Questions tagged [x509]
X.509 is an ITU-T standard commonly used for public key infrastructure (PKI) and for privilege management infrastructure (PMI).
31
questions with no upvoted or accepted answers
3
votes
0
answers
17k
views
x509 certificate not valid for any names when added IP address to openssl.cnf
A self-signed certificate works well while the command used to generate it on a ubuntu machine is:
openssl req -x509 -newkey rsa:4096 -keyout private.key -out cert.crt -days 365 -nodes
If the ...
3
votes
0
answers
2k
views
The revocation function was unable to check revocation for the certificate 0x80092012
Please help me to deal with self-signed revocation check
I've used makecert.exe to create root and client certificate
The problem is that certutil fails to check certificate with error
The ...
3
votes
0
answers
649
views
Is there an extension of host to host ipsec to a many-many configuration?
Having a typical host to host transport mode ipsec configuration,
conn appserver01-to-swift01
[email protected]
left=10.133.176.246
leftrsasigkey=xxxxxxxxxxxxxxxxxxxxxxxx
...
2
votes
0
answers
809
views
OpenSSL - Create Cross Intermediate Certificate from 2 Root CAs
Good evening all,
I have 2 servers running in different datacenters which are both connected using OpenVPN.
Both servers have their own ca-server who is able to sign new certificates using ...
2
votes
0
answers
194
views
Trust certificate for OCSP, but not for client certs?
According to the nginx docs, you can specify certificates to be trusted for both OCSP response and client certificate verification:
ssl_trusted_certificate / ssl_client_certificate
Specifies a ...
2
votes
0
answers
298
views
Tomcat 7: how to log x509 cert dn with AccessLogValve
I have Tomcat7 running on RHEL6 with mutual authentication using x509 certificates for the entire container.
From the user point of view in the browser, everything seems to work fine with a cert ...
2
votes
1
answer
370
views
Alternatives to a Trusted Root certificate
Given a SSL-protected site that was formerly whitelisted (Allow from x.x.x.x etc), and and a requirement from a customer to change the way authentication works, to use X.509 HTTPS Client verification. ...
1
vote
0
answers
450
views
Entra Id (AAD) certificate based authentication (CBA) client certificate validation failed ("invalid request") error
I'm trying to get CBA to work according to this article:
https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-certificate-based-authentication
I created a self-signed CA for testing ...
1
vote
0
answers
654
views
Kubernetes: using an intermediate CA which certificate is signed by a self-signed root CA certificate
Does anyone use own certificate chains for Kubernetes clusters?
There's an issue with such kind of setup, and I would be grateful for any ideas on how to solve it.
Let's assume we have a Root CA which ...
1
vote
0
answers
678
views
How to export the details of a digital certificate (.cer file) to a csv file using powershell?
I have a digital certificate that I'm using for a specific task. I need to export the details of the certificate such as the serial number and issuer to a csv file that is already on my computer using ...
1
vote
0
answers
332
views
x509 + asn1: are subjectAltName elements explicit or implicit?
From https://www.rfc-editor.org/rfc/rfc5280:
SubjectAltName ::= GeneralNames
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] ...
1
vote
0
answers
3k
views
How does certutil determine that a cert is revoked
I'm testing that an x509 certificate can be correctly determined to be revoked. I'm taking the cert from https://revoked.badssl.com and verifying it via certutil. When my system is online, it seems to ...
1
vote
0
answers
266
views
apache/mod_gnutls ssl certificate based authentication
I'm using apache with gnutls. I've configured both to request authentication from the client.
When providing the certificate it works. But it works also if I provide another that the correct ...
1
vote
0
answers
427
views
Apache SSL x509 authentication timeout
I have setup a location to enable client authentication based on x509 certificates:
<Location /authenticate>
SSLRequireSSL
SSLVerifyClient require
SSLVerifyDepth 10
</Location>
The ...
0
votes
0
answers
4
views
What happens if the startdate of a CA is later that the startdate of a X509 certificate signed by it?
I am in the process of extending the lifetime of a private CA creating a new certificate with the same name, serial number, private/public keys, etc. The only change would be the "startdate" ...
0
votes
0
answers
26
views
Kubernetes won't pick up new certificate, x509 certificate expired
kubectl version Client Version: v1.20.4 Server Version: v1.20.15
At the end of January we renewed our external certificates that we use for the applications on the system (as opposed to the kubeadm ...
0
votes
0
answers
43
views
Establishing mutual authentication over SSH using SPIFFE
For this learning purpose I have created a k8s cluster using 4 azure VMs (VM1, VM2, VM3 & VM4).I have followed the spiffe doc to deploy spire-server and spire-agent on a k8s infra. I have kept all ...
0
votes
0
answers
37
views
Generating certificate with subjectUniqueID field
I would like to generate a certificate with the subjectUniqueID field as indicated in rfc5280( https://www.rfc-editor.org/rfc/rfc5280#section-4).I have tried this:
openssl req -config myConfigFile....
0
votes
0
answers
62
views
How to properly use MediaWiki with $wgDBadminuser?
I have to set up a fresh MediaWiki and am getting increasingly upset with config recommendations that don't seem to work well when configured as outlined in the official documentation.
Two servers. ...
0
votes
1
answer
407
views
How can I add alternate subject names when creating a CSR using xca?
openSUSE and SLES dropped their old CA management, now recommending to use xca.
While it was easy to add alternate subject names like hostname aliases or IP addresses in the old CA management, I could ...
0
votes
1
answer
2k
views
ADFS Client Certificate Authentication
I have ADFS on my environment and it's currently authenticating via active directory perfectly fine. I'm trying to enable certificate authentication so they can authenticate with their smart cards. ...
0
votes
2
answers
573
views
What are Groups in Kubernetes certificate signing requests?
In a Certificate signing request API object for a user, you have to specify a group.
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
name: myname
spec:
groups:
...
0
votes
2
answers
85
views
Cross-sign third party DV cert with our own CA for high trust
I am looking to expand trust within our application by setting up mutual TLS between the customer service and our service. I am trying to wrap my head around this stuff as I am kinda new to this tech ...
0
votes
0
answers
2k
views
Submitting CSR to Microsoft CA from linux bash best practice
Similar questions:
https://stackoverflow.com/questions/31283476/submitting-base64-csr-to-a-microsoft-ca-via-curl
The link above presents an answer but it is far too complicated for me.
Below is an ...
0
votes
1
answer
629
views
Demand user's x509 certificate from java web application only when required
My web application authenticates the user based on user's x509 certificate.
For now, I've configured tomcat for mutual authentication by setting "clientAuth=want".
However, as this ...
0
votes
0
answers
319
views
Client certificate works in Firefox but not when used in Internet Explorer (or Edge)
With a certain web site, a certain client certificate works fine with Firefox, but not with IE or Edge (all on Windows 10, as both IE and Edge behave the same, I'll use the term "IE/Edge" ...
0
votes
0
answers
266
views
Error generating client certificate using openssl
Getting this error with openssl 1.1.1d when using the CA generated as shown:
openssl req -new -x509 -config ca.cnf -newkey rsa:4096 -sha256 -nodes -out ca-certificate.pem -outform PEM
openssl req -...
0
votes
0
answers
589
views
Digital signing certificate for SOAP
I'm calling a third-party Web Service with SOAP requests. This service requires me to to sign my SOAP requests digitally. Regarding to How to buy a X.509 certificate for signing digital payloads ...
0
votes
1
answer
656
views
Preserve X509 client cert data from apache2 reverse proxy to jetty
I am not able to receive on jetty-9.3.14 the X509 client cert data which are submitted to apache2 and forwarded via ProxyPass directive.
<Location /X509>
SSLVerifyClient require
...
0
votes
1
answer
944
views
SSL certificate for Oracle Application Server 11g
I was asked to get an SSL certificate for an "Oracle Application Server 11g" which has a soon-to-expire certificate. Brushing aside the fact that 10g seems to be the newest version, I got a ...
0
votes
1
answer
125
views
How can you get x509 to work with Trac?
Hi I have been trying to find a way to get x509 certs for authentication for Trac but I could not find any plugins on TracHacks or tutorials on this.
The closest I've seen so far is this post on ...