Tag Info

New answers tagged

0

If your user base and their computers are not managed by you, then that is a classic case where you should purchase an SSL certificate from a 3rd party rather than use self-signed certs. Wildcard certs are readily available from many 3rd party CAs and they are not very expensive. I assume you own the example.com domain.


1

strongline is right, I think. You should launch the certificate templates MMC snapin on your CA server and make a copy of the certificate template that you are using. Then, modify the copy to use the desired settings, such as the cert lifetime.


0

You cannot issue certs whose expiry date is longer than what its template defines. You need to change your certificate template.


2

Given that you're using this in your apache config: SSLCertificateFile /etc/apache2/cert/ssl.crt SSLCertificateKeyFile /etc/apache2/cert/ssl.key The /etc/apache2/cert/ssl.crt file should contain certificate of e.g. yourdomain.com certificate of first intermediate CA, signed by root CA (e.g.StartCom Class 1 Primary Intermediate Server CA) certificate ...


3

A UCC cert is more of a marketing term than a technically different type of certificate. A UCC cert is really just a regular X509 certificate with a bunch of SANs (subject alternative names) on it. As such, you can easily mimic the functionality of such a cert with your own internal certification authority. If you own the CA, you can have it issue ...


0

I don't know about appcmd, I consider that a legacy tool which I don't recommend using anymore. In PowerShell you indicate SNI with the SSlFlags parameter, 0 is no SNI, 1 sets SNI. New-WebBinding -Name site1.local -Port 443 -Protocol https -SslFlags 0 New-WebBinding -Name site2.local -Port 443 -Hostheader site2.local -Protocol https -SslFlags 1 To assign ...


3

Wikipedia explains it pretty well in Certificates and web site security. There are three kinds of validations for X.509 certificates for websites. Domain Validation (DV) The cheapest and simplest validation. It is only checked if you have access to the domain and the infrastructure behind it. Organization Validation (OV) The issuer also checks the ...


0

In my case I had not enabled the site 'default-ssl'. Only '000-default' was listed in the /etc/apache2/sites-enabled folder. Enable SSL site on Ubuntu 14 LTS, Apache 2.4.7: a2ensite default-ssl service apache2 reload


0

In my case I had not enabled the site 'default-ssl'. Only '000-default' was listed in the /etc/apache2/sites-enabled folder. Enable SSL site on Ubuntu 14 LTS, Apache 2.4.7: a2ensite default-ssl service apache2 reload


2

The first server configuration is a redirect to HTTPS (second configuration). In the second server configuration SPDY module is not built by default, it should be enabled with the --with-http_spdy_module configuration parameter. Note that in order to accept both HTTPS and SPDY connections simultaneously on the same port, OpenSSL library used should support ...


2

It is pretty decent for it's age. A site I have found good and informative in regards to web server security is Cipherli.st which gives modern configurations for very secure configurations (incompatible with older clients) and also a set of legacy options so you can support older browsers (IE < 9, Android < 2.2 or Java < 6). When you want to test ...


-1

The files /etc/pki/tls/certs/localhost.crt and /etc/pki/tls/private/localhost.key are created by the postinstall script of the mod_ssl package. You can find the spec file here: https://git.centos.org/blob/rpms!!httpd.git/6f7de23710cf2fb30178692d962a51a8252842f6/SPECS!httpd.spec. Here is the script from CentOS 7: postinstall scriptlet (using /bin/sh): umask ...


2

I figured it out! The problem was my openssl.cnf. The old certificate was created with string_mask = utf8only. This line was missing from my current file, resulting in a default value of PrintableString, T61String, BMPString. I did not use any non-ASCII characters, but it seems it was still enough to irritate Firefox.


1

I deleted the old certificate from my PC and installed the new one. Firefox uses its own separate certificate store. At the risk of stating the obvious (for those of us who regularly use Firefox), did you add the new CA certificate to Firefox itself?


4

Now, how do I create a chained ssl certificate for Dovecot, including domain1 and domain2? The term chained certificate is used when there are intermediates certificate between a certificate and the roots certificate. Your ultimate goal is providing dovecot service with SSL for multiple domain. Your current dovecot configuration is using default ...


2

All of your location blocks need to be in the https server block since that's what is handling your requests. The only logic that needs to be in the http server section is what's required to perform the redirect. Edit: Now that we have the hostname in question, I can see that port 443 on your server is closed: $ nmap www.boilerplaza.co.uk -p 443 Starting ...


1

The reseller pre-purchases thousands of them at once. Additionally, the issuing CA use the resellers to do what's called "Market Segmentation". In other words, there are people who are happy to pay $49/cert and those that are happy to pay $490/cert and those that only want to pay $4.95/cert. By selling the certs at a really low price, they capture all the ...


3

You need a new certificate for test.domain.com -- you can't add it to an existing certificate that has already been issued. If you'll be doing much else with subdomains, you might consider getting a wildcard certificate for *.domain.com.


5

First to specifically answer your question; "How can i change that to DHE_RSA or ECDHE_RSA?" The easiest solution to this is to download IIS Crypto and let it do the hard work for you. https://www.nartac.com/Products/IISCrypto/ In order to use DHE_RSA or ECDHE_RSA you'll need to re-order the cipher suite preferences in the bottom left pane of the ...


0

The easiest way I know to change the order of cipher suites in Windows is using the small tool IIS Crypto However the message you get in Chrome is most likely not related to that. Your connection to website is encrypted with obsolete cryptography is shown when your certificate or its parents have a signature algorithm of sha1. Check that first and maybe ...


8

Your certificate is using the outdated SHA-1 algorithm, which because of security risks Google Chrome now warns about. http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html https://community.qualys.com/blogs/securitylabs/2014/09/09/sha1-deprecation-what-you-need-to-know https://shaaaaaaaaaaaaa.com/check/aws.hatchlings.com ...


3

In your config, you have these three lines: SSLCertificateFile /etc/ssl/certs/mycert.crt SSLCertificateKeyFile /etc/ssl/private/mycert.key SSLCertificateFile /etc/ssl/certs/sub.class1.server.ca.pem You are repeating SSLCertificateFile. That means that Apache will use the second instance of the variable, i.e. /etc/ssl/certs/sub.class1.server.ca.pem - ...


0

In your configuration file, you point on the bad PrivateKey file SSLCertificateKeyFile /etc/ssl/private/mycert.key instead of SSLCertificateKeyFile /etc/ssl/private/myweb.key. Out of the scope of the question : are you sure you want to keep a password on your private key ? Means that if your server restarts, it will need the password again. But also means ...


1

It is a MTU issue, this iptable rule(on gateway box) make it work: iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu


1

While I am not proficient in IIS in particular (I deal with Apache mostly), I would expect this is be a custom logging sort of thing. The following page documents some of the advanced logging functionality of IIS; while it doesn't show SSL things in the screenshots, it may still be useful. ...


0

You have installed the trust list. Now it's trying to grab the CA certificate. You're probably going to have to grab that certificate manually as well. It appears that this is the certificate chain it is trying to obtain: http://http.fpki.gov/fcpca/caCertsIssuedTofcpca.p7c Download it and import it into your computer's Trusted Root Certification ...


1

Fire up your own internal CA. Issue a cert with whatever names you need/want on it. Use Active Directory to deploy it to your domain-joined clients. Users who are not members of your Active Directory domain will get certificate errors that they will have to ignore until you've migrated to an adequately named domain and can once again replace with a ...



Top 50 recent answers are included