Tag Info

New answers tagged

5

Caused by: java.net.SocketException: Permission denied You need to be root (superuser) to bind to ports under 1024. That's why 9443 works, but 443 doesn't.


0

The agent is not using the pregenerated client certificate. It created a CSR (with a new key) instead, so the master will not trust the agent. Make sure that the files found in `puppet agent --configprint ssldir`/{certs,private_keys}/`puppet agent --configprint certname` are identical to those that you pregenerated and put on your master as well. (The ...


-2

With PHP 5.3.3 on CentOS 6.3 this was an error I ran across because the webserver user didn't have a valid shell. Adding .bashrc to the nginx user's home directory fixed it for us. See answer as this dupe question: https://stackoverflow.com/questions/20648949/php-warning-exec-unable-to-fork/24517481#24517481


1

The KeyUsage is a v3 extension, which may or may not be present in a certificate. A useful (if slightly dated) summary of id-ce-keyUsage values: http://www.alvestrand.no/objectid/2.5.29.15.html [newly added values are 7 = encipherOnly and 8 = decipherOnly] The trick is that this "OID=2.5.29.15 keyUsage extension" /might or might not/ be present in a ...


0

Check /etc/httpd/conf.d/ssl.conf look at the path assigned to SSLCertificateFile ...sounds like it is pointing to the default cert, as Robert suggests Bumped this because I just had a 'duh' moment myself while setting up SSL on an Amazon EC2 instance


1

If they don't copy, you can just do it yourself. Afterward, register the dlls using regsvr32 libssl32.dll and regsvr32 ssleay32.dll so they can be used.


2

The JKS has certificates in DER and for Apache you want to have PEM (AKA X509) format. Sample of how to do this: $JAVA_HOME/bin/keytool --list -keystore <mykeystore> $JAVA_HOME/bin/keytool -export -rfc -alias <alias_name> -file <cert.crt> -keystore <mykeystore> So you will want to export the private key and then the certificates. ...


-1

Found a possible answer: Wget does simply not work with SSL on Ubunut 14.04. Since software that does not communicate securely over the Internet is not good software anymore in 2014, I consider wget as broken since it is not compiled against SSL in Ubuntu 14.04 LTS. To learn how to re-compile wget, you can read here: ...


1

Configuration file is not the answer. It is organized into sections using lines with square brackets like [default_CA] and [req_exts]. There are a few sections that all openssl subcommands read (for engines and addOIDs) but beyond that only the sections that apply to a particular subcommand and sometimes mode of that subcommand are used, and no such sections ...


0

The filenames in the CA directory are not free-form. Each file is for one single CA certificate and the name of the file must be identical to the <hash_value>.<n> based of the subject name i.e. <hash_value> is the value returned by: openssl x509 -subject_hash -in cafile.cert and <n> n is an integer, typically 0. If the hash ...


2

If you get this issue with a Java HTTPS server running on OpenJDK, try editing /etc/java-7-openjdk/security/java.security and commenting out the line security.provider.10=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.cfg as discovered by Christoph W.


0

If you have a root login to a server you have generated it on, and if you did it via whm/cpanel try looking for a key at /var/cpanel/ssl/system they might have been there until the system cleanup... Just look at the file dates, because names might be random.


2

The other answers all seem to be correct but they may be missing the point. It seems to me that the real answer is don't do that. I can't imagine a use case that requires you to secure an arbitrary IP address; it seems like a bad idea for all the good reasons mentioned in the other answers. You lose the flexibility of decoupling the name from the IP address ...


1

You cannot generally get SSL certificates issued with an IP address as a subject name. Firstly, you have no basis with which to get such a certificate issued unless the IP block is delegated to you (from an RIR, for example). This means that unless you are listed and named in the whois information for that IP block, you will not get a certificate. ...


0

The Common Name must be the FQDN of the domain you want to request the certificate for. E.g. www.example.com It cannot be an IP address.


2

Sometimes the original source tree will provide you with a make uninstall, assuming someone cared to create that make target. Whatever you simply can remove your ~/.sys folder or not really depends on what else you might have installed there, or not. Some people prefer to rather use a --prefix such as /base/path/name/version, keeping it all tidy and ...



Top 50 recent answers are included