Tag Info

Hot answers tagged

6

If the clients are truly offline, then a commercial cert won't work properly anyway, because the clients will fail when they try to look up the CRL for the cert issuer's CA. SO no, if the entire environment has no internet connection, than a commercial cert will do you no good. Using manual certificate distribution or an internal CA would be better.


4

Now, how do I create a chained ssl certificate for Dovecot, including domain1 and domain2? The term chained certificate is used when there are intermediates certificate between a certificate and the roots certificate. Your ultimate goal is providing dovecot service with SSL for multiple domain. Your current dovecot configuration is using default ...


4

A UCC cert is more of a marketing term than a technically different type of certificate. A UCC cert is really just a regular X509 certificate with a bunch of SANs (subject alternative names) on it. As such, you can easily mimic the functionality of such a cert with your own internal certification authority. If you own the CA, you can have it issue ...


3

Wikipedia explains it pretty well in Certificates and web site security. There are three kinds of validations for X.509 certificates for websites. Domain Validation (DV) The cheapest and simplest validation. It is only checked if you have access to the domain and the infrastructure behind it. Organization Validation (OV) The issuer also checks the ...


3

HIGH, LOW, EXPORT etc are kind of macros which include a range of ciphers. To get the actual ciphers use openssl ciphers command, i.e. $ openssl ciphers -V 'HIGH:!aNULL:!MD5' 0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD 0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA ...


3

It appears that the web server at https://facts.dohrn.com/ does not include the intermediate certificate. This would appear to be a configuration mistake on their part. It is definitely something that can be expected to cause compatibility issues as you are really only supposed to rely on clients having the root certificates in place beforehand. See the ...


2

If you're renewing this certificate with a public CA, your request will either be rejected, or the SAN entry with the .local DNS name will be stripped. From the CA/Browser forums Baseline Requirements (7.1.4.2): [...] Also as of the Effective Date, the CA SHALL NOT issue a certificate with an Expiry Date later than 1 November 2015 with a ...


2

At some level, a self-signed certificate will always appear in a certificate chain - most notably the case with CA certs, which are by definition self-signed, but are trusted. You are seeing that message because the StartSSL CA cert is self-signed. Your chain file is also wrong - you don't need the client certificates. The file should be in the following ...


2

strongline is right, I think. You should launch the certificate templates MMC snapin on your CA server and make a copy of the certificate template that you are using. Then, modify the copy to use the desired settings, such as the cert lifetime.


2

Given that you're using this in your apache config: SSLCertificateFile /etc/apache2/cert/ssl.crt SSLCertificateKeyFile /etc/apache2/cert/ssl.key The /etc/apache2/cert/ssl.crt file should contain certificate of e.g. yourdomain.com certificate of first intermediate CA, signed by root CA (e.g.StartCom Class 1 Primary Intermediate Server CA) certificate ...


2

I figured it out! The problem was my openssl.cnf. The old certificate was created with string_mask = utf8only. This line was missing from my current file, resulting in a default value of PrintableString, T61String, BMPString. I did not use any non-ASCII characters, but it seems it was still enough to irritate Firefox.


2

It is pretty decent for it's age. A site I have found good and informative in regards to web server security is Cipherli.st which gives modern configurations for very secure configurations (incompatible with older clients) and also a set of legacy options so you can support older browsers (IE < 9, Android < 2.2 or Java < 6). When you want to test ...


2

The first server configuration is a redirect to HTTPS (second configuration). In the second server configuration SPDY module is not built by default, it should be enabled with the --with-http_spdy_module configuration parameter. Note that in order to accept both HTTPS and SPDY connections simultaneously on the same port, OpenSSL library used should support ...


1

I deleted the old certificate from my PC and installed the new one. Firefox uses its own separate certificate store. At the risk of stating the obvious (for those of us who regularly use Firefox), did you add the new CA certificate to Firefox itself?


1

You cannot issue certs whose expiry date is longer than what its template defines. You need to change your certificate template.


1

After some investigation, I've come across this: https://code.google.com/p/chromium/issues/detail?id=401365, which suggests chrome will throw this warning if any certificate in the chain is using SHA1 and has a validity longer than 01/01/2016. Lo and behold: [edit] Apparently this only affects people who have this certificate stored. [edit2] This: ...


1

The certificate used by an Exchange server must include all names with which the server can possibly be called; if your server is configured to use different URLs for internal and external web services, and if the internal URLs use the "corp.local" suffix (which I'm assuming is the DNS name for your Active Directory domain), then yes, your Exchange ...


1

CAPolicy.inf is used to specify settings that affect CA certificate itself and cannot be configured elsewhere (nor by certutil or MMC GUI). This includes (but not limits to) CA certificate renewal validity, key length, alternate signature algorithm, certificate extension configuration. This file is processed only during CA server installation and CA ...


1

1) Remember - Apache uses either httpd.conf or ssl.conf depending on how Apache was configured - since ssl.conf is preferred make sure the "failing" server is NOT using ssl.conf instead. 2) Have you tried copying the httpd.conf file from the working server to the "failing" server. If everything else is the same, that should make SSL work, if it doesn't ...


1

Caveat: I never had to go through PCI certification. This is based on my research on this topic for your question. It looks like the primary difference between PCI3.0 and PCI3.1 is that 3.1 requires TLS1.1 or higher. Can't use SSL3 or TLS1.0. See http://www.infosecurity-magazine.com/news/pci-dss-31-forces-move-from-ssl-to/ Although, in some places they even ...


1

TL;DR: PCI-DSS 3.1 is effective immediately, but the requirement to disable TLS 1.0 and SSL 3 takes effect after 30 June 2016. In most cases you should have already disabled SSL 3 months ago, or more, for the POODLE vulnerability. So that isn't a concern. The interesting part of this requirement is not being able to use TLS 1.0. The official word is: ...



Only top voted, non community-wiki answers of a minimum length are eligible