Questions tagged [certificate]
Certificates are a Public Key and Identifying Information
1,370
questions
0
votes
0
answers
23
views
Bypassing CERT_HAS_EXPIRED leads to 401 Unauthorized
In our Next.js app, axios requests work in client components (using useEffect) but fail with a CERT_HAS_EXPIRED error from server components. As a workaround in development, we run ...
0
votes
0
answers
24
views
Windows 10 computer certificate deleted and not issued again after gpupdate /f
I deleted the local computer certificate from:
MMC>Certificate>ComputerAccount>Local Computer
To test if my network lab is working and the network authentication fallback on the MAB from the ...
0
votes
0
answers
24
views
Spire deployment on kubernetes and certificate retrieval
I am currently trying to deploy spire on my k8s cluster (3 worker nodes). My objective is to successfully deploy spire and use the certificates generated by the spire-server to encrypt the exchanges ...
0
votes
0
answers
56
views
curl: (60) SSL: unable to obtain common name from peer certificate
I'm trying to create self-signed certificates for my webserver but it's not going well. The title is the error message curl gives me when I run
curl --noproxy "*" https://example.com
(with ...
0
votes
2
answers
41
views
OpenVPN - Properly sharing keys/certificates
I enabled OpenVPN on the router at work so that we can connect to different devices like our NAS and RDP into the computers there without opening those ports to the internet.
One cause of concern that ...
1
vote
2
answers
87
views
Certificate chains on server and client
I have OpenSSL Certificate Authority, and I have generated Root certificate (self-signed), Intermediate certificate (signed by Root certificate), Server certificate (signed by Intermediate certificate)...
0
votes
2
answers
56
views
GPO Wireless Settings - Trusted Root CA
We pushed SSID configuration by GPO. Computer configuration > Policies > Security Settings > Wireless Network Policies.
In these settings we enabled certificate authentication, however the ...
0
votes
0
answers
30
views
How to add certificates to an existing PKCS#7 bundle (p7b) file?
I have a PKCS#7 bundle (p7b file) that holds many public S/MIME certificates, and I need two more certificates in the bundle.
Is there a way to add these certificates using openssl (or possibly ...
0
votes
1
answer
112
views
VPS https and redirect for domain
I recently bought a vps ( apache + ubuntu) and created ssl-certificates for my domain by using acme.sh --issue --dns -d example.com -d www.example.com and got them. But for my domain I want https to ...
0
votes
1
answer
325
views
Unauthorized error when trying to get a ssl certificate with certbot
I recently bought a domain, hosting and a Ubuntu 22.04 vps, all on godaddy.
The domain and hosting work, I can access the site by typing the url in.
But when I try to get a ssl certificate with ...
0
votes
1
answer
85
views
Windows hello for business: remove certificate from virtual smartcard
I've managed to add a certificate to windows hello for signin to RDP.
See: https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/rdp-sign-in?tabs=intune
However ...
0
votes
0
answers
33
views
FreeRadius EAP-TLS Auth using Email Address
We have a requirement to authenticate devices to WIFI using the user's email address stored in AD. The devices are enrolled into InTune and the only shared piece of information is the email address.
...
0
votes
1
answer
55
views
Path #2: Not trusted in SSLLabs domain check
First and foremost I want to apologize, because I am really an amateur in networking. I tried to run a SSLLabs check on a web domain my company owns. The overall rating is "A" and everything ...
0
votes
0
answers
28
views
ssh-certificate LDAP schema existence?
Hello.
I'm looking for an LDAP schema to make it possible to publish my ssh-certificates into user/host LDAP nodes.
Is there any common one?
0
votes
1
answer
194
views
How to assign certificate to IMAP/S and SMTP/S in Exchange 2016?
Please advise me because I pull all my hair out.
I have Exchange 2016 and I want to assign one officially signed-off certificate to the IMAP/S port 993/tcp and SMTP/S port 465/tcp .
I went through ...
0
votes
0
answers
84
views
StrongSwan IPSec VPN - IKEv2 - LetsEncrypt Certificate Issue (building CRED_PRIVATE_KEY - RSA failed, tried 10 builders)
I followed the link below for setup IKEv2 VPN Using Strongswan and Let's encrypt on CentOS 7.
How to Setup IKEv2 VPN Using Strongswan and Let's encrypt on CentOS 7
But info on that link has been ...
0
votes
1
answer
59
views
TLS Server Hello message has incorrect Certificate information
I am using a self-signed certificate for my forest created by Microsoft CA. All DC's are auto-enrolled and receive the correct certificate from the CA and LDAPS connections can be established using ...
0
votes
0
answers
348
views
Verify return code: 21 unable to verify the first certificate
I'm encountering an issue on my Ubuntu server when attempting to establish an email connection from the frontend application. The error message I receive reads: "Verify return code: 21 unable to ...
0
votes
2
answers
65
views
How do I list all existing open vpn certificates
I need to know how to view existing certificates in OpenVPN, the internal documentation passed me (written by a past employer) contains creating, removing, retrieving and revoking user, see below
/etc/...
0
votes
1
answer
308
views
Docker- Giving Container access to Host's CA certs
I was wondering security wise if there was anything wrong with volume mounting the host's ca certs into a container. I.e,
docker run \
-v /usr/local/share/ca-certificates:/usr/local/share/ca-...
0
votes
1
answer
186
views
How to modify the command line used to renew a certificate using WACS
I have been using Let's Encrypt certificates for some of my domains/servers for a while, using the win-acme client for Windows for the generation and renewal.
My problem is: every renewal I have to ...
0
votes
0
answers
37
views
Generating certificate with subjectUniqueID field
I would like to generate a certificate with the subjectUniqueID field as indicated in rfc5280( https://www.rfc-editor.org/rfc/rfc5280#section-4).I have tried this:
openssl req -config myConfigFile....
0
votes
1
answer
41
views
Single domain, two webservers running on different ports, two different SSL issuers possible?
Short, Can a domain have multiple SSL issuers installed on different servers ?
Long ,
I have a domain.
example.com
Its running on two different servers , two different websites, two different ports , ...
0
votes
1
answer
657
views
Use openssl 3 to create a self-signed certificate just like what "New-SelfSignedCertificate" can
First of all, I did googling about openssl, such as this one, and also tried dozens of time on creating a valid self-signed certificate.
But I guess asking on serverfault would be much quicker.
My ...
0
votes
0
answers
215
views
Issuing Certificate For Child Domain After Issuing One From Parent From Same CA
I am trying it issue a certificate as part of my Enrollment ability for a 2FA device for our child domain from our parent domain. I was able to do this months ago but now it won't let me do the child ...
0
votes
1
answer
394
views
AH02565: Certificate and private key from <cert> and <private key> do not match
I'm trying to update some expired SSL certificates internally on some Ubuntu and Redhat servers. I have an internal certificate authority for this (ADCS). These are the steps I'm taking:
Generate CSR ...
1
vote
2
answers
457
views
Local Machine certificate (certlm.msc) - choosing "Microsoft Software Key Storage Provider" on import
When importing a device certificate/private key through CERTLM, the GUI seems to choose a deprecated Cryptography Service Provider (CSP) called "Microsoft Strong Cryptographic Provider"; I'm ...
1
vote
1
answer
384
views
Error: The issuer of this certificate could not be found for AD issued Code Signing Certificate
Problem
I've created a certificate through AD certificate services, but it has the error "The issuer of this certificate could not be found." despite the full chain being present in the PFX.
...
0
votes
1
answer
222
views
Why is certificate request invalid from Exchange 2019?
I am creating a cert request in powershell on an exchange 2019 server as follows:
$binrequest = New-ExchangeCertificate -Server "exchange" -BinaryEncoded -GenerateRequest -FriendlyName "...
1
vote
1
answer
122
views
openssl ignores intermediate certificate in pkcs12 file
After creating a new S/MIME certificate, I am stuck with creating a valid PKCS #12 file that is accepted by most mail clients:
$ openssl verify smime.pfx
CN = [email protected], emailAddress = mail@...
0
votes
1
answer
858
views
How to extract CA Certificate from .pfx file and add it to a trust store file
I have a .pfx file that has multiple certificates, one of them is the signing CA certificate of a server certificate assigned to the IBM i Remote Command Server in DCM.
I managed to use openssl and ...
1
vote
0
answers
196
views
Windows CA Publishing Expired Certs in CRL When not configured to do so
I have a Windows ADDS CA that for some reason is publishing revoked but expired certificates in the CRL and I can't for the life of me figure out why. Here is my configuration:
Server 2012 R2
...
0
votes
1
answer
123
views
Microsoft Certificate Authority Machine Template - add single label host name to SAN
I would like to create a machine certificate template on a Microsoft Certificate Authority that includes the single label Active Directory (AD) Computer Names in the SAN.
I have tens of thousands of ...
1
vote
1
answer
242
views
FreeIPA subject name encoding mismatch when renewing certificate
When reading this question and answer, it seems this should be possible but I need a little more help understanding the answer.
Is there a way to change the string format for an existing CSR "...
1
vote
1
answer
366
views
Bluehost - wrong certificate presented by host for API call to Twilio
Bluehost VPS running CentOS, but cat /etc/redhat-release reveals CloudLinux release 6.10 (Final).
Executing curl commands against Twilio APIs on my local PC (Win11/IIS/PHP) works fine. When I attempt ...
0
votes
0
answers
82
views
Windows Remote Desktop Certificate is re-created after deleting from the Remote Desktop store
I'm running a WS2019 in Hyper-V.
After deleting a certificate in the Remote Desktop Store and it returns after deleting it.
I changed Certificate Auto enrollment settings but it does not help, the ...
0
votes
0
answers
445
views
Why do I get ECONNREFUSED|ECONNREFUSED for an openvpn server, after doing easyrsa gen-crl?
My OpenVPN server has been working perfectly fine on an Arch Linux install. I've done regular pacman -Syu updates over the past year, every now and then I've had to run:
easyrsa gen-crl
When the ...
0
votes
1
answer
39
views
Certificate management: which party should request certificates?
My question is concerned with proper certificate management.
Different parties provide domain / server / application services to our organisation.
One party manages our DNS (and more).
Another party ...
0
votes
0
answers
325
views
Unblock virtual smart card
I've setup a virtual smart card by following this guide. It worked fine until someone locked out the virtual smart card and now it's blocked.
When I try to use it with the correct code to sign in to ...
1
vote
3
answers
1k
views
Unable to RDP, Error: SSL certificate is revoked
Problem
Unable to RDP to server due to the certificate is revoked.
However, when checking certificate, it is not expired. (Today is Oct 5, the Cert expires in November.)
My attempts to fix
Login to ...
0
votes
1
answer
438
views
Attributes Windows CA templates
Windows Enterprise CA.
I have been requested that in the certificates appear the following attributes: OU, C (country) and O (organization).
I have seen that in the certificate template in the "...
1
vote
3
answers
153
views
Postfix - Cannot run - update-ca-certificates -fresh
I just face an extensive Email service disruption at my work. During the incident, we had some postfix giving some errors concerning:
Fatal: connect #n to subsystem private/rewrite: Connection refused....
0
votes
1
answer
44
views
Should I create a new forest for the DMZ
I have a local area network with a DC called "mycompanyptyltd.local" and a DMZ that is not in the AD DC forest.
I own the domain "mycompany.com" and I receive and send email from ...
1
vote
0
answers
511
views
How to convert a DER private key to PEM
I have a private key that is in binary format. I'm not sure if this is DER format but I need to convert it to PEM.
I'm using openssl with this command:
openssl rsa -inform DER -outform PEM -in test....
0
votes
0
answers
43
views
Request Certificate CA
I have a Windows server configured as a Certificate Authority (CA).
When requesting a certificate via https://server/certServ and choosing the template to request (Request Certificate->Advance ...
0
votes
0
answers
64
views
Export pfx certificate after approving pending request
In Active Directory Certificate Authority I have template with CA certificate manager approval.
CA picture
When I approve a request I can not export issued certificates to pfx format. How can I export ...
0
votes
1
answer
226
views
self signed certificate for a site that can only be access through VPN
I read a lot of articles about self signed certificates and I'm not exactly sure if I'm getting near to what I want to actually achieve.
I'm trying to implement a self signed certificate so that the ...
0
votes
1
answer
3k
views
How to force Domain Controller to get new certificate from PKI Server
I bluntly created a PKI Server (AD CS) that sits inside the Domain.
My Domain Controllers got a DomainController Certificate from it.
After that I thought that it would be better, to create a Root CA ...
0
votes
1
answer
408
views
How can I add alternate subject names when creating a CSR using xca?
openSUSE and SLES dropped their old CA management, now recommending to use xca.
While it was easy to add alternate subject names like hostname aliases or IP addresses in the old CA management, I could ...
0
votes
1
answer
115
views
CA: Certificate User for VPN
From a subordinate Enterprise CA I want to generate a user certificate that serves as an authentication method for VPN connections.
I want to install this certificate with autoenroll on the domain ...