Questions tagged [x509]
X.509 is an ITU-T standard commonly used for public key infrastructure (PKI) and for privilege management infrastructure (PMI).
116
questions
0
votes
1
answer
26
views
Use nameConstraints to exclude all names but a few in OpenSSL
I want to use the x.509v3 certificate name constraint extension to exclude all names, except for one or a few of them, using OpenSSL's openssl.cnf file.
The directive is
nameConstraints = critical, ...
- 1
2
votes
0
answers
31
views
Client certificates and custom revoked html
I can configure Apache to authenticate users with client certificate and validate them via OCSP. Do you know how can I redirect the user to a custom html page if the certificate is revoked? The ...
- 121
2
votes
1
answer
143
views
What happens if the startdate of a CA is later that the startdate of a X509 certificate signed by it?
I am in the process of extending the lifetime of a private CA creating a new certificate with the same name, serial number, private/public keys, etc. The only change would be the "startdate" ...
- 273
0
votes
0
answers
263
views
Kubernetes won't pick up new certificate, x509 certificate expired
kubectl version Client Version: v1.20.4 Server Version: v1.20.15
At the end of January we renewed our external certificates that we use for the applications on the system (as opposed to the kubeadm ...
6
votes
4
answers
3k
views
When does this SSL certificate expire?
Below are the results from testing the SSL certificate at https://www.ssllabs.com/ssltest/analyze.html?d=bungalowsoftware.com
It looks like we have two certificates. Am I reading that right?
Does ...
- 1,523
0
votes
0
answers
65
views
Establishing mutual authentication over SSH using SPIFFE
For this learning purpose I have created a k8s cluster using 4 azure VMs (VM1, VM2, VM3 & VM4).I have followed the spiffe doc to deploy spire-server and spire-agent on a k8s infra. I have kept all ...
0
votes
0
answers
104
views
Generating certificate with subjectUniqueID field
I would like to generate a certificate with the subjectUniqueID field as indicated in rfc5280( https://www.rfc-editor.org/rfc/rfc5280#section-4).I have tried this:
openssl req -config myConfigFile....
- 1
0
votes
0
answers
98
views
How to properly use MediaWiki with $wgDBadminuser?
I have to set up a fresh MediaWiki and am getting increasingly upset with config recommendations that don't seem to work well when configured as outlined in the official documentation.
Two servers. ...
- 101
2
votes
1
answer
1k
views
Entra Id (AAD) certificate based authentication (CBA) client certificate validation failed ("invalid request") error
I'm trying to get CBA to work according to this article:
https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-certificate-based-authentication
I created a self-signed CA for testing ...
- 21
1
vote
1
answer
2k
views
keytool error: java.security.cert.CertificateParsingException: signed fields invalid
I have a X509 certificate pem file I got from Mongo Atlas. I'm trying to import it into the keystore like so:
keytool -importcert -file X509-cert.pem -alias myalias -keystore mykeystore.p12 -storetype ...
- 139
0
votes
1
answer
959
views
How can I add alternate subject names when creating a CSR using xca?
openSUSE and SLES dropped their old CA management, now recommending to use xca.
While it was easy to add alternate subject names like hostname aliases or IP addresses in the old CA management, I could ...
- 391
-1
votes
1
answer
952
views
How to verify signed file? [closed]
How to check a validity of a file using openssl and cms?
I've got a file (foo.bin) and a signature (foo.bin.cms) which is include x509 der format certificate.
is there any way to check validity of ...
- 3
0
votes
1
answer
2k
views
ADFS Client Certificate Authentication
I have ADFS on my environment and it's currently authenticating via active directory perfectly fine. I'm trying to enable certificate authentication so they can authenticate with their smart cards. ...
- 1
0
votes
2
answers
779
views
What are Groups in Kubernetes certificate signing requests?
In a Certificate signing request API object for a user, you have to specify a group.
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
name: myname
spec:
groups:
...
- 1
0
votes
2
answers
116
views
Cross-sign third party DV cert with our own CA for high trust
I am looking to expand trust within our application by setting up mutual TLS between the customer service and our service. I am trying to wrap my head around this stuff as I am kinda new to this tech ...
- 111
1
vote
0
answers
816
views
Kubernetes: using an intermediate CA which certificate is signed by a self-signed root CA certificate
Does anyone use own certificate chains for Kubernetes clusters?
There's an issue with such kind of setup, and I would be grateful for any ideas on how to solve it.
Let's assume we have a Root CA which ...
- 619
1
vote
0
answers
744
views
How to export the details of a digital certificate (.cer file) to a csv file using powershell?
I have a digital certificate that I'm using for a specific task. I need to export the details of the certificate such as the serial number and issuer to a csv file that is already on my computer using ...
- 11
1
vote
0
answers
3k
views
Submitting CSR to Microsoft CA from linux bash best practice
Similar questions:
https://stackoverflow.com/questions/31283476/submitting-base64-csr-to-a-microsoft-ca-via-curl
The link above presents an answer but it is far too complicated for me.
Below is an ...
- 11
0
votes
1
answer
211
views
manual certificate authentication for IMAPS
I'm running an IMAPS service and users are authenticated with an X.509 certificate.
It works fine using Thunderbird. But how I can connect to the IMAPS service manually using openssl? I use the same ...
- 101
0
votes
1
answer
319
views
X.509 signed certificate validity
We are trying to generate server certificates for a cluster of Kafka servers to communicate over SSL.
The procedure works, but the resulting validity of the certificates is only 30 days.
We are ...
- 103
2
votes
1
answer
3k
views
Finding out if a certificate is due for renewal without triggering the actual renewal with Certbot
I am trying to use Certbot to allow for semi-automated certificate updates. I don't want fully-automated updates to avoid automatic certificate replacements that could interrupt business and ensure ...
- 1,795
2
votes
1
answer
887
views
Why OCSP stapling on NGINX for "buypass" DV certs fails without explicit root declaration?
tl;dr
For buypass DV certs fetched by certbot I need to explicitly tell NGINX to trust buypass root cert to enable OCSP stapling. This is not the case for Let's Encrypt certificates and I cannot ...
- 131
0
votes
1
answer
3k
views
Open SSL Error on Windows 10 - Converting a signed CSR from PEM to CRT
I am attempting to create an IPSec VPN connection with x.509 cert authentication for users.
What follows is a test to get things going and isn't a secure implementation. I will get a certificate from ...
- 3
2
votes
1
answer
85
views
How to make Certbot respect Debian standards for certificate deployment?
Certbot seems to manage X.509 certificates and private keys in its own directory structure in /etc/letsencrypt.
On Debian-based systems (including Ubuntu, Linux Mint and others) X.509 certificates are ...
- 1,795
1
vote
1
answer
365
views
Why my signed certificate is not accepted by IOS (valid in Firefox)
I tried to generate my own CA with TLS Server Certificates. In Firefox I also do not have problems and the certificate is accepted after import of the root certificate. But after importing the root ...
- 121
0
votes
1
answer
714
views
Demand user's x509 certificate from java web application only when required
My web application authenticates the user based on user's x509 certificate.
For now, I've configured tomcat for mutual authentication by setting "clientAuth=want".
However, as this ...
0
votes
1
answer
2k
views
Installing certificate installed through MMC for a service account
(Disclaimer: I have posted this question on StackOverflow, but from a developer point of view. I tried to rewrite the question to fit ServerFault conditions)
A custom service has to log on a remote ...
- 113
1
vote
0
answers
384
views
x509 + asn1: are subjectAltName elements explicit or implicit?
From https://www.rfc-editor.org/rfc/rfc5280:
SubjectAltName ::= GeneralNames
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] ...
- 143
1
vote
1
answer
2k
views
How can I make a CA certificate with `certtool`?
I can make a self-signed CA certificate with the openssl command by putting the line basicConstraints = critical,CA:true in the appropriate section of a configuration file and using it:
openssl req -...
- 113
0
votes
0
answers
371
views
Client certificate works in Firefox but not when used in Internet Explorer (or Edge)
With a certain web site, a certain client certificate works fine with Firefox, but not with IE or Edge (all on Windows 10, as both IE and Edge behave the same, I'll use the term "IE/Edge" ...
- 528
0
votes
1
answer
1k
views
OpenVPN Access Server - Encounter the Warning X509_V_ERR_CERT_HAS_EXPIRED but the cert is actually not expired yet
I was trying to connect to my company openvpn network via MacOS openvpn application and hitting the warning "The server vpn.my_company.com has an UNTRUSTED SSL certificate. Allow the connection to ...
- 103
6
votes
1
answer
2k
views
X509 certificates - Are there any naming conventions?
What are the naming conventions when buying certificates, if any?
When buying a cert for TLS/HTTPS for a particular Server, naturally I will default to the server's name. For example, if the server is ...
- 161
4
votes
1
answer
376
views
x509 extensions: can the "extnValue" be empty?
I'm writing a script that parses x509 certificates. x509 v3 certificates have extensions which are an ASN.1 sequence containing an OID, a critical flag, and an octetString called extnValue.
For the ...
- 143
1
vote
1
answer
3k
views
How to properly generate an x509 certificate with restricted usage
I'm putting certificates into a repository that will not allow a successive certificate with more limited usage than the previous one. I need an initial dummy cert/key/chain to bootstrap the process ...
- 125
0
votes
0
answers
322
views
Error generating client certificate using openssl
Getting this error with openssl 1.1.1d when using the CA generated as shown:
openssl req -new -x509 -config ca.cnf -newkey rsa:4096 -sha256 -nodes -out ca-certificate.pem -outform PEM
openssl req -...
- 101
2
votes
2
answers
12k
views
Create DER certificate+key from PEM
I'm not sure if it's even possible. Also, OpenSSL is one ugly motherlover of an utility :/
I need top upload certificate+private key as DER to ESET Security Management Center (ESMC), at least ...
- 920
1
vote
2
answers
1k
views
FreeIPA refuses to sign a VMWare certificate signing request (CSR)
I'm attempting to make VMWare's certificate authority (VMCA) v6.7 a trusted sub-CA of a FreeIPA certificate authority. I should be able to generate a certificate signing request within VMCA using ...
- 223
0
votes
2
answers
11k
views
error when trying to add custom extensions to X509 certificates using openSSL
I am trying to add custom extensions to my self-signed certificate.
I tried the following
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -extfile myconfig.cnf -extensions ...
- 163
1
vote
2
answers
498
views
Exchange 2013 clients receive error 500 or unable to send mails
We have windows 2012R2 with Exchange 2013, we had public ssl certificate that was used both for external and internal users. We decided to not renew certificate and sign a new one with our domain ...
- 11
1
vote
1
answer
952
views
Unable to load certificate key C:apache-tomcat-8.5.38conf/abc.key (error:0909006C:PEM routines:get_name:no start line)
Need help on below error: Just added a new certificate and copied key , chain and crt to /conf. after starting the tomcat getting below error.
I read in blog that needs to add native="false" in ...
- 11
3
votes
1
answer
396
views
How does one change the certificate and key for https
We have a server whose original PKI certificate was issued by a discontinued root CA. We have a replacement certificate issued from a different root authority chain. This site was set up some time ...
- 367
7
votes
2
answers
2k
views
Revoked SSL certificate
We're using Paypal SDK here:
https://github.com/paypal/PayPal-NET-SDK
To help handle our webhooks. We've started receiving the exceptions:
PayPal.PayPalException: Unable to verify the certificate(s)...
- 385
1
vote
0
answers
3k
views
How does certutil determine that a cert is revoked
I'm testing that an x509 certificate can be correctly determined to be revoked. I'm taking the cert from https://revoked.badssl.com and verifying it via certutil. When my system is online, it seems to ...
- 111
0
votes
0
answers
688
views
Digital signing certificate for SOAP
I'm calling a third-party Web Service with SOAP requests. This service requires me to to sign my SOAP requests digitally. Regarding to How to buy a X.509 certificate for signing digital payloads ...
2
votes
2
answers
2k
views
Why would Chrome ignore the X509v3 Subject Alternative Name in my cert?
I have a cert that include an X509v3 Subject Alternative setting, but Chrome 67.0.3396.99 is saying the Subject Alternative Name is missing even though it looks like it's included in the cert.
Here's ...
- 257
3
votes
1
answer
18k
views
x509 certificate not valid for any names when added IP address to openssl.cnf
A self-signed certificate works well while the command used to generate it on a ubuntu machine is:
openssl req -x509 -newkey rsa:4096 -keyout private.key -out cert.crt -days 365 -nodes
If the ...
- 181
1
vote
1
answer
3k
views
Authenticate to LXD rest API over network , certificate auth keeps failing
I am trying to access LXD REST API over the Network.
Followed : Link to Doc.
lxc config set core.https_address "[::]:8443"
lxc config set core.trust_password <some random password>
curl -s -...
- 163
0
votes
1
answer
3k
views
Edit x509v3 extended key usage in existing certificate-file
Is it possible to manually edit the key usage of a X509v3 certificate ?
$ openssl x509 -in crt.crt -text
...
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment
X509v3 ...
- 130
3
votes
0
answers
2k
views
The revocation function was unable to check revocation for the certificate 0x80092012
Please help me to deal with self-signed revocation check
I've used makecert.exe to create root and client certificate
The problem is that certutil fails to check certificate with error
The ...
- 130
6
votes
1
answer
12k
views
openssl certificate chain lost when converting from pem to der
I have a cetificate chain in .pem format from Letsencrypt, called fullchain.pem
It has 2 certificates in the chain:
keytool -printcert -v -file fullchain.pem |grep "Certificate fingerprints" |wc -l
...
