Tag Info

Hot answers tagged

76

Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is essentially a man-in-the-middle attack. It accomplishes this by decrypting and re-encrypting communications using Microsoft's own key. Such tampering, of course, does not go unnoticed. Firefox dutifully reports ...


60

If you have access to OpenSSL, try openssl s_client -connect {HOSTNAME}:{PORT} -showcerts replacing {HOSTNAME} and {PORT} with whatever your values are.


33

To be honest, I have never tried this before (never needed to) however, I have just tried in Firefox and it seems to work for saving: Click on the SSL certificate icon at the top / Padlock at the bottom. Click View Certificate Click on the Details Tab Chose which certificate you want from the hierarchy [not circled in picture] Click Export


30

A quick method to get the certificate pulled and downloaded would be to run the following command which pipes the output from the -showcerts to the x509 ssl command which just strips everything extraneous off. For example: openssl s_client -showcerts -connect server.edu:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem


25

This is a summary of the answers from the thread Disable Google Chrome warning if security certificate is not trusted. You can avoid the message for trusted sites by installing the certificate. This can be done by clicking on the warning icon in the address bar, then click Certificate Information -> Details Tab -> Export... Save the ...


24

Some options to view PFX file details: Open a command prompt and type: certutil -dump <path to cert> Install OpenSSL and use the commands to view the details, such as: openssl pkcs12 -info -in <path to cert> (unverified)


21

man update-ca-certificates: update-ca-certificates is a program that updates the directory /etc/ssl/certs to hold SSL certificates and generates certificates.crt, a concatenated single-file list of certificates. It reads the file /etc/ca-certificates.conf. Each line gives a pathname of a CA certificate under /usr/share/ca-certificates that ...


20

You can avoid the message for trusted sites by installing the certificate. This can be done by clicking on the warning icon in the address bar, then click "Certificate Information" -> Details Tab -> Copy to file Save the certificate, then double click on the certificate file. On the certificate window that opens, click install certificate, then walk ...


18

Using PowerShell: Get-ChildItem -Recurse Cert:


17

Thanks to the link posted by harrymc, I spent almost a day investigating this problem and figured out it was Windows Server 2008 default domain policy. I suspect this problem only applies to Windows PC in a domain network environment. The default domain policy doesn't allow user to install additional certificate to Trusted Root Certification Authorities, ...


17

On Ubuntu 12.04 (precise), you have to drop the certificate file to /usr/local/share/ca-certificates and it has to end ".crt". Then run update-ca-certificates. It should tell you: "1 added, 0 removed; done." Note that unfortunately firefox does not honor the system installed certificates ( http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=316436 ). You can ...


17

There are three types of certificate stores in Windows. User Account store Service Account store Local Computer store Each of the three stores contain a number of folders which certificates go into Personal (can be known as My when using scripts to add certs) Trusted Root Certification Authority (can be known as Root) Enterprise Trust Intermediate ...


15

They're hurrying to obtain certificates from a CA that supports SHA-2 for certificate signing. When a CA "issues" a certificate, it digitally signs a hash of that certificate. The hash used to be in the MD5 algorithm; when MD5 turned out to be completely insecure, SHA-1 became the new recommendation, but it took many years for most websites to migrate from ...


14

For Chrome on OSX, here's a relatively easy way to add the self-signed certificate to the system's Keychain, which is used by Chrome: Google Chrome, Mac OS X and Self-Signed SSL Certificates. No more annoying red warning screen! (I do wish Chromium would simplify adding the exception though.)


13

Yes, it is a different level of certificate, as you say. It's green when it is an Extended Validation Certificate. See Extended Validation Certificate at Wikipedia: "[...] a special type of X.509 certificate which requires more extensive investigation of the requesting entity[2] by the Certificate Authority before being issued. [...]" The cheapest of ...


12

Or run (Start -> Run or just hit WIN+R): certmgr.msc


12

Be sure that the date of your computer is accurate. A dead CMOS battery might reset the date to the early 2000 every time the computer boots which will prevent a certificate from being valid, since they have an expiration date and a validity date.


11

Installing a CA Copy your certificate in PEM format (the format that has ----BEGIN CERTIFICATE---- in it) into /usr/local/share/ca-certificates and name it with a .crt file extension. Then run sudo update-ca-certificates. Caveats: This installation only affects products that use this certificate store. Some products may use other certificate stores; if ...


11

By definition, a self-signed certificate can be trusted only through direct trust, i.e. what Web browsers like Firefox show as the "allow exception" process. One very specific certificate, down to the last bit, is declared as "trusted". Nothing can be changed in a certificate without exiting from this model, and, in particular, the expiry date, which is part ...


10

Follow the instructions linked here: http://stackoverflow.com/questions/681695/what-do-i-need-to-do-to-get-internet-explorer-8-to-accept-a-self-signed-certifica It's pretty much the same for IE9, except you have to press the Alt key on your keyboard to get the menu bar to pop up.


10

Start mmc via Search files or Command Prompt: Menu File → Add/Remove Snap-In... → Add... → Certificates → Add → My User account and/or Computer account → Finish → Close → OK → Browse.


10

In Internet Explorer: Go to Tools (Alt+X) → Internet Options → Content → Certificates.


10

If your system date or time is not wrong, and your problem is still not resolved, try the following. Because this problem is occurring only in your Firefox, but not IE, navigate to the secure site in IE, and determine which certificate is being used, which will be an icon somewhere around the menu bar. Then go to IE > Tools > Internet options > Content > ...


10

You can use OpenSSL directly. Create a Certificate Authority private key (this is your most important key): openssl req -new -newkey rsa:1024 -nodes -out ca.csr -keyout ca.key Create your CA self-signed certificate: openssl x509 -trustout -signkey ca.key -days 365 -req -in ca.csr -out ca.pem Issue a client certificate by first generating the key, then ...


10

Go to the "Java Control Panel", "Secure" tab and click on "Certificates". Go to "System" tab and select "Secure CA" or "Secure Sites CA" from the drop down. IIRC, the certificates are stored in a Java serialised file in jre/lib/security/cacerts. This is a standard Java keystore that can be manipulated with the keytool utility: keytool -keystore ...


9

Instructions for Linux (Chrome 12+): Certificate Information -> Details -> Export Save the certificate as a file of your choice. Preferences -> Under the hood -> Manage certificates -> Authorities Import the file and check all the boxes when it asks. You are done. It is very important to import under the Authorities tab, and not other!


9

Question: What will happen if the private key of a CA is leaked? Meet answer: make fake certificates for any other website


9

dig [zone] dnskey That will show you if there is the required DNSKEY RRset in the zone that will be used to validate the RRsets in the zone. If you want to see if your recursive server is validating the zone, dig +dnssec [zone] dnskey This will set the DO (dnssec OK) bit on the outbound query and cause the upstream resolver to set the AD (authenticated ...


9

This problem has been Reported to Mozilla in their support forum. The reason is that Firefox 33 has fully switched to libPKIX that is more stricter and you can no longer disable this library and fall back to the previous NSS code. See bug 975229 - Remove NSS-based certificate verification, and related Mozilla blog post. It appears that they will not ...



Only top voted, non community-wiki answers of a minimum length are eligible