Tag Info

New answers tagged

0

After a lot of searching I found that I just had to update the cloud server's load balancer - in the settings on their intranet site I had to paste in the certificate, private key and intermediate certificate. Now chrome gives me the all clear. I assume that without the load balancer I would have to set up the conf files on the server myself. There was no ...


1

I am working through the same process, Exchange 2010 with Outlook 2013 clients and having just registered a mail.domain.com certificate. Our server isn't server.local though, it is server.domain.com, but I don't want to have to add that server name to the listed hostnames in the certificate, and also want to do it correctly. ...


0

This can be done and it turns out it's not that difficult. You need to: Makes sure rd.company.com points at the IP address of rd.ad.company.com on the RDG server. You can either add a new DNS zone for rd.company.com and add an empty A record pointing to the correct IP, or add an entry in the hosts file on the RDG. You could add the internal IP to your ...


1

I happen to be running an OpenVPN server in TCP mode, and I can confirm that you cannot use openssl s_client to get the certificate: [me@risby 17]$ openssl s_client -connect openvpn.example.com:1194 CONNECTED(00000003) 140413456672632:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184: --- no peer certificate available --- No client ...


1

Wildcard certificates work for only one level of domains, that is, the most specific domain level. So, you need to get another certificate for *.ad.company.com.


1

First part: SSLCertificateFile /etc/apache2/ssl/11-2013/09********ss.crt This is the public certificate for your website. This is the one you would rekey to change the SHA1 to SHA2. SSLCertificateKeyFile /etc/apache2/ssl/11-2013/server.key This is private certificate for your web server. SSLCertificateChainFile /etc/apache2/ssl/11-2013/gd_bundle.crt ...


1

ssl_certificate_key should contain what's presently in server.key, ie they server's unencrypted private key. ssl_certificate should contain the server's certificate and the certificate chain, as explained in the documentation, in that order. So, that's basically the output of cat 09********ss.crt gd_bundle.crt A handy online tool to quickly check out what ...


0

It is my understanding that neither 2012 R2 nor Server 2016 support dual certificates. You can only assign a single certificate to a binding. Set up a second binding and point your legacy devices to it.


1

First of all you need to make sure the SSL mod is enabled a2enmod ssl then you need to change your config to something like this: <VirtualHost *:443> SSLEngine On SSLCertificateFile /etc/ssl/localcerts/www.test-site.com.crt SSLCertificateKeyFile /etc/ssl/localcerts/www.test-site.com.key SSLCertificateChainFile ...


0

You need to provide a SSLCertificateFile configuration line in addition to the SSLCertificateKeyFile configuration file. You have configured one of two options for CA certificates. You may not need either. This may be configured with the file that should be the SSLCertificateFile GoDaddy provides documentation on installing your certificates. According ...


1

I ran this command to generate a key from a PEM file: openssl rsa -in privkey.pem -outform PEM -out myserver.key It prompted me for the key again, but I guessed it. I put this key in the the nginx/conf directory and everything worked.


0

If you renewed the previous certificate, the old .key file you used in nginx should work with the new certificate file. Also, if you are not sure how the certificates should be concatenated, you might be able to replace the first certificate in your previous .crt file with the one in MY.SERVER.COM.crt file. This might not be possible though if the ...


0

I was also facing similar sort of ssl certificate verification error. Setting verify-certificate to 'no' worked for me. Example: lftp -c 'set ftps:initial-prot ""; set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate no; open -u Usename,Password 208.82.204.46; put uploadfilename;'


0

Here is what I did to fix the issue. Purchased the external domain certificate and installed that as per instructions here https://www.digicert.com/csr-creation-microsoft-exchange-2013.htm Installed as per here https://www.digicert.com/ssl-certificate-installation-microsoft-exchange-2013.htm Resolved the certificate issue by following this post http:// ...


2

You need to combine domain certificate & bundle certificate into one file and reference that as ssl_certificate like : $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt refer http://nginx.org/en/docs/http/configuring_https_servers.html#chains


1

Nginx wants any chain cert(s) in the ssl_certificate file after the server cert. See http://nginx.org/en/docs/http/configuring_https_servers.html#chains . Link conveniently found on related question Can't get Nginx to serve correct certificate chain although in that question the actual problem turned out to be different.


0

Chances are Microsoft ARR is using CAPI to store its certificates, but there are no guarantee that ARR will use it even if you make the certificate available to it. Client side authentication requires extra code, and your requirements are not that common. It could have been overlooked and left behind... To make your client certificate available to a ...


4

From a purely technical perspective, there is usually no issue with using the same certificate on multiple machines. Ensure you have the private key so you can import the certificate properly on each host. From a functionality standpoint: If the cert is only for example.com then it won't work properly for serverlet.example.com as the hostname won't match ...


0

Perhaps the issuing certificate authority's certificate is going to expire in 10 days. A CA cannot issue a certificate whose validity exceeds its own.


0

In your certificate request, you must add "Subject Alternate Names" (SAN). Your certificate CN will still be site.com, but the SAN will have the other names your website is reachable with, such as: site.com www.site.com anything-other-as-long-as-it-works.example.com You'll notice that the I've added the CN in the list of CN and that hosts name need not ...


1

I would not change the server name, since that would mean that all your search engine results would need updating, and that will take time. When purchasing server certificates, the standard way is to send the .csr with www. prefix. The certificate provider will then issue a certificate both with and without the prefix.


0

Go to the WebLogic admin console -> Environment -> Servers -> your server -> Configuration -> SSL Open the "Advanced" flap Change "Hostname Verification" from "BEA Hostname Verifier" to "None" Click "Save" Restart your server.


1

It is not IIS fault. Looks like you downloaded wrong intermediate CA certificate or incorrectly merged certificates with OpenSSL. IIS internally builds certificate chain and uses these certificates (except root certificate, which is not transmitted during SSL handshake) to send to client. Even if the certificate is not presented in the store, IIS can use ...


0

While I can't comment specifically on StartCom I have had similar issues in the past from vendors changing from SHA 1 to SHA 2, usually issues with cross signing certificates. What I've found to be the best route to go is find all the intermediate and root certificates returned by your server at the current time and delete the intermediate and root ...


0

After investigating apache and nginx, I settled on haproxy-1.5. Version 1.5 has integrated https support of exactly the kind I need. After the proper haproxy.cfg has been written to specify the load balancer nodes, all I need to do after that is turn my exported PFX cert files to PEM files using openssl, and dump them in a folder. My catchall binding will ...


0

This is a common issue when you use a self-signed certificate together with the CAS role. You want to install a certificate that is not a self-signed certificate, from a CA in your organization, or by purchasing a third-party certificate. Alternatively, if you want to use that certificate, and you're in an AD domain, you can use a GPO to distribute the ...


1

In IIS 10 you can have: Name Bindings ---- -------- Default Web Site https *:443:*.bar.com sslFlags=3 https *:443:*.bar.net sslFlags=3 https *:443:*.foo.edu sslFlags=3 and use the CCS for all bindings, but you can't do: https *:443:*.*.com sslFlags=3 or https *:443:*.com ...


0

I found the solution here: http://www.techpository.com/?page_id=1364 You need to edit the template to use the request supplied subject name instead of building it from AD. Here are the relevant steps that i followed: Click start->run, then key in command mmc Click File in the mmc console, then select Add/Remove Snap-in… Click Add… buton in ...


0

You are talking about two different concepts here: SNI, the ability to use TLS (SSL is dead) based on a hostname, so you don't need a separate IP address for each TLS site. The central certificate store, which just changes the way IIS is storing the certificates and makes it easier for you to deploy them. To use the CCS you need to define the hostname in ...


0

This might require some web server reconfiguration. But you can configure your https virtual hosts to use different local private ip addresses and have a reverse proxy ssl server like Nginx to handle all incoming https connections. This is how I overcame this exact limitation. https://www.rubysecurity.org/nginx_reverse_ssl-proxy


-1

Yes, you need a dedicated IP address if you want your users to browse your site using any browser on any OS. If you use something which is called SNI (Server Name Indication) then you don't need a dedicated IP address for each SSL certificate, but not all browsers support SNI. It's the same thing CloudFlare is providing with free SSL certificates for their ...


11

If you can safely limit the supported clients of your service to systems supporting Server Name Indication, having only one IP address should be sufficient. See this article for a list of supported clients.


4

If you need more then one domain covered by SSL, you need to buy a wildcard SSL certificate. This covers a domain name and all sub-domains. Remember to create your SSL cert for *.example.com: otherwise you only sign your normal domain. If you have two different domains you need SSL for each domain. Or if you have only one subdomain, sometimes two normal ...


15

No, that won't work. In order to sign certificates you need your own certificate authority certificate. The certificates you purchase are signed by a certificate authority, but specifically marked as not being a certificate authority certificate. Check the "Certificate Basic Constraints" in your certificate, and you will see that it "Is not a Certification ...


0

This is possible depending on both the Apache version and the OpenSSL version. Running ECC & RSA certificates in parallel on Apache using different intermediate certificates requires Apache 2.4.8+ and OpenSSL 1.0.2+. The sslcertificatefile entry added support for intermediates as of Apache 2.4.8. OpenSSL adds the ability to load intermediates on a ...


1

There are a few updates that add SHA-256 support in Windows Server 2003. The one you need is KB2868626; when installed this update will enable you to install SHA-256 SSL certificates on Server 2003 SP2. You may want to install the ones below as well so you can connect to your own site. KB938397 adds SHA-256 support to Server 2003 (SP1 or SP2). This update ...


4

Assuming that the example you're pointing to is actually the one about "The site is using outdated security settings", and not "does not have public audit records", about 99.99% sure that your problem isn't CT, for several reasons: It is my understanding that only CA certificates in the system trust store are subject to CT validation; locally-managed CA ...


0

Right, Well I scripted it then. I still believe that there is an easier way with certreq and powershell but here is the bash script. Requirements: Cygwin, standard UNIX utilities, clip, openssl #!/bin/bash iexplore='/cygdrive/c/Program\ Files\ \(x86\)/Internet\ Explorer/iexplore.exe'; printf "\033c"; echo -e "This function automates IIS7 certificate ...


0

Yes, a UCC certificate is a good fit here. You have a single Drupal multi-site installation serving two sites, which are somewhat related to each other. The UCC certificate will allow you to: Use a single Apache web server configuration for both sites. Use a single IP address for both sites without requiring SNI. (But you still can waste extra IP ...


0

Assuming these two websites have their own domain names, and they are all in the commercial usage. Thus, you want to encrypt the data for your customers. Situation one, the minimum cost is my world! Go get DC SSL * 2 for your websites, some vendors provide cheap SSL for as low as $5/year. Situation two, brand reputation is my heart! Go get EV SSL * 2, a ...


0

Turns out the first non-UCC certificate was under the same CommonName as the UCC certificate. Simply using the UCC certificate on all the VirtualHosts sovled the issue.


0

The problem is that IE8 and older on Windows XP does not support SNI. If you need to support users on Win XP/IE 8, each site needs its own dedicated IP address and corresponding SSL certificate.


2

A quick visit to ssllabs.com shows that your server is failing to send an intermediate certificate "RapidSSL SHA256 CA - G3". Add this intermediate certificate to your Elastic Load Balancer.



Top 50 recent answers are included