SSL certificates are used to encrypt and authenticate connections to web servers

learn more… | top users | synonyms (1)

83
votes
4answers
90k views

how to download the ssl certificate from a website?

I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?
43
votes
9answers
5k views

Why do I need to purchase an SSL certificate when I can generate one locally?

I am having trouble understanding why we need to purchase SSL certificates when we can generate them locally using openSSL. What is the difference between the certificate I purchase and a test ...
36
votes
2answers
8k views

Should a wildcard SSL certificate secure both the root domain as well as the sub-domains?

I ask this question, because Comodo are telling me that a wildcard certificate for *.example.com will also secure the root domain example.com. So with a single certificate, both my.example.com and ...
31
votes
2answers
17k views

How can I work around problems with certificate configuration in Remote Desktop Services?

I am setting up a Remote Desktop Services farm, and am having trouble configuring certificates for it to use. A demonstration of the problem I'm seeing can be found in Step #4. At this point I am ...
29
votes
5answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
27
votes
4answers
6k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
26
votes
2answers
10k views

Can I build my own Extended Validation SSL certificate?

I can create by own CA and generate a self signed SSL certificate this way. But what does it take to make the browser show the certificate as being an "Extended Validation SSL certificate" ? Can I ...
22
votes
3answers
25k views

stop apache from asking for SSL password each restart [duplicate]

Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
19
votes
8answers
34k views

IIS7: can't set host name on site with SSL cert and port 443

Consider a Win 2008 SP2 machine with IIS7. The task is to apply a certificate and host name to the one and only Site on this machine. The site's host headers need to be abc.123.mysite.com The first ...
19
votes
2answers
5k views

Must CSRs be generated on the server that will host the SSL certificate?

Is it necessary to generate the CSR (Certificate Signing Request) on the same machine that will host my web application and SSL certificate? This page on SSL Shopper says so, but I'm not sure if ...
18
votes
4answers
2k views

Where do companies typically store SSL certificates for future use?

We recently bought a wildcard SSL cert for our domain. We converted all of the certs to a Java keystore, but now we are asking ourselves where we should store these for later use. Do people use ...
18
votes
3answers
2k views

choosing the right SSL certificate

We're looking to purchase some SSL certificates to secure the login pages of ecommerce sites. It is not required to secure the actual payment process as this is protected by a third party with its own ...
18
votes
2answers
15k views

SSL Certificate Location on UNIX/Linux

Is there any standard or convention for where SSL certificates and associated private keys should go on the UNIX/Linux filesystem? Thanks.
15
votes
4answers
1k views

SSL certificate selection based on host-header: is it possible?

Is it possible for a web server to select an SSL certificate to use based on the host-header of the incoming connection, or is that information that is only available after the SSL connection is ...
15
votes
1answer
716 views

How does this kind of SSL work?

"Issued to" and "Domain Name" doesn't match but still valid and accepted by all major browsers without any warning. While previewing my blog post in Blogger, I noticed that my blog was previewed via ...
15
votes
2answers
3k views

Can MS Certificate Services be a Subordinate to CA created with OpenSSL

I want to setup a enterprise certification authority for my domain. So I can issue certificates for various purposes. I would like to follow the best practice of having an offline CA as the root, ...
14
votes
2answers
975 views

Purchase new SSL Certificate before existing one expires

I am currently transferring a new customer onto my virtual private server from their old host. They have an existing SSL certificate but it expires next month so I don't think it is worth the hassle ...
14
votes
3answers
10k views

SSL Certificate Class 2 vs Class 3 vs Class 4

I just got a "Premium EV SSL Certificate" form GoDaddy.com. Apparently as of 8 months ago GoDaddy doesn't provide Class 3 Certificates. ...
13
votes
5answers
7k views

Do any well-known CAs issue Elliptic Curve certificates?

Background I've seen that Comodo has an elliptic curve root ("COMODO ECC Certification Authority"), but I don't see mention of EC certificates on their web site. Does Certicom have intellectual ...
13
votes
2answers
1k views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...
13
votes
2answers
20k views

How to setup SSL on Amazon EC2?

I have just hopped over to Amazon for serving my .net sites and one site requires SSL. I have an elastic IP pointing at my EC2 instance, and I have my site setup in IIS 7 all working fine. I also ...
13
votes
6answers
25k views

Installing SSL Certificate for use in IIS7, installation “works”, but cert listing disappears

Windows Server 2008 R2, IIS7. We have an SSL cert from Go Daddy. It's a wildcard cert, so it will work across subdomains (e.g. *.domain.com). I followed the instructions located at ...
12
votes
5answers
17k views

How to avoid lftp Certificate verification error?

I'm trying to get my Pelican blog working. It uses lftp to transfer the actual blog to ones server, but I always get an error: mirror: Fatal error: Certificate verification: subjectAltName does not ...
11
votes
9answers
76k views

SSL Error - unable to read server certificate from file

I've been setting up SSL for my domain today, and have struck another issue - I was hoping someone could shed some light on.. I keep receiving the following error messages: [error] Init: Unable to ...
11
votes
7answers
10k views

Free (or nearly free) Trusted SSL Certificate? [closed]

Is it possible to get a trusted signed ssl certificate for free? I could create a self signed one using iis7 for example but these normally require the user to accept them as compared to one from a ...
11
votes
4answers
996 views

differences of SSL certificates?

What are differences of SSL certificates for web server, such like extended validation, Smart Seal, wildcards, single root? What certificates are appropriate for what needs?
11
votes
2answers
9k views

Save Remote SSL Certificate via Linux Command Line

Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert ...
11
votes
3answers
13k views

How to set up my own full-featured certificate authority?

I'd like to set up a certificate authority, which I can then import to all the company's browsers and systems to get rid of all those nasty client warnings when using HTTPS or SSL.
11
votes
2answers
2k views

Cost of getting in-house certificate authority trusted

My company has an in-house certificate authority that is currently self-signed. Since we want to start using it for external SSL and secure email to our customers, we need to get it trusted. Does ...
11
votes
1answer
186 views

Find out how many browsers reject SSL certificate

I'd like to find out how many browsers reject our SSL certificate when making HTTP requests to our webserver. We're using a free CA which now seems to be recognised by most modern browsers, but I'd ...
10
votes
2answers
4k views

Can't upload certificate to AWS

I'm doing: aws iam upload-server-certificate --server-certificate-name MysiteCertificate --certificate-body Downloads/mysite/mysite.crt --private-key mysite.pem --certificate-chain ...
10
votes
1answer
5k views

Certificate does not have a name

I've successfully managed to install an ssl-certificate in IIS, however the 'Name' column is showing as blank even though I entered a friendly name. Is there any way to rectify this? The screenshot I ...
10
votes
3answers
807 views

Why issue a SSL certificate that expires in 2037?

In Firefox, if I view the Verisign Universal Root Certificate Authority, I notice that it expires in 2037. (Settings tab -> advanced -> view certificates -> VeriSign Universal Root Certification ...
10
votes
2answers
6k views

How do I ensure that stunnel sends all intermediate CA certs?

A few computers, but not most, are rejecting the SSL certificate from my webserver. The problem seems to be that some computers are rejecting the CA certs. The problem seems to be manifesting on Mac ...
10
votes
3answers
18k views

How to remove Private Key Password from pkcs12 container?

I extracted certificate using Chrome's SSL/export command. Then provided it as input to openvpn - in the config for openvpn: pkcs12 "path/to/pkcs12_container" When calling openvpn ~/openvp_config it ...
10
votes
1answer
8k views

Import .pem into IIS 7

I was given two .pem files to import. I did not generate these files. Can I import them into IIS 7 or do they have to be converted into another format? I know that IIS likes .pfx - can .pem's be ...
10
votes
4answers
34k views

Why does Window's SSL Cipher-Suite get restricted under certain SSL certificates?

Problem: Windows Server 2008 R2 will only support the following ssl cipher suites when using certain certificates on the server: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ...
10
votes
1answer
214 views

How do SAN Certs degrade performance?

I have heard that when lots of names get added to a single SAN Cert (Subject Alternative Name) performance starts to degrade. Can someone explain how SAN certs are processed so I understand what ...
10
votes
1answer
338 views

Utilizing an alternate CA (Like Microsoft Certificate Services) with Puppet

I'm investigating whether I can somehow make the puppet ecosystem utilize our existing Microsoft Enterprise CA rather than being its own CA. Since puppet touts that all of the system is "standard ...
9
votes
3answers
383 views

Is it good practice to remove the password from a ssl cert?

I have read at several blogs now that one should remove passwords from SSL certificates in order to avoid password prompts during Apache restarts. Is this true and does this pose any security risks?
9
votes
3answers
512 views

Why does a web server's public key certificate have to be signed by a certificate authority?

In other words, what would be the security risk of not signing public key certificates by certificate authorites (from a user perspective)? I mean, the data is still encrypted... What could a man in ...
9
votes
2answers
11k views

Postfix “warning: cannot get RSA private key from file”

I just followed this tutorial to set up a postfix mailserver with dovecot and mysql as backend for virtual users. Now I got the most parts working, I can connect to POP3(S) and IMAP(S). Using echo ...
9
votes
1answer
3k views

Details on exact expiration datetime of an SSL certificate?

Let's say we have an SSL certificate for a site. According to a web browser, the certificate expires tomorrow, Dec 10 2011. OK, but that glosses over time zones. When will it expire, exactly? 00:00 ...
8
votes
3answers
1k views

Do I have to update my snakeoil certificate after updating openssl (heartbleed)?

I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed. I do support SSL on my server, but only with a snakeoil certificate. I was just ...
8
votes
5answers
35k views

cURL or SSL problems, how to solve?

I keep getting this error: No cURL data returned for https://XXX.XXXX.XXX:XXXX [0] SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
8
votes
4answers
3k views

Free SSL Certificate authority I can trust

Can anyone point me to a free SSL Certificate authority I can trust?
8
votes
2answers
713 views

Can we use a certificate bought for one domain on another domain?

We bought a certificate two years ago for service1.domain1.com and it is valid up to 2018. The problem is that domain was managed by third party and they are going to drop that sub domain. My ...
8
votes
3answers
3k views

Can I purchase a certificate for my domain that can sign other certificates for subdomains?

I have written a small program to run on a Windows computer that serves SSL/TLS web pages through port 443 to visiting web browsers. I want it to be easy for non-technical people to install and run ...
8
votes
2answers
470 views

HTTPS warning: works on desktop, warning on mobile

I installed a wildcard SSL certificate (*.vht.com) for my work and accessing the following website in chrome (or any desktop browser) https://tours.vht.com/fsviewer3/fss2.html works, but when trying ...
8
votes
4answers
13k views

Apache: SSLCertificateKeyFile: file does not exist or is empty

I am configuring SSL for Apache 2. My system is Ubuntu Server 10.04 LTS. I have the following settings related to SSL in my vhost configuration: SSLEngine On SSLCertificateKeyFile ...