Hot answers tagged

17

The certificate chain of your certificate is incomplete. Most likely your provider failed to install some intermediate certificate when installing the new certificate. Most times such intermediate certificates are provided by the SSL authority, to provide support for some older browsers and operating systems. That's the reason, that while it works for you, ...


10

In order for a certificate to be trusted, it must be signed by an entity that is itself trusted by your browser/OS combination, or that has in its own turn been signed by such an entity. This is usually done by one trusted root CA which signs an intermediate CA, and the intermediate CA signs your certificate. This creates a chain, like this: Root CA which ...


5

You can open a Powershell console and use the dir command on the Cert: provider to list the information you want. For example, the commands below would list thumbprints and subjects (friendly names) for the current user certs and the machine certs respectively: dir Cert:\CurrentUser\My ls Cert:\LocalMachine\My\ You can run the command below to get more ...


4

This will depend, especially for the worst-case, on the type of certificate in combination with how often the CA re-validates the certificate subject information for renewals. First of all, if the CA has current enough validated information they may just sign the new certificate immediately. If it's a domain-validated certificate (where the CA only ...


4

I assume that you are attempting to add the wildcard IP addresses as a Subject Alternate Name and not as the Subject (which doesn't allow IP addresses at all). RFC5280 Section 4.2.1.6 states: For IP version 4, as specified in [RFC791], the octet string MUST contain exactly four octets which rules out wildcard certs. Wildcards are only valid in ...


3

Looks like you have to download the updates to a web or file server and point your clients at it - TechNet document


3

Keep in mind that renewal procedure using letsencrypt-auto will only work fine if your previous certificate was issued using letsencrypt-auto 0.4.0 or above. If your certificate was issued with older letsencrypt-auto version then you need to issue again the certificate in the same way and with the same options and params as you did it the first time and ...


2

You can use eapol_test, which is part of the wpa_supplicant package. You need to download the source code and compile it with make eapol_test (it's not built by default). It should work at least on Linux, Windows and Mac OS X (not advertised as much, but I could compile and use it on the latter). You create a configuration file (some examples here, but I ...


1

Ok, I just found my mistake. I have used cert.pem instead of fullchain.pem. Explained here: http://stackoverflow.com/questions/34189199/how-do-i-use-let-s-encrypt-with-gitlab


1

If the domain name is staying the same, you can use the same key and certificate chain.


1

If your clients are not updated browsers (or are not browsers at all), it is not sure that Letsencrypt's root certificate is configured on their side since it is pretty recent. On that issue, there is not much you can do from your side; the clients have to do their job and ensure that the root certificate used by Letsencrypt is configured. I tried ...


1

Most websites using a CDN make use of a subdomain (e.g. cdn.yourwebsite.com) in order to deliver static assets from. This means that in order to deliver CDN assets over SSL you will need a certificate for the "cdn" subdomain. If you already have an SSL certificate installed on your origin, its likely that it is valid for yourwebsite.com and ...


1

I don't see anything wrong with your setup, but maybe removing the redundant resolver directive will yield a different result. I've also faced a similar situation, and I've even tested OCSP stapling using openssl based on this article: echo QUIT | openssl s_client -connect www.yourdomain.com:443 -servername www.yourdomain.com -status 2> /dev/null | grep ...


1

Recently, LetsEncrypt has announced the availability of their command line tools to generate valid certificates. No validation emails, no complicated configuration editing, no expired certificates breaking your website. And of course, because Let’s Encrypt provides certificates for free, no need to arrange payment. For those wondering if those ...


1

Can't speak to the blue-zone stuff but there should be no need to change anything for clients, assuming they are capable of supporting TLS.


1

Mixed content means that while you are connected over https some of the page elements such as images or linked CSS files and fonts are fetched using http - use the right click 'inspect element' on images and also look in the CSS files, for the redirect loop you can disable USE_SSL = true in wp_config file to FALSE. hope that helps.



Only top voted, non community-wiki answers of a minimum length are eligible