate for *.example.com. I'm using nginx, and redirecting all traffic for http to https, and also rewriting the URLs without a trailing www (if there is one). So it ...
1
vote
1answer
251 views

How do I redirect users from https://www.example.com to https://example.com?

I did not purchase a wildcard certificate, but I see a big problem with my setup. When I navigate to https://www.redmeetsblue.org I do not have a certificate, like the one I have for ...
1
vote
3answers
1k views

Thawte SSL123 SHA-2 Intermediate Certificate Chain, Broken?

I attempted to upgrade my one Web site, running nginx, from a SHA-1 SSL123 certificate to a SHA-2 one. Thawte's Web page with intermediate CAs has "RSA SHA-2 (under SHA-1 Root)" and "RSA SHA-2 ...
5
votes
2answers
2k views

OpenSSL: how to generate a CSR with interactively solicited Subject Alternative Names (SANs)?

I wish to configure OpenSSL such that when running openssl req -new to generate a new certificate signing request, I am prompted for any alternative subject names to include on the CSR. I have added ...
-2
votes
0answers
25 views

Is it possible to create a single SSL certificate with two or more wildcard domains? [duplicate]

I am aware of the possibility to have a wildcard SSL certificate, for ex *.example.com or a multi-domain SSL certificate, for ex example.com;example.nl etc. But since we host multiple domains per ...
0
votes
2answers
1k views

Passed SSL checker, but browser doesn't show secure?

I've set up my SSL certificate following the instructions at http://splittingelectrons.wordpress.com/2012/02/24/how-to-configure-an-ssl-certificate-for-apache-on-amazon-ec2/ I've checked my website ...
14
votes
4answers
4k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
3
votes
2answers
149 views

Do I need to purchase a trusted cert for offline environment?

I have a webserver used self-sign cert which is not connected to internet and those connect to my webserver also have no connection to internet, in such environment, do I need to purchase a trusted ...
0
votes
1answer
997 views

Config Manager 2012 Application Download stuck at 0%

We have a Config Manager 2012 R2 setup with 2 Distribution Points on remote sites. In the remote site the Applications don't get downloaded, the status remains on 'downloading (0% complete)' In the ...
3
votes
3answers
3k views

suppress warnings from windows live mail untrusted cerficate ssl

Hi we have setup our own mailserver using ssl. Each time I start up windows live mail, in comes up with an annoying message that "The server you are connected to is using a security certificate that ...
1
vote
1answer
15 views

IIS8.5 Centralized Certificates: using more specific wildcard?

I've set up Centralized Certificates on my IIS 8.5 (Windows 2012 Standard). I have the following certificates available, among others: CN=*.dev2.pressero.com, OU=Domain Control Validated ...
0
votes
1answer
31 views

Self-signed SSL certificate to match multiple subdomains

I have a bunch of sites served through nginx with SSL with self-signed certificates, each of which is on a subdomain, e.g.: https://app1.example.com https://app2.example.com My user base is small ...
1
vote
1answer
73 views

Apache's deprecated SSLCertificateChainFile directive (AH02559)

Recently I've upgraded Apache from 2.2 to 2.4 and I cannot figure out how to deprecate a SSLCertificateChainFile directive. The error: me@jessie:~$ sudo apache2ctl configtest AH02559: The ...
2
votes
1answer
31 views

User domain CA to create a UCC cert

We have 30+ RDS servers and use a hardware load balancer. I'm trying to figure out how to generate a UCC cert from our in house CA. Anyone point me in the right direction to do so? Need to alias all ...
1
vote
0answers
249 views

Squid 3.5.4: ssl bump: error - Error negotiating SSL connection on FD 10: Success (0)

I am trying to install squid 3.5.4 (on docker, running debian 8) and run it in ssl-bump mode. Compilation: ./configure --prefix=/opt/squid --srcdir=. --disable-maintainer-mode \ ...