Questions tagged [ssl-certificate-errors]
The ssl-certificate-errors tag has no usage guidance.
110
questions
0
votes
0
answers
23
views
My server has been physically moved to a new rack with a new IP address, and now I'm getting OCSP errors? Could it be an IPv6 thing maybe?
I'm pretty sure SSL certificates are almost always tied to a domain name rather than an IP address. And the vast majority of my traffic is unaffected, generally things are working well.
However, my ...
- 1,034
0
votes
0
answers
30
views
Best Way to Force use of SSL Certificate
When a browser connects to my website by entering it's FQDN the connection is encrypted using the site's SSL Certificate.
However it has come to my attention that it is possible to bypass the SSL and ...
- 101
0
votes
0
answers
38
views
Nginx with SSL behind another Nginx (with nginx-proxy)
I have two VMS. The first is VM1 and the second is VM2. The first is a VPN server and the second is a client.
On VM1 the Nginx is installed as a reverse proxy from the official Docker repository.
On ...
0
votes
0
answers
46
views
Unable to install Godaddy SSL on openlitespeed webserver
I'm trying to install Godaddy Ssl to openLitespeed server but it's not working.
I added .key .crt files to /usr/local/lsws/conf/cert/
then added the path to ssl listener as:
$SERVER_ROOT/conf/cert/...
0
votes
0
answers
130
views
After some time Nginx reverse proxy stops functioning with SSL errors to upstream until configuration is reloaded
I have a Nginx reverse proxy, which mysteriously stops functioning after some hours. Error log gets filled with SSL errors connecting to upstream. Runing "nginx -s reload" (restarting nginx ...
- 1
0
votes
0
answers
45
views
SSL certificate error minio-server and windows server
I've installed minio on a VPS (running Ubuntu 20) with SSL via CERTBOT.
When I connect to this site from my laptop, everything works fine, the certificate is valid.
If I try to connect to this site ...
- 1
0
votes
0
answers
56
views
ERR_SSL_VERSION_OR_CIPHER_MISMATCH with signed certificate in Tomcat 8.5
I have a tomcat server for which I needed a signed certificate. I generated a key using
openssl req -new -newkey rsa:2048 -nodes -out sample_bfc_org.csr -keyout sample_bfc_org.key -subj "/C=BD/ST=...
0
votes
1
answer
217
views
This site is missing a valid, trusted certificate || Apache2 webserver, Windows root CA
I'm learning about certificates, HTTPS together and after 4 days I'm out of idea how to set up to become trusted. In my lab env. I have a Windows server with a CA role.
Previously I installed a VM-...
- 13
0
votes
1
answer
442
views
How to add server certificate exception to Chrome/Edge?
Is it possible to add server certificate exceptions for some websites (to skip warning page about certificates that are expired, self-signed or with missing or mismatched CN/SANs) in Google Chrome / ...
- 3
0
votes
1
answer
110
views
Exim4 client rejecting TLS certificate
I'm having a problem with Exim4 and the TLS certificates, when I try a test connection using gnutls-cli I get this error:
Processed 128 CA certificate(s).
Resolving 'mail.reformaspaco.es:25'...
...
0
votes
0
answers
82
views
Make gnutls-cli print local root certificate as well as server-provided certificates
I'm diagnosing a TLS certificate verification problem in Ubuntu Xenial that resulted from the recent Let's Encrypt root certificate expiration. The problem happens in cURL which uses GnuTLS under the ...
- 343
0
votes
1
answer
290
views
SSL certificate error when not typing FQDN and relying on default search domain
DNS and SSL aren't really in my wheelhouse more than a rudimentary understanding, I hope what I want to do isn't impossible!
Here's the situation:
We have an internal domain and DNS servers, let's ...
- 101
0
votes
2
answers
1k
views
How to remove expired Let's Encrypt cert (Debian)
I am trying to remove the expired DST Root CA X3 Let's Encrypt SSL cert (expired yesterday) from a Debian server which is still appearing when I check in SSL Labs:
RSA 2048 bits (e 65537) / ...
- 392
0
votes
0
answers
87
views
Can wget ignore certificate issues on redirects (or for specific domains)?
We use a redirector service so that requests act like this:
https://realsite1.redirector.ourdomain --302--> https://realsite1.anotherdomain1
https://realsite2.redirector.ourdomain --302--> https:...
- 2,571
1
vote
2
answers
378
views
OpenDKIM-provided tools do not provide a usable key-pair for DKIM
I use opendkim-genkey -b 2048 -t -s default -d mydomain.com, resulting in files default.private and default.txt. Yes, default.private begins (correctly, SFAIK) with -----BEGIN RSA PRIVATE KEY----- and ...
- 11
0
votes
1
answer
202
views
Exchange Server Error ID 15021
My Exchange Server 2013 writes "Error 15021" dozens of times in the Error log. It says, that there is an error using the SSL-Configuration. I googled the error but there seem to be a lot of ...
- 1
0
votes
0
answers
210
views
Reach TimescaleDB with Hasura API: "CA certificate and CA private key do not match" when using self-signed server certificate / private key
I follow the guide at timescaleDB for APIs with Certificate authentication --> 2. Generate keys and certificates for nodes:
For an SSL connection, you need four environment variables:
SSL Root ...
0
votes
2
answers
87
views
Nginx Revers Proxy Overwrite Certificate
I have a problem trying to overwrite a certificate using NGINX as a Reverse Proxy forwarding all request to an Apache Server with and old certificate (TLS 1.0)
This is the output for my .conf file:
...
0
votes
1
answer
314
views
Cloudfront 502 error with ALB origin in different region
I have a CloudFront which has one of its origins as an application load balancer, this load balancer is available in a different region from the CloudFront which is only available in N.Virginia and is ...
- 1
0
votes
0
answers
479
views
Decrypt error in TLS handshake after ServerKeyExchange
I have a WEB application deployed to Tomcat server. I connect to it with Chrome browser with HTTPS but I have decrypt error during TLS handshaking on the client side after ServerKeyExchange.
...
- 101
1
vote
1
answer
415
views
Redirecting Error with google load balancer
I'm trying to setup Google Load Balancer and couldn't get it work. It produces either 502 or 302 error.
Wanting to direct www to non-www, http to https.
This is my rewrite rule
SetEnvIf X-...
google-cloud-platform
0
votes
1
answer
135
views
Exchange 2019 ssl certificate invalid
I have installed Exchange 2019 for testing purposes.
I have purchased a domain name and a certificate.
After I installed it, the status shows: invalid.
Thank you.
Here is the result of certutil -...
- 33
1
vote
2
answers
569
views
Gunicorn/Flask reject identical SSL certificate that works fine with Apache
What would cause a Gunicorn server running a Flask app to report a "sslv3 alert certificate unknown" error in the browser, when an Apache server running a WSGI app, using the exact same ...
- 3,432
0
votes
0
answers
332
views
Renew Letsencrypt certificate on Amazon AWS Linux AMI with nginx
I have production and test instances on AWS Linux AMI. On the test instance I am unable to renew letsencrypt certificate with certbot because it requires ACME2 and I am still using old certbot to ...
- 133
0
votes
1
answer
144
views
.htaccess redirect from SSL root domain to another subdomain with different SSL causes NET::ERR_CERT_COMMON_NAME_INVALID
I need help to figure this out.
I have two local, separate webservers 192.168.11.5 (https://www.example.com) and 192.168.9.14 (https://project.example.com). Each has separate non-wildcard SSL ...
- 11
4
votes
3
answers
3k
views
Email server certificate valid according to CheckTLS, invalid according to Thunderbird
I have set up an email server using docker-mailserver.
DKIM, SPF, and DMARC are configured fine.
SSL was set up using Let's Encrypt. Server has TLS and STARTTLS enabled.
I ran a TLS/SSL test on https:/...
0
votes
1
answer
271
views
Unable to open file for reading: /etc/exim/domains on Centos 7 - err_ssl_protocol_error
How can I fix the issue below I saw at /var/log/messages
panel crond: 2020-11-13 21:17:02 1kdgRJ-0008yG-Rv Tainted filename '/etc/exim/domains/example.com/dkim.pem'
panel crond: 2020-11-13 21:17:02 ...
1
vote
1
answer
1k
views
SSL error: No path found from the leaf certificate to any root. Maybe an intermediate certificate is missing
I've setup a personal mail server using postfix, postfix-saslauth, courier (mysqlauthd, imap, pop) plus some well practices like SPF, DKIM and DMARC.
This set up has been working fine for the last 10 ...
- 468
3
votes
1
answer
15k
views
How to diagnose "CA certificate too weak" error, how to use the CA cert anyway?
I have to use a service that uses self-signed certificate (from Ubuntu). I have added the company's CA to the trusted list (Ubuntu). After that "self signed certificate in chain" error is ...
- 173
0
votes
1
answer
255
views
Enabling Nginx TLSv1.3 error despite having Openssl 1.1.1g
I have Nginx 1.18.0 and OpenSSL enabled v1.1.1g. I know before this version is not possible to enable TLSv1.3 but even with this version is not possible. If I check ssl checkers website its enabled ...
- 166
0
votes
0
answers
144
views
OpenSSL randomly fails to verify the certificate chain of a URL on the 443 port can verify all instance ports
I'm hoping someone can help me because I am at a loss. My team has been suffering from issues of missing intermediate certificates in our services. I was tasked with writing a script that would ...
2
votes
0
answers
77
views
Not able to login to my node application after SSL certificate installation in nginx server
I have a node application having its front end deployed in Nginx http web server and the back end (molecular microservices) in node server both on an AWS ec2 Linux VM. the application URL is ...
0
votes
1
answer
711
views
How to install SSL certificate for domain and subdomain
I want to install certificate on EC2 for domains and subdomains.
I'm running a website "www.example.in" on single EC2 instance which is in public subnet with public IP and also pointing some ...
0
votes
0
answers
121
views
Client certificate works in Firefox but not when used in Internet Explorer (or Edge)
With a certain web site, a certain client certificate works fine with Firefox, but not with IE or Edge (all on Windows 10, as both IE and Edge behave the same, I'll use the term "IE/Edge" ...
- 378
2
votes
1
answer
1k
views
OpenSSL fails to detect expired intermediate CA certificate in s_client SSL connection test
By accident, I have an expired intermediate certificate at the end of my chain file in my Dovecot server's SSL configuration. It's enough of a problem that my Android e-mail client refuses to use it, ...
- 374
0
votes
1
answer
367
views
Dovecot enters a failed state with exit code error
I am having problems with dovecot on a debian 9 system running webmin/virtualmin.
After an update, it seems that the renewal of a domain SSL certificate caused at least one client domain to use the ...
- 11
0
votes
1
answer
3k
views
Openssl "Self-signed certificate in certificate chain" when server sends whole certificate chain with the self-signed certificate to the client
I am having the following certificate chain:
Self-signed Certificate --> Intermediate --> Client cert, Server cert. I have application for ssl communication and also verify peer setting. I try to ...
4
votes
1
answer
2k
views
SSL client certificate authentication returns "21:unable to verify the first certificate"
I'm in the process of transferring some of my old-and-busted apache2 web servers to newer and more resilient nginx containers.
On my old web server, I have an apache2 server that hosts secretbackdoor....
- 358
0
votes
1
answer
47
views
Best way to monitor for SSL / Connection failures on a server that's still up [closed]
We had an outage issue today (NGinx not successfully restarted by our Let's Encrypt renewal CRON job, so not serving the renewed cert) leading to the server being up according to Pingdom but not ...
- 53
0
votes
0
answers
23
views
A record points to new webhost but local clients still get certificate errors
Our main website was moved to a new webhost and a new domain. We control our DNS and were instructed to change the A record for olddomain.com to point it to the new host newdomain.ca.
We lowered the ...
- 660
0
votes
1
answer
2k
views
Certificate hasn't got a known issuer
The TLS (SSL) certificate on one of my site expired yesterday. I obtained a new one - and installed it on the site (running on Debian 9 under nginx). Now when I access the site from a windows or mac, ...
- 721
1
vote
1
answer
5k
views
OpenSSL s_client returns unsupported certificate purpose on one machine but works normally on another with same certificates
I'm debugging TLS connection issue between host and docker container. My docker container has a server certificate:
-----BEGIN CERTIFICATE-----
...
- 113
1
vote
1
answer
1k
views
openssl alternative names is missing
I generated CA, with this article, and stored it in my machine. Now, I want to create a server certificate and use it in my webserver. This is my generate server certificate code:
#!/bin/bash
# USE: ....
- 133
0
votes
0
answers
219
views
How to SSL Certificate file max size for an IE11 Browser?
At my work have a SSL Certificate file for web services.
this Certificate file size is over than 44K.
But seems like IE11 browser cannot parse or read a >44K SSL Certificate file.
So IE11 Browser ...
- 1
3
votes
2
answers
11k
views
Errors when attempting to connect to PostgreSQL 9.6 using SSL wildcard server certificate and no client certificates
I have a PostgreSQL 9.6.11 database on Amazon Linux that has been configured with a 2048-bit SSL wildcard server certificate and password-based (no client certificates) remote connections since ...
- 753
3
votes
2
answers
9k
views
openssl keeps creating v1 certificate instead of v3
Hell everyone,
so i'm trying to create a self signed certificate for my domain and for some reason openssl keeps creating V1 certificates for my server instead of V3 and that is causing browsers to ...
-1
votes
1
answer
986
views
LetsEncrypt certificate (renewing) installing error
I'm trying to renew my LetsEncrypt certificate on my Raspberry Pi running apache2, but I seem to get an error when CertBot tries to generate the certificate.
Expected sha256 ...
- 1
2
votes
0
answers
916
views
DLG_FLAGS_INVALID_CA and DLG_FLAGS_SEC_CERT_CN_INVALID
scenario is trying to connect via web browser to the IPMI of a new server I have; from Windows 10 either Internet Explorer 11 or Edge. Both report This site is not secure with the error being ...
- 735
1
vote
0
answers
94
views
CNAME SSL Redirect Setup with Cloudflare
I’m hosting two subdomains with two (non-wildcard) Let’s Encrypt certificates outside of cloudflare:
name.feed.example.com
name.example.com
I have a CNAME alias on Cloudflare (free plan) pointing
...
- 11
0
votes
0
answers
173
views
Getting random but frequent err_ssl_version_interference, err_ssl_protocol_version
I have a asp.net core api hosted in a service fabric cluster on windows server. We configured the https following this guide.
We are getting a lot of err_ssl_version_interference, ...
- 101