Tag Info

Hot answers tagged

23

You can just request a new certificate, and run both certificates at the same time. In fact this is quite common for applications that need to be allowed to run without downtime, that require new certificates. If you install both on one server, the old certificate will be ignored, in favor of the new one. Datasprings has a nice write-up about certificate ...


5

Some CAs, I know DigiCert is one, will carry over the remaining time on your existing cert to the new one. If you're using such a CA, then just go ahead and request the new certificate. If you're not, then the only issue that would arise is that you paid twice for the left over time. There are no technical issues to take into account.


5

HTTPS clients should refuse to match TLD wildcards like *.com or *.net (or even *) for security reasons: No single certificate should claim authority over a whole TLD. Now how is the client supposed to find out whether .example is a TLD (matching *.example forbidden) or a short form (matching allowed)? Particularly considering that new TLDs pop up every ...


5

If the chain is sufficient depends on the CA store of the client. It looks like Firefox and Google Chrome have included the certificate for "COMODO RSA Certification Authority" end of 2014. For Internet Explorer it probably depends on the underlying OS. The CA might not yet be included in trust stores used by non-browsers, i.e. crawlers, mobile applications ...


4

I contacted Comodo and downloaded a bundle.crt file from them. I renamed it to ssl.ca, as per this server's setup, and now the cert passes all tests. Chain issues = Contains anchor isn't a problem (see below) Worth noting: the widely regarded as most complete test now shows Chain issues = Contains anchor, whereas before it used to show Chain issues = None ...


4

Your Exchange server's FQDN (Fully Qualified Domain Name) is still hostname.domainname.local, hence the clients connect to it, see that the name of the server they are connecting to does not match either the name, nor the SANs (Subject Alternative Names) on the certificate you have, and throw that error, as they are designed to do. The easiest solution (by ...


4

An SSL certificate depends on the IP address of host too, right (besides the hostname)? No, only the Hostname ("DNS-Name") is relevant for a X.509 certificate and the Application Layer. Such a certificate has a field called Common Name (CN) which holds the domain name (which also apprears in the address bar of your browser). The browser validates the ...


3

They are using a private PKI, thus essentially self-signed certs, this makes sense. It's kind of a bad practice, but the documentation is all there, hopefully you have some out-of-band way to confirm the certs before downloading them. The risk is that an attacker could change the KB webpage and the certs, and own your connection; you'd never know until it ...


3

If I understand your question correctly, you're asking if you can proxy SSL connections transparently, with a CA cert distributed by GPO. In my experience, all browsers accept the supplied CA, including for certificate pinned sites. The only issue you might run into is clients that send no SNI data (older clients generally - XP/IE the worst offender)


2

Personal Experience A while back I had a similar issue. I had set up a local DNS for Windows and Linux servers with .staging as the TLD. To save on creating and signing certificates for each virtual host and avoid having to configure new IP addresses (non-SNI web servers), I created a key and cert for *.staging but all the clients I tried (including curl) ...


2

It seems that there is something wrong with the intermediate certificate . If you verify your certificate using tools from SSLShopper or SSLLabs , both are returning errors in the certificate chain.


2

yeah, i dont expect it to be same, just that why there is error in the second one, and how to fix it is the problem, i think my generation or assign to dovecot/posfix is wrong, becasue i dont knw how to use the CA into this installation, how do i use CA crts ? in postfix/dovecot ? To use chain ssl certificate in postfix, you can refer to this docs. ...


2

This depends on what you want and your setup details. smtpd service: A certificate has a Common Name (CN) as you know, holding the domain which it is valid for. Say this example.com and *.example.com, as a typical case for certs intended for the web. If the hostname of the mailserver is mail.example.com (the domain in MX-record matters here), the cert ...


1

I see two things immediately wrong. You have a certificate for *.example.com, but you're accessing the site as https://example.com. A wildcard certificate won't be accepted for a parent domain. Either access it via https://www.example.com, or make a new certificate. You're using a SHA1 hash for the cert. This is considered bad. the -sha256 switch in ...


1

You can and you should (unless you want to use a host specific cert). Technically you can use any certificate you'd like, including snakoil. It's just another self-signed cert with a mismatched identifier. However, it's best to use a certificate that matches what a legitimate client would use to contact the host. This depends on your setup. If people are ...


1

Certificates are public. Private keys are private. The private key you generated before requesting the cert is what you need to be careful with.


1

I posted the question and shortly after that I found answer in another post Apache and multiple PHP-FPM pools The code didn't work for me 100% but it showed me the right way to do it. This code didn't work for me: <FilesMatch \.php$> SetHandler php-script </FilesMatch> So my code is simply: AddHandler php5-fcgi .php I included this ...


1

It seems pretty clear based on the details in your cert and the intermediate that your old manager did indeed pay whatever it cost for a wildcard cert from RapidSSL a year ago. What he had to generate was likely the certificate request to submit to RapidSSL.


1

How did we get the wildcard certificate, if we didn't pay $200 or whatever for it? A cheaper CA than you found now? I'm sure you'll find a reseller with lower prices. Where did we get intermediate.crt? What does intermediate.crt do? You have it form your CA. CA's ususally don't sign certs directly with their Root certificates, but do this via an ...


1

Certificates from different CAs is a non-issue as long as the clients trust these CAs. Serving multiple sites with different certificates on the same IP, regardless which CAs have signed the certificates, is what has some limitations in terms of compatibility. Supporting multiple certificates on one IP, at all, requires support for a TLS extension called ...


1

I would suggest to utilize ADCS SMTP Exit Module: https://technet.microsoft.com/en-us/library/cc773129(v=ws.10).aspx Exit module is more flexible than eventlog subscription. Though, eventlog subscription is suitable for low pofile CAs.


1

The order to concatenate these files is: yoursite.crt USERTrustRSADomainValidationSecureServerCA.crt USERTrustRSACertificationAuthority.crt AddTrustExternalCARoot.crt


1

Apparently, this is what you are looking for: http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate Available since version 1.7.8. location / { ... proxy_pass the_other_nginx; proxy_ssl_certificate the_certificate.pem; ... }



Only top voted, non community-wiki answers of a minimum length are eligible