Tag Info

New answers tagged

0

Browsers wont show all the details you have entered at the time of creating CSR. It will show limited details like Common domain name, certificate authority etc. In order to get complete details, you will need either CSR key or Certificate. If you have CSR key, you can enter the CSR key at following URL and get complete details: ...


1

TL;DR: PCI-DSS 3.1 is effective immediately, but the requirement to disable TLS 1.0 and SSL 3 takes effect after 30 June 2016. In most cases you should have already disabled SSL 3 months ago, or more, for the POODLE vulnerability. So that isn't a concern. The interesting part of this requirement is not being able to use TLS 1.0. The official word is: ...


1

Caveat: I never had to go through PCI certification. This is based on my research on this topic for your question. It looks like the primary difference between PCI3.0 and PCI3.1 is that 3.1 requires TLS1.1 or higher. Can't use SSL3 or TLS1.0. See http://www.infosecurity-magazine.com/news/pci-dss-31-forces-move-from-ssl-to/ Although, in some places they even ...


1

1) Remember - Apache uses either httpd.conf or ssl.conf depending on how Apache was configured - since ssl.conf is preferred make sure the "failing" server is NOT using ssl.conf instead. 2) Have you tried copying the httpd.conf file from the working server to the "failing" server. If everything else is the same, that should make SSL work, if it doesn't ...


0

If you define only one vhost for your port, it will be treated by apache as a default vhost and served to any client that connects to it. What you therefore need is to add another vhost, indicate it should be treated as the default one, and set it up so that it will 404 clients. You should use the same certificate as the one for example.com, because it will ...


0

Updating the Crypt32.dll solved for me.


1

CAPolicy.inf is used to specify settings that affect CA certificate itself and cannot be configured elsewhere (nor by certutil or MMC GUI). This includes (but not limits to) CA certificate renewal validity, key length, alternate signature algorithm, certificate extension configuration. This file is processed only during CA server installation and CA ...


3

It appears that the web server at https://facts.dohrn.com/ does not include the intermediate certificate. This would appear to be a configuration mistake on their part. It is definitely something that can be expected to cause compatibility issues as you are really only supposed to rely on clients having the root certificates in place beforehand. See the ...


0

In the Ironport web administration page, under Network/Certificates, you can define the various certificates you wish to use for SMTPS and HTTPS. When defining a new certificate, you can upload the (last step) PKCS#12 certificate. After this, you can edit the existing certificate via the same page. At the bottom of the page is a collapsed section ...


0

I am having similar experiences with my website and i initially thought it was the certificate but the certificate's algorithm is in SHA-2. I finally discovered that the problem wasn't from Chrome but my avast mail shield blocking the certificate.


3

HIGH, LOW, EXPORT etc are kind of macros which include a range of ciphers. To get the actual ciphers use openssl ciphers command, i.e. $ openssl ciphers -V 'HIGH:!aNULL:!MD5' 0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD 0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA ...


0

Here is the answer that I found to my own question... I needed to use netsh with the following syntax:- netsh http add sslcert hostnameport=www.shifts.org.uk:443 certstorename=MY certhash=<put your hash here> appid={<put your app ID here>} The key part that I was missing previously was the parameter called "hostnameport" above. I hope this ...


0

Use Set-SBCertificate command. Example: Set-SBCertificate ` -EncryptionCertificateThumbprint ‎<thumbprint> ` -FarmCertificateThumbprint ‎<thumbprint> ` -SBFarmDBConnectionString "Server=sqlserver;Trusted_Connection=true;Database=SbManagement;Connect Timeout=300" Also take a look at these blogposts: ...


1

After some investigation, I've come across this: https://code.google.com/p/chromium/issues/detail?id=401365, which suggests chrome will throw this warning if any certificate in the chain is using SHA1 and has a validity longer than 01/01/2016. Lo and behold: [edit] Apparently this only affects people who have this certificate stored. [edit2] This: ...


0

Check the Exchange Certificate common name - it must match the exchange server name. Even if the Exchange server name is listed in the SAN (subject alternative names) windows XP will prompt for credentials. So you can make sure that when you create the certificate that the Exchange name is the common name or run the following command: Set-OutlookProvider ...


0

the FQDN that your client uses to access your service has to be same as what your certificate contains. Doesn't matter what your real internal host name is.


2

At some level, a self-signed certificate will always appear in a certificate chain - most notably the case with CA certs, which are by definition self-signed, but are trusted. You are seeing that message because the StartSSL CA cert is self-signed. Your chain file is also wrong - you don't need the client certificates. The file should be in the following ...


2

If you're renewing this certificate with a public CA, your request will either be rejected, or the SAN entry with the .local DNS name will be stripped. From the CA/Browser forums Baseline Requirements (7.1.4.2): [...] Also as of the Effective Date, the CA SHALL NOT issue a certificate with an Expiry Date later than 1 November 2015 with a ...


1

The certificate used by an Exchange server must include all names with which the server can possibly be called; if your server is configured to use different URLs for internal and external web services, and if the internal URLs use the "corp.local" suffix (which I'm assuming is the DNS name for your Active Directory domain), then yes, your Exchange ...


0

Thanks guys. With inetmgr I cannot issue a domain certificate of validity of 20 years even if I've duplicate my Web Server template changing it's expiration time. With the certsrv WebServe I'm able to create a certificate using the duplicated template but this certificate doesn't have a private key so that I cannot convert it ina pfx (p12) cert and using it ...


0

At the time I'm writing this (20150518) thawte is not the provider anyone should be using. I just got this about my wild card cert which we bought only a multi year deal, so we have little choice. Thanks for the e-mail, it seems that you are referring to our root certificate as SHA1. We currently do not offer SHA1 root CA yet, the reason is to ensure ...


0

This "subjectAltName" should not be in this section: attributes = req_attributes. But in a section for req_extensions = (call it whatever you want). And no need for all the BS like subjectAltName = Alternative subject names subjectAltName_default = DNS:www.g00gle.com Just type in what you want, how many you want: subjectAltName = ...


0

You must select Wildcard SSL certificate based on your security needs. Before Purchasing Wildcard SSL Certificate you must aware about a few factors mentioned below Brand's Reputation & Trust Level: As per recent survey of W3Techs on SSL certificate authorities, Comodo overtook Symantec and become most trusted CA with 35.4% market share. Types ...


-1

If environment is completely offline then there is no need of certificate as you won't be able to see any error without internet connection. However, if you need one then would advise go with self-signed certificate for testing purpose as it would cost you zero bucks. But using self-signed certificate for testing purpose then it would not assure you that ...


6

If the clients are truly offline, then a commercial cert won't work properly anyway, because the clients will fail when they try to look up the CRL for the cert issuer's CA. SO no, if the entire environment has no internet connection, than a commercial cert will do you no good. Using manual certificate distribution or an internal CA would be better.


0

Remove the live mail account. Then install the certificate in the trusted root authorities. Finally add again the account. For some reason if you install the certificate after adding he account it will not work.


0

When you export your SSL certificates to a pfx file, name the certificate the same thing that will be used as the host header value for your SSL binding. This designation is how the correct certificate is located and loaded for a site since you no longer bind a specific SSL certificate to a site when using this configuration. From here: ...


0

If your user base and their computers are not managed by you, then that is a classic case where you should purchase an SSL certificate from a 3rd party rather than use self-signed certs. Wildcard certs are readily available from many 3rd party CAs and they are not very expensive. I assume you own the example.com domain.


2

strongline is right, I think. You should launch the certificate templates MMC snapin on your CA server and make a copy of the certificate template that you are using. Then, modify the copy to use the desired settings, such as the cert lifetime.


1

You cannot issue certs whose expiry date is longer than what its template defines. You need to change your certificate template.


2

Given that you're using this in your apache config: SSLCertificateFile /etc/apache2/cert/ssl.crt SSLCertificateKeyFile /etc/apache2/cert/ssl.key The /etc/apache2/cert/ssl.crt file should contain certificate of e.g. yourdomain.com certificate of first intermediate CA, signed by root CA (e.g.StartCom Class 1 Primary Intermediate Server CA) certificate ...


4

A UCC cert is more of a marketing term than a technically different type of certificate. A UCC cert is really just a regular X509 certificate with a bunch of SANs (subject alternative names) on it. As such, you can easily mimic the functionality of such a cert with your own internal certification authority. If you own the CA, you can have it issue ...


0

I don't know about appcmd, I consider that a legacy tool which I don't recommend using anymore. In PowerShell you indicate SNI with the SSlFlags parameter, 0 is no SNI, 1 sets SNI. New-WebBinding -Name site1.local -Port 443 -Protocol https -SslFlags 0 New-WebBinding -Name site2.local -Port 443 -Hostheader site2.local -Protocol https -SslFlags 1 To assign ...


3

Wikipedia explains it pretty well in Certificates and web site security. There are three kinds of validations for X.509 certificates for websites. Domain Validation (DV) The cheapest and simplest validation. It is only checked if you have access to the domain and the infrastructure behind it. Organization Validation (OV) The issuer also checks the ...


0

In my case I had not enabled the site 'default-ssl'. Only '000-default' was listed in the /etc/apache2/sites-enabled folder. Enable SSL site on Ubuntu 14 LTS, Apache 2.4.7: a2ensite default-ssl service apache2 reload


0

In my case I had not enabled the site 'default-ssl'. Only '000-default' was listed in the /etc/apache2/sites-enabled folder. Enable SSL site on Ubuntu 14 LTS, Apache 2.4.7: a2ensite default-ssl service apache2 reload


2

The first server configuration is a redirect to HTTPS (second configuration). In the second server configuration SPDY module is not built by default, it should be enabled with the --with-http_spdy_module configuration parameter. Note that in order to accept both HTTPS and SPDY connections simultaneously on the same port, OpenSSL library used should support ...


2

It is pretty decent for it's age. A site I have found good and informative in regards to web server security is Cipherli.st which gives modern configurations for very secure configurations (incompatible with older clients) and also a set of legacy options so you can support older browsers (IE < 9, Android < 2.2 or Java < 6). When you want to test ...


-1

The files /etc/pki/tls/certs/localhost.crt and /etc/pki/tls/private/localhost.key are created by the postinstall script of the mod_ssl package. You can find the spec file here: https://git.centos.org/blob/rpms!!httpd.git/6f7de23710cf2fb30178692d962a51a8252842f6/SPECS!httpd.spec. Here is the script from CentOS 7: postinstall scriptlet (using /bin/sh): umask ...


2

I figured it out! The problem was my openssl.cnf. The old certificate was created with string_mask = utf8only. This line was missing from my current file, resulting in a default value of PrintableString, T61String, BMPString. I did not use any non-ASCII characters, but it seems it was still enough to irritate Firefox.


1

I deleted the old certificate from my PC and installed the new one. Firefox uses its own separate certificate store. At the risk of stating the obvious (for those of us who regularly use Firefox), did you add the new CA certificate to Firefox itself?



Top 50 recent answers are included