Questions tagged [x509]
X.509 is an ITU-T standard commonly used for public key infrastructure (PKI) and for privilege management infrastructure (PMI).
0
votes
0answers
11 views
Digital signing certificate for SOAP
I'm calling a third-party Web Service with SOAP requests. This service requires me to to sign my SOAP requests digitally. Regarding to How to buy a X.509 certificate for signing digital payloads ...
1
vote
1answer
48 views
Why would Chrome ignore the X509v3 Subject Alternative Name in my cert?
I have a cert that include an X509v3 Subject Alternative setting, but Chrome 67.0.3396.99 is saying the Subject Alternative Name is missing even though it looks like it's included in the cert.
Here's ...
0
votes
0answers
321 views
x509 certificate not valid for any names when added IP address to openssl.cnf
A self-signed certificate works well while the command used to generate it on a ubuntu machine is:
openssl req -x509 -newkey rsa:4096 -keyout private.key -out cert.crt -days 365 -nodes
If the ...
0
votes
0answers
113 views
Node js: Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
I have searched the website and found some answers but it didn't solve my problem,
And I don't know what's I am doing is correct or not.
My website is php based, for chat I am using nodejs, and ...
0
votes
1answer
561 views
Authenticate to LXD rest API over network , certificate auth keeps failing
I am trying to access LXD REST API over the Network.
Followed : Link to Doc.
lxc config set core.https_address "[::]:8443"
lxc config set core.trust_password <some random password>
curl -s -...
0
votes
1answer
461 views
Edit x509v3 extended key usage in existing certificate-file
Is it possible to manually edit the key usage of a X509v3 certificate ?
$ openssl x509 -in crt.crt -text
...
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment
X509v3 ...
3
votes
0answers
521 views
The revocation function was unable to check revocation for the certificate 0x80092012
Please help me to deal with self-signed revocation check
I've used makecert.exe to create root and client certificate
The problem is that certutil fails to check certificate with error
The ...
0
votes
1answer
2k views
openssl certificate chain lost when converting from pem to der
I have a cetificate chain in .pem format from Letsencrypt, called fullchain.pem
It has 2 certificates in the chain:
keytool -printcert -v -file fullchain.pem |grep "Certificate fingerprints" |wc -l
...
1
vote
1answer
148 views
Limiting power of a trusted certificate
I am creating a site with my own CA and signing client certs with it. The clients will need to add my CA as a trusted source, but for security reasons I don't want them to blindly trust everything ...
1
vote
1answer
231 views
Is it possible to generate openssl configuration file from an existing x509 certificate?
I am looking for a way to restore openssl configuration from an X509 certificate (or a csr).
I know it's possible to look at the certificate and manually reconstruct the config file but it's ...
0
votes
1answer
556 views
Difference between openssl's verify and s_client
openssl verify gives me a 20 error code whereas s_client gives me a 1 return code and correctly gets the root certificate.
Can anyone point me out to how to verify a downloaded certificate ?
...
1
vote
1answer
158 views
Block Subject Alternative Names in ADCS
I am managing a Windows 2008 ADCS CA and have been aware of the security risks in issuing certificates with SANs. So I tested issuing a PKCS10 file with SANs in the request and it issued the ...
4
votes
2answers
432 views
Can I restrict an intermediate CA to only sign client certificates?
I want to use SCEP to give out client certificates, probably using ADCS. We already have an internal offline root CA in place (securely in a safe, only used for signing and revoking intermediate ...
1
vote
0answers
432 views
OpenSSL - Create Cross Intermediate Certificate from 2 Root CAs
Good evening all,
I have 2 servers running in different datacenters which are both connected using OpenVPN.
Both servers have their own ca-server who is able to sign new certificates using ...
0
votes
1answer
437 views
How can I select a certificate from a PEM file with multiple certificates?
Background info: I am working on an OS X server, and I need to use certificates from the key chain with openssl smime in order to encrypt messages in a bash script. In order to do so, I use the ...
3
votes
0answers
2k views
MongoDB rs.initiate error: replSetInitiate quorum check failed because not all proposed set members responded affirmatively
I have to start my own replica set with internal authentication enabled using X.509 certificates, but I failed. Any advice is welcome.
MongoDB 3.2 x64 on Debian 8.2 x64.
It is a problem from MongoDB ...
0
votes
1answer
417 views
Preserve X509 client cert data from apache2 reverse proxy to jetty
I am not able to receive on jetty-9.3.14 the X509 client cert data which are submitted to apache2 and forwarded via ProxyPass directive.
<Location /X509>
SSLVerifyClient require
...
2
votes
3answers
1k views
Forwarding logs from rsyslog to graylog over tls
I'm trying to forward logs from rsyslog to graylog over tls.
rsyslog configuration:
# make gtls driver the default
$DefaultNetstreamDriver gtls
#
# # certificate files
$DefaultNetstreamDriverCAFile /...
2
votes
0answers
112 views
Trust certificate for OCSP, but not for client certs?
According to the nginx docs, you can specify certificates to be trusted for both OCSP response and client certificate verification:
ssl_trusted_certificate / ssl_client_certificate
Specifies a ...
31
votes
1answer
2k views
Trusting an untrustworthy CA - Can I restrict how system trusts it?
(Posted to ServerFault instead of StackOverflow because I feel it concerns OS configuration more than programming code).
I'm currently responsible for maintaining a system which connects to a third-...
1
vote
1answer
354 views
Google App Engine The SSL certificate provided could not be inserted. xn- domain
I try installing Comodo Certificate that I ordered in SSLs.com on Google App Engine Custom Domain. But I have error:
The SSL certificate provided could not be inserted.
I checked that my key is ...
google-app-engine
1
vote
1answer
679 views
How to get Subject from client certificate issued as a claim in ADFS?
I'm using Certificate Based Authentication in ADFS 3.0 and need to get the Subject field from the client certificate issued as a claim, but it's not available as an incoming claim to ADFS.
When I ...
2
votes
0answers
146 views
Tomcat 7: how to log x509 cert dn with AccessLogValve
I have Tomcat7 running on RHEL6 with mutual authentication using x509 certificates for the entire container.
From the user point of view in the browser, everything seems to work fine with a cert ...
2
votes
0answers
511 views
Is there an extension of host to host ipsec to a many-many configuration?
Having a typical host to host transport mode ipsec configuration,
conn appserver01-to-swift01
leftid=@appserver01.server.com
left=10.133.176.246
leftrsasigkey=xxxxxxxxxxxxxxxxxxxxxxxx
...
13
votes
1answer
5k views
OCSP responder not present?
Am trying to set up OCSP validation routines, and so want to be comfortable with the environment first. Found excellent tutorials at for example OpenSSL: Manually verify a certificate against an OCSP....
0
votes
2answers
3k views
Can one domain have 2 or more SSL certificates?
I have googled and found this post: https://security.stackexchange.com/questions/46988/is-it-technically-possible-to-configure-two-different-ssl-certificates-for-the-s
If it actually is possible, ...
0
votes
1answer
62 views
How should a wildcard certificate be used?
I have a wildcard certificate (pfx file) and I have doubts on how to use that.
Should I install that on all of my application servers or alternatively create a new certificate and sign it with the ...
1
vote
1answer
6k views
Error 207: ERR_CERT_INVALID
I'm trying to make it so people can create a private key via the browser via the element and then after have it so that an X.509 cert is sent to them that's then installed into the browser. But I can'...
1
vote
1answer
101 views
Can OpenDirectory on OS X reasonably be configured to use an intermediate CA cert from an existing CA?
We're trying to set up OpenDirectory. It seems to want to create its own CA, and then an intermediate CA with a certificate signed by its own CA. I'd prefer to generate an intermediate CA certificate ...
4
votes
1answer
7k views
OPENSSL Save x509 certificate of a website
I can see the certificate with this command
openssl s_client -host {HOST} -port 443 -prexit -showcerts
How can I save the x509 cert of the website in a PEM - File?
5
votes
1answer
4k views
Limit on X509v3 Subject Alternative Name DNSname length
I have been searching through RFC 5280, 1034, and 1123 trying to figure out what a max string length is, but I can't find it. I'm wondering if any of you happen to know.
For those of you who know ...
1
vote
0answers
240 views
apache/mod_gnutls ssl certificate based authentication
I'm using apache with gnutls. I've configured both to request authentication from the client.
When providing the certificate it works. But it works also if I provide another that the correct ...
1
vote
2answers
812 views
DER encoded hash
according to the manpage of stunnel4
the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
1
vote
1answer
185 views
Integrity of Request/X509 Alternative Name/Extension Information
Am I correct in assuming that there's protection against the modification of both the subject and the extension information in a request or X509 certificate?
This signature is just another element ...
1
vote
1answer
2k views
Strongswan with X.509 authentication and LDAP authorization
I would like to setup Strongswan/Libreswan with PKI authentication. Now I have searched and found only how to configure specific accepted client certificates like here: http://technikenity.blogspot....
1
vote
1answer
941 views
Convert EC2 ssh .pem key to Azure X.509 certificate?
Normally I use a pem file to login into my ec2 instance via
ssh -i key.pem
Now, in Azure, their requirement during instance creation is
UPLOAD AN SSH KEY OR PROVIDE A PASSWORD FOR AUTHENTICATION
...
1
vote
2answers
982 views
How does OpenSSL determine that a certificate is for a root CA?
I have a Verisign intermediate certificate that was issued by a Verisign root CA. But when I ask OpenSSL to validate the chain without providing the root CA certificate, OpenSSL says the chain is ...
0
votes
1answer
2k views
How can I renew the SSL certificate used on our Exchange server?
According to the MSDN article Renew an Exchange Certificate, I'm supposed to use
Get-ExchangeCertificate -Thumbprint 'AD19B141228C7CF98B5F78DCED978B7C45E15434' | New-ExchangeCertificate -...
2
votes
2answers
12k views
Openssl Custom Extension
I know how to create x509 certificates with the openssl command line. But now I want to create one with a custom extension. How can I do this with openssl command line?
0
votes
3answers
1k views
Detect unencrypted SSL keys
I have an OpenVPN server installed on a Debian machine.
Is there a way to find which of the keys have been created without being encrypted with a password, so as to replace them?
0
votes
1answer
8k views
OpenSSL: Why can't I enter a PEM Pass Phrase in the prompt? [duplicate]
I am trying to install an SSL certificate on my WAMP server for the first time. I've never done anything like this, so please, bare with me.
W:\wamp\bin\apache\apache2.2.22\bin>echo %...
0
votes
1answer
533 views
Renewing a self-signed certificate
Is there a way to reset the expiry of a self signed X.509 certificate but keep both the public and the private key as they were?
Technically this should be nothing more than a different date for the "...
0
votes
1answer
3k views
openssl Subject Public Key Info: RSA Public Key: (1024 bit) vs Public Key: (1024 bit)
I have a couple of certificates whose format seem pretty similar except for one thing
I have checked the details of the cert by using the following openssl command
openssl x509 -in certname -text
In ...
0
votes
2answers
458 views
How do I set up the DN for a SSL cert with a hostname of greater than 64 characters?
Everywhere I read says to have the server hostname in the commonName field and the subjectAltName field. The problem is that the hostname that I want to sign has greater than 64 characters. Therefore, ...
2
votes
1answer
162 views
Alternatives to a Trusted Root certificate
Given a SSL-protected site that was formerly whitelisted (Allow from x.x.x.x etc), and and a requirement from a customer to change the way authentication works, to use X.509 HTTPS Client verification. ...
0
votes
1answer
2k views
Error while converting der private key to pem
I have DER private key and certificate. I need to convert them to PEM format. Certificate converted normally, but when i try to convert key this error happens:
# openssl x509 -in client-key.der -...
27
votes
3answers
95k views
Import of PEM certificate chain and key to Java Keystore
There are plenty of resources out there about this topic, but none I found which covers this slightly special case.
I have 4 files;
privatekey.pem
certificate.pem
intermediate_rapidssl.pem
...
1
vote
2answers
5k views
Can you re-use a SSL certificate across platforms?
Let's say I want to buy a wildcard SSL that I can use for web servers, spanning across a multitude of different servers and platform.
I could issue a CSR for each and every one of them, with their ...
1
vote
3answers
5k views
Install X509 certificate into Windows 2008 R2
I'm trying to install a certificate into my windows 2008 but I'm not able to do it right.
I have a .crt file and I click to install from contextual menu. It succeed to import but if I browse the ...
1
vote
1answer
2k views
Renew SSL client certificates
For a internally used webbased software, which must be available from everywhere, I have created client certificates which are installed in the browsers of authorized consumers.
Now, with 2012 being ...
