Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ssl-certificate]

SSL certificates are used to encrypt and authenticate connections to network servers, most popularly for web servers but also email, file transfers, and other network connections.

4
votes
0answers
104 views

Puzzled by SSLCACertificateFile parameter

there's something I can't understand with the SSLCACertificateFile parameter on Apache SSL conf. Put for example I have a ROOT cert "A" that issued an intermediate cert "B". Then, I produced a couple ...
4
votes
0answers
616 views

Exchange 2013 Internal and External URLs with multiple servers and certificates

I'm building a lab with two Exchange 2013 Servers with different internal names and only one external URL, the naming schema is something like this: Internal Names: exchange1.local.example.com ...
4
votes
0answers
754 views

How to properly replace CA certificate when clients get it bundled in PKCS#12 containers?

I'm about to regenerate a certificate of my CA (maintained by OpenSSL) used mostly to provide OpenVPN access to the intranet for my clients. My question is related to this one — "Certification ...
3
votes
0answers
730 views

AWS SSL Certificate without Load-Balancer?

I have a standard Elastic Beanstalk app set up and running great over HTTP. Following the AWS Documentation I requested an SSL Certificate and configured it with CloudFront. Instead of a load-...
3
votes
0answers
83 views

Installing apache2 ssl - ubuntu

I need to install a ssl in my apache2 ubuntu, and do not know what I'm wrong, but the fact is that I do not get ... I have the relevant files: one .key file and two .crt files. At first, when editing ...
3
votes
0answers
2k views

hMail Server SSL Certificate Verify Issue | TLS/SSL handshake failed

I will tell you my situation step by step and ask me any necessary questions and help me to fix hmail certificate issue. First of all : 1- i am using a windows server 2008 - r2 2- latest hmail ...
3
votes
0answers
115 views

How to prevent users from bypassing certificate warnings in Outlook

I had a case where a roaming user was connected to a public WiFi and got a certificate warning. The user saw the error and called me before connecting. Turns out the WiFi was doing SSL inspection. ...
3
votes
0answers
3k views

SSL: couldn't read X509 certificate from pem file lighttpd

I have installed ssl key in the past on my lighttpd and I've documented the steps I did to make sure that I can replicate it in the future. Well, I haven't touched the server for a while and I need ...
3
votes
0answers
79 views

Losing server that generated CSR (Certificate Signing Request)

I have created a CSR file on a Windows server about 3 months earlier and used this CSR file to buy a wildcard SSL Certificate. The SSL company (opentrust) then gave me 3 files, the root CA file, the ...
3
votes
0answers
647 views

Creating SSL certificate signed by a self-signed CA certificate in Jetty

I'm trying to configure a jetty-distribution-9.3.1.v20150714 backend running on Java 1.8.0_45-b14 with a certificate signed by a self-signed CA certificate, for SSL pinning. Following Apple's guide, ...
3
votes
0answers
517 views

Browser and openSSL return different certificates

I'm trying to debug my first attempt at using SSL Pinning in an app I'm developing. I use a shared hosting service on which I have a few domains active. One of the domains is going to act as an API ...
2
votes
0answers
71 views

FreeRADIUS with Let's Enrypt Certificate (trusted connection without provisioning?)

I have a FreeRADIUS server set up for PEAP/MSCHAPv2 connections with an SQL user backend. On that server, I have set up a Let's encrypt certificate for domain access.example.org. This certificate is ...
2
votes
0answers
252 views

Nginx self-signed certificates for gRPC server

I want to set up a gRPC service behind nginx that also serves letsencrypt enabled https services. I want to enable and disable access from client services (other websites) on a regular basis. So if ...
2
votes
0answers
406 views

OpenVPN service, run as root:root instead of nobody:nogroup?

This was moved from NetworkEngineering. I used this DigitalOcean guide (hereafter "guide") to set up an OpenVPN service (v2.3.10, OpenSSL 1.0.2g) several months ago. It's worked flawlessly, and it's ...
2
votes
0answers
1k views

Manually trigger Root Certificate Update on Windows

Is there a way to manually trigger a Root Certificate Update? I'm troubleshooting a problem with a certificate that keeps disappearing from the Certificate Store. I think this is related to Trusted ...
2
votes
0answers
249 views

FTP over SSL: Verify return code: 21 (unable to verify the first certificate)

I am trying to verify a SSL connection to one of my (sub) domains. I've installed a wildcard cert on IIS for a particular sub domain. When I check the connected website instance via https://www....
2
votes
0answers
270 views

Apache proxy - split SSL_CLIENT_S_DN_CN value and set header

I have configured on Apache proxy mutual SSL with SSLVerifyClient require SSLVerifyDepth 3 The configuration and communication is working like expected. Now I would like to send from Apache proxy ...
2
votes
0answers
837 views

Domain Validation for SSL certificate on internal/offline server?

For internal-only servers which may have outbound access to the Internet, but for which their web services are running internal only and are not accessible from outside the organisation, is it ...
2
votes
0answers
509 views

SSL Client Auth for Apache Forward Proxy

I'm trying to authenticate a specific user for whom I've issued a certificate to authenticate to my web proxy using the mentioned certificate. I think I've tried almost 20 combinations of the ...
2
votes
0answers
639 views

Why might a ssl certificate fail to validate after the root certificate was installed?

I am building an openssl Certificate Authority for an intranet. I have root.crt, intermediate.crt which is signed by the root, and server.crt which is signed by the intermediate. I can validate the ...
2
votes
0answers
119 views

Trust certificate for OCSP, but not for client certs?

According to the nginx docs, you can specify certificates to be trusted for both OCSP response and client certificate verification: ssl_trusted_certificate / ssl_client_certificate Specifies a ...
2
votes
0answers
205 views

Windows Server 2008 R2 w/ IIS 7.5 w/ Autodiscover.xml, but SAN-Certificate causes “Target Principle name is incorrect”

Outlook 365 finds the account through autodiscover without any problems, but warns about "Target Principle name is incorrect" (CN=eposthub.de), when adding an account like anything@nabil-redmann.de ...
2
votes
0answers
4k views

stunnel won't verify client certificate as expected

I'm trying to set up stunnel to provide a TLS wrapper to an HTTP service that doesn't natively support TLS. I have this working well without using TLS client certificates. When adding the client ...
2
votes
0answers
3k views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
2
votes
0answers
1k views

Apache2:Unable to read server certificate from file

Cannot start apache2 server. error info is below. Looking into similar questions (SSL Error - unable to read server certificate from file, Apache cannot read certificate file, and so on), still ...
2
votes
0answers
2k views

Import a P12 certificate into a NSS database (with an alias)

Here´s the deal... I have a personal P12 certificate generated by a certificate authority. I want to use it with CURL to access a protected URL. If CURL on CENTOS was compiled with openssl, I should ...
2
votes
0answers
78 views

Certificate can only be used by network service account

Issues : Our service is using one certification for partner service call. It worked well in IIS site which is running as network service account. But when we run test the code as administrator (...
2
votes
0answers
777 views

Powershell Install-WindowsFeature Application-Server (and subfeatures) and assign certificate

I want to use a Powershell script to install Application Server on a windows 2012 server. When using the wizard, it prompts for you to select a certificate (for WS-Atomic Transactions) from the local ...
2
votes
0answers
93 views

CA is repeated in IIS https response, what is the configuration section to be checked?

This is about the https of the payment service provider we're using. We've notified them about the problem which causes some android devices to show SSL error message when the browser is redirected to ...
2
votes
0answers
1k views

Maven - resolving “java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors”

I am attempting to build/install this project on an Ubuntu 12.04 box: https://bitbucket.org/petermr/pdf2svg However: mvn clean install Fails to build due to getting errors like this: Downloading: ...
2
votes
0answers
974 views

Installing RD Gateway on a server with another site already in Default Web Site and listening on port 443?

I have a server running Windows Server 2008 R2, web facing with one website already installed. I would like to also add the RD Gateway services to this machine since it is already accessible form the ...
2
votes
0answers
104 views

require client certificates in IIS without requiring SSL

In IIS 7, I've created an https binding for a site, and I'd like to require client certificates for https and still keep my http endpoint. That is to say, I'd like to require client certificates for ...
2
votes
0answers
277 views

Windows 2008 R2 Active Directory + NDES CA, OpenSSL clients renewing certificates

I posted another question which seems to be getting nowhere, so maybe it was too specific (or I was on the wrong track). I have OpenSSL clients which generate Certificate Signing Requests, which are ...
1
vote
0answers
17 views

PfSense: redirection to authentication / login page from HTTPS links for unauthentified users

I've installed and configured pfsense 2.2.4 it works well and redirects unauthenticated users to the login page, as long as they use http; but when I type an https link the redirection doesnt work. ...
1
vote
0answers
40 views

SSL cert mismatch on redirect to sorry/maintenance website

We are trying to address an (IIS) SSL cert mismatch issue. We own dozens of domains name for various lines of business. We have multiple websites load balanced on a netscaler onsite. For example, ...
1
vote
0answers
14 views

How to allow a newly inserted user certificate with Apache 'SSLVerifyClient optional'?

My web users are able to optionally use a Smart Card Certificate to identify themself via Firefox to my web server running Apache httpd 2.4. For this I use SSLVerifyClient optional plus for speed ...
1
vote
0answers
148 views

ECDSA certificates fail validation with curl and Firefox

I've been stuck on a problem for 2 days regarding certificates where some clients connect and some other fails the certificate validation. I'm working on CentOS 7.3 and Nginx 1.15.4. I have 3 levels ...
1
vote
0answers
1k views

0x80004005 Error When RDPing to CA-certified computers

I have a server (let's call it srv1) on my network that I use RDP to connect to and manage, from my Windows 10 computer. Recently, I deployed RDP server certificates so that I could stop the ...
1
vote
0answers
51 views

How is session caching affected by the renewal of a ssl certificate?

I optimized my nginx session cache like this # Optimize session cache ssl_session_cache shared:SSL:40m; ssl_session_timeout 4h; In a few days my Let's Encrypt certificate will be renewed. Does this ...
1
vote
0answers
610 views

slapd won't start (due to missing certificate?)

I'm trying to setup a OpenLDAP server on a CentOS 7.5. Following this guide seemed to work very well until something went wrong (LDAP-password wasn't accepted any longer) due to a server crash. I ...
1
vote
0answers
140 views

ssl files: Nginx works but Nodejs https module does not?

I have a Node instance running on an EC2 instance. I just got my ssl certificate, private key and ca-bundle. so I put them in Nodejs like: var options = { key: fs.readFileSync("/path/to/private/key"...
1
vote
0answers
415 views

How can I check if a custom CA certificate is installed on CentOS?

We are having a custom CA certificate for our infrastructure I wrote puppet module to install a CA certificate: exec {"update-ca-trust extract": path => ['/bin', '/usr/bin', '/sbin'], ...
1
vote
0answers
70 views

Is it possible to configure IIS with the `optional_no_ca` option for the client certificate validation?

I'm looking for a way to setup IIS to process the client certificate authentication the same way as nginx does when the optional_no_ca option is used for the ssl_client_certificate directive. ...
1
vote
0answers
70 views

Have I installed 2 SSL letsencrypt certificate?

Since yesterday, I was trying to install letsencrypt certificate on one of my subdomain text.example.com. Since example.com already had it, first I tried to "extend" it by adding another subdomain ...
1
vote
0answers
311 views

certbot-auto can't extend license to new domain (403 Forbidden)

I have an Ubuntu server on Digital Ocean from which I'm running mainly a single domain, with multiple subdomains: domain.com, sub1.domain.com, sub2.domain.com, etc. Each has it's own Virtual Host. ...
1
vote
0answers
32 views

Can the RPK infrastructure sign a SSL certificate for an IP? Will browsers recognize it?

In theory every AS, ISP provider or whatever, holds a certificate proving that it owns the range of addresses assigned to him. This is the Resource Public Key Infrastructure (RPKI) and it seems well ...
1
vote
0answers
23 views

Expired Sub Certificate

I'm running into an issue where 4 client windows computers out of a 200+ are still showing an expired cert from one of our websites (hosted externally) even though we added the new cert to the website....
1
vote
0answers
47 views

Allow users to add their own domain name to my server and make it HTTPS (SSL)

I'm creating a website builder where the user can sign up, and it will create a subdomain someuser.sitebuilder.com. At the moment it's not SSL as I'm waiting for LetsEncrypt to launch the wildcard SSL ...
1
vote
0answers
336 views

Apache : Wrong hostname is checked when connecting to proxyed sever using SSL

I'm trying to make this setup work : Reverse proxy : SSL enabled and facing the internet using Let's Encrypt certificate (reverse-proxy.com). Target : Site accessed via the reverse proxy with SSL ...
1
vote
0answers
446 views

IIS 8.5 403.16 Untrusted Client Certificate

I'm in the process of moving some sites from an IIS 7.5 web server (2008 R2) to an IIS 8.5 server (2012 R2) and one in particular is giving me a fit. The site uses client certs for authentication. ...