Tag Info

Hot answers tagged

3

There is currently no built-in way to do this in DSC. I wrote a custom resource for my organization that installs a certificate from a PFX. I can't post that code at this time unfortunately, but I used the Cert: PSDrive, Import-PfxCertificate cmdlet and secured credentials in DSC (for the PFX password).


3

You web server is not sending the intermediate certificate(s) and hence some browsers may show the warning. --- Certificate chain 0 s:/OU=GT65756367/OU=See www.rapidssl.com/resources/cps (c)14/OU=Domain Control Validated - RapidSSL(R)/CN=www.hepsibebek.com i:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA - G3 --- The steps to install and configure the ...


2

The solution depends on client capabilities, your budget and architecture specificities. 1. If both domains are hosted on the same IP address and you can't have an other one : If client supports TLS SNI extension : server { listen X.X.X.X:443 ssl; ssl_certificate /path/to/myolddomain.cert; ssl_certificate_key /path/to/myolddomain.key; ...


2

Looks like you are missing their "GeoTrust DV SSL CA" root CA certificate from your Intermediate Certification Authorities store. https://ssltools.geotrust.com/checker/views/certCheck.jsp


2

Is there a CRL on the certificate? Can your application server reach the new CRL? Check the "CRL Distribution Points" field in the cert and there should be a URL. Try to browse to that URL from your application server.


2

A wildcard cert should be fine! Client issues are very rare. Just make sure you include the whole cert chain (intermediate certs) to avoid issues with older hw / mobile phones. Setup depends on the mailserver but I can't remember any compatibility issues or the like. Setting up SSL with Dovecot is fairly straightforward and so do most MTAs. Postfix and ...


2

You can simply use split-brain DNS to mirror your "ourdomain.com" public entries, substituting the internal IPs for your Exchange hosts, and do this with one proper SAN cert. Per Paul Cunningham, you could also use an internal PKI for the .local certs and use a proper public cert for your public entries.


2

You do need to do that. When you create the certificate request, your computer automatically generates a mathematically related private key at the same time. This private key is associated to that exact certificate request. No one else has the private key except for the computer on which the request was generated. Those signed .crt files that you get back ...


1

How about using group policy to deploy the certificate to the domain? http://technet.microsoft.com/en-us/library/cc770315%28v=ws.10%29.aspx To deploy a certificate by using Group Policy Open Group Policy Management Console. Find an existing or create a new GPO to contain the certificate settings. Ensure that the GPO is associated with the domain, site, or ...


1

Getting custom SSL certificates to work with vCenter is historically painful. 5.1 was the first version that VMware actually provided some guidance on the process (late in the version's lifecycle), but it was still pretty buggy. Derek Seaman has, in my opinion, one of the most comprehensive tutorials on getting things to work properly in his vCenter 5.1 ...


1

Ok, so I have finally chanced upon the solution to this problem, however the solution gives me no understanding on what the bug was (I think source code would be needed for that, and given that Win2k3/IIS 6 is no longer supported, I do not see the utility in such a venture). But better write this up for future for the common good. Following Twisty's advice, ...


1

Your server sends only the leaf certificate, the necessary intermediate certificate is missing. Browsers might have cached this if they've seen it before with other sites, but if not they will fail to validate the certificate (or they might download the issuer certificate if this info is available inside the certificate). See also the analysis by ssllabs: ...


1

If you really did domain.key domain.crt sf_bundle.crt >> domain.pem then you included your private key in the chain, which you should not. Only your server's certificate plus the chain of intermediary certificates are needed, so that the client can match the issuer of the top of them to a trusted root certificate he possesses


1

This error I got in browser when trying to access site over SSL(https) but in fact on that port normal HTTP server was running.



Only top voted, non community-wiki answers of a minimum length are eligible