New answers tagged

0

Faced same issue in Ubuntu 20 and Mariadb 10.2.40, Deployed certs but "have_ssl" was still disabled and solution was to change ownership of all certs to mysql user, group and it solved the issue.


0

In my case. issue was selinux try: semanage permissive -a squid_t then restart your service.


0

Expired certificates on IIS can be removed, since those certificates don't provide any kind of backward-compatibility for older websites and or devices.


1

"Production" and "development" could be considered as two different web sites which happened to run the same application. This means, your problem boils down to running several different web sites with SSL on the same IP address (and port). This problem is the valid use case for the reverse HTTP proxy. Give your sites different names (...


1

In addition to the previous suggestions keep in mind that Google-managed SSL certificates aren't supported for regional external HTTP(S) load balancers and internal HTTP(S) load balancers. For these load balancers you will need to use self-managed SSL certificates. I have not seen what type of load balancer you are using, however before trying to set this ...


0

In my case, the path to ssl_crtd was not being accessible by the squid user, getting the following error in the log: 2021/11/26 09:07:02.781| ipcCreate: /home/claudiu/kits/squid-3.5.27/src/ssl/ssl_crtd: (13) Permission denied Once I moved it to an accessible location, it worked.


2

You will have downtime. You can follow these tips to minimize downtime. With proper planning the downtime will be very short and in some cases automatic retries will make this invisible to clients. However, I do not know the design of your site, the usage of cookies, authentication, session management, etc. There might be disruptions that are unavoidable. If ...


0

server { server_name another.example.com; root /usr/share/nginx/another.example.com; index index.html; location / { try_files $uri $uri/ =404; } listen [::]:443 ssl http2; listen 443 ssl http2; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/...


0

I had the same issue, and finally got the solution. This is a bug in AWS CLI because the certificate is valid. However, in my case, the cert file had an extra space at the end of each line (I don't know why our certificate authority - Sectigo in that case - generated such weird certificates by the way). Removing these extra space did fix the issue. This is ...


1

There's no need to download all the ca certificates if you just wish to add one. Simply download the new ISRG Root X1 root certificate in PEM format from Let's Encrypt's repository (having confirmed that the link is to the genuine HTTPS protected site of course). Rename the file so that it's extension is .crt and place in /usr/local/share/ca-certificates. ...


0

A certificate signed by your own fictitious certificate authority will always throw errors because the CA isn't trusted by your system. To get the green lock you have to add your certificate authority's self-signed certificate to the trusted root certification authorities store on the machine. Even if you trust your fictitious CA on your own machine the ...


0

You likely need to lower your system's crypto policy to LEGACY: update-crypto-policies --set LEGACY Consider creating your own policy to better match your environment. Update: https://access.redhat.com/solutions/5473501 What does curl -v https://subscription.rhsm.redhat.com/subscription/ --cacert /etc/rhsm/ca/redhat-uep.pem yield? If your org does TLS ...


0

What I ended up doing is putting the virtual hosts in SNIProxy on localhost http, and putting NGINX as a HTTPS frontend to it, so that when it recieves a request, it shuttles it to localhost along with the host header. For posterity, here is my configs: For SNIProxy: user nobody pidfile /run/sniproxy/sniproxy.pid error_log { syslog deamon priority ...


0

if you'd like to limit dependencies to openssl, grep, sed and tr and still have easily parseable/iterable output: space separated list: $ openssl x509 -text -in cert.pem | grep DNS | sed s/DNS://g | tr -d ' ' | tr , ' ' output: example.com example.org www.example.com www.example.org newline separated list: $ openssl x509 -text -in cert.pem | grep DNS | ...


2

If updated certificate has same public key (I bet it is the case), then install that public certificate in LocaL Machine\Personal, then run the following command in elevated command prompt: certutil -repairstore my "ab cd ef" where ab cd ef is the serial number of renewed certificate. Replace this string with actual serial number. The command will ...


1

The error implies you have a typo and missed a d out of the command when you entered it the first time (-adext != -addext). If you take exactly what you've shown in the question and just remove all the {} so it uses domain-name.com as the domain, it fails because L= needs a value, but if you add in a value it then works just fine: $ openssl req -new \ > -...


2

Is this possible? Yes. Simply request a certificate from Let's Encrypt for dev.example.com. This can be verified using e.g. DNS challenge, or some other type. What matters is that you can respond to the challenge successfully, and you'll be handed a certificate. If so, should the cert be installed on 2.2.2.2? Does the cert need to be setup in a certain way?...


2

Chrome doesn't support post-handhsake authentication, that is, renegotiating SSL and sending a client certificate when the connection is already established, because (from the Chrome bugreport page) Post-handshake authentication has a mess of security, semantics, and DoS issues. (...) Some spec work is needed to make it defined in HTTP/1.1 at all and, more ...


1

There are two issues with the certificates posted in the question: Both certificates are using one shared key. As a certificate should bind a key to its owner (Subject) it really doesn't make sense to use one key for two subjects. As a consequence of the above, the Subject Key Identifier and Authority Key Identifier hashes are the same across both ...


0

RFC 5280 compliant certificate validation function require that all certificates in the chain (including root certificate) MUST be within their validity periods at the time of validation. That is, proper certificate validation function will fail to validate your certificate chain after root is expired (in 2022). RFC 5280 §6.1.3.a.3: The certificate validity ...


1

The relevant error is "The certificate issuer is unknown". That usually means one of several things: The certificate is self-signed and therefor not trusted. The certificate is signed by a CA, but the CA that issued the certificate is not known to the client The certificate is signed with an intermediate certificate of a known CA, and although ...


4

So how does SSL certificate map to server IP when it is issued for domain name? it doesn't. If certificate is issued to some domain name, then no one cares web server's IP address where resource is located. TLS client checks if requested address (in address bar, for example), matches the name in server certificate. No one cares about IP address, because it ...


Top 50 recent answers are included