430 reputation
312
bio website 2130706433
location California
age 34
visits member for 4 years, 8 months
seen Apr 13 at 19:38
while(1)
{
    share(knowledge);
}

Apr
3
awarded  Revival
Mar
18
comment Can't get self-signed CA cert to request corresponding client cert; Apache
One other note. The fact that the openssl returned 3 acceptable CAs raises a red flag for me. (You might want to double-check that this isn't a security risk?)
Mar
18
comment Can't get self-signed CA cert to request corresponding client cert; Apache
Interesting; I just checked a cert I use for client SSL authentication, and its key usage field indeed matches this requirement. (It's using Digital Signature, Non Repudiation, Key Encipherment.)
Mar
9
comment Can't get self-signed CA cert to request corresponding client cert; Apache
Did you also create a server certificate from the same CA? In other words, does the output of openssl s_client -connect <yourserver.com>:443 -showcerts < /dev/null return a trust chain that is trusted by the same self-signed CA? Actually, it would be helpful if you post the full transcript from the openssl s_client command I mentioned.
Mar
9
comment Can't get self-signed CA cert to request corresponding client cert; Apache
Does the client trust your self-signed CA?
Nov
9
comment How do I configure OpenSwan to allow pure IPsec (not L2TP) connections from an iPhone?
This question, as written, is probably obsolete now. StrongSwan offers a WeakSwan option now which should allow this configuration. I haven't tested yet.
Sep
21
awarded  Student
Jun
12
comment Requiring client certificate issued by a specific intermediate CA in Apache
Never mind. Looks like you'd do it with SSLCACertificateFile set to PRODUCTION-CA. And in your case this might be fine because you have root_ca.crt (your own) specified in the configuration. I was worried about implicit trust from a public CA. I guess from a general security perspective it's better to trust less, so why not use the production CA and just exclude everything else?
Jun
12
awarded  Commentator
Jun
12
comment Requiring client certificate issued by a specific intermediate CA in Apache
Is this solution vulnerable to implicit trust attacks? (i.e. if someone manages to obtain a CA certificate you trust, with the name PRODUCTION-CA.) Can you check against a specific public key here, or maybe there is some other way to tell Apache "only trust certificates issued by this specific CA certificate"?
Apr
6
comment How to tell which local branch is tracking which remote branch in Git?
On git version 1.7.7.5 this is showing me the local branch and the sha-1 it points to, but it doesn't show the tracked remote branch...
Mar
22
awarded  Tumbleweed
Mar
15
comment HP Procurve Issue Passing Multiple VLANs over a link
Looks OK to me. At first I was confused about the untagged link to the ASA on VLAN 100. (Why is an ASA port wasted on a guest VLAN? I thought you meant the Cisco box was sending tagged traffic to the distribution switch.) I guess I'd check show cdp and show lldp inf rem but I'm not sure that will help much.
Mar
15
asked How do I configure OpenSwan to allow pure IPsec (not L2TP) connections from an iPhone?
Mar
15
comment iPhone VPN with OpenSwan fails to reconnect
What does your configuration look like? I've been trying for hours to get this to work.
Nov
12
comment Cisco 877 responds to IPv6 ping from internet, doesn't respond to internal clients
Also, have you tried turning off ipv6 cef to see if this is a bug with Cisco Express Forwarding? (perhaps ipv6 cef, at least in whatever version of software you're running, doesn't correctly identify IPv6 packets that need to be forwaded to software to be responded to by the host stack) Also, I found a reference that suggested that you need to also enable ipv6 cef at the interface level.
Nov
12
comment Cisco 877 responds to IPv6 ping from internet, doesn't respond to internal clients
Can you post the output of show ipv6 neighbors and show ipv6 route on the router? Can you verify that the neighbor cache on the hosts includes the correct MAC address for the router? Have you tried running Wireshark on the hosts to see what is happening? (i.e. are some packets received but ignored?)
Oct
8
awarded  Yearling
Sep
29
answered IEEE 802.1Q performance (VLAN tagging)
Sep
20
revised How to bind a non-local IPv6 address?
add comment about the all-zeroes address