Tag Info

Hot answers tagged

19

There are multiple solutions: One avenue is a specific key vault either a hardware based appliance, a hardware security module or a software based equivalent. Another is to simply revoke the old key and generate a new one private/public key-pair when the situation arises. That somewhat shifts the problem from maintaining key security to securing the ...


17

No, SSL certificates dont go in source control, at least not the private key part. Treat them like you would a password. Ours actually get stored the exact same way our passwords do - in KeePass. It allows you to attach files, and is encrypted.


11

You can add additional certs from the trust chain to a PKCS #12 file using openssl. For example, to include the trust chain you could use the following command: openssl pkcs12 -export -in input.pfx -out bundle.pfx -CAfile allcacerts.crt -chain This would attempt to include the entire cert trust chain in your output pfx. You may need to include -passin ...


11

You're most likely missing the intermediate GoDaddy certificates on your server. Most desktop browsers cache these, but I don't think mobile ones do. Check the GoDaddy Article on intermediate certificates with full instructions on acquiring and installing the ones from them. Generally, certificates come as a "chain". The top Certificate Authority does not ...


5

Depends. EDIT 1 (Because my first answer was snarky and bad) This is entirely dependent on all sending servers' preferences. If the sending server that connects to your server is set to... ...first connect with TLS over port 465 but die on an expired certificate, then yes you're toast. ...first connect with TLS over port 465 but be okay with an expired ...


3

Your own certificate is signed by exactly one certificate. This means that your certificate is at one end of exactly one of these Thawte chains, you would need a different certificate to be in the other chain (one signed by the intermediate certificate from that chain). As for the signature of the root certificate being SHA-1, SHA-2 or something else it is ...


3

You will need to add the intermediate certificate into the IIS SSL configuration. For details see: https://support.godaddy.com/help/article/4875/installing-an-ssl-certificate-in-microsoft-iis-5-6 You can test if the intermediate certificate is provided by IIS with: echo ""| openssl s_client -showcerts -connect tours.vht.com:443 The intermediate certificate ...


3

If you put the private key in source control, anyone who has access to it will be able to impersonate your server. If your webserver is not using PFS (perfect forward secrecy) then its also possible to decrypt any captured SSL traffic with commonly available open source tools like Wireshark. You can protect the key by DES or AES encrypting it with a ...


3

You're probably missing the intermediate certificate. AFAIK Dovecot does not have a chain certificate option as you have in for instance Apache, you need to concatenate the intermediate certificate into a single file with your public certificate: The signed certificate for your domain Intermediate CA cert Root CA cert Get correct intermediate ...


2

No, certutil doesn't have an option to add private keys. You need to use pk12util for that. If your private key is in PKCS12 format, you can add it to the key/cert database with pk12util -i keyfile.key -d/path/to/database -W password If it's in PEM format, you'll need to convert it to PKCS12 first by openssl pkcs12 -export -out server.pfx -inkey ...


2

In most configurations the requests originating from the .Net application servers are routed independently and that reverse proxy never comes into play... I would investigate how a web service request would be routed from the application server. I.e. First Can the external host be resolved is there a default gateway and does that one grant access to the ...


2

I just ended up working this out, the correct order for the certificate chain is as follows: OV_NetworkSolutionsOVServerCA2 OV_USERTrustRSACertificationAuthority AddTrustExternalCARoot Good luck!


2

There are two solutions to this issue: 1) You can regenerate the default self-signed certificate using OpenSSL: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/localhost.key -out /etc/ssl/certs/localhost.crt<br/><br/> 2) You can search the Apache config files and replace the self-signed cert with the new ...


2

your ssl certificate issuer should provide you free replacement or reissue. Just go to digicert and ask them. Generate new key files from server and reissue ssl. Make sure the new ssl should be SHA2 only.


1

This page on wiki Jenkins mentioned that as per July 2014, the recommended configuration for Jenkins reverse proxy. The missing parameter is RequestHeader set X-Forwarded-Proto "https" and RequestHeader set X-Forwarded-Port "443" So the configuration became <VirtualHost *:443> SSLEngine on SSLCertificateFile /etc/ssl/certs/cert.pem ...


1

It turns out that Thawte's site is just confusing for people who don't work with SSL certs a lot. Despite the fact that there are two certificates shown for SSL123 SHA2 under SHA-1 Root, you only need the first one. The second certificate is the SHA-1 root, and you don't need it concatenated with your site's cert for deployment to nginx. Just use the first ...


1

As per @HBruijn's comment, Gmail only supports retrieving email through POP3, not IMAP. This has been confirmed on their product forums Both Gmail and Dovecot support POP3 over SSL, which you should be able to use by opening port 995 on your firewalls, and directing Gmail at it.


1

I found a workaround for this problem. Instead of configuring Squid I added the CA certificate to the list of trusted CA certificates system-wide. I followed the instructions here http://gagravarr.org/writing/openssl-certs/others.shtml


1

I found that stunnel may be a suitable solution to add that layer in between, is it a good solution? I don't aware that nginx have that functionality (i.e. provide client certificate when proxying request to upstream). The stunnel solution works in this case. You can provide certificate per service. Configure it in stunnel.conf [upstream] accept = ...


1

With Vista and IE9 (9.0.8112.16421) I had the same problem: Apache 2.2 with SNI and two subdomains. When calling the second domain https://sub2.example.org IE9 always complained because the certificate IE9 had loaded was www.example.org instead of sub2.example.org. Apache is configured right (no problems with Firefox, Google Chrome or Safari). I enabled and ...


1

When openssl is not available on your system you could alternatively convert certificates with the java keytool. However you have to create a java keystore (JKS) first. The certificates can then be imported and exported in different formats. keytool -genkey -alias test -keystore <key store file> keytool -delete -alias test -keystore <key store ...



Only top voted, non community-wiki answers of a minimum length are eligible