X.509 is an ITU-T standard commonly used for public key infrastructure (PKI) and for privilege management infrastructure (PMI).

learn more… | top users | synonyms

0
votes
0answers
12 views

Is my router trying to MITM my office365 connection? [migrated]

I recently installed a new BT HomeHub6 router for my household internet connection. It's been less than 24 hours, and I'm seeing a warning pop up on my desktop computer occasionally regarding Outlooks'...
0
votes
0answers
16 views

Using OpenSSL Certificate with Windows Firewall Connection Security

I'm attempting to set up an IPSec transport mode connection between Windows 7 machines, using Windows Firewall Connection Security, authenticating using certificates. I can get it to work correctly by ...
11
votes
3answers
42k views

Import of PEM certificate chain and key to Java Keystore

There are plenty of resources out there about this topic, but none I found which covers this slightly special case. I have 4 files; privatekey.pem certificate.pem intermediate_rapidssl.pem ...
15
votes
5answers
11k views

How to split a PEM file

Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others. Question : How to read a concatenated PEM ...
1
vote
1answer
50 views

Can OpenDirectory on OS X reasonably be configured to use an intermediate CA cert from an existing CA?

We're trying to set up OpenDirectory. It seems to want to create its own CA, and then an intermediate CA with a certificate signed by its own CA. I'd prefer to generate an intermediate CA certificate ...
30
votes
1answer
2k views

Trusting an untrustworthy CA - Can I restrict how system trusts it?

(Posted to ServerFault instead of StackOverflow because I feel it concerns OS configuration more than programming code). I'm currently responsible for maintaining a system which connects to a third-...
0
votes
0answers
47 views

Google App Engine The SSL certificate provided could not be inserted. xn- domain

I try installing Comodo Certificate that I ordered in SSLs.com on Google App Engine Custom Domain. But I have error: The SSL certificate provided could not be inserted. I checked that my key is ...
1
vote
1answer
51 views

How to get Subject from client certificate issued as a claim in ADFS?

I'm using Certificate Based Authentication in ADFS 3.0 and need to get the Subject field from the client certificate issued as a claim, but it's not available as an incoming claim to ADFS. When I ...
15
votes
2answers
14k views

Save Remote SSL Certificate via Linux Command Line

Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert ...
0
votes
0answers
25 views

Dovecot X509 + MySQL Auth backend not working

I'm trying to configure IMAPS-clients to use client X509 certificates to authenticate towards Dovecot. I've followed instructions and tips on the following two pages: Certificate based auth with ...
1
vote
0answers
32 views

Tomcat 7: how to log x509 cert dn with AccessLogValve

I have Tomcat7 running on RHEL6 with mutual authentication using x509 certificates for the entire container. From the user point of view in the browser, everything seems to work fine with a cert ...
22
votes
7answers
12k views

Can I be my own trusted CA via an signed intermediate certificate?

Can I get a certificate from a root CA that I can then use to sign my own web server certificates? I would, if possible, use a signed certificate as an intermediate to sign other certs. I know that I ...
4
votes
6answers
6k views

OpenSSL x509 Purpose flag “Any Purpose” What is this?

Looking at the details of a certificate using the following: openssl x509 -noout -text -purpose -in mycert.pem I find a bunch of purpose flags (which I've discovered are set by the various ...
11
votes
1answer
1k views

OCSP responder not present?

Am trying to set up OCSP validation routines, and so want to be comfortable with the environment first. Found excellent tutorials at for example OpenSSL: Manually verify a certificate against an OCSP....
0
votes
0answers
86 views

Passing X509 client certificate to CA SiteMinder as a header

I am currently building an environment where our requirements state that we need to terminate SSL on a NetScaler before it is forwarded to one of several IBM HTTP Servers with the SiteMinder module. ...
2
votes
0answers
138 views

Is there an extension of host to host ipsec to a many-many configuration?

Having a typical host to host transport mode ipsec configuration, conn appserver01-to-swift01 leftid=@appserver01.server.com left=10.133.176.246 leftrsasigkey=xxxxxxxxxxxxxxxxxxxxxxxx ...
0
votes
2answers
145 views

Can one domain have 2 or more SSL certificates?

I have googled and found this post: http://security.stackexchange.com/questions/46988/is-it-technically-possible-to-configure-two-different-ssl-certificates-for-the-s If it actually is possible, then ...
30
votes
5answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
1
vote
1answer
5k views

Error 207: ERR_CERT_INVALID

I'm trying to make it so people can create a private key via the browser via the element and then after have it so that an X.509 cert is sent to them that's then installed into the browser. But I can'...
0
votes
1answer
40 views

How should a wildcard certificate be used?

I have a wildcard certificate (pfx file) and I have doubts on how to use that. Should I install that on all of my application servers or alternatively create a new certificate and sign it with the ...
2
votes
1answer
2k views

OPENSSL Save x509 certificate of a website

I can see the certificate with this command openssl s_client -host {HOST} -port 443 -prexit -showcerts How can I save the x509 cert of the website in a PEM - File?
5
votes
1answer
2k views

Limit on X509v3 Subject Alternative Name DNSname length

I have been searching through RFC 5280, 1034, and 1123 trying to figure out what a max string length is, but I can't find it. I'm wondering if any of you happen to know. For those of you who know ...
2
votes
2answers
458 views

Can I restrict SSL access to Tomcat by Extended Key Usage?

I'd like to restrict the SSL access to a Tomcat instance using certificates, and not relying on any "user" accounts. I have a CA which is being used to sign the certificates, but if I configure ...
1
vote
0answers
183 views

apache/mod_gnutls ssl certificate based authentication

I'm using apache with gnutls. I've configured both to request authentication from the client. When providing the certificate it works. But it works also if I provide another that the correct ...
1
vote
1answer
175 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
1
vote
1answer
107 views

Integrity of Request/X509 Alternative Name/Extension Information

Am I correct in assuming that there's protection against the modification of both the subject and the extension information in a request or X509 certificate? This signature is just another element ...
0
votes
1answer
1k views

Strongswan with X.509 authentication and LDAP authorization

I would like to setup Strongswan/Libreswan with PKI authentication. Now I have searched and found only how to configure specific accepted client certificates like here: http://technikenity.blogspot....
1
vote
1answer
704 views

Convert EC2 ssh .pem key to Azure X.509 certificate?

Normally I use a pem file to login into my ec2 instance via ssh -i key.pem Now, in Azure, their requirement during instance creation is UPLOAD AN SSH KEY OR PROVIDE A PASSWORD FOR AUTHENTICATION ...
1
vote
2answers
575 views

How does OpenSSL determine that a certificate is for a root CA?

I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
0
votes
1answer
1k views

How can I renew the SSL certificate used on our Exchange server?

According to the MSDN article Renew an Exchange Certificate, I'm supposed to use Get-ExchangeCertificate -Thumbprint 'AD19B141228C7CF98B5F78DCED978B7C45E15434' | New-ExchangeCertificate -...
1
vote
2answers
4k views

Openssl Custom Extension

I know how to create x509 certificates with the openssl command line. But now I want to create one with a custom extension. How can I do this with openssl command line?
0
votes
3answers
374 views

Detect unencrypted SSL keys

I have an OpenVPN server installed on a Debian machine. Is there a way to find which of the keys have been created without being encrypted with a password, so as to replace them?
0
votes
1answer
5k views

OpenSSL: Why can't I enter a PEM Pass Phrase in the prompt? [duplicate]

I am trying to install an SSL certificate on my WAMP server for the first time. I've never done anything like this, so please, bare with me. W:\wamp\bin\apache\apache2.2.22\bin>echo %...
0
votes
1answer
200 views

Renewing a self-signed certificate

Is there a way to reset the expiry of a self signed X.509 certificate but keep both the public and the private key as they were? Technically this should be nothing more than a different date for the "...
4
votes
2answers
6k views

Can you generate a self signed certificate on Windows Server using CLI tools like certreq and certutil?

I need to quickly generate a self signed certificate on a Windows Server. I'd like to use the standard CLI tools that ship with it. I know I can use openssl.
0
votes
1answer
2k views

openssl Subject Public Key Info: RSA Public Key: (1024 bit) vs Public Key: (1024 bit)

I have a couple of certificates whose format seem pretty similar except for one thing I have checked the details of the cert by using the following openssl command openssl x509 -in certname -text ...
0
votes
2answers
183 views

How do I set up the DN for a SSL cert with a hostname of greater than 64 characters?

Everywhere I read says to have the server hostname in the commonName field and the subjectAltName field. The problem is that the hostname that I want to sign has greater than 64 characters. Therefore, ...
2
votes
1answer
105 views

Alternatives to a Trusted Root certificate

Given a SSL-protected site that was formerly whitelisted (Allow from x.x.x.x etc), and and a requirement from a customer to change the way authentication works, to use X.509 HTTPS Client verification. ...
0
votes
1answer
771 views

Error while converting der private key to pem

I have DER private key and certificate. I need to convert them to PEM format. Certificate converted normally, but when i try to convert key this error happens: # openssl x509 -in client-key.der -...
1
vote
2answers
2k views

Can you re-use a SSL certificate across platforms?

Let's say I want to buy a wildcard SSL that I can use for web servers, spanning across a multitude of different servers and platform. I could issue a CSR for each and every one of them, with their ...
0
votes
3answers
2k views

Install X509 certificate into Windows 2008 R2

I'm trying to install a certificate into my windows 2008 but I'm not able to do it right. I have a .crt file and I click to install from contextual menu. It succeed to import but if I browse the ...
2
votes
2answers
2k views

Any open source web based X509 PKI tool? [closed]

Want to setup a CA, but it's hard to find a good web based X509 PKI tool, any recommend?
1
vote
1answer
872 views

Renew SSL client certificates

For a internally used webbased software, which must be available from everywhere, I have created client certificates which are installed in the browsers of authorized consumers. Now, with 2012 being ...
5
votes
1answer
4k views

How to configure IIS Express to ask for client certificate

Does anybody know how to configure IIS Express to require client certificate for access? I'm trying to debug a problematic ASP.NET application which uses client certificates for authentication.
0
votes
1answer
680 views

SSL certificate for Oracle Application Server 11g

I was asked to get an SSL certificate for an "Oracle Application Server 11g" which has a soon-to-expire certificate. Brushing aside the fact that 10g seems to be the newest version, I got a ...
1
vote
2answers
1k views

Exchange 2010 can't find SSL certificate that exists

I'm trying to set up TLS for the POP3 server in the Exchange CAS role. I purchased a cert from NameCheap, and the CA path is fully trusted, and installed it within the Certificates MMC snap-in ...
4
votes
1answer
3k views

extracting raw ASN.1 parts from X.509 certificate

I'd like to extract raw hex ASN.1 data from X.509 certificate. I know, that I can do this by using DER format and hexdumping it. I'm interested in particular parts like "subject", "issuer" and their ...
1
vote
0answers
195 views

Apache SSL x509 authentication timeout

I have setup a location to enable client authentication based on x509 certificates: <Location /authenticate> SSLRequireSSL SSLVerifyClient require SSLVerifyDepth 10 </Location> ...
0
votes
2answers
454 views

client x.509 based authorization on apache

I want to give my users the ability to login with their own personal x.509 certificates. The user supply me (the account registration script) his/her x.509 public key. Apache should only accept the ...
2
votes
3answers
473 views

Configuring a Unified Communications Certificate for many virtual hosts running in Jetty

I have a single IP with Jetty serving up X sites on port 80. Basically you can sign up for our service, then point your domain www.mycompany.com to that IP, and Jetty will serve up your custom site. ...