New answers tagged

3

Your cert is already a PEM cert. If it doesn't get accepted make a copy, remove the certificate details above the -----BEGIN CERTIFICATE----- and try again.


1

As suggested I checked the site with ssllabs and it came back that the chain was incomplete. When the cert was provided it came in two peices, a domain.ca-bundle and domain.crt. The cert that nginx was using was domain.ca-bundle. I concatenated the two and that seems to have taken care of it.


1

You can host your services however you want with the cert you obtain from LetsEncrypt. But in order to get a cert, you first need to prove that you own the domain name the certs are being generated for. With many Certificate Authorities, this is a fairly manual process. But part of the point of LetsEncrypt is automation of the whole certificate lifecycle ...


0

centos 6 has a wonderful system for trusting CAs, shared system certificates Place the CA cert in pem format in /etc/pki/ca-trust/source/anchors/, run update-ca-trust && update-ca-trust enable The beauty of this tool is that it generates openssl, java and nss stores. So if your CA certificate is correct, it will work (at $work we deploy our ...


0

I just posted my workaround here, as we faced same issue still in 2016 on Windows 2012 Server with IIS8(!) http://serverfault.com/a/786098/362281 Hope this helps to do not waste too much time on it!


0

I suspect that you haven't got the following enabled: NameVirtualHost *:80 NameVirtualHost *:443 There should be something in your error log (ssl_error_log) explaining why there is nothing listening on port 443. But you're paths look very un-CentOS/RHEL6 like (which don't have a sites-available structure, and don't log to /var/www/log/ ), so I'm willing ...


0

I figured this out pretty quickly, in my httpd.conf I had the ports bound there instead of the vhost. So I removed them from httpd.conf and added Listen 80 and Listen 443 to the vhost file and it worked.


3

Your certificate was issued to CN=*.example.com and does not contain X509v3 Subject Alternative Name for the following domains: *.example.com example.com You need to get a new certificate. Check out https://en.wikipedia.org/wiki/Subject_Alternative_Name You can dump your certificates with the following command, to verify: openssl x509 -text -in &...


1

It's the EKU (ExtendedKeyUsage extension) rfc 5280 4.2.1.12 extKeyUsage says In general, this extension will appear only in end entity certificates. CABforum Baseline Requirements (v1.3.4) 7.2.2 g affirms this, but along with 7.1.5 allows one case: For a Subordinate CA Certificate to be considered Technically Constrained, the certificate MUST ...


3

Do client certificate and key have to be generated with the same ca-key, as server certificates? No, the main requirement for the client certificate is that the server trusts the CA which has signed that client certificate. In theory you can even trust multiple CA's and use client certificates from completely different sources. Which CA has signed the ...


0

I had the same problem today, and fixed it by repairing the key store and providing the serial number of the public certificate. See my answer here or go directly to this link which explains how to repair the key store


-1

@AAgg, Just reissue the certificate from your cert provider with new CSR and Key. I have done that several times without having any issues.


0

Talk to cert vendor Depending on your vendor, they may either insist on re-payment, or just do this free of charge. I would not spend time looking for the cert in nginx's RAM. Sure, if https still works, then the privkey must still be there, and extraction from RAM is possible, but if you have never done this before, then just buying another cert is the ...


2

Hmm, OpenVPN's easyrsa creates certificates like this: CA1: X509v3 Subject Key Identifier: 87:13:73:D4:7C:9A:E1:EA:9A:F8:90:48:93:18:5A:B0:AF:B9:B6:25 X509v3 Authority Key Identifier: keyid:87:13:73:D4:7C:9A:E1:EA:9A:F8:90:48:93:18:5A:B0:AF:B9:B6:25 DirName:/CN=Easy-RSA CA serial:8B:E0:6F:16:C0:46:46:FC X509v3 Basic Constraints: CA:TRUE X509v3 Key Usage: ...


1

There will not be any conflict created of using your certificate with the two different server. Normally you can order one certificate for your domain and install to any number of physical server.Only the thing you needed is your private key. You can get the private key from your initial server where the CSR was created and use it on the desired server. Or ...


-1

Here is the command to combine using cat cat first_cert.pem second_cert.pem > combined_cert.pem


0

Thnx to ychaouche's answer this was resolved by creating a full certificate chain and adding to the v-host config.


0

I struggled with exactly this issue on an AWS instance. It seemed like every 5 minutes, I had to go into the bindings and re-select the SSL Cert. So, I decided to save myself some time by creating a batch-file that sets the SSL cert from the command-line. I ran the batch-file once, and then left it on the desktop, with the intention of double-clicking it ...


0

Is it good to disable SSL 3? Generally yes. Is it good to enable TLS 1.2? Generally yes. Is there a solution to improve the SSL Score? In broad strokes: Regardless of what web server you are running: Update your server software. Disable SSL3. Enable TLS1.2. If running the Microsoft IIS web server: Download and run ...


0

To generate a wildcard cert, follow the same procedure but add a wildcard to the CN -- so instead of CN=foo.example.com, use CN=*.example.com.


3

The email address in the request doesn't need to relate to the DNS names in the certificate at all. It could be a gmail address if you wanted. It's just metadata and a hypothetical way for someone to contact the owner of an SSL protected site. Technically it's not even required metadata. It's completely up to the Certificate Authority whether they want to ...


1

tlsv1 alert unknown ca The server cannot verify the client certificate you've sent because it does not find any path to the CA's trusted by the server.


0

Please post your full configuration. The configuration for http is missing. If i had to guess, you have to to the following: Change the ServerName entries to the following: ServerName helpdesk.domain.com Ensure that your configuration for helpdesk.domain.com is not the first read by Apache. If they are in different files, Apache will read them in ...


2

Disabling a cipher (RC4) or a protocol (SSLv3) is not done by changing the certificate but by changing the configuration of the web server. The certificate is (mostly) independent of cipher and protocol. When using apache you would need to adjust the SSLProtocol and SSLCipherSuite configuration options.


0

You need to determine which conf files are being loaded (likely conf/*.conf , vhost/*.conf .. trace it from the httpd.conf). Apache is reading multiple conf files, one of them already has a :443 that is listening on port 443. You only need the SSL configuration in the 2nd block/conf file for the :443 listener (this is why you are getting a default page, ...


0

That's the config file for Apache listening on port 80. However, HTTPS is delivered via port 443. It's likely that you have a rogue site remapping port 443 to the default directory (Possibly even Apache's own /etc/apache2/sites-available/default-ssl.conf).


1

From ADFS PoV, no need to do anything. Yes - certificate removed. However, any CP and RP that do not automatically pick up the new metadata will break as they will think that the token is incorrectly signed. These need to be updated manually.


1

The CSR (Certificate Signing Request) alone is enough to generate a valid certificate. The CSR has all of the requested details of the certificate (Subject name, location, organization, etc.) along with the public key. The private key however is stored on the machine that generated the CSR (presumably the server requiring the cert, but not necessarily) and ...


2

The two most common problems I see with this are either permissions related or template version related. The user logged into the certsrv site needs to have both Read and Enroll permissions on the certificate template. If they don't, it won't show up in the list of available templates. Also when duplicating the template, you were likely asked what version ...


0

Usually, most of CA like Comodo cover both domain www and non www domain name and you need not to maintain two different SSL Certificate.


2

This now works, I requested a certificate from Certificate Manager and assigned to my US West (Oregon) Elastic Load Balancer. I added an EC2 instance to the ELB and had the ELB point to port 80 on the EC2 instance, not port 443 (this is some what faster I suppose). The ELB will then encrypt the connection between the user and the EC2 instance.


1

Personally I add the alt names at CSR generation, so I know that works (there's a little byplay in default conf files both for generation and signing). For changing afterwards, as far as I remember the Alt Names are extensions, and it seems you can override or add the extensions you want while doing the signing. I will shamelessly copy: From: Patrick ...



Top 50 recent answers are included