Tag Info

Hot answers tagged

4

CSR hash and cert hash not related The hash type on the request and on the actual certificate are not related to one another. The CA checks the signature on the CSR. That way, the CA can verify that the CSR was not changed in transit. That's all the signature on the CSR does. There is no official (or even semi-official) in-band way of telling a CA what ...


4

From the Apache documentation, the SSLOpenSSLConfCmd option was added in version 2.4.8: Compatibility: Available in httpd 2.4.8 and later, if using OpenSSL 1.0.2 or later You will need to update to a later version of Apache if you need to use this option.


4

The "SSLOpenSSLConfCmd" config parameter isn't working for Apache 2.2 and it doesn't provide any similar config parameter for this. Though there is a workaround for Apache 2.2 until there is an official patch: https://bitbucket.org/snippets/wneessen/grb8


4

also apache 2.2.22 (debian 7) I also removed the problematic ciphers one by one, according to the qualys ssl labs test https://www.ssllabs.com/ssltest/index.html it passes now, only WinXP / IE6 is incompatible Cipher i ended up using: SSLCipherSuite ...


3

HIGH, LOW, EXPORT etc are kind of macros which include a range of ciphers. To get the actual ciphers use openssl ciphers command, i.e. $ openssl ciphers -V 'HIGH:!aNULL:!MD5' 0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD 0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA ...


3

It appears that the web server at https://facts.dohrn.com/ does not include the intermediate certificate. This would appear to be a configuration mistake on their part. It is definitely something that can be expected to cause compatibility issues as you are really only supposed to rely on clients having the root certificates in place beforehand. See the ...


3

If you're using OpenSSL, you can simply add the -sha256 command line option, which will generate the CSR with the SHA-256 signature algorithm.


2

I believe your openssl version is the problem. The openssl group recommends version 1.01j minimum. Also, check your cipher. Isn't there supposed to be a colon before !RC4?


2

I figured it out! The problem was my openssl.cnf. The old certificate was created with string_mask = utf8only. This line was missing from my current file, resulting in a default value of PrintableString, T61String, BMPString. I did not use any non-ASCII characters, but it seems it was still enough to irritate Firefox.


1

I deleted the old certificate from my PC and installed the new one. Firefox uses its own separate certificate store. At the risk of stating the obvious (for those of us who regularly use Firefox), did you add the new CA certificate to Firefox itself?



Only top voted, non community-wiki answers of a minimum length are eligible