42

According to the SSL FAQ: the validity (and thus level of trust) of a given certificate is determined by the corresponding validity of the higher-level certificate that signed it. So while it is technically possible to make a certificate which lasts longer than its issuer, it makes no sense, as the chain becomes broken the moment an intermediate (or the ...


15

The signature of the certificate depends only on the public key in the issuer certificate and not on the expiration of the issuers certificate or other parameters. The path validation though depends on all certificates in the trust chain not being expired. If the client has only the server certificate and an expired issuer certificate then the path ...


13

Writing a comprehensive tutorial on this might not be suitable for a Q/A site, but here's some advices. Also, this is from the perspective of managing the installation for a single client within their own intranet. For e.g. SaaS installations it's better to use global FQDNs & PKI. As a software vendor, you SHOULD NOT: implement own PKI and push it ...


11

Let's Encrypt requires Internet connectivity, but that is needed by the EFF ISRG who run it. Certbot (which runs on your computer) communicates with Let's Encrypt to issue and renew certs and does require connectivity from your computer. A valid domain name (in the case of Let's Encrypt) is a domain you set up which can be resolved by the global DNS ...


10

Don't introduce root CAs into other organisations Using self-signed certificates and distributing them through Active Directory is possible, but fairly involved. Esa Jokinen goes into more detail in his answer. More important are the security implications; root certificates are like a master key, all certificates signed by a root certificate in AD will be ...


10

Please note you have to wait for a while until changes in your DNS zone will be updated on servers worldwide. Your problem is that you're trying to check if changes are applied to the DNS too fast. There is a good way out from this case and it requires using DNS provider's API. If you use for instance OVH, you can use their API for DNS changes and certbot ...


9

No, or not necessarily. .dev like all new Google TLDs (including .new in one month) has been added to the HSTS Preloading list. It means that all names under this TLD will force browsers (because they incorporate the HSTS preloading list) to do only HTTPS calls, and never HTTP one. You can find Google explanations at https://security.googleblog.com/2017/09/...


7

If you are on Postfix >=3.4, consider the following steps below as adapted from this link: Step 1: Comment out the top two lines and add the follow lines to /etc/postfix/main.cf: --- # smtpd_tls_cert_file = /etc/pki/dovecot/certs/dovecot.pem # smtpd_tls_key_file = /etc/pki/dovecot/private/dovecot.pem # provide the primary certificate for the server, to ...


7

Note that in a zone file, names not ending with a dot . are relative, usually to the current domain. So an entry for _acme-challenge.db.example.com inside the zone for db.example.com actually means an entry for _acme-challenge.db.example.com.db.example.com. To make sure you have the right entry, you can either: Add a dot a the end: _acme-challenge.db....


7

If you only have one IP address, you need to set all sites that are using HTTPS to require Server Name Identification so that IIS knows what cert to use for clients connecting to which site. Either each site needs to use SNI, or you must use different ports, or different IP addresses. By default most webservers assume that if you're coming to them with HTTPS,...


5

In ubuntu, add the ca-cert as described here: https://askubuntu.com/questions/73287/how-do-i-install-a-root-certificate wget https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem sudo mkdir /usr/local/share/ca-certificates/aws sudo mv rds-ca-2019-root.pem /usr/local/share/ca-certificates/aws sudo openssl x509 \ -in /usr/local/share/ca-...


5

This behavior sounds a lot like an HSTS (https://en.m.wikipedia.org/wiki/HTTP_Strict_Transport_Security) header was set for the domain. The good news is that you can simply stop applying it and the effects will eventually go away. The bad news is that it’s usually set to at least six months, and the only way to stop it earlier is to have all clients clear ...


4

extnValue isn't empty, it's 30 00, which is an empty sequence. https://tools.ietf.org/html/rfc5280#section-4.2.1.9 says that the encoding of a Basic Constraints extension value is BasicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLenConstraint INTEGER (0..MAX) OPTIONAL } The empty sequence is therefore ...


3

Adding the server name as follows worked for me: openssl s_client -connect server.com:443 -servername server.com


3

Just like the post OP answered himself, postgres has the default sslmode set to prefer, and this is the excerpt from the doc: I don't care about encryption, but I wish to pay the overhead of encryption if the server supports it. So by default, the pg driver will not verify the certificates unless specified; and this is exactly why to OP's original ...


3

There are two sides to this certificate update: On the server side: Any RDS instances created before 2019-11-01 require a restart. This incurs an outage of ~5 minutes. This will update them to have the new certificates in place. If your clients use SSL (off/prefer by default), then you need to update the certificates (intermediate+chain) from AWS on ...


3

subdomain.subdomain.domain.com is a little bit confusing. Unifying might help for explanation: A subdomain is every part left of the most right dot. Only the most right part (com) is no subdomain. It is a Top Level Domain (TLD). Terminology: subsubdomain.subdomain.domain.com | | | | | | | \---> TLD: ...


3

This should work certbot-auto certonly --server https://acme-v02.api.letsencrypt.org/directory --manual --preferred-challenges dns -d 'uncovery.net,*.uncovery.net' Afterwards don't forget to point fullchain.pem and privkey.pem in your apache config ssl settings. usually, those located at /etc/letsencrypt/live/uncovery.net/fullchain.pem /etc/letsencrypt/...


3

Ah. The answer to this seems to be that you in fact can put all 4 IP addresses into the A-record. But that you have to put them all into the same record, rather than 4 records one with each. It seems the way to use the UI to put multiple IP addresses into the one A record is to use this tiny 'plus' icon next to the text box. It then adds another row with a ...


3

There should not be any kind of error which is because the switch of the site certificate. As long as your certificate is valid and trusted by browsers, you should encounter no issues.


3

It must be a SiteGround policy. I haven't met such a restriction elsewhere. I suggest you issue the certificate yourself, if it's possible to install a certificate of your preference, not only the ones issued by them. You can even issue a free Let's encrypt certificate yourself, although it's got some procedure. Else buy one from another CA.


2

As of OpenSSL 1.1.1, providing subjectAltName directly on command line becomes much easier, with the introduction of the -addext flag to openssl req Example: export HOST="my.host" export IP="127.0.0.1" openssl req -newkey rsa:4096 -nodes -keyout ${HOST}.key -x509 -days 365 -out ${HOST}.crt -addext 'subjectAltName = IP:${IP}' -subj '/C=US/...


2

Basically, and for your needs (that started this whole thread) your wildcard certificate should be specified as both root AND first-level wildcards: "example.com, *.example.com" This way, a single wildcard certificate will cover both the root domain (example.com) AND any first-level subdomains (sub1.example.com, sub2.example.com, ...) A certificate in the ...


2

To create a self-signed certificate along with subjectAltName openssl req \ -x509 \ -newkey rsa:4096 \ -sha256 \ -days 3560 \ -nodes \ -keyout certs/domain.key \ -out certs/domain.crt \ -subj '/CN=myregistrydomain.com' \ -extensions san \ -config <( \ echo '[req]'; \ echo 'distinguished_name=req'; \ echo '[san]'; \ echo 'subjectAltName=IP:127.0.0....


2

Before upgrading Certificate authority in RDS to rds-ca-2019, without connection interruption, you can upgrade certificate on client-side. If your RDS has rds-ca-2015, you should upgrade the client-side key with this https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem. As per AWS document https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/...


2

I know this is an old question, but I saw no one provided a workable solution for windows 7 using only powershell. That didn't require the extra hassle of importing it into the certificate store,other tom foolery like using IE or certutil. I happened to have the same issue today, and this is the solution I came up with: $cert = New-Object System.Security....


2

Agreeing with timeSmith's answer that the permissions on these files and folders are intentionally tight, and should be left as 0700. You need to run service httpd or apachectl commands as sudo so that these processes have root privileges and get read access to the letsencrypt certificate folders and files.


2

Updated answer for Solaris 11 (even though tags specify 10, this was the first hit when I needed the same info, but for Solaris 11): /etc/certs/CA/ in PEM format, vendor provided. Not sure about back-porting from 11 to 10. https://docs.oracle.com/cd/E53394_01/html/E54783/kmf-cacerts.html


2

There is a project to give a name to every IPv6 address. They have a corresponding Docker image that runs Let's Encrypt on those names. This is not exactly the same as "a cert for an IPv6 address" but it is pretty close and it is automated. https://ungleich.ch/u/blog/has-a-name-for-every-ipv6-address/ https://ungleich.ch/u/blog/fully-automated-ssl-...


2

if the case it's similar to my servers at a site, in which I have the public ip ports 80 and 443 forwarded to the private ip ports 8080 and 8443, you can do it this way: certbot certonly --manual that will ask you to make available a hash in a particular URL, easily accomplished by creating a file in your root webserver directory with the requested contents,...


Only top voted, non community-wiki answers of a minimum length are eligible