The tag has no wiki summary.

learn more… | top users | synonyms

-1
votes
0answers
21 views

Restore certificate from a text dump

A have a paper page with a pretty-printed X.509 certificate dump. I want to convert it to a format that can be added to Windows certificate store. How can I do this? I want to use my certificate ...
0
votes
0answers
64 views

How can I generate a CER file using OpenSSL? (Azure recovery service)

I'm trying to generate self-signed x509 certificates for Azure's recovery service which requires: less than three years in time at least 2048 bit key use ClientAuthorization in extendedKeyUsage ...
0
votes
0answers
93 views

IIS Client Authentication without a CDP

I'm running IIS 7.5 on Win2k8, and am trying to configure 2-way SSL. I've turned Require Client Certificate on in IIS, I've installed a valid root certificate in my local machine's trusted root store, ...
0
votes
1answer
170 views

Limit on X509v3 Subject Alternative Name DNSname length

I have been searching through RFC 5280, 1034, and 1123 trying to figure out what a max string length is, but I can't find it. I'm wondering if any of you happen to know. For those of you who know ...
1
vote
0answers
58 views

apache/mod_gnutls ssl certificate based authentication

I'm using apache with gnutls. I've configured both to request authentication from the client. When providing the certificate it works. But it works also if I provide another that the correct ...
1
vote
1answer
52 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
1
vote
1answer
55 views

Integrity of Request/X509 Alternative Name/Extension Information

Am I correct in assuming that there's protection against the modification of both the subject and the extension information in a request or X509 certificate? This signature is just another element ...
0
votes
1answer
266 views

Strongswan with X.509 authentication and LDAP authorization

I would like to setup Strongswan/Libreswan with PKI authentication. Now I have searched and found only how to configure specific accepted client certificates like here: ...
1
vote
1answer
132 views

Convert EC2 ssh .pem key to Azure X.509 certificate?

Normally I use a pem file to login into my ec2 instance via ssh -i key.pem Now, in Azure, their requirement during instance creation is UPLOAD AN SSH KEY OR PROVIDE A PASSWORD FOR AUTHENTICATION ...
1
vote
2answers
219 views

How does OpenSSL determine that a certificate is for a root CA?

I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
0
votes
1answer
137 views

How can I renew the SSL certificate used on our Exchange server?

According to the MSDN article Renew an Exchange Certificate, I'm supposed to use Get-ExchangeCertificate -Thumbprint 'AD19B141228C7CF98B5F78DCED978B7C45E15434' | New-ExchangeCertificate ...
1
vote
2answers
596 views

Openssl Custom Extension

I know how to create x509 certificates with the openssl command line. But now I want to create one with a custom extension. How can I do this with openssl command line?
0
votes
3answers
44 views

Detect unencrypted SSL keys

I have an OpenVPN server installed on a Debian machine. Is there a way to find which of the keys have been created without being encrypted with a password, so as to replace them?
0
votes
1answer
955 views

OpenSSL: Why can't I enter a PEM Pass Phrase in the prompt?

I am trying to install an SSL certificate on my WAMP server for the first time. I've never done anything like this, so please, bare with me. W:\wamp\bin\apache\apache2.2.22\bin>echo ...
0
votes
1answer
82 views

Renewing a self-signed certificate

Is there a way to reset the expiry of a self signed X.509 certificate but keep both the public and the private key as they were? Technically this should be nothing more than a different date for the ...
0
votes
1answer
540 views

openssl Subject Public Key Info: RSA Public Key: (1024 bit) vs Public Key: (1024 bit)

I have a couple of certificates whose format seem pretty similar except for one thing I have checked the details of the cert by using the following openssl command openssl x509 -in certname -text ...
0
votes
2answers
84 views

How do I set up the DN for a SSL cert with a hostname of greater than 64 characters?

Everywhere I read says to have the server hostname in the commonName field and the subjectAltName field. The problem is that the hostname that I want to sign has greater than 64 characters. Therefore, ...
2
votes
1answer
72 views

Alternatives to a Trusted Root certificate

Given a SSL-protected site that was formerly whitelisted (Allow from x.x.x.x etc), and and a requirement from a customer to change the way authentication works, to use X.509 HTTPS Client verification. ...
0
votes
1answer
360 views

Error while converting der private key to pem

I have DER private key and certificate. I need to convert them to PEM format. Certificate converted normally, but when i try to convert key this error happens: # openssl x509 -in client-key.der ...
2
votes
1answer
8k views

Import of PEM certificate chain and key to Java Keystore

There are plenty of resources out there about this topic, but none I found which covers this slightly special case. I have 4 files; privatekey.pem certificate.pem intermediate_rapidssl.pem ...
0
votes
2answers
637 views

Can you re-use a SSL certificate across platforms?

Let's say I want to buy a wildcard SSL that I can use for web servers, spanning across a multitude of different servers and platform. I could issue a CSR for each and every one of them, with their ...
0
votes
3answers
455 views

Install X509 certificate into Windows 2008 R2

I'm trying to install a certificate into my windows 2008 but I'm not able to do it right. I have a .crt file and I click to install from contextual menu. It succeed to import but if I browse the ...
1
vote
1answer
340 views

Renew SSL client certificates

For a internally used webbased software, which must be available from everywhere, I have created client certificates which are installed in the browsers of authorized consumers. Now, with 2012 being ...
0
votes
0answers
467 views

SSLVerifyClient optional with location-based exceptions

I have a site that requires authentication in order to access certain directories, but not others. (The "directories" are really just rewrite rules that all pass through /index.php) In order to ...
0
votes
1answer
307 views

SSL certificate for Oracle Application Server 11g

I was asked to get an SSL certificate for an "Oracle Application Server 11g" which has a soon-to-expire certificate. Brushing aside the fact that 10g seems to be the newest version, I got a ...
2
votes
2answers
3k views

Can you generate a self signed certificate on Windows Server using CLI tools like certreq and certutil?

I need to quickly generate a self signed certificate on a Windows Server. I'd like to use the standard CLI tools that ship with it. I know I can use openssl.
3
votes
1answer
1k views

extracting raw ASN.1 parts from X.509 certificate

I'd like to extract raw hex ASN.1 data from X.509 certificate. I know, that I can do this by using DER format and hexdumping it. I'm interested in particular parts like "subject", "issuer" and their ...
1
vote
0answers
126 views

Apache SSL x509 authentication timeout

I have setup a location to enable client authentication based on x509 certificates: <Location /authenticate> SSLRequireSSL SSLVerifyClient require SSLVerifyDepth 10 </Location> ...
7
votes
2answers
3k views

How to split a PEM file

Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others. Question : How to read a concatenated PEM ...
1
vote
2answers
530 views

Exchange 2010 can't find SSL certificate that exists

I'm trying to set up TLS for the POP3 server in the Exchange CAS role. I purchased a cert from NameCheap, and the CA path is fully trusted, and installed it within the Certificates MMC snap-in ...
2
votes
2answers
1k views

Any open source web based X509 PKI tool? [closed]

Want to setup a CA, but it's hard to find a good web based X509 PKI tool, any recommend?
0
votes
2answers
278 views

client x.509 based authorization on apache

I want to give my users the ability to login with their own personal x.509 certificates. The user supply me (the account registration script) his/her x.509 public key. Apache should only accept the ...
2
votes
1answer
2k views

How to configure IIS Express to ask for client certificate

Does anybody know how to configure IIS Express to require client certificate for access? I'm trying to debug a problematic ASP.NET application which uses client certificates for authentication.
2
votes
2answers
166 views

x509 Authentication for SSL IRC

Does anyone know if it's possible to do client authentication with x509 signed certificates on any IRCd server? We'd like to set up a work irc server (yes, that's really what we want), but it'd be a ...
2
votes
2answers
234 views

X509 PKI Managment Appliance

Can anybody recommend a X509 managment appliance? The needs are rather basic, it should provide secured storage of private keys and the certificates for users and hosts, offer an overview of ...
2
votes
1answer
428 views

How to setup a reverse proxy to enable HTTP access with basic authentication to an internal HTTPS server that requires a certificate

We have an internal server that requires x509-based authentication, but I've been requested to open it up with a basic user/password authentication. I've been trying to setup a reverse proxy in ...
0
votes
1answer
187 views

How to sign and encrypt all sended mail via sendmail\postfix

I have certificates x.509 for signing and enrypting outgoing emails. I want to create plain emails in some app (Ruby on Rails app in my case) and send it via sendmail with autosign and autocrypt ...
2
votes
4answers
265 views

Is there a provider that offers free SSL certificates that don't give a warning in Firefox 4?

I am looking to install SSL certificates for frequently used https services. I used to use StartSSL for this, but they "temporarily" stopped offering their services. I wonder if there are any other ...
28
votes
4answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
1
vote
1answer
1k views

REMOTE_USER = SSL_CLIENT_S_DN_CN under x509 with +FakeBasicAuth in Apache. Is it possible?

Hi I'm trying to incorporate a software to our intranet services (BackupPc) This Software uses the environment variable REMOTE_USER to get the username. Placed under an Apache 2.2 server with Client ...
4
votes
1answer
3k views

Apache not Forwarding Client x509 Certificate to Tomcat via mod_proxy

I am having difficulties getting a client x509 certificate to be forwarded to Tomcat from Apache using mod_proxy. From observations and reading a few logs it does seem as though the client x509 ...
2
votes
1answer
1k views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
3
votes
3answers
231 views

Client-side certificates

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
2answers
320 views

Can I restrict SSL access to Tomcat by Extended Key Usage?

I'd like to restrict the SSL access to a Tomcat instance using certificates, and not relying on any "user" accounts. I have a CA which is being used to sign the certificates, but if I configure ...
0
votes
1answer
108 views

How can you get x509 to work with Trac?

Hi I have been trying to find a way to get x509 certs for authentication for Trac but I could not find any plugins on TracHacks or tutorials on this. The closest I've seen so far is this post on ...
10
votes
2answers
5k views

Save Remote SSL Certificate via Linux Command Line

Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert ...
4
votes
4answers
3k views

OpenSSL x509 Purpose flag “Any Purpose” What is this?

Looking at the details of a certificate using the following: openssl x509 -noout -text -purpose -in mycert.pem I find a bunch of purpose flags (which I've discovered are set by the various ...
2
votes
3answers
464 views

Configuring a Unified Communications Certificate for many virtual hosts running in Jetty

I have a single IP with Jetty serving up X sites on port 80. Basically you can sign up for our service, then point your domain www.mycompany.com to that IP, and Jetty will serve up your custom site. ...
17
votes
6answers
8k views

Can I be my own trusted CA via an signed intermediate certificate?

Can I get a certificate from a root CA that I can then use to sign my own web server certificates? I would, if possible, use a signed certificate as an intermediate to sign other certs. I know that I ...