Questions tagged [ssl-certificate]
SSL certificates are used to encrypt and authenticate connections to network servers, most popularly for web servers but also email, file transfers, and other network connections.
3,296
questions
434
votes
15
answers
805k
views
Displaying a remote SSL certificate details using CLI tools
In Chrome, clicking on the green HTTPS lock icon opens a window with the certificate details:
When I tried the same with cURL, I got only some of the information:
$ curl -vvI https://gnupg.org
* ...
- 13.6k
278
votes
6
answers
569k
views
how to download the ssl certificate from a website?
I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?
- 4,534
247
votes
7
answers
707k
views
How do I view the details of a digital certificate .cer file?
I am using Windows and have been given a .cer file. How can I view the details of it?
- 7,483
206
votes
6
answers
824k
views
How do I convert a .cer certificate to .pem?
I have a .cer certificate and I would like to convert it to the .pem format.
If I remember correctly, I used to be able to convert them by exporting the .cer in Base64, then renaming the file to .pem ...
- 2,205
202
votes
14
answers
258k
views
How to view all ssl certificates in a bundle?
I have a certificate bundle .crt file.
doing openssl x509 -in bundle.crt -text -noout only shows the root certificate.
how do i see all the other certificates?
- 2,517
190
votes
6
answers
499k
views
SSL Certificate Location on UNIX/Linux
Is there any standard or convention for where SSL certificates and associated private keys should go on the UNIX/Linux filesystem?
- 2,205
148
votes
8
answers
26k
views
Is there a reason to use an SSL certificate other than Let's Encrypt's free SSL?
Let's Encrypt are providing free SSL certificates. Are there any downsides compared to other, paid certificates e.g. AWS Certificate Manager?
- 6,050
106
votes
3
answers
453k
views
What is .crt and .key files and how to generate them?
I've the following configuration:
SSLEngine on
SSLCertificateFile /etc/httpd/conf/login.domain.com.crt
SSLCertificateKeyFile /etc/httpd/conf/login.domain.com.key
SSLCipherSuite ALL:-ADH:+HIGH:+MEDIUM:...
- 1,793
106
votes
5
answers
51k
views
Should a wildcard SSL certificate secure both the root domain as well as the sub-domains?
I ask this question, because Comodo are telling me that a wildcard certificate for *.example.com will also secure the root domain example.com. So with a single certificate, both my.example.com and ...
- 1,175
96
votes
4
answers
242k
views
Does each subdomain need its own SSL certificate?
I am creating a websocket server which will live on ws.mysite.example. I want the web socket server to be SSL encrypted as well as domain.example to be SSL encrypted. Do I need to purchase a new ...
- 1,111
82
votes
5
answers
165k
views
Best location to keep SSL certificates and private keys on Ubuntu servers?
On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/
This answer adds that the certificate should go in /etc/ssl/certs/ but ...
- 1,687
81
votes
10
answers
199k
views
How to avoid lftp Certificate verification error?
I'm trying to get my Pelican blog working. It uses lftp to transfer the actual blog to ones server, but I always get an error:
mirror: Fatal error: Certificate verification: subjectAltName does not ...
- 912
78
votes
6
answers
133k
views
Generating a self-signed cert with openssl that works in Chrome 58
As of Chrome 58 it no longer accepts self-signed certs that rely on Common Name: https://productforums.google.com/forum/#!topic/chrome/zVo3M8CgKzQ;context-place=topicsearchin/chrome/category$3ACanary%...
- 1,737
74
votes
6
answers
22k
views
Why are CA root certificates all SHA-1 signed (since SHA-1 is deprecated)?
I understand that SSL certs cannot be signed using SHA-1 anymore. Yet, all CA root certificates are SHA-1 signed (mostly). Does it mean the same algorithm that is no longer trusted for "you grandma ...
- 897
74
votes
2
answers
68k
views
Must CSRs be generated on the server that will host the SSL certificate?
Is it necessary to generate the CSR (Certificate Signing Request) on the same machine that will host my web application and SSL certificate?
This page on SSL Shopper says so, but I'm not sure if that'...
- 921
74
votes
2
answers
234k
views
How to combine various certificates into single .pem
I've just finished reading over this great thread explaining the different SSL formats.
Now I'm essentially looking for the opposite of How to split a PEM file
There's 4 files I want to consolidate, ...
- 2,185
65
votes
4
answers
24k
views
How to decide where to purchase a wildcard SSL certificate?
Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
- 1,277
63
votes
4
answers
89k
views
Download SSL certificate from aws certificate manager
I am using aws certificate manager for managing SSL. Recently I purchased a wildcard ssl *.example-private.com Now I need that SSL certificate to deploy on enterprise git instance on aws.
How can i ...
- 1,577
61
votes
11
answers
19k
views
Why do I need to purchase an SSL certificate when I can generate one locally?
I am having trouble understanding why we need to purchase SSL certificates when we can generate them locally using openSSL. What is the difference between the certificate I purchase and a test ...
- 1,311
59
votes
8
answers
122k
views
Apache: SSLCertificateKeyFile: file does not exist or is empty
I am configuring SSL for Apache 2. My system is Ubuntu Server 10.04 LTS. I have the following settings related to SSL in my vhost configuration:
SSLEngine On
SSLCertificateKeyFile /etc/ssl/private/...
- 4,350
57
votes
8
answers
227k
views
How to remove Private Key Password from pkcs12 container?
I extracted certificate using Chrome's SSL/export command.
Then provided it as input to openvpn - in the config for openvpn:
pkcs12 "path/to/pkcs12_container"
When calling openvpn ~/openvp_config it ...
- 673
56
votes
6
answers
115k
views
Can an SSL certificate be on a single line in a file (no line breaks)?
SSL certificates by default have line breaks after 67 characters. I'm trying to create SSL certificate files using Chef. Essentially I want to create the entire certificate file from a string variable ...
- 3,170
55
votes
11
answers
133k
views
IIS7: can't set host name on site with SSL cert and port 443
Consider a Win 2008 SP2 machine with IIS7. The task is to apply a certificate and host name to the one and only Site on this machine. The site's host headers need to be abc.123.example.com
The first ...
- 4,437
53
votes
16
answers
486k
views
SSL Error - unable to read server certificate from file
I've been setting up SSL for my domain today, and have struck another issue - I was hoping someone could shed some light on..
I keep receiving the following error messages:
[error] Init: Unable to ...
- 1,177
52
votes
5
answers
199k
views
Failed tls handshake. Does not contain any IP SANs
I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
- 555
50
votes
7
answers
118k
views
Default CA Cert Bundle Location
I need to add a .pem cert file to my default CA cert bundle but I don't know where the default CA Cert bundle is kept.
I need to append my new .pem file to this default bundle. I'd rather do that ...
- 1,057
50
votes
3
answers
157k
views
stop apache from asking for SSL password each restart [duplicate]
Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
user274
45
votes
6
answers
23k
views
View the SSL certificate of a page that immediately redirects to another
So I've googled quite a bit for this but it appears that my google-fu fails me - apologies if this is a trivial and already answered question, I could not find anything about this
I'm trying to ...
- 575
43
votes
2
answers
110k
views
Can not get rid of `net::ERR_CERT_COMMON_NAME_INVALID` error in chrome with self-signed certificates
There are numerous question on the web where people are having difficulty setting up self signed certificates for use on internal network.
Just to link a few:
Getting Chrome to accept self-signed ...
- 535
41
votes
2
answers
63k
views
Error code: ssl_error_rx_record_too_long
I have nginx with the following setup:
server {
listen 80;
server_name site.com www.site.com;
root /home/site/public_html;
listen 443;
#...
- 6,691
39
votes
2
answers
82k
views
nginx permission denied to certificate files for ssl configuration
I'm installing an nginx ssl proxy on my Fedora server.
I've created a cert and key pair under /etc/nginx. They look like this:
ls -l /etc/nginx/
total 84
...
-rw-r--r--. 1 root root 1346 Sep 20 12:...
- 523
37
votes
3
answers
68k
views
Moving servers and IPs will change. Do SSL certificates need to be re-issued and installed?
We are moving servers to another facility with different block of IP addresses. Will we need to get new SSL certificates issued and installed once the move has taken place?
If so, is there any way to ...
- 747
36
votes
2
answers
64k
views
Save Remote SSL Certificate via Linux Command Line
Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert ...
Jim
36
votes
4
answers
84k
views
How to make Firefox trust system CA certificates?
Our network admin recently enabled HTTPS inspection on our firewall/router. For IE users this is fine because the certs have all been distributed via Active Directory for domain-joined machines. ...
- 1,922
35
votes
4
answers
257k
views
How to generate .key and .crt file from JKS file for httpd apache server
I have the mycert.jks file only.
Now i need to extract and generate .key and .crt file and use it in apache httpd server.
SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt
...
- 799
35
votes
1
answer
33k
views
Certificate does not have a name
I've installed an SSL certificate in IIS, however the 'Name' column is showing as blank even though I entered a friendly name. Is there any way to fix this?
- 1,329
35
votes
4
answers
175k
views
Is the alert “SSL3_READ_BYTES:sslv3 alert bad certificate” indicating that the SSL failed
While running the below command openssl s_client -host example.xyz -port 9093
I get the following error:
139810559764296:error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate:s3_pkt....
- 453
35
votes
2
answers
50k
views
Details on exact expiration datetime of an SSL certificate?
Let's say we have an SSL certificate for a site. According to a web browser, the certificate expires tomorrow, Dec 10 2011.
OK, but that glosses over time zones. When will it expire, exactly?
00:00 ...
- 816
35
votes
2
answers
20k
views
Can I build my own Extended Validation SSL certificate?
I can create by own CA and generate a self signed SSL certificate this way.
But what does it take to make the browser show the certificate as being an "Extended Validation SSL certificate" ?
Can I ...
- 2,196
34
votes
1
answer
2k
views
Trusting an untrustworthy CA - Can I restrict how system trusts it?
(Posted to ServerFault instead of StackOverflow because I feel it concerns OS configuration more than programming code).
I'm currently responsible for maintaining a system which connects to a third-...
- 2,299
33
votes
4
answers
57k
views
How do I know if *.pem is password protected using ssh-keygen?
I have got a file myfile-privkey.pem.
How do I check if the private key file is password protected using ssh-keygen?
- 465
33
votes
2
answers
49k
views
How can I work around problems with certificate configuration in Remote Desktop Services?
I am setting up a Remote Desktop Services farm, and am having trouble configuring certificates for it to use. A demonstration of the problem I'm seeing can be found in Step #4.
At this point I am ...
- 530
32
votes
7
answers
61k
views
Redirect non-www to www over SSL with Nginx
I'm having an error when trying to redirect https://example.com to https://www.example.com.
When I go to https://example.com, it doesn't redirect and returns the page/200 status.
I don't want this, ...
- 2,141
31
votes
1
answer
151k
views
What does "tlsv1 alert unknown ca" mean?
I am trying to do a curl request using a client certificate like so:
curl -E my.pem https://some.site
And I get the following error message:
curl: (35) error:14094418:SSL routines:SSL3_READ_BYTES:...
- 421
30
votes
1
answer
62k
views
openssl keeps giving me "unknown option" errors
I'm trying to create an SSL cert for the first time. I have no idea how this works and am simply following some instructions provided to me.
first command works fine:
openssl genrsa -des3 -out ...
29
votes
3
answers
43k
views
Do I need a separate SSL certificate for a DNS redirect?
I am implementing a multi-tenant application where my application hosts and serves technical documentation for a tenant's product.
Now, the approach that I was considering was - I host the ...
- 401
29
votes
5
answers
3k
views
Is a Self Signed SSL Certificate a False Sense of Security?
Is a Self Signed SSL certificate a false sense of security?
If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
- 1,351
28
votes
2
answers
58k
views
How does one install a custom CA certificate on CentOS?
I'm trying to install a certificate for my internal certificate server on a series of CentOS systems, and I'm finding the documentation on this to be almost non existent.
My end goal is to be able to ...
- 1,417
28
votes
2
answers
145k
views
Curl: unable to get local issuer certificate. How to debug?
I’ve got an odd problem. Updated my LAMP dev machine (Debian) to PHP 7. Afterwards I cannot connect to a specific TLS encrypted API via Curl anymore.
The SSL cert in question is signed by thawte.
...
- 383
27
votes
2
answers
19k
views
Can't upload certificate to AWS
I'm doing:
aws iam upload-server-certificate --server-certificate-name MysiteCertificate --certificate-body Downloads/mysite/mysite.crt --private-key mysite.pem --certificate-chain Downloads/mysite/...
- 901