Questions tagged [ssl-certificate-errors]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

My server has been physically moved to a new rack with a new IP address, and now I'm getting OCSP errors? Could it be an IPv6 thing maybe?

I'm pretty sure SSL certificates are almost always tied to a domain name rather than an IP address. And the vast majority of my traffic is unaffected, generally things are working well. However, my ...
user avatar
  • 1,034
0 votes
0 answers
30 views

Best Way to Force use of SSL Certificate

When a browser connects to my website by entering it's FQDN the connection is encrypted using the site's SSL Certificate. However it has come to my attention that it is possible to bypass the SSL and ...
user avatar
  • 101
0 votes
0 answers
38 views

Nginx with SSL behind another Nginx (with nginx-proxy)

I have two VMS. The first is VM1 and the second is VM2. The first is a VPN server and the second is a client. On VM1 the Nginx is installed as a reverse proxy from the official Docker repository. On ...
user avatar
0 votes
0 answers
46 views

Unable to install Godaddy SSL on openlitespeed webserver

I'm trying to install Godaddy Ssl to openLitespeed server but it's not working. I added .key .crt files to /usr/local/lsws/conf/cert/ then added the path to ssl listener as: $SERVER_ROOT/conf/cert/...
user avatar
0 votes
0 answers
130 views

After some time Nginx reverse proxy stops functioning with SSL errors to upstream until configuration is reloaded

I have a Nginx reverse proxy, which mysteriously stops functioning after some hours. Error log gets filled with SSL errors connecting to upstream. Runing "nginx -s reload" (restarting nginx ...
user avatar
0 votes
0 answers
45 views

SSL certificate error minio-server and windows server

I've installed minio on a VPS (running Ubuntu 20) with SSL via CERTBOT. When I connect to this site from my laptop, everything works fine, the certificate is valid. If I try to connect to this site ...
user avatar
  • 1
0 votes
0 answers
56 views

ERR_SSL_VERSION_OR_CIPHER_MISMATCH with signed certificate in Tomcat 8.5

I have a tomcat server for which I needed a signed certificate. I generated a key using openssl req -new -newkey rsa:2048 -nodes -out sample_bfc_org.csr -keyout sample_bfc_org.key -subj "/C=BD/ST=...
user avatar
0 votes
1 answer
217 views

This site is missing a valid, trusted certificate || Apache2 webserver, Windows root CA

I'm learning about certificates, HTTPS together and after 4 days I'm out of idea how to set up to become trusted. In my lab env. I have a Windows server with a CA role. Previously I installed a VM-...
user avatar
  • 13
0 votes
1 answer
442 views

How to add server certificate exception to Chrome/Edge?

Is it possible to add server certificate exceptions for some websites (to skip warning page about certificates that are expired, self-signed or with missing or mismatched CN/SANs) in Google Chrome / ...
user avatar
0 votes
1 answer
110 views

Exim4 client rejecting TLS certificate

I'm having a problem with Exim4 and the TLS certificates, when I try a test connection using gnutls-cli I get this error: Processed 128 CA certificate(s). Resolving 'mail.reformaspaco.es:25'... ...
user avatar
0 votes
0 answers
82 views

Make gnutls-cli print local root certificate as well as server-provided certificates

I'm diagnosing a TLS certificate verification problem in Ubuntu Xenial that resulted from the recent Let's Encrypt root certificate expiration. The problem happens in cURL which uses GnuTLS under the ...
user avatar
0 votes
1 answer
290 views

SSL certificate error when not typing FQDN and relying on default search domain

DNS and SSL aren't really in my wheelhouse more than a rudimentary understanding, I hope what I want to do isn't impossible! Here's the situation: We have an internal domain and DNS servers, let's ...
user avatar
0 votes
2 answers
1k views

How to remove expired Let's Encrypt cert (Debian)

I am trying to remove the expired DST Root CA X3 Let's Encrypt SSL cert (expired yesterday) from a Debian server which is still appearing when I check in SSL Labs: RSA 2048 bits (e 65537) / ...
user avatar
  • 392
0 votes
0 answers
87 views

Can wget ignore certificate issues on redirects (or for specific domains)?

We use a redirector service so that requests act like this: https://realsite1.redirector.ourdomain --302--> https://realsite1.anotherdomain1 https://realsite2.redirector.ourdomain --302--> https:...
user avatar
  • 2,571
1 vote
2 answers
378 views

OpenDKIM-provided tools do not provide a usable key-pair for DKIM

I use opendkim-genkey -b 2048 -t -s default -d mydomain.com, resulting in files default.private and default.txt. Yes, default.private begins (correctly, SFAIK) with -----BEGIN RSA PRIVATE KEY----- and ...
user avatar
0 votes
1 answer
202 views

Exchange Server Error ID 15021

My Exchange Server 2013 writes "Error 15021" dozens of times in the Error log. It says, that there is an error using the SSL-Configuration. I googled the error but there seem to be a lot of ...
user avatar
  • 1
0 votes
0 answers
210 views

Reach TimescaleDB with Hasura API: "CA certificate and CA private key do not match" when using self-signed server certificate / private key

I follow the guide at timescaleDB for APIs with Certificate authentication --> 2. Generate keys and certificates for nodes: For an SSL connection, you need four environment variables: SSL Root ...
user avatar
0 votes
2 answers
87 views

Nginx Revers Proxy Overwrite Certificate

I have a problem trying to overwrite a certificate using NGINX as a Reverse Proxy forwarding all request to an Apache Server with and old certificate (TLS 1.0) This is the output for my .conf file: ...
user avatar
0 votes
1 answer
314 views

Cloudfront 502 error with ALB origin in different region

I have a CloudFront which has one of its origins as an application load balancer, this load balancer is available in a different region from the CloudFront which is only available in N.Virginia and is ...
user avatar
0 votes
0 answers
479 views

Decrypt error in TLS handshake after ServerKeyExchange

I have a WEB application deployed to Tomcat server. I connect to it with Chrome browser with HTTPS but I have decrypt error during TLS handshaking on the client side after ServerKeyExchange. ...
user avatar
  • 101
1 vote
1 answer
415 views

Redirecting Error with google load balancer

I'm trying to setup Google Load Balancer and couldn't get it work. It produces either 502 or 302 error. Wanting to direct www to non-www, http to https. This is my rewrite rule SetEnvIf X-...
user avatar
0 votes
1 answer
135 views

Exchange 2019 ssl certificate invalid

I have installed Exchange 2019 for testing purposes. I have purchased a domain name and a certificate. After I installed it, the status shows: invalid. Thank you. Here is the result of certutil -...
user avatar
  • 33
1 vote
2 answers
569 views

Gunicorn/Flask reject identical SSL certificate that works fine with Apache

What would cause a Gunicorn server running a Flask app to report a "sslv3 alert certificate unknown" error in the browser, when an Apache server running a WSGI app, using the exact same ...
user avatar
  • 3,432
0 votes
0 answers
332 views

Renew Letsencrypt certificate on Amazon AWS Linux AMI with nginx

I have production and test instances on AWS Linux AMI. On the test instance I am unable to renew letsencrypt certificate with certbot because it requires ACME2 and I am still using old certbot to ...
user avatar
0 votes
1 answer
144 views

.htaccess redirect from SSL root domain to another subdomain with different SSL causes NET::ERR_CERT_COMMON_NAME_INVALID

I need help to figure this out. I have two local, separate webservers 192.168.11.5 (https://www.example.com) and 192.168.9.14 (https://project.example.com). Each has separate non-wildcard SSL ...
user avatar
4 votes
3 answers
3k views

Email server certificate valid according to CheckTLS, invalid according to Thunderbird

I have set up an email server using docker-mailserver. DKIM, SPF, and DMARC are configured fine. SSL was set up using Let's Encrypt. Server has TLS and STARTTLS enabled. I ran a TLS/SSL test on https:/...
user avatar
0 votes
1 answer
271 views

Unable to open file for reading: /etc/exim/domains on Centos 7 - err_ssl_protocol_error

How can I fix the issue below I saw at /var/log/messages panel crond: 2020-11-13 21:17:02 1kdgRJ-0008yG-Rv Tainted filename '/etc/exim/domains/example.com/dkim.pem' panel crond: 2020-11-13 21:17:02 ...
user avatar
1 vote
1 answer
1k views

SSL error: No path found from the leaf certificate to any root. Maybe an intermediate certificate is missing

I've setup a personal mail server using postfix, postfix-saslauth, courier (mysqlauthd, imap, pop) plus some well practices like SPF, DKIM and DMARC. This set up has been working fine for the last 10 ...
user avatar
  • 468
3 votes
1 answer
15k views

How to diagnose "CA certificate too weak" error, how to use the CA cert anyway?

I have to use a service that uses self-signed certificate (from Ubuntu). I have added the company's CA to the trusted list (Ubuntu). After that "self signed certificate in chain" error is ...
user avatar
0 votes
1 answer
255 views

Enabling Nginx TLSv1.3 error despite having Openssl 1.1.1g

I have Nginx 1.18.0 and OpenSSL enabled v1.1.1g. I know before this version is not possible to enable TLSv1.3 but even with this version is not possible. If I check ssl checkers website its enabled ...
user avatar
  • 166
0 votes
0 answers
144 views

OpenSSL randomly fails to verify the certificate chain of a URL on the 443 port can verify all instance ports

I'm hoping someone can help me because I am at a loss. My team has been suffering from issues of missing intermediate certificates in our services. I was tasked with writing a script that would ...
user avatar
2 votes
0 answers
77 views

Not able to login to my node application after SSL certificate installation in nginx server

I have a node application having its front end deployed in Nginx http web server and the back end (molecular microservices) in node server both on an AWS ec2 Linux VM. the application URL is ...
user avatar
0 votes
1 answer
711 views

How to install SSL certificate for domain and subdomain

I want to install certificate on EC2 for domains and subdomains. I'm running a website "www.example.in" on single EC2 instance which is in public subnet with public IP and also pointing some ...
user avatar
0 votes
0 answers
121 views

Client certificate works in Firefox but not when used in Internet Explorer (or Edge)

With a certain web site, a certain client certificate works fine with Firefox, but not with IE or Edge (all on Windows 10, as both IE and Edge behave the same, I'll use the term "IE/Edge" ...
user avatar
2 votes
1 answer
1k views

OpenSSL fails to detect expired intermediate CA certificate in s_client SSL connection test

By accident, I have an expired intermediate certificate at the end of my chain file in my Dovecot server's SSL configuration. It's enough of a problem that my Android e-mail client refuses to use it, ...
user avatar
  • 374
0 votes
1 answer
367 views

Dovecot enters a failed state with exit code error

I am having problems with dovecot on a debian 9 system running webmin/virtualmin. After an update, it seems that the renewal of a domain SSL certificate caused at least one client domain to use the ...
user avatar
  • 11
0 votes
1 answer
3k views

Openssl "Self-signed certificate in certificate chain" when server sends whole certificate chain with the self-signed certificate to the client

I am having the following certificate chain: Self-signed Certificate --> Intermediate --> Client cert, Server cert. I have application for ssl communication and also verify peer setting. I try to ...
user avatar
4 votes
1 answer
2k views

SSL client certificate authentication returns "21:unable to verify the first certificate"

I'm in the process of transferring some of my old-and-busted apache2 web servers to newer and more resilient nginx containers. On my old web server, I have an apache2 server that hosts secretbackdoor....
user avatar
0 votes
1 answer
47 views

Best way to monitor for SSL / Connection failures on a server that's still up [closed]

We had an outage issue today (NGinx not successfully restarted by our Let's Encrypt renewal CRON job, so not serving the renewed cert) leading to the server being up according to Pingdom but not ...
user avatar
  • 53
0 votes
0 answers
23 views

A record points to new webhost but local clients still get certificate errors

Our main website was moved to a new webhost and a new domain. We control our DNS and were instructed to change the A record for olddomain.com to point it to the new host newdomain.ca. We lowered the ...
user avatar
  • 660
0 votes
1 answer
2k views

Certificate hasn't got a known issuer

The TLS (SSL) certificate on one of my site expired yesterday. I obtained a new one - and installed it on the site (running on Debian 9 under nginx). Now when I access the site from a windows or mac, ...
user avatar
  • 721
1 vote
1 answer
5k views

OpenSSL s_client returns unsupported certificate purpose on one machine but works normally on another with same certificates

I'm debugging TLS connection issue between host and docker container. My docker container has a server certificate: -----BEGIN CERTIFICATE----- ...
user avatar
  • 113
1 vote
1 answer
1k views

openssl alternative names is missing

I generated CA, with this article, and stored it in my machine. Now, I want to create a server certificate and use it in my webserver. This is my generate server certificate code: #!/bin/bash # USE: ....
user avatar
0 votes
0 answers
219 views

How to SSL Certificate file max size for an IE11 Browser?

At my work have a SSL Certificate file for web services. this Certificate file size is over than 44K. But seems like IE11 browser cannot parse or read a >44K SSL Certificate file. So IE11 Browser ...
user avatar
3 votes
2 answers
11k views

Errors when attempting to connect to PostgreSQL 9.6 using SSL wildcard server certificate and no client certificates

I have a PostgreSQL 9.6.11 database on Amazon Linux that has been configured with a 2048-bit SSL wildcard server certificate and password-based (no client certificates) remote connections since ...
user avatar
3 votes
2 answers
9k views

openssl keeps creating v1 certificate instead of v3

Hell everyone, so i'm trying to create a self signed certificate for my domain and for some reason openssl keeps creating V1 certificates for my server instead of V3 and that is causing browsers to ...
user avatar
-1 votes
1 answer
986 views

LetsEncrypt certificate (renewing) installing error

I'm trying to renew my LetsEncrypt certificate on my Raspberry Pi running apache2, but I seem to get an error when CertBot tries to generate the certificate. Expected sha256 ...
user avatar
  • 1
2 votes
0 answers
916 views

DLG_FLAGS_INVALID_CA and DLG_FLAGS_SEC_CERT_CN_INVALID

scenario is trying to connect via web browser to the IPMI of a new server I have; from Windows 10 either Internet Explorer 11 or Edge. Both report This site is not secure with the error being ...
user avatar
  • 735
1 vote
0 answers
94 views

CNAME SSL Redirect Setup with Cloudflare

I’m hosting two subdomains with two (non-wildcard) Let’s Encrypt certificates outside of cloudflare: name.feed.example.com name.example.com I have a CNAME alias on Cloudflare (free plan) pointing ...
user avatar
0 votes
0 answers
173 views

Getting random but frequent err_ssl_version_interference, err_ssl_protocol_version

I have a asp.net core api hosted in a service fabric cluster on windows server. We configured the https following this guide. We are getting a lot of err_ssl_version_interference, ...
user avatar