New answers tagged

0

Openldap 2.4 use default port 398 for tls, so try s_client via it. You can check config files in /etc/openldap/slapd.d/, check database instance file cn=olcDatabase={2}hdb.ldif. This file can contain filenames and location of your certs. If your company buy certs from domain provider like goDaddy, you can purchase and use its certs to install with openldap ...


3

Not as of now, no. The answer to the question is slightly hidden, under an entirely different question in the ACM FAQ: Q: Can I use the same certificate in more than one AWS Region? It depends on whether you’re using Elastic Load Balancing or Amazon CloudFront. If you want to use a certificate with Elastic Load Balancing for the same site (the same ...


0

Here's an awk based solution that doesn't rely on intermediate files. cat bundle.crt | awk '{ if ($0 == "-----BEGIN CERTIFICATE-----") cert="" else if ($0 == "-----END CERTIFICATE-----") print cert else cert=cert$0 }' | while read CERT; do echo "$CERT" | base64 -d | openssl x509 -inform DER -text -noout done It works by reading PEM blocks from ...


0

Do I need a wildcard cert You would need a wildcard certificate if you planned on using multiple records with a single certificate. Typically, a non wildcard cert will be signed with the naked domain and one other name you choose. Default is usually "www". Each CA is a little different in the manner they present these options. If you are planning on ...


0

I'm pretty sure you have to give an actual ServerName and not a wildcard one. Does your new cert have just "*.newdomain.com" or also "newdomain.com"? I'd guess just the first so can only be used for subdomains and not top level domain (TLD). In that case just set the ServerName to www.newdomain.com, or any other ServerName that the wildcard will match. It's ...


1

First - there are a lot cheaper places for SSL certificates than most of the UK vendors. They all resell the same stuff. Buy in US dollars and things get a lot cheaper. https://certificatesforexchange.com/ Wildcard certificates can work in certain scenarios. Tended to keep away from them for Exchange though as some clients can have problems with them. ...


0

I solved it in another way, by installing the ca-certificate. Copy your *.crt file to `/usr/local/share/ca-certificates/ run sudo update-ca-certificates This solution works with Ubuntu 14.04 at least.


1

Checking here it seems you might need to install an Intermediate/chain certificate.


0

You will need to submit a new request to your issuer. The certificate you already have will have to be replaced with the newly issued certificate. The SANs (and other certificate properties) are part of the specific certificate/key pair that was issued to you. (Some vendors call this process a reissue, as opposed to issuing a new certificate) If you could ...


8

You can't modify an already-issued certificate; EVER. That's the whole point of having it digitally signed by a Certification Authority in the first place. You need to generate (or request) a new one if you need to change anything, including of course the SANs it includes.


4

It's 2016, and now we have a better alternative: Let’s Encrypt Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. Let’s Encrypt is a service provided by the Internet Security Research Group (ISRG). The key principles behind Let’s Encrypt are: Free: Anyone who owns a domain name can use ...


1

The option is on the actual server node, not on a web site or application node. Here's an easy guide from Scott Guthrie on how to get https up and running on a dev or test machine, using a self-signed certificate: http://weblogs.asp.net/scottgu/tip-trick-enabling-ssl-on-iis7-using-self-signed-certificates


2

I think you're confusing terms a little bit. A CNAME is not a redirect per se. It's just a record type in DNS, also known as a DNS alias. The DNS protocol is ultimately about mapping names to IP addresses. The most common record type is a "A" record which is a one-way mapping of Name to IP. The CNAME record instead is a one way mapping of Name1 to Name2. ...


0

You have to understand that DNS resolving is totally separated from any HTTPS dialogue. Your system will do a DNS request to have an IP address from a DNS name. The CNAME is just an alias to another record in the DNS registry. But in the end you have an IP adddress. You can also add some record to your /etc/hosts file. Once your browser have an IP address ...


0

Windows Apache Front-end setup for Jenkins The main differences here are: How to set up a temporary certificate stopping apache winging about not having any ssl cache My setup: Install was to d:\ (not c:\ - adapt this to your needs) Jenkins is on port 8080 Unzip Apache httpd-2.4.18-win64-VC14.zip (from http://www.apachelounge.com/download/) to d:\ . ...


3

Unfortunately there is not a way to do what you want, outside of obtaining a new certificate which contains e.g. Subject Alternative Name (SAN) extensions for the other DNS names/IP addresses by which your TLS client would contact that server. The reason is that this "aliasing" needs to be trustable by the X509 verification process, and the only thing that ...


0

Let's Encrypt doesn't keep track of previous redirects. You can either use the HTTP or HTTPs version for validation. Your error highlights a different problem DNS problem: query timed out looking up CAA for [somedomain.com] The validation system was not able to complete a DNS lookup of the domain. It may be possible that the DNS provider you are using ...


2

Browsers can build up cert links back to a CA in funny ways. Normally your server will supply the site cert, and an intermediate cert and most browsers should be able to chain that intermediate back to a CA it has in its trust store. There are a few gotchas to be aware of though that are not covered in the scenarios in your question: If there are ...


1

You wrote: ...they automatically generate a certificate request used for the... But then you ask: Is there any way to get around this without generating a certificate request on the server... Are you trying to install the same cert on multiple servers? Are you taking steps locally on your server to initiate the cert req? Or are you initiating the req ...


0

PayPal is requiring the discontinue use of the VeriSign G2 Root Certificate. That is not the same as the GoDaddy G2 root. If there is a requirement to use the Verisign root then you have to get a Verisign issued certificate. Your current certificate is issued by GoDaddy not Verisign. You can't chain a GoDaddy cert to a Verisign root.


4

Q: Can I use certificates on Amazon EC2 instances or on my own servers? No. At this time, certificates provided by ACM can only be used with specific AWS services. Q: With which AWS services can I use certificates provided by ACM? You can use ACM with the following AWS services: • Elastic Load Balancing • Amazon CloudFront ...


3

It does not matter where you generate the CSR. As long as you have entered the correct FQDN and use the correct private key for your CSR everything should work. Edit: Generating a CSR on OSX works the same as on a Linux host. If you do not have openSSL installed on your Mac you can install it with brew. If you do have openSSL installed you can for example ...


0

I found that having the following set in /etc/puppet/puppet.conf to solve a case where regenerating certs "by the book" still produced the situation described in the Q: [master] certname=masterhost.domain.com [agent] certname=agenthost.domain.com (where masterhost.domain.com is the FQDN of the puppetmaster and agenthost.domain.com the same for the agent) ...


0

This problem is solved by installing KB3072630, which is installed automatically if you have Windows Update enabled. The version number of Crypt32.dll is 5.131.3790.5668 after the update. KB938397 and KB968730 are deprecated and replaced by the update above.


0

Some suggestions: Use the openssl command line tool review the contents of your certificate. Confirm that it really supports both domains. If so, it may use SNI to do this. Check your SNI support. Break the problem down into smaller problems to start with. Create 4 server {} blocks: One for "http://www", one for "https://www", one for for "https://no-www" ...


4

First, I agree that it's a bad idea to spread wildcard certificates around. Best practice is to use either separate certificates (when the domains live on different servers or virtual hosts), or SAN certificates (when they all live in the same place). However, you shouldn't be able to use your existing certificate to sign a sub-domain's certificate. SSL ...


0

In addition to the other answers, note that if your server is handling SSL/TLS for many different domains, you will either need to have a single certificate covering all of the domains or have Server Name Indication (SNI) configured on the server to enable it to use different certificates for different domains. The client also needs to support SNI, but all ...


1

In addition to Håkan Lindqvist, an answer regarding your update: Where should be user.com certificate be applied? At the machine which terminates your HTTPS / TLS. Is that possible to use self-generated certificate in this case for user.com? Of course...but using these would give your visitors cert warnings (assuming the CA cert isn't known / ...


4

There being a CNAME record rather than a direct address record (A/AAAA) is not a factor. The certificate verification is based on the hostname in the location URL. For navigating to https://example.com/ to work, you would need a certificate that is valid for example.com. Ie, a certificate that either has example.com as the Subject CN (Common Name) or that ...


-2

You have to redirect the request directly to your subdomain. This is an hidden redirection and so here is no valid certificate for the requested domain.


1

That's my everyday script: curl --insecure -v https://www.google.com 2>&1 | awk 'BEGIN { cert=0 } /^\* Server certificate:/ { cert=1 } /^\*/ { if (cert) print }' Ouput: * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * start date: 2016-01-07 11:34:33 GMT * expire date: 2016-04-06 ...


1

Since your SSL certificate is not valid for www.example.com, when someone accesses your site using www.example.com, they will get a certificate warning. This happens regardless of whether they are served a redirect or not. Otherwise, it would be possible to create a redirect to any site at all and it would look trustworthy. What you need to do is to either ...


1

You cannot include a redirection http -> https rule inside a SSL-enabled virtualhost. You cannot by design. Just accept it. You need a plain-HTTP virtualhost for doing redirection from HTTP (and this is your main mistake). Actually you can have just any config file inside your configuration directory in Debian-based Linux. You can even delete the dogmatic ...


1

buy your ssl certificate from DigiCert Follow the instruction to generate your public/private key upload to aws: aws iam upload-server-certificate --server-certificate-name <make-up-a-name> --certificate-body <public-key-file-path> --private-key <private-key-file-path> --certificate-chain <certificate-chain-path> Now the only part ...


1

You cannot create or extract a private key from a certificate; if you could, SSL would be pointless. You created the key first, as a pre-requisite to creating the CSR that you submitted to digicert, in order to get them to give you a certificate. So, go back to the machine and the directory where you created the CSR; the private key is likely somewhere ...


0

Alternative syntax using Ex and process substitution: ex +'/BEGIN CERTIFICATE/,/END CERTIFICATE/p' <(echo | openssl s_client -showcerts -connect example.com:443) -scq > file.crt


0

Just right-click on the same certificate store from which you made the request, go to All Tasks, and choose Import... You'll know that you did it correctly if the imported certificate shows up with a little key on its icon, meaning that you have the corresponding private key. If your certificate's icon is missing the little key, then you did something ...


0

OpenSSL can also be used to create self signed certificate as described in this Stack Overflow answer: http://stackoverflow.com/a/30517344/537961


2

The wrong tag is the best indicator you have. Apache assumes that your keys and certificates look like this. Check the files you reference meet these criteria. Certificate -----BEGIN CERTIFICATE----- xxxxxxx -----END CERTIFICATE----- Key -----BEGIN PRIVATE KEY----- xxxxxxx -----END PRIVATE KEY----- If you are pointing to a file with additional ...



Top 50 recent answers are included