Tag Info

New answers tagged

3

They are using a private PKI, thus essentially self-signed certs, this makes sense. It's kind of a bad practice, but the documentation is all there, hopefully you have some out-of-band way to confirm the certs before downloading them. The risk is that an attacker could change the KB webpage and the certs, and own your connection; you'd never know until it ...


1

Certificates from different CAs is a non-issue as long as the clients trust these CAs. Serving multiple sites with different certificates on the same IP, regardless which CAs have signed the certificates, is what has some limitations in terms of compatibility. Supporting multiple certificates on one IP, at all, requires support for a TLS extension called ...


0

The only issue is client compatibility, some very old browser/OS combination will not work, notably Windows XP/IE8. Everything else (Chrome, Opera, Firefox, etc.) on Windows XP will work. You do not need to buy anything, sign one of the certificates (or all of them) yourself. Signing CA does not matter on the server side, only on the client, and if you ...


0

How did we get the wildcard certificate if we didn't pay $200 or whatever for it? There are Two ways to get your certificate, Certificate authority Resellers of trusted certificate authorities Get an SSL certificate direct from the certificate authority can be costly. I have purchased my wildcard certificate at just $42 from re-seller ...


1

How did we get the wildcard certificate, if we didn't pay $200 or whatever for it? A cheaper CA than you found now? I'm sure you'll find a reseller with lower prices. Where did we get intermediate.crt? What does intermediate.crt do? You have it form your CA. CA's ususally don't sign certs directly with their Root certificates, but do this via an ...


1

It seems pretty clear based on the details in your cert and the intermediate that your old manager did indeed pay whatever it cost for a wildcard cert from RapidSSL a year ago. What he had to generate was likely the certificate request to submit to RapidSSL.


4

Your Exchange server's FQDN (Fully Qualified Domain Name) is still hostname.domainname.local, hence the clients connect to it, see that the name of the server they are connecting to does not match either the name, nor the SANs (Subject Alternative Names) on the certificate you have, and throw that error, as they are designed to do. The easiest solution (by ...


0

The answer (as explained in this security.SE post) is that the two GeoTrust Global CA certificate you see in the chain are in fact not the same certificate, one is derived from the other. Because of CA Cross-signing! When the GeoTrust Global CA certificate was first created and signed, no computer/browsers/applications would have had it in their trust ...


2

That's the thing with SSL certificates. You don't have to do anything for them to stop working. They expire on their own. You have to renew CRLs too. For Remote Desktop, you really should be using a Windows Enterprise CA in an Active Directory domain, and not OpenSSL. It will automate most of this stuff for you. I don't have enough detail to work out what ...


2

No - the website can't "choose" which certificate to use. Only you can. With SNI, you can configure name-based virtual hosts to have a different certificate per host header on the same listener, which is probably what you want - configure a virtual host for the hostname listener with the hostname cert, and an IP virtual host with the IP cert (and otherwise ...


0

There is no such thing as a SSL Certificate Request in SHA-256. When creating a CSR you can only choose the size (1024 bit-4096 bit). You need to send that CSR to a certificate authority that will sign it for you. Very likely they will sign it by default with a SHA-256 signature or will provide a listbox to choose between SHA1 and SHA-256. Update: it ...


0

Finally, i found out what is going on with this situation: It seems that when you have the Remote Desktop Gateway installed as Server Role, using the role's panel you can manually assing a certificate to a desired recipient and from a desired issuer. That means that if one wanted to issue a certificate to example.com with example.com as the issuer all he ...


7

It has nothing to do with SSL. Why you should get the warning from scp is a different matter. Assuming the hostname is exactly the same as when you SSHed, perhaps you are using scp as a different user or from a different host (or using sudo, which means you will be using root's known_hosts file). To verify the fingerprint, you can use ssh-keygen -l -f ...


2

One is a public cert, the other is a key. As Federico stated in comments, this question addresses it pretty well. That being said, what are you trying to do?


0

We use an EV SSL with Cloudfront CDN and it's a waste money. Cloudfront will support the EV SSL, but we have to upgrade to the $200/month plan. That's a lot of money for a green bar. It does help conversions, but I don't think it would cover the $200/month to Cloudfront. So if Amazon offers a CDN that will work with the EV SSL (Basically you would have to ...


1

I had the same exact issue and found the fix. It's all how you created the certificate template and request the certificate. Here is the fix: Create a certificate template from by duplicating the Computer template Edit the new certificate and these two important mods 2a. Allow export private key 2b. On the Subject Name tab select "Supply in the request" ...


4

Yup, when the SAN field of the SSL certificate contains the IP:XXX.XX.XX.XXX value it's possible to successfully connect to such a service without warnings (for a known CA, of course). But in reality this has to be supported by the CA you are buying the certificate from. In my experience I don't remember seeing such options in commercial CA web interfaces, ...


4

It appears that someone can't spell phoneproxy correctly when they typed it in setting it up. Regardless it's for CUCM's phone proxy feature on an ASDM firewall. See here: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/unified_comm_phoneproxy.html Here's the gist of it: The Cisco Phone Proxy on the ASA bridges IP ...


0

I had a real issue with this. I'm not using logstash, I was simply trying to get IP SANs to work with docker tls. I would create the certificate as described in the docker article on https (https://docs.docker.com/articles/https/), then when I would connect from a docker client: docker --tlsverify -H tcp://127.0.0.1:2376 version I would get this error ...


0

Don't know if you done that but you have to upload to the endpoint the cert with the priv key with commands like : heroku certs:add server.crt server.key And check if its ok with : heroku certs If its not okay you have someting wrong in the cert , edit with a vim or notepad to checks inside cert .


1

I don't know much about ufw, but in this case I think it will be completely ineffective on INPUT traffic, because the rules that implement it come after a blanket DROP (the fifth rule in the INPUT chain). You can see from the packet counts on the later rules in the INPUT chain that no packets are ever getting as far as any of the rules that are supposed to ...


1

Browsers warn about untrusted SSL certificates because users expect an SSL-protected connection to be safe for transmitting sensitive data. Looking at it from your point of view, you use an SSL certificate to encrypt data between two computers at your company. You do this instead of using a non-encrypted connection because you have something secret to ...


1

If a certificate is self-signed, and not known by your browser, you can send informations to a man in the middle. Some sensitive informations can be sent to to bad guy. If your self-signed certificate is known by your browser, you will not have the exception and the connection will be encrypted. You are right : the non enctypted connections are bad, but not ...


1

The correct way to do it with a. Local is to use the external domain. You set the path to the external'one, you register the certificate (some cheap exist) and you doa split dns setup, so internally the external host will resolve to the internal'one. This is the only clean way.


3

/path/todirectory/ is the physical path on the server that the files reside at. So, https://servername/ maps to the index in /path/todirectory/ (your DocumentRoot), while https://servername/path/todirectory would map to the physical directory /path/todirectory/path/todirectory/, which probably doesn't exist. What content are you expecting that it should ...


-1

Set up two virtual hosts: the one with www without SSL and the one without www - with both SSL and plain HTTP. Update: @MadHatter is right, you'l need 2 IP addresses to separate http and https.



Top 50 recent answers are included