Tag Info

Hot answers tagged

15

No, that won't work. In order to sign certificates you need your own certificate authority certificate. The certificates you purchase are signed by a certificate authority, but specifically marked as not being a certificate authority certificate. Check the "Certificate Basic Constraints" in your certificate, and you will see that it "Is not a Certification ...


11

If you can safely limit the supported clients of your service to systems supporting Server Name Indication, having only one IP address should be sufficient. See this article for a list of supported clients.


4

If you need more then one domain covered by SSL, you need to buy a wildcard SSL certificate. This covers a domain name and all sub-domains. Remember to create your SSL cert for *.example.com: otherwise you only sign your normal domain. If you have two different domains you need SSL for each domain. Or if you have only one subdomain, sometimes two normal ...


4

From a purely technical perspective, there is usually no issue with using the same certificate on multiple machines. Ensure you have the private key so you can import the certificate properly on each host. From a functionality standpoint: If the cert is only for example.com then it won't work properly for serverlet.example.com as the hostname won't match ...


4

Assuming that the example you're pointing to is actually the one about "The site is using outdated security settings", and not "does not have public audit records", about 99.99% sure that your problem isn't CT, for several reasons: It is my understanding that only CA certificates in the system trust store are subject to CT validation; locally-managed CA ...


2

You need to combine domain certificate & bundle certificate into one file and reference that as ssl_certificate like : $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt refer http://nginx.org/en/docs/http/configuring_https_servers.html#chains


2

This is not possible. To use an existing certificate to sign another certificates it must have the appropriate purpose and extension set, so that it can work as a CA (certificate authority). End user certificates don't have this extension. You would probably be able to use your certificate to sign a new one, but this new certificate could then not be ...


2

The IP address is not relevant for SSL/TLS on websites. What is important is that the name the browser uses (e.g. example.com) matches the name listed in the certificate. So, if you install the cert on many servers and somehow make sure you can reach them all with the same DNS name, things should work. Does your application require load balancing? Would ...


1

I reinstalled apache and the problem was fixed. Something must have been corrupted.


1

The public key is - like it's name suggests - public. It can thus not alone be used for authorization, since everybody knows it. But only the owner of the private key is able to sign some random challenge and this signature can then be verified by everybody having access to the public key - in this case the server which has sent this challenge to the client. ...


1

I ran this command to generate a key from a PEM file: openssl rsa -in privkey.pem -outform PEM -out myserver.key It prompted me for the key again, but I guessed it. I put this key in the the nginx/conf directory and everything worked.


1

First of all you need to make sure the SSL mod is enabled a2enmod ssl then you need to change your config to something like this: <VirtualHost *:443> SSLEngine On SSLCertificateFile /etc/ssl/localcerts/www.test-site.com.crt SSLCertificateKeyFile /etc/ssl/localcerts/www.test-site.com.key SSLCertificateChainFile ...


1

ssl_certificate_key should contain what's presently in server.key, ie they server's unencrypted private key. ssl_certificate should contain the server's certificate and the certificate chain, as explained in the documentation, in that order. So, that's basically the output of cat 09********ss.crt gd_bundle.crt A handy online tool to quickly check out what ...


1

First part: SSLCertificateFile /etc/apache2/ssl/11-2013/09********ss.crt This is the public certificate for your website. This is the one you would rekey to change the SHA1 to SHA2. SSLCertificateKeyFile /etc/apache2/ssl/11-2013/server.key This is private certificate for your web server. SSLCertificateChainFile /etc/apache2/ssl/11-2013/gd_bundle.crt ...


1

Wildcard certificates work for only one level of domains, that is, the most specific domain level. So, you need to get another certificate for *.ad.company.com.


1

I happen to be running an OpenVPN server in TCP mode, and I can confirm that you cannot use openssl s_client to get the certificate: [me@risby 17]$ openssl s_client -connect openvpn.example.com:1194 CONNECTED(00000003) 140413456672632:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184: --- no peer certificate available --- No client ...


1

I am working through the same process, Exchange 2010 with Outlook 2013 clients and having just registered a mail.domain.com certificate. Our server isn't server.local though, it is server.domain.com, but I don't want to have to add that server name to the listed hostnames in the certificate, and also want to do it correctly. ...


1

There are a few updates that add SHA-256 support in Windows Server 2003. The one you need is KB2868626; when installed this update will enable you to install SHA-256 SSL certificates on Server 2003 SP2. You may want to install the ones below as well so you can connect to your own site. KB938397 adds SHA-256 support to Server 2003 (SP1 or SP2). This update ...


1

In IIS 10 you can have: Name Bindings ---- -------- Default Web Site https *:443:*.bar.com sslFlags=3 https *:443:*.bar.net sslFlags=3 https *:443:*.foo.edu sslFlags=3 and use the CCS for all bindings, but you can't do: https *:443:*.*.com sslFlags=3 or https *:443:*.com ...


1

It is not IIS fault. Looks like you downloaded wrong intermediate CA certificate or incorrectly merged certificates with OpenSSL. IIS internally builds certificate chain and uses these certificates (except root certificate, which is not transmitted during SSL handshake) to send to client. Even if the certificate is not presented in the store, IIS can use ...


1

I would not change the server name, since that would mean that all your search engine results would need updating, and that will take time. When purchasing server certificates, the standard way is to send the .csr with www. prefix. The certificate provider will then issue a certificate both with and without the prefix.


1

Nginx wants any chain cert(s) in the ssl_certificate file after the server cert. See http://nginx.org/en/docs/http/configuring_https_servers.html#chains . Link conveniently found on related question Can't get Nginx to serve correct certificate chain although in that question the actual problem turned out to be different.



Only top voted, non community-wiki answers of a minimum length are eligible