Questions tagged [x509]

X.509 is an ITU-T standard commonly used for public key infrastructure (PKI) and for privilege management infrastructure (PMI).

31 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
17k views

x509 certificate not valid for any names when added IP address to openssl.cnf

A self-signed certificate works well while the command used to generate it on a ubuntu machine is: openssl req -x509 -newkey rsa:4096 -keyout private.key -out cert.crt -days 365 -nodes If the ...
minghua's user avatar
  • 181
3 votes
0 answers
2k views

The revocation function was unable to check revocation for the certificate 0x80092012

Please help me to deal with self-signed revocation check I've used makecert.exe to create root and client certificate The problem is that certutil fails to check certificate with error The ...
oleksa's user avatar
  • 130
3 votes
0 answers
649 views

Is there an extension of host to host ipsec to a many-many configuration?

Having a typical host to host transport mode ipsec configuration, conn appserver01-to-swift01 [email protected] left=10.133.176.246 leftrsasigkey=xxxxxxxxxxxxxxxxxxxxxxxx ...
user22866's user avatar
  • 151
2 votes
0 answers
809 views

OpenSSL - Create Cross Intermediate Certificate from 2 Root CAs

Good evening all, I have 2 servers running in different datacenters which are both connected using OpenVPN. Both servers have their own ca-server who is able to sign new certificates using ...
Genpc's user avatar
  • 21
2 votes
0 answers
194 views

Trust certificate for OCSP, but not for client certs?

According to the nginx docs, you can specify certificates to be trusted for both OCSP response and client certificate verification: ssl_trusted_certificate / ssl_client_certificate Specifies a ...
dst's user avatar
  • 146
2 votes
0 answers
298 views

Tomcat 7: how to log x509 cert dn with AccessLogValve

I have Tomcat7 running on RHEL6 with mutual authentication using x509 certificates for the entire container. From the user point of view in the browser, everything seems to work fine with a cert ...
user330855's user avatar
2 votes
1 answer
370 views

Alternatives to a Trusted Root certificate

Given a SSL-protected site that was formerly whitelisted (Allow from x.x.x.x etc), and and a requirement from a customer to change the way authentication works, to use X.509 HTTPS Client verification. ...
Tom O'Connor's user avatar
  • 27.6k
1 vote
0 answers
450 views

Entra Id (AAD) certificate based authentication (CBA) client certificate validation failed ("invalid request") error

I'm trying to get CBA to work according to this article: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-certificate-based-authentication I created a self-signed CA for testing ...
The F's user avatar
  • 11
1 vote
0 answers
654 views

Kubernetes: using an intermediate CA which certificate is signed by a self-signed root CA certificate

Does anyone use own certificate chains for Kubernetes clusters? There's an issue with such kind of setup, and I would be grateful for any ideas on how to solve it. Let's assume we have a Root CA which ...
Volodymyr Melnyk's user avatar
1 vote
0 answers
678 views

How to export the details of a digital certificate (.cer file) to a csv file using powershell?

I have a digital certificate that I'm using for a specific task. I need to export the details of the certificate such as the serial number and issuer to a csv file that is already on my computer using ...
Darius's user avatar
  • 11
1 vote
0 answers
332 views

x509 + asn1: are subjectAltName elements explicit or implicit?

From https://www.rfc-editor.org/rfc/rfc5280: SubjectAltName ::= GeneralNames GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName GeneralName ::= CHOICE { otherName [0] ...
pinhead's user avatar
  • 143
1 vote
0 answers
3k views

How does certutil determine that a cert is revoked

I'm testing that an x509 certificate can be correctly determined to be revoked. I'm taking the cert from https://revoked.badssl.com and verifying it via certutil. When my system is online, it seems to ...
Stealth Rabbi's user avatar
1 vote
0 answers
266 views

apache/mod_gnutls ssl certificate based authentication

I'm using apache with gnutls. I've configured both to request authentication from the client. When providing the certificate it works. But it works also if I provide another that the correct ...
meme's user avatar
  • 43
1 vote
0 answers
427 views

Apache SSL x509 authentication timeout

I have setup a location to enable client authentication based on x509 certificates: <Location /authenticate> SSLRequireSSL SSLVerifyClient require SSLVerifyDepth 10 </Location> The ...
rthill's user avatar
  • 31
0 votes
0 answers
4 views

What happens if the startdate of a CA is later that the startdate of a X509 certificate signed by it?

I am in the process of extending the lifetime of a private CA creating a new certificate with the same name, serial number, private/public keys, etc. The only change would be the "startdate" ...
jcea's user avatar
  • 243
0 votes
0 answers
26 views

Kubernetes won't pick up new certificate, x509 certificate expired

kubectl version Client Version: v1.20.4 Server Version: v1.20.15 At the end of January we renewed our external certificates that we use for the applications on the system (as opposed to the kubeadm ...
Stuckinthemud's user avatar
0 votes
0 answers
43 views

Establishing mutual authentication over SSH using SPIFFE

For this learning purpose I have created a k8s cluster using 4 azure VMs (VM1, VM2, VM3 & VM4).I have followed the spiffe doc to deploy spire-server and spire-agent on a k8s infra. I have kept all ...
Yuvraj Singh's user avatar
0 votes
0 answers
37 views

Generating certificate with subjectUniqueID field

I would like to generate a certificate with the subjectUniqueID field as indicated in rfc5280( https://www.rfc-editor.org/rfc/rfc5280#section-4).I have tried this: openssl req -config myConfigFile....
alvy's user avatar
  • 1
0 votes
0 answers
62 views

How to properly use MediaWiki with $wgDBadminuser?

I have to set up a fresh MediaWiki and am getting increasingly upset with config recommendations that don't seem to work well when configured as outlined in the official documentation. Two servers. ...
Marian's user avatar
  • 101
0 votes
1 answer
407 views

How can I add alternate subject names when creating a CSR using xca?

openSUSE and SLES dropped their old CA management, now recommending to use xca. While it was easy to add alternate subject names like hostname aliases or IP addresses in the old CA management, I could ...
U. Windl's user avatar
  • 383
0 votes
1 answer
2k views

ADFS Client Certificate Authentication

I have ADFS on my environment and it's currently authenticating via active directory perfectly fine. I'm trying to enable certificate authentication so they can authenticate with their smart cards. ...
Mlsracer's user avatar
0 votes
2 answers
573 views

What are Groups in Kubernetes certificate signing requests?

In a Certificate signing request API object for a user, you have to specify a group. apiVersion: certificates.k8s.io/v1 kind: CertificateSigningRequest metadata: name: myname spec: groups: ...
Tanchwa's user avatar
0 votes
2 answers
85 views

Cross-sign third party DV cert with our own CA for high trust

I am looking to expand trust within our application by setting up mutual TLS between the customer service and our service. I am trying to wrap my head around this stuff as I am kinda new to this tech ...
Decrypter's user avatar
  • 111
0 votes
0 answers
2k views

Submitting CSR to Microsoft CA from linux bash best practice

Similar questions: https://stackoverflow.com/questions/31283476/submitting-base64-csr-to-a-microsoft-ca-via-curl The link above presents an answer but it is far too complicated for me. Below is an ...
searchbruh's user avatar
0 votes
1 answer
629 views

Demand user's x509 certificate from java web application only when required

My web application authenticates the user based on user's x509 certificate. For now, I've configured tomcat for mutual authentication by setting "clientAuth=want". However, as this ...
Bhushan Karmarkar's user avatar
0 votes
0 answers
319 views

Client certificate works in Firefox but not when used in Internet Explorer (or Edge)

With a certain web site, a certain client certificate works fine with Firefox, but not with IE or Edge (all on Windows 10, as both IE and Edge behave the same, I'll use the term "IE/Edge" ...
David Balažic's user avatar
0 votes
0 answers
266 views

Error generating client certificate using openssl

Getting this error with openssl 1.1.1d when using the CA generated as shown: openssl req -new -x509 -config ca.cnf -newkey rsa:4096 -sha256 -nodes -out ca-certificate.pem -outform PEM openssl req -...
L P's user avatar
  • 101
0 votes
0 answers
589 views

Digital signing certificate for SOAP

I'm calling a third-party Web Service with SOAP requests. This service requires me to to sign my SOAP requests digitally. Regarding to How to buy a X.509 certificate for signing digital payloads ...
Mikael H.'s user avatar
0 votes
1 answer
656 views

Preserve X509 client cert data from apache2 reverse proxy to jetty

I am not able to receive on jetty-9.3.14 the X509 client cert data which are submitted to apache2 and forwarded via ProxyPass directive. <Location /X509> SSLVerifyClient require ...
473183469's user avatar
  • 1,370
0 votes
1 answer
944 views

SSL certificate for Oracle Application Server 11g

I was asked to get an SSL certificate for an "Oracle Application Server 11g" which has a soon-to-expire certificate. Brushing aside the fact that 10g seems to be the newest version, I got a ...
Easter Sunshine's user avatar
0 votes
1 answer
125 views

How can you get x509 to work with Trac?

Hi I have been trying to find a way to get x509 certs for authentication for Trac but I could not find any plugins on TracHacks or tutorials on this. The closest I've seen so far is this post on ...
sasker's user avatar
  • 101