Hot answers tagged

39

Yes, it is possible. In the case of Windows, there is a feature called Cross-Certification or Qualified Subordination. The idea is that you sign third party's issuing CA certificate in your environment. As the result remote SSL certificate is chained to your own root CA certificate. In order to protect yourself from possible rogue certificates, you ...


3

It's easier to maintain if you have one certificate, and there are no real downsides. You can put as many unrelated domains as you like on a certificate, so putting the www subdomain on seems fairly reasonable. Just use one certificate IMHO.


2

If you read RFC 5246 Chapter 7.4.2 you'll find that: certificate_list This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Because certificate validation requires that root keys be distributed ...


1

Personally I add the alt names at CSR generation, so I know that works (there's a little byplay in default conf files both for generation and signing). For changing afterwards, as far as I remember the Alt Names are extensions, and it seems you can override or add the extensions you want while doing the signing. I will shamelessly copy: From: Patrick ...


1

Did you include the StartCom Certification Authority CA into the bundle ca file? Afaik it's necessary because StartCom isn't trusted by all vendors and operating systems. The error tells you that the certificate could not be validated - so it might be a good idea to import the StartCom CA into your system. (Some older threads about this problem)


1

Your OpenLDAP server doesn't appear to have TLS configured. Your /etc/ldap/slapd.d/cn=config.ldif should have something like the following: olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key olcTLSCACertificateFile: /etc/ldap/ssl/ldap_ca.cert olcTLSCertificateFile: /etc/ldap/ssl/ldap.cert olcTLSCipherSuite: HIGH:!aNull:!MD5:@STRENGTH olcTLSProtocolMin: 3.1 ...


1

Yes, as the example goes: <VirtualHost *:443> DocumentRoot /var/www/html2 ServerName www.yourdomain.com SSLEngine on SSLCertificateFile /path/to/your_domain_name.crt SSLCertificateKeyFile /path/to/your_private.key SSLCertificateChainFile /path/to/DigiCertCA.crt </VirtualHost> Put this inside your Apache config file using the virtual host ...


1

Use SSLCACertificateFile instead of SSLCertificateChainFile. SSLEngine on SSLCertificateKeyFile ./ssls/server.key SSLCertificateFile ./ssls/STAR_domain_com.crt SSLCACertificateFile ./ssls/PositiveSSL.ca-bundle Also, be sure that they are in the correct directories accessible by Apache. You can also transfer your certificates to /etc/ssl/private to double ...


1

I've just gone through this issue on my server. This was on 2008R2. Ensure all certs are using the new intermediate certificate as we're going to remove the old one Remove X1 intermediate cert from the local computer and all local user accounts Remove the secure binding in IIS for each certificate Re-add each of the secure bindings in IIS There maybe ...



Only top voted, non community-wiki answers of a minimum length are eligible