Hot answers tagged

3

You do realise that RHEL 5 was released in 2007 well before TLS 1.2 was defined in 2008? And although Red Hat backports security updates and bug fixes, as far as I know TLS 1.2 support was not. You'll need to upgrade your OS and have found yet another good reason to do so.


3

Your cert is already a PEM cert. If it doesn't get accepted make a copy, remove the certificate details above the -----BEGIN CERTIFICATE----- and try again.


1

Bad idea: My samba's (Version 4.1.21-SerNet-RedHat-11.el7) ca.pem has only year of validity. There's no CA private key. ca.pem - is CA certificate, cert.pem is AD's certificate and key.pem is AD's key, Short CA cert length (1024b) - minimum recommended by OpenVPN developers is 2048b. Solution? Do it backwards - use EasyRSA (3.0!) and regererate keys for ...


1

tlsv1 alert unknown ca The server cannot verify the client certificate you've sent because it does not find any path to the CA's trusted by the server.


1

Adding -servername $domain fixed it: echo | openssl s_client -connect $domain:443 -servername $domain 2> /dev/null | openssl x509 -noout -enddate Many thanks to Steffen Ullrich for the comment on the Q.


1

The CSR (Certificate Signing Request) alone is enough to generate a valid certificate. The CSR has all of the requested details of the certificate (Subject name, location, organization, etc.) along with the public key. The private key however is stored on the machine that generated the CSR (presumably the server requiring the cert, but not necessarily) and ...



Only top voted, non community-wiki answers of a minimum length are eligible