Hot answers tagged

4

I assume that you are attempting to add the wildcard IP addresses as a Subject Alternate Name and not as the Subject (which doesn't allow IP addresses at all). RFC5280 Section 4.2.1.6 states: For IP version 4, as specified in [RFC791], the octet string MUST contain exactly four octets which rules out wildcard certs. Wildcards are only valid in ...


3

Verify that the olcTLS*File directives in cn=config point to real files. olcTLSCACertificateFile: /etc/ssl/certs/ca-bundle.crt olcTLSCertificateFile: /etc/pki/tls/certs/server.example.com.crt olcTLSCertificateKeyFile: /etc/pki/tls/private/server.example.com.key Check your logs. By default CentOS doesn't log for slapd. slapd defaults to facilty LOCAL4 ...


2

Here is a one liner that should do what you want without requiring the creation of a public key file locally. $ ssh-keygen -lf /dev/stdin <<< $( ssh-keygen -f ~/.ssh/keyname.pem -y ) 2048 14:df:c7:b7:f1:26:7f:87:d5:e7:10:6c:ac:af:a2:03 /dev/stdin (RSA) This uses the bash here string <<< in order to have stdin available as a regular file ...


1

You need to concatenate all the PEM files into one, then convert it to PKCS#12: $ cat certificate.crt intermediate.crt > bundle.crt $ openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in bundle.crt


1

When you install from a tarball, many times the binary is installed in /usr/local. Probably your new openssl binary can be found in /usr/local/bin. Yet it would be easier to just install an rpm. You installed a source rpm, which contains the sources but not the binaries. You need to look for openssl.x.y.z.rpm (and not openssl.x.y.z.src.rpm).


1

I've found this is caused by a combination on two things: a weak GTE CyberTrust certificate has been dropped from ca-certificates Debian ships with old openssl 1.0.1, which has buggy certificate validation and can't handle cross-signing properly Installing openssl 1.0.2 from unstable solves the problem.



Only top voted, non community-wiki answers of a minimum length are eligible