Questions tagged [ssl-certificate]
SSL certificates are used to encrypt and authenticate connections to network servers, most popularly for web servers but also email, file transfers, and other network connections.
3,338
questions
0
votes
1
answer
73
views
Windows nginx as proxy passing to https://localhost - Certificate issues
we are having the following setup and i am struggling with certificates and how all works together.
I am running a web application on a windows machine that is served (only) over https://localhost:...
- 101
-1
votes
1
answer
25
views
Getting NET::ERR_CERT_AUTHORITY_INVALID but only in Chrome, only on phone
I've built a website and have used certbot to create SSL certs.
The page loads fine on every system I've tried it, except in Chrome on my phone.
In Chrome, on the phone (Android), I get NET::...
- 109
0
votes
1
answer
23
views
Use nameConstraints to exclude all names but a few in OpenSSL
I want to use the x.509v3 certificate name constraint extension to exclude all names, except for one or a few of them, using OpenSSL's openssl.cnf file.
The directive is
nameConstraints = critical, ...
- 1
0
votes
1
answer
110
views
Ubuntu 24 certificate error "unknown issuer" using Firefox
My company has implemented an upstream device that does decryption and this requires all boxes to have the root CA certificate installed.
I copied the ca certificate in pem format and did the below. ...
- 103
0
votes
0
answers
15
views
How would you begin to troubleshoot a ERR_BAD_SSL_CLIENT_AUTH_CERT error? [closed]
I'm trying to surface information like:
What certificates did the browser look at?
Did they connect to a trusted CA?
0
votes
1
answer
82
views
SSL certificate for local network
For a winforms application that is ONLY used in the local network, we want to access some functions from the mobile phone (also connected locally).
In this case, a React+ .NET Core application hosted ...
- 153
0
votes
1
answer
87
views
Kubeadm showing errors about reading configuration from the cluster and missing etcd certificates
I have 3 master-worker nodes in the cluster. on one of them kubeadm is showing errors when checking for expired certificates:
# kubeadm certs check-expiration
[check-expiration] Reading configuration ...
0
votes
0
answers
96
views
Establishing an IPsec IKEv2 VPN connection fails with "IKE failed to find valid machine certificate." on Windows 11
I'm trying to setup a remote access VPN server with IPSec/IKEv2 for a medium sized company. Users are expected to be connecting to this server (a FortiGate firewall) using the native Windows client ...
0
votes
0
answers
40
views
local ACME with DNS challenge unbound
I would like to run nginx, traefik, or whatever is needed to do a DNS challenge over ACME.
If possible, without an additional app like Certbot. But even with certbot, as far as I can see, unbound ...
1
vote
0
answers
36
views
Ansible Automation Platform not Syncing with Gitlab project
AAP 2.4 Project not syncing GitLab using PAT and my error is
SSL certificate problem: self signed certificate in certificate chain.
I really don’t want to disable https and not sure if I download the ...
- 21
0
votes
0
answers
23
views
Any downsides in changing PEM-formatted certificate's .pem extension to .cer?
I have a .pem file that contains only (one) certificate – no private key. To signal this fact, (I think) it'd be better to change the extension from .pem to .cer (or .crt). Are there any downsides?
...
- 101
0
votes
1
answer
38
views
Redirection www to non-www on Nginx gives me 400 bad request
I'm trying to redirect all www to non-www domain address. I have installed my LetsEncrypt SSL for non-www domain. non-www domains are working fine. I have configured www to non-www redirection on my ...
- 11
0
votes
2
answers
163
views
Kubernetes kube-apiserver can't boot up after kubeadm certs renew, OIDC connection refused
In a Kubernetes 1.25 with 2 Ubuntu controllers cluster, after detecting the expiration of certificates inside /etc/kubernetes/pki we launched 'kubeadm renew all' command on both the controller nodes, ...
- 103
3
votes
2
answers
727
views
Is it a good practice to share a certificate between two applications
I have a mail server and a postfixadmin application sharing the same certificate for https and postfix TLS encryption.
Is it a good practice?
Thanks in advance for your Help.
- 29
1
vote
1
answer
123
views
PKI architecture "redundancy": Online root & 1 Sub CA?
My company prefers minimalism and "KISS" over best practice. I've read the documentation, and know that "offline root CAs" are best practice. A need has arisen to add redundancy to ...
- 11
0
votes
0
answers
14
views
Rsyslog Client hello message showing Too many ciphers when used tls connection?
I have configured rsyslog over tls , My client hello message sending too many ciphers :
Tried using debian machines and Redhat 8 Machines both resulted in same way.
rsyslog version : 8.2404
gnutls - 3....
0
votes
1
answer
91
views
Openssl cannot verify CA cert and then it can verify it all in the same operation?
Open ssl debug reports first that it cannot verify the CA cert, and then that it can verify it during the course of just one command, why?
openssl s_client -connect 3d.example.com:443 -debug
depth=0 ...
- 340
0
votes
0
answers
19
views
Are wildcard ssl certs insecure for multi-level domains? [duplicate]
I have an SSL cert that has a CN set for *.mydomain.com. This seems to be fine for my 1st level subdomains, e.g. forum.mydomain.com and www.mydomain.com. However, on 2nd level subdomains (e.g. www....
- 129
0
votes
1
answer
48
views
ejabberd not using the certificates listed on config file
I installed ejabberd on my Ubuntu 20.04.6 LTS with Cyberpanel, I configured it to use the Let's Encrypt certificates from Cyberpanel, I fixed permissions and now it doesn't complain about the ...
0
votes
0
answers
27
views
Issue with SSL for Confluence Java back-end REST API
I have problems to get uploaded files to work with Confluence API's REST Client on Java EE back-end for OpenAI Speech-to-Text feature that needs correct configuration in SSL and not only https on Web-...
- 123
0
votes
0
answers
32
views
Https over CludflareD Tunnel with custom Comodo SSL Certificate?
I have read many similar topics but none of them helped me.
How do I configure Https through CludflareD Tunnel with my custom Comodo SSL Certificate.
I have been working fine with Universal SSL for a ...
- 123
0
votes
0
answers
33
views
Apache 2.4 shows default SSL certificate instead of requested domain
I am running 5 domains on my Apache server using Vhosts. The first domain on the httpd-vhosts.conf and httpd-ssl.conf work fine. If I go to one of the other domains, it will try to use the default ...
- 1
0
votes
0
answers
102
views
Windows Server 2019 Enterprise CA Certificate Request Error
I'm setting up a Windows Server 2019 Enterprise CA for my lab.
I am setting up a Windows CA server so I can lab various things on my Palo Alto firewall that rely on certificate services.
I am not very ...
- 1
0
votes
1
answer
96
views
Nginx ssl_verify_client on does not deny requests sent with no client cert
With ssl_verify_client on in my nginx, I would expect that requests that have no client cert are denied. But they are allowed.
eg use a web browser to GET /foo/bar, response is 200 OK. I would expect ...
- 340
0
votes
1
answer
86
views
let's encrypt certificate permission issue with postgres
I'm using certbot, on Ubuntu 22, to generare ssl certificate. All works fine but all certificate is generated in the following folder
/etc/letsencrypt/live/domain/cert.pem
The problem is that user and ...
- 103
2
votes
0
answers
204
views
Google Cloud Load Balancing: cannot select Google-managed SSL certificate
I'm planning the migration of our managed HAProxy instance to a GCP Global external Application Load Balancer. As we need to switch production traffic, we must have everything set up before switching ...
google-cloud-platform
1
vote
2
answers
396
views
Renew FreeIPA certs when existing cert already expired
I have FreeIPA on Rocky 8. I installed custom certs from LetsEncrypt using the command
ipa-cacert-manage -p DM_PASSWORD -n NICKNAME -t C,, install ca.crt
ipa-certupdate
ipa-server-certinstall -w -d /...
- 623
1
vote
0
answers
268
views
wget / openssl : Unable to locally verify the issuer's authority
I have wildcard certificate (*.example.com) from DigiCert
Have following files in the zip file from DigiCert portal
DigiCert Global Root G2.pem
DigiCertCA.crt
star_example_com.crt
TrustedRoot.crt
I ...
- 101
0
votes
2
answers
196
views
Why my website works when I disabled SNI from IIS?
In my company, we have Windows Server 2022. For each website, we use Let's Encrypt certificates. This showed an alert that said: "No default SSL site has been created. To support browsers without ...
1
vote
1
answer
847
views
Certbot failing on nginx reverse proxy: 404
I am trying to setup a Mastodon instance on Ubuntu 22.04. I have setup Nginx as a reverse proxy and now I am trying to generate an SSL certificate with Let's Encrypt. When I run certbot --nginx -d ...
2
votes
1
answer
110
views
Server certificate has expired
When I try to log in to my mail client I get this:
This certificate belongs to:
mail.ssk.pm
This certificate was issued by:
R3
Let's Encrypt
US
This certificate is valid
from Thu, 21 ...
- 163
1
vote
0
answers
38
views
One individual being served a different scrambled security certificate for our website? [closed]
We have set up a new certificate for our website using Let's Encrypt. We don't have customers using the site yet, but when we test it from multiple locations, almost everyone that goes to our site is ...
- 119
0
votes
0
answers
62
views
Mosquitto 1.6 TSL / OpenSSL error: problems getting password
When starting mosquitto (on CentOS), I am getting the following logs
06-19T14:34:55: mosquitto version 1.6.10 starting
06-19T14:34:55: Config loaded from /etc/mosquitto/mosquitto_[org].conf.
06-19T14:...
- 125
1
vote
1
answer
107
views
IIS 10 website serving ssl certificate that does not exists
When accessing the website externally we are served an SSL certificate that was previously removed (months ago) as it was expired and a new certificate issued. I can not find any reference to the old ...
- 11
0
votes
1
answer
148
views
HTTPS timeout/site won't load. HTTP works
Have 'mydomain.com' hosted by GoDaddy 'with multiple CNAMEs, ex: 'one.mydomain.com', 'two.mydomain.com'.
I have a wildcard SSL certificate from GoDaddy installed in IIS and setup site bindings. Every ...
- 1
0
votes
0
answers
58
views
Docker nginx proxy with multiple websites Cloudflare SSL
I have been trying to setup SSL on my Docker Nginx server to no avail.
Backstory: I have a VPS on which i run multiple dockerized websites. On the front i have the jwilder nginx reverse proxy server ...
1
vote
1
answer
91
views
How to declare an explicit list of allowed client certificates in apache2 server
I use an apache2 server configured as a reverse proxy to access an internal service. To protect this service from unauthorized access I would like to use a certificate-based client authentication.
...
- 131
0
votes
0
answers
245
views
Unable to connect to O365: The revocation function was unable to check revocation because the revocation server was offline
On June 1st my VPS web server (Windows 2016) hosted by Godaddy stopped being able to connect to the Office 365 servers for both SMTP and IMAP (connections work fine from other environments). The ...
- 101
0
votes
2
answers
47
views
Why would I not use a single SSL cert with multiple wildcard SANs?
Google uses a single SSL cert with multiple wildcard SANs for all its domains. You can check this here.
Are there potential disadvantages to this? Does a large cert present processing/latency issues ...
- 3,559
0
votes
0
answers
236
views
Mailu email server: Let’s Encrypt does not request new certificate automatically
Using Mailu docker image, I built an email server on Debian 12.
Whenever the certificate expires, I use docker compose down and docker compose up command so certificate will be renewed.
What I ...
- 101
2
votes
0
answers
31
views
Client certificates and custom revoked html
I can configure Apache to authenticate users with client certificate and validate them via OCSP. Do you know how can I redirect the user to a custom html page if the certificate is revoked? The ...
- 121
-2
votes
2
answers
86
views
Issue with using IP address SSL
Mongod database with Nginx.
I am getting this error when connected to my database.
http://212.38.94.32:3001/api/
"This request has been blocked; the content must be served over HTTPS".
I ...
0
votes
0
answers
165
views
ECK Monitor Fleet Server Error When add TLS Certificate on Elasticsearch
When i add TLS Certificates in elasticsearch my fleet-server has error as detail below.
{"log.level":"error","@timestamp":"2024-05-03T08:02:03.862Z","log....
0
votes
1
answer
287
views
certbot Could not automatically find a matching server block for subdom.mydom.com. Set the `server_name` directive
Certbot is not able to install the certificate for a subdomain nginx config.
It says that no matching server_name directive is set, although it is set.
1) My Nginx config:
server {
listen 80 ;
...
- 35
0
votes
0
answers
357
views
How to troubleshoot "EOF" Docker pull error when working over VPN?
I am pulling image from the public Docker registry and getting the following error:
% docker pull ubuntu
Using default tag: latest
Error response from daemon: Head "https://registry-1.docker.io/...
- 199
0
votes
4
answers
622
views
How to confirm SSL certificate expiration date on an API site?
In Microsoft Edge, I can browse to a website and click on the SSL icon in the address bar. From here, I can dig down and see the expiration date for that site.
However, I can find no way to do this ...
- 309
0
votes
0
answers
212
views
How to use multiple ports on the same server for a single domain using nginx and SSL
I am using Godaddy as my domain registrar and created a <subdomain_name> which is linked to my servers IP address on Digital Ocean. I am also using Let's encrypt to get SSL certificates and ...
- 101
0
votes
2
answers
628
views
Nginx unable to find new certificate
I use Nginx in a Docker container on Alpine. Used Certbot to generate a new certificate named my.domain.com-0004.
Replacing the certificate with either mv or cp resulted in an SSL protocol error and ...
1
vote
3
answers
546
views
What is the role of Subject Name (SN) / Subject Alternative Name (SAN) in Microsoft Public Key Infrastructure (PKI)?
What is the Subject Names / Subject alternative names and how do they differ from each other?
Specially the template below "subject name" tab. What does that change in the normal certificate ...
- 53
1
vote
1
answer
111
views
Autorenew wildcard certificates on multiple Azure subscriptions
I am designing the architecture of a new Azure environment. I was planning to use subscriptions to segregate development, staging and production.
I see that Azure wildcard SSL certificates need to be ...
- 13