SSL certificates are used to encrypt and authenticate connections to web servers

learn more… | top users | synonyms

65
votes
4answers
65k views

how to download the ssl certificate from a website?

I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?
41
votes
9answers
4k views

Why do I need to purchase an SSL certificate when I can generate one locally?

I am having trouble understanding why we need to purchase SSL certificates when we can generate them locally using openSSL. What is the difference between the certificate I purchase and a test ...
30
votes
1answer
9k views

How can I work around problems with certificate configuration in Remote Desktop Services?

I am setting up a Remote Desktop Services farm, and am having trouble configuring certificates for it to use. A demonstration of the problem I'm seeing can be found in Step #4. At this point I am ...
28
votes
4answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
27
votes
2answers
5k views

Should a wildcard SSL certificate secure both the root domain as well as the sub-domains?

I ask this question, because Comodo are telling me that a wildcard certificate for *.example.com will also secure the root domain example.com. So with a single certificate, both my.example.com and ...
22
votes
2answers
8k views

Can I build my own Extended Validation SSL certificate?

I can create by own CA and generate a self signed SSL certificate this way. But what does it take to make the browser show the certificate as being an "Extended Validation SSL certificate" ? Can I ...
18
votes
3answers
2k views

choosing the right SSL certificate

We're looking to purchase some SSL certificates to secure the login pages of ecommerce sites. It is not required to secure the actual payment process as this is protected by a third party with its own ...
16
votes
4answers
14k views

stop apache from asking for SSL password each restart [duplicate]

Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
16
votes
8answers
23k views

IIS7: can't set host name on site with SSL cert and port 443

Consider a Win 2008 SP2 machine with IIS7. The task is to apply a certificate and host name to the one and only Site on this machine. The site's host headers need to be abc.123.mysite.com The first ...
15
votes
4answers
1k views

Where do companies typically store SSL certificates for future use?

We recently bought a wildcard SSL cert for our domain. We converted all of the certs to a Java keystore, but now we are asking ourselves where we should store these for later use. Do people use ...
15
votes
4answers
1k views

SSL certificate selection based on host-header: is it possible?

Is it possible for a web server to select an SSL certificate to use based on the host-header of the incoming connection, or is that information that is only available after the SSL connection is ...
15
votes
2answers
2k views

Can MS Certificate Services be a Subordinate to CA created with OpenSSL

I want to setup a enterprise certification authority for my domain. So I can issue certificates for various purposes. I would like to follow the best practice of having an offline CA as the root, ...
14
votes
1answer
692 views

How does this kind of SSL work?

"Issued to" and "Domain Name" doesn't match but still valid and accepted by all major browsers without any warning. While previewing my blog post in Blogger, I noticed that my blog was previewed via ...
13
votes
2answers
3k views

Must CSRs be generated on the server that will host the SSL certificate?

Is it necessary to generate the CSR (Certificate Signing Request) on the same machine that will host my web application and SSL certificate? This page on SSL Shopper says so, but I'm not sure if ...
12
votes
2answers
19k views

How to setup SSL on Amazon EC2?

I have just hopped over to Amazon for serving my .net sites and one site requires SSL. I have an elastic IP pointing at my EC2 instance, and I have my site setup in IIS 7 all working fine. I also ...
11
votes
2answers
786 views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...
11
votes
4answers
922 views

differences of SSL certificates?

What are differences of SSL certificates for web server, such like extended validation, Smart Seal, wildcards, single root? What certificates are appropriate for what needs?
11
votes
6answers
22k views

Installing SSL Certificate for use in IIS7, installation “works”, but cert listing disappears

Windows Server 2008 R2, IIS7. We have an SSL cert from Go Daddy. It's a wildcard cert, so it will work across subdomains (e.g. *.domain.com). I followed the instructions located at ...
10
votes
5answers
5k views

Do any well-known CAs issue Elliptic Curve certificates?

Background I've seen that Comodo has an elliptic curve root ("COMODO ECC Certification Authority"), but I don't see mention of EC certificates on their web site. Does Certicom have intellectual ...
10
votes
3answers
500 views

Why issue a SSL certificate that expires in 2037?

In Firefox, if I view the Verisign Universal Root Certificate Authority, I notice that it expires in 2037. (Settings tab -> advanced -> view certificates -> VeriSign Universal Root Certification ...
10
votes
7answers
7k views

Free (or nearly free) Trusted SSL Certificate? [closed]

Is it possible to get a trusted signed ssl certificate for free? I could create a self signed one using iis7 for example but these normally require the user to accept them as compared to one from a ...
10
votes
3answers
6k views

SSL Certificate Class 2 vs Class 3 vs Class 4

I just got a "Premium EV SSL Certificate" form GoDaddy.com. Apparently as of 8 months ago GoDaddy doesn't provide Class 3 Certificates. ...
10
votes
2answers
5k views

How do I ensure that stunnel sends all intermediate CA certs?

A few computers, but not most, are rejecting the SSL certificate from my webserver. The problem seems to be that some computers are rejecting the CA certs. The problem seems to be manifesting on Mac ...
10
votes
3answers
11k views

How to set up my own full-featured certificate authority?

I'd like to set up a certificate authority, which I can then import to all the company's browsers and systems to get rid of all those nasty client warnings when using HTTPS or SSL.
10
votes
2answers
6k views

Save Remote SSL Certificate via Linux Command Line

Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert ...
10
votes
2answers
1k views

Cost of getting in-house certificate authority trusted

My company has an in-house certificate authority that is currently self-signed. Since we want to start using it for external SSL and secure email to our customers, we need to get it trusted. Does ...
10
votes
1answer
193 views

How do SAN Certs degrade performance?

I have heard that when lots of names get added to a single SAN Cert (Subject Alternative Name) performance starts to degrade. Can someone explain how SAN certs are processed so I understand what ...
10
votes
1answer
148 views

Find out how many browsers reject SSL certificate

I'd like to find out how many browsers reject our SSL certificate when making HTTP requests to our webserver. We're using a free CA which now seems to be recognised by most modern browsers, but I'd ...
10
votes
1answer
260 views

Utilizing an alternate CA (Like Microsoft Certificate Services) with Puppet

I'm investigating whether I can somehow make the puppet ecosystem utilize our existing Microsoft Enterprise CA rather than being its own CA. Since puppet touts that all of the system is "standard ...
9
votes
3answers
504 views

Why does a web server's public key certificate have to be signed by a certificate authority?

In other words, what would be the security risk of not signing public key certificates by certificate authorites (from a user perspective)? I mean, the data is still encrypted... What could a man in ...
8
votes
3answers
359 views

Is it good practice to remove the password from a ssl cert?

I have read at several blogs now that one should remove passwords from SSL certificates in order to avoid password prompts during Apache restarts. Is this true and does this pose any security risks?
8
votes
3answers
1k views

Do I have to update my snakeoil certificate after updating openssl (heartbleed)?

I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed. I do support SSL on my server, but only with a snakeoil certificate. I was just ...
8
votes
5answers
31k views

cURL or SSL problems, how to solve?

I keep getting this error: No cURL data returned for https://XXX.XXXX.XXX:XXXX [0] SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
8
votes
2answers
711 views

Can we use a certificate bought for one domain on another domain?

We bought a certificate two years ago for service1.domain1.com and it is valid up to 2018. The problem is that domain was managed by third party and they are going to drop that sub domain. My ...
8
votes
3answers
10k views

How to avoid lftp Certificate verification error?

I'm trying to get my Pelican blog working. It uses lftp to transfer the actual blog to ones server, but I always get an error: mirror: Fatal error: Certificate verification: subjectAltName does not ...
8
votes
3answers
1k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
8
votes
2answers
369 views

HTTPS warning: works on desktop, warning on mobile

I installed a wildcard SSL certificate (*.vht.com) for my work and accessing the following website in chrome (or any desktop browser) https://tours.vht.com/fsviewer3/fss2.html works, but when trying ...
8
votes
1answer
9k views

SSL Certificate Location on UNIX/Linux

Is there any standard or convention for where SSL certificates and associated private keys should go on the UNIX/Linux filesystem? Thanks.
8
votes
2answers
2k views

Can't upload certificate to AWS

I'm doing: aws iam upload-server-certificate --server-certificate-name MysiteCertificate --certificate-body Downloads/mysite/mysite.crt --private-key mysite.pem --certificate-chain ...
8
votes
1answer
6k views

Import .pem into IIS 7

I was given two .pem files to import. I did not generate these files. Can I import them into IIS 7 or do they have to be converted into another format? I know that IIS likes .pfx - can .pem's be ...
8
votes
4answers
4k views

Is there a difference between a self-signed certificate and one signed by your own CA?

We need to use SSL on our internal network for a few sensitive applications, and I need to know if there is a difference between a self signed certificate and one signed by a Windows Server CA that we ...
8
votes
3answers
8k views

How to remove Private Key Password from pkcs12 container?

I extracted certificate using Chrome's SSL/export command. Then provided it as input to openvpn - in the config for openvpn: pkcs12 "path/to/pkcs12_container" When calling openvpn ~/openvp_config it ...
7
votes
8answers
49k views

SSL Error - unable to read server certificate from file

I've been setting up SSL for my domain today, and have struck another issue - I was hoping someone could shed some light on.. I keep receiving the following error messages: [error] Init: Unable to ...
7
votes
4answers
403 views

What's the common practice of when to update a soon expiring SSL certificate?

Recently Windows Azure Storage SSL certificate expired and that causes a lot of problems. Now the certificate can be retrieved by any user and so everyone could have noticed that it was going to ...
7
votes
4answers
3k views

Free SSL Certificate authority I can trust

Can anyone point me to a free SSL Certificate authority I can trust?
7
votes
1answer
644 views

How do I match a certificate file to a key file?

I have a SSL certificate that the former sysadmin was issued (crt file.) Searching the filesystem I found several .key files. How do I match the crt to the key file and confirm that they match? ...
7
votes
2answers
2k views

Can I generate a CSR file for mod_ssl on a different machine to the production box?

The production VM won't be cloned for a few days but we need the CSR file now to buy the certificate. Can I just create the private key and CSR file on my own machine, supply the CSR file to the ...
7
votes
5answers
6k views

What is TLS and how does it compare to SSL?

Is TLS the "new" version of SSL? What features does it add, or security issues does it address? Can anything that supports SSL support TLS? What would be involved in making the switch? Is the ...
7
votes
4answers
25k views

Why does Window's SSL Cipher-Suite get restricted under certain SSL certificates?

Problem: Windows Server 2008 R2 will only support the following ssl cipher suites when using certain certificates on the server: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ...
7
votes
3answers
5k views

Cant connect to mysql using self signed SSL certificate

After creating a self-signed SSL certificate, I have configured my remote mysqld to use them (and ssl is enabled) I ssh into my remote server, and try connecting to its own mysqld using ssl (mysql ...