Hot answers tagged

4

Your certificate was issued to CN=*.example.com and does not contain X509v3 Subject Alternative Name for the following domains: *.example.com example.com You need to get a new certificate. Check out https://en.wikipedia.org/wiki/Subject_Alternative_Name You can dump your certificates with the following command, to verify: openssl x509 -text -in &...


3

I recently had an issue where a C7 system would not upgrade some packages because the remote cert was not trusted. I could verify this using wget. After some searching and head-scratching I decided to reinstall the ca-certificates package yum reinstall ca-certificates This solved my problem. Try reinstalling the ca-certificates package on the system you ...


3

Save certificate and key files with identical names in the same folder (cert.cer and cert.key, for example) and use certutil: certutil -mergepfx cert.cer cert.pfx and enter PFX password.


3

Some words of caution to begin with: Know what you're doing, if you're planing to implement HPKP. If you don't do it right, or "if bad things happen", which aren't under your control, you might render your domain unusable. Be sure to test your setup with a domain which isn't that important, or with a very short cache time, like ten seconds for example. ...


3

Clients are expected to have the root certificate already in their list of trusted certificates. Your own certificate is at the other end of the chain but between these two certificates there are typically one or more intermediate certificates. As clients are not expected to know about these intermediate certificates you should configure your server to not ...


3

Your cert is already a PEM cert. If it doesn't get accepted make a copy, remove the certificate details above the -----BEGIN CERTIFICATE----- and try again.


2

You can host your services however you want with the cert you obtain from LetsEncrypt. But in order to get a cert, you first need to prove that you own the domain name the certs are being generated for. With many Certificate Authorities, this is a fairly manual process. But part of the point of LetsEncrypt is automation of the whole certificate lifecycle ...


2

After reading some more, I found out that the great "Scrott Helme" already has a tutorial on exactly my problem. Basically, using a different ACME client called acme-tiny you can request a certificate with your own key and signing request. Here is the link to the tutorial: https://scotthelme.co.uk/setting-up-le/


2

Like your own output of openssl the web server (is it apache or nginx? a bit unclear in your question) misses the intermediate chain certificate. You need the SSLCertificateChainFile config in apache The output of ssllabs is correct because you are testing port 443, which does work using wget or curl. You are not allowed to test other ports than 443 in the ...


2

Would echo everything that gf_ said. However, to answer the question, yes you can. By default Let's Encrypt recreates the key and the cert at renewal. This makes implementing HPKP difficult if you want to pin at the leaf, which you probably should do in case intermediate changes (like it did in March 2016). So you've several options around this if you ...


1

I found the answer after spending a few more hours on it this morning. You need two additional server blocks: one to enforce the www, one to enforce the https while keeping the wildcard subdomain. Here's the code: server { listen 80; listen 443; server_name domain.com; return 301 https://www.domain.com$request_uri; } server { listen 80; ...


1

The current RFC governing checking of wildcards in DNS SANs is RFC 6125, Section 6.4.3. According to those rules, a DNS SAN such as "citrix*.domain.com" is permitted. The catch, however, is that the RFC uses the MAY language, which means that it is up to the specific cert-checking client implementation whether it will check/allow such wildcards. Thus the ...


1

Does having and unencrypted connection between the load balancer and nginx pose a security risk? If talking about credit card data and stuff like this: Yes. If the answer to 1 is yes, how would I setup nginx to allow the secure connections from the load balancer? Would this involve setting up an ssl certificate on each nginx server? The nginx ...


1

You need a certificate which is valid for vm.abc.dk and www.vm.abc.dk. So, if you want to go the wildcard way, get a cert including: *.abc.dk *.*.abc.dk Edit: According to Steffen Ullrich in the comments, this is not possible. Thanks for the hint! or, if this is cheaper or there aren't that many subdomains involved, put all of them into the Subject ...


1

I believe a wildcard cert is only valid for anything at that sub-domain and no other lower sub-domain. Ie. *.abc.dk is anything.abc.dk But will not work with any.thing.abc.dk For this you would need *.thing.abc.dk Because you are requesting www.*.vm.abc.dk then the cert is not valid and is why you get the SSL_ERROR_BAD_CERT_DOMAIN error. You could add a ...


1

As suggested I checked the site with ssllabs and it came back that the chain was incomplete. When the cert was provided it came in two peices, a domain.ca-bundle and domain.crt. The cert that nginx was using was domain.ca-bundle. I concatenated the two and that seems to have taken care of it.



Only top voted, non community-wiki answers of a minimum length are eligible