Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ssl-certificate]

SSL certificates are used to encrypt and authenticate connections to network servers, most popularly for web servers but also email, file transfers, and other network connections.

169
votes
6answers
276k views

how to download the ssl certificate from a website?

I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?
152
votes
10answers
202k views

Displaying a remote SSL certificate details using CLI tools

In Chrome, clicking on the green HTTPS lock icon opens a window with the certificate details: When I tried the same with cURL, I got only some of the information: $ curl -vvI https://gnupg.org * ...
136
votes
8answers
17k views

Is there a reason to use an SSL certificate other than Let's Encrypt's free SSL?

Let's Encrypt are providing free SSL certificates. Are there any downsides compared to other, paid certificates e.g. AWS Certificate Manager?
100
votes
4answers
173k views

SSL Certificate Location on UNIX/Linux

Is there any standard or convention for where SSL certificates and associated private keys should go on the UNIX/Linux filesystem? Thanks.
94
votes
4answers
227k views

How do I view the details of a digital certificate .cer file?

I am using Windows and have been given a .cer file. How can I view the details of it?
85
votes
10answers
65k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
74
votes
4answers
30k views

Should a wildcard SSL certificate secure both the root domain as well as the sub-domains?

I ask this question, because Comodo are telling me that a wildcard certificate for *.example.com will also secure the root domain example.com. So with a single certificate, both my.example.com and ...
66
votes
5answers
12k views

Why are CA root certificates all SHA-1 signed (since SHA-1 is deprecated)?

I understand that SSL certs cannot be signed using SHA-1 anymore. Yet, all CA root certificates are SHA-1 signed (mostly). Does it mean the same algorithm that is no longer trusted for "you grandma ...
64
votes
4answers
23k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
57
votes
3answers
204k views

How do I convert a .cer certificate to .pem?

I have a .cer certificate and I would like to convert it to the .pem format. If I remember correctly, I used to be able to convert them by exporting the .cer in Base64, then renaming the file to .pem ...
56
votes
5answers
67k views

Best location for SSL certificate and private keys on Ubuntu

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/ This answer adds that the certificate should go in /etc/ssl/certs/ but ...
55
votes
11answers
16k views

Why do I need to purchase an SSL certificate when I can generate one locally?

I am having trouble understanding why we need to purchase SSL certificates when we can generate them locally using openSSL. What is the difference between the certificate I purchase and a test ...
52
votes
2answers
166k views

What is .crt and .key files and how to generate them?

I've the following configuration: SSLEngine on SSLCertificateFile /etc/httpd/conf/login.domain.com.crt SSLCertificateKeyFile /etc/httpd/conf/login.domain.com.key SSLCipherSuite ALL:-ADH:+HIGH:+MEDIUM:...
50
votes
2answers
36k views

Must CSRs be generated on the server that will host the SSL certificate?

Is it necessary to generate the CSR (Certificate Signing Request) on the same machine that will host my web application and SSL certificate? This page on SSL Shopper says so, but I'm not sure if that'...
45
votes
10answers
96k views

IIS7: can't set host name on site with SSL cert and port 443

Consider a Win 2008 SP2 machine with IIS7. The task is to apply a certificate and host name to the one and only Site on this machine. The site's host headers need to be abc.123.example.com The first ...
45
votes
6answers
55k views

Generating a self-signed cert with openssl that works in Chrome 58

As of Chrome 58 it no longer accepts self-signed certs that rely on Common Name: https://productforums.google.com/forum/#!topic/chrome/zVo3M8CgKzQ;context-place=topicsearchin/chrome/category$3ACanary%...
40
votes
8answers
92k views

How to avoid lftp Certificate verification error?

I'm trying to get my Pelican blog working. It uses lftp to transfer the actual blog to ones server, but I always get an error: mirror: Fatal error: Certificate verification: subjectAltName does not ...
40
votes
3answers
95k views

stop apache from asking for SSL password each restart [duplicate]

Using instructions from this site but varying them just a little i created a CA using -newca, i copied cacert.pem to my comp and imported as trusted issuer in IE. I then did -newreq and -sign (note: i ...
36
votes
5answers
111k views

How to remove Private Key Password from pkcs12 container?

I extracted certificate using Chrome's SSL/export command. Then provided it as input to openvpn - in the config for openvpn: pkcs12 "path/to/pkcs12_container" When calling openvpn ~/openvp_config it ...
35
votes
3answers
87k views

Does each subdomain need it's own SSL certificate?

I am creating a websocket server which will live on ws.mysite.com. I want the web socket server to be SSL encrypted as well as domain.com to be SSL encrypted. Do I need to purchase a new certificate ...
34
votes
2answers
19k views

Can I build my own Extended Validation SSL certificate?

I can create by own CA and generate a self signed SSL certificate this way. But what does it take to make the browser show the certificate as being an "Extended Validation SSL certificate" ? Can I ...
33
votes
14answers
252k views

SSL Error - unable to read server certificate from file

I've been setting up SSL for my domain today, and have struck another issue - I was hoping someone could shed some light on.. I keep receiving the following error messages: [error] Init: Unable to ...
32
votes
2answers
69k views

How to combine various certificates into single .pem

I've just finished reading over this great thread explaining the different SSL formats. Now I'm essentially looking for the opposite of How to split a PEM file There's 4 files I want to consolidate, ...
32
votes
2answers
40k views

How can I work around problems with certificate configuration in Remote Desktop Services?

I am setting up a Remote Desktop Services farm, and am having trouble configuring certificates for it to use. A demonstration of the problem I'm seeing can be found in Step #4. At this point I am ...
31
votes
1answer
2k views

Trusting an untrustworthy CA - Can I restrict how system trusts it?

(Posted to ServerFault instead of StackOverflow because I feel it concerns OS configuration more than programming code). I'm currently responsible for maintaining a system which connects to a third-...
30
votes
2answers
41k views

Error code: ssl_error_rx_record_too_long

I have nginx with the following setup: server { listen 80; server_name site.com www.site.com; root /home/site/public_html; listen 443; #...
30
votes
5answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
29
votes
5answers
25k views

Download SSL certificate from aws certificate manager

I am using aws certificate manager for managing SSL. Recently I purchased a wildcard ssl *.example-private.com Now I need that SSL certificate to deploy on enterprise git instance on aws. How can i ...
27
votes
2answers
10k views

Can't upload certificate to AWS

I'm doing: aws iam upload-server-certificate --server-certificate-name MysiteCertificate --certificate-body Downloads/mysite/mysite.crt --private-key mysite.pem --certificate-chain Downloads/mysite/...
27
votes
3answers
38k views

Moving servers and IPs will change. Do SSL certificates need to be re-issued and installed?

We are moving servers to another facility with different block of IP addresses. Will we need to get new SSL certificates issued and installed once the move has taken place? If so, is there any way to ...
27
votes
4answers
56k views

Failed tls handshake. Does not contain any IP SANs

I'm trying to set up logstash forwarder, but I have issues with making a proper secure channel. Trying to configure this with two ubuntu (server 14.04) machines running in virtualbox. They are 100% ...
27
votes
5answers
51k views

Apache: SSLCertificateKeyFile: file does not exist or is empty

I am configuring SSL for Apache 2. My system is Ubuntu Server 10.04 LTS. I have the following settings related to SSL in my vhost configuration: SSLEngine On SSLCertificateKeyFile /etc/ssl/private/...
27
votes
2answers
34k views

Save Remote SSL Certificate via Linux Command Line

Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert ...
24
votes
1answer
18k views

Certificate does not have a name

I've successfully managed to install an ssl-certificate in IIS, however the 'Name' column is showing as blank even though I entered a friendly name. Is there any way to rectify this? I grabbed a ...
24
votes
5answers
14k views

Where do companies typically store SSL certificates for future use?

We recently bought a wildcard SSL cert for our domain. We converted all of the certs to a Java keystore, but now we are asking ourselves where we should store these for later use. Do people use ...
23
votes
2answers
31k views

nginx permission denied to certificate files for ssl configuration

I'm installing an nginx ssl proxy on my Fedora server. I've created a cert and key pair under /etc/nginx. They look like this: ls -l /etc/nginx/ total 84 ... -rw-r--r--. 1 root root 1346 Sep 20 12:...
23
votes
4answers
50k views

How to make Firefox trust system CA certificates?

Our network admin recently enabled HTTPS inspection on our firewall/router. For IE users this is fine because the certs have all been distributed via Active Directory for domain-joined machines. ...
23
votes
4answers
6k views

View the SSL certificate of a page that immediately redirects to another

So I've googled quite a bit for this but it appears that my google-fu fails me - apologies if this is a trivial and already answered question, I could not find anything about this I'm trying to ...
22
votes
4answers
26k views

How do I know if *.pem is password protected using ssh-keygen?

I have got a file myfile-privkey.pem. How do I check if the private key file is password protected using ssh-keygen?
22
votes
5answers
41k views

Redirect non-www to www over SSL with Nginx

I'm having an error when trying to redirect https://example.com to https://www.example.com. When I go to https://example.com, it doesn't redirect and returns the page/200 status. I don't want this, ...
22
votes
2answers
20k views

Details on exact expiration datetime of an SSL certificate?

Let's say we have an SSL certificate for a site. According to a web browser, the certificate expires tomorrow, Dec 10 2011. OK, but that glosses over time zones. When will it expire, exactly? 00:00 ...
22
votes
3answers
12k views

Can I purchase a certificate for my domain that can sign other certificates for subdomains?

I have written a small program to run on a Windows computer that serves SSL/TLS web pages through port 443 to visiting web browsers. I want it to be easy for non-technical people to install and run ...
21
votes
2answers
70k views

Using CA certificate for Remote Desktop Connection

I’m connecting over the web to a remote Windows Server 2012 R2 via Remote Desktop Connection for administration needs. It is a single web and database server without an AD etc. I’m not talking ...
19
votes
1answer
17k views

Why does my wildcard SSL certificate cause a domain mismatch error on a second level subdomain?

I have a server https://www.groups.example.com - in FireFox I get the "This Connection is Untrusted" message and the "technical details" say www.groups.example.com uses an invalid security ...
19
votes
3answers
35k views

SSL Certificate Class 2 vs Class 3 vs Class 4

I just got a "Premium EV SSL Certificate" form GoDaddy.com. Apparently as of 8 months ago GoDaddy doesn't provide Class 3 Certificates. (http://support.godaddy.com/groups/go-daddy-customers/forum/...
19
votes
3answers
38k views

Chrome reports ERR_SPDY_INADEQUATE_TRANSPORT_SECURITY connecting to local web server over HTTPS

Summary Chrome is reporting ERR_SPDY_INADEQUATE_TRANSPORT_SECURITY when I try and connect to my local web server over HTTPS. I am almost certain this problem has to do with my recent Windows 10 ...
18
votes
3answers
29k views

How to create an SSL certificate for more than one subdomain?

I'm running a server "myserver.net", which has the subdomains "a.myserver.net" and "b.myserver.net". When creating (self-signed) SSL certificates, I have to create one for every subdomain, containing ...
18
votes
3answers
3k views

choosing the right SSL certificate

We're looking to purchase some SSL certificates to secure the login pages of ecommerce sites. It is not required to secure the actual payment process as this is protected by a third party with its own ...
17
votes
4answers
1k views

SSL certificate selection based on host-header: is it possible?

Is it possible for a web server to select an SSL certificate to use based on the host-header of the incoming connection, or is that information that is only available after the SSL connection is ...
17
votes
2answers
7k views

Does it matter where the CSR and key files for SSL certification are generated?

I have to create a CSR for a wildcard SSL certificate. Some FAQs from SSL providers say that I should generate the CSR file on the machine where I want to install the certificate? My understanding is ...