Hot answers tagged

58

My solution: openssl req \ -newkey rsa:2048 \ -x509 \ -nodes \ -keyout server.key \ -new \ -out server.crt \ -subj /CN=dev.mycompany.com \ -reqexts SAN \ -extensions SAN \ -config <(cat /System/Library/OpenSSL/openssl.cnf \ <(printf '[SAN]\nsubjectAltName=DNS:dev.mycompany.com')) \ -sha256 \ -...


26

Chrome stores SSL certificate state per host in browser history. So just clear browser history (Ctrl+Shift+Del), at least the following parts: Cached images and files Hosted app data Content licenses Cookies and other site data, for Chrome version 64 Solution 2. If the above doesn't help, try this: Close Chrome Delete the directory: %USERPROFILE%/AppData/...


15

What you see is now is not the "green address bar" you would expect with an EV certificate, but the following: The reason for that is the following announcement on the Google Online Security blog: The SHA-1 cryptographic hash algorithm has been known to be considerably weaker than it was designed to be since at least 2005 — 9 years ago. Collision ...


15

In Windows, save this script in your SSL folder as makeCERT.bat. It will create these files: example.cnf, example.crt, example.key @echo off REM IN YOUR SSL FOLDER, SAVE THIS FILE AS: makeCERT.bat REM AT COMMAND LINE IN YOUR SSL FOLDER, RUN: makecert REM IT WILL CREATE THESE FILES: example.cnf, example.crt, example.key REM IMPORT THE .crt FILE INTO ...


12

Here is a solution that works for me: Create CA key and cert # openssl genrsa -out server_rootCA.key 2048 # openssl req -x509 -new -nodes -key server_rootCA.key -sha256 -days 3650 -out server_rootCA.pem Create server_rootCA.csr.cnf # server_rootCA.csr.cnf [req] default_bits = 2048 prompt = no default_md = sha256 distinguished_name = dn [dn] C=DE ST=...


10

This is because of Google's sunset plan for SHA-1. There is no immediate security concern. SHA-2 is the current recommended hashing algorithm for SSL. No breaches with certificates using SHA-1 have been reported. The display of degraded UI indicators on Chrome 39 and later is part of Google’s SHA-1 deprecation plan and will apply to all Certificate ...


9

Many problems with SSL certificates can be solved by simply removing the file from the cache folder. In Chrome or Chromium, the file to be removed is cert9.db in the folder ~/.pki/nssdb. (In Firefox, you’d want to remove cert8.db.) Attention! After removing these files, you will need to re-register CAs in your browser. The steps for Windows users would be ...


9

Very easy! Enable "Software Restriction Policy" in Group Policy - make sure you customize as needed if you have binaries in non-standard locations (Program Files, Windows dir etc is automatically included). Edit: For clarity to future readers, one point brought up in comments is that you should run Software Execution Policy in a whitelist mode. This means ...


9

There are several great answers that give examples of how to get this working, but none that explain where things went wrong in your attempt. OpenSSL can be pretty non-intuitive some times so it is worth walking through. First, as an aside, OpenSSL defaults to ignoring any distinguished name values you provide in the config. If you want to use them you must ...


6

AFAICS, the documentation suggests granting the capabilities needed for a container, rather than using the --privileged switch. Running in privileged mode seems to grant the container all capabilities (exactly which those are is listed in the first URL, provided that the docs are up to date). In short, I'd say that --cap-add=SYS_ADMIN grants a smaller ...


5

You need SHA2 certificate to make it disappear. More info about Gradually sunsetting SHA-1


5

If your page is in English, you could trying setting the HTML lang attribute as shown: <html lang="en"> <title>My Page</title> [rest of page] </html> Replace en with the ISO 639-1 code of your choice. Alternatively, if you want to go the Sledghammer route you can disable translation by using a Google specific meta tag: <meta ...


5

It calls home. If it can't call home it will try for 7 minutes and then give up.


4

You wouldn't. You'd set up the network so everyone goes through a proxy server, then keep the logs to see what IP is hitting what sites. Depending on the implementation you can have people log in, or just track by machine IP, or invisibly log the user if the proxy integrated to understand Windows and AD. That removes the logging burden from the Windows ...


4

As far as I know, certificates are not specific to Google Chrome (at least on Windows) but to the whole system. You’ve already deleted that cert through Chrome’s interface, so it should gone. Just to be certain, you could try. Start → Run → certmgr.msc Another tool to try is CCleaner. It should help with better cleaning of Chrome’s caches.


4

The OP's answer is correct as far as it goes. However, you can get a Windows shortcut to launch relative to the current directory. While you can use Windows Environment Variables in shortcuts, there are a few volatile ones that cannot be used (such as %CD%). As the OP suggested, using a batch file is an excellent way to bypass this restriction: @echo off ...


3

This behavior can be disabled by setting the policy value to 0. Additionally, NOGOOGLEUPDATEPING=1 can be passed to the installer to prevent the omaha ping. See http://crbug.com/80567 and http://crbug.com/96243 for details.


3

For future reference: Policy templates are available at http://support.google.com/a/bin/answer.py?hl=en&answer=187945 Lots of useful tips at http://www.chromium.org/administrators Feel free to file bugs/feature requests at the chromium bug tracker using the Enterprise Issue template


3

I was able to solve my problem by instead using a .bat file and using this as it's content "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "file:///%cd%/specViewer.html" --user-data-dir="C:/chromedev" --disable-web-security --new-window Note: prefixing that command is START breaks it.


2

In working with Microsoft regarding this issue and how IE9 behaves, we have found information from Verizon in how to opt out of this service. They call it "DNS Assistance". In working with another user on this issue who has BrightHouse ISP in FL,they have the same thing going on. But, they too, provide information on how to opt out of this service. I ...


2

Chrome 23 supports Click-to-Play through the DefaultPluginsSetting policy. The details at http://www.chromium.org/administrators/policy-list-3#DefaultPluginsSetting haven't been updated yet, but that policy can use value 3 to enforce click to play for plugins.


2

Your certificate is only valid for sh149.surpasshosting.com and www.sh149.surpasshosting.com, however your domain is www.frostjedi.com. This mismatch in domains is causing the browser's verification of the certificate to fail. You will need to re-key the existing certificate, or get a new certificate for www.frostjedi.com. If you can post your cert provider,...


2

I've done some tests using the TCP fast open test code at https://github.com/yuryu/tfoecho My count TCPFastOpenPassive does go up when using the test code. $ grep '^TcpExt:' /proc/net/netstat | cut -d ' ' -f 87-92 | column -t TCPOFOMerge TCPChallengeACK TCPSYNChallenge TCPFastOpenActive TCPFastOpenActiveFail TCPFastOpenPassive 1000 ...


2

Comparing client capabilities I have noted that Chrome 42 only supports the following elliptic curves: Elliptic curves: secp256r1, secp384r1 (It appears that secp521r1 used to be supported in earlier versions, there is a bug report for this.) While for instance Firefox 37 supports: Elliptic curves secp256r1, secp384r1, secp521r1 Looking at the ...


2

When you hit F5 in a browser, you are instructing the browser to ask the sever and any proxies in the path for new content. That Cache-Control request header does just that. It does not get added during normal navigation. Also, PHP has no way of knowing that your content didn't change, especially if it is making a database call. It will never return a 304 ...


2

My solution is to keep the main openssl.cnf like it is and just at the end to add a new section like [ cert_www.example.com ] where www.example.com is the website for which I want to create a certificate, and in it, put the subjectAltName I would need (and anything else). Of course the section could be named whatever you want. After that, I can run the ...


2

Sounds like the Google "distrusting" of Legacy Symantec PKIs. https://productforums.google.com/forum/#!msg/chromebook-central/c_OUU8KPIqQ/uJkWySlOBgAJ


2

Chrome 67 is pretty old, but your cert has TWO BasicConstraint extensions which violates RFC5280 4.2, and if I replicate that error (by hand!) my up-to-date 71.0.3578.98 exhibits the same symptoms: NET::ERR_CERT_COMMON_NAME_INVALID and 'advanced' claims 'certificate does not specify Subject Alternative Names' -- even though if I 'proceed to $site (unsafe)' ...


2

The Manifest is part of the extension and should not be modified, so while the manifest is set up to allow access to all sites if the browser permissions block it the browser won't run that extension on a tab that it's been blocked from accessing. The reason for this is the extension authors don't know what sites you want it to run on or not to run on so ...


1

One difference is that --privileged mounts /dev and /sys as RW, where as SYS_ADMIN mounts them as RO. This means that a privileged container has full access to devices on the system. SYS_ADMIN doesn't give you that.


Only top voted, non community-wiki answers of a minimum length are eligible