Tag Info

Hot answers tagged

47

If you have access to OpenSSL, try openssl s_client -connect {HOSTNAME}:{PORT} -showcerts replacing {HOSTNAME} and {PORT} with whatever your values are.


26

To be honest, I have never tried this before (never needed to) however, I have just tried in Firefox and it seems to work for saving: Click on the SSL certificate icon at the top / Padlock at the bottom. Click View Certificate Click on the Details Tab Chose which certificate you want from the hierarchy [not circled in picture] Click Export


21

A quick method to get the certificate pulled and downloaded would be to run the following command which pipes the output from the -showcerts to the x509 ssl command which just strips everything extraneous off. For example: openssl s_client -showcerts -connect server.edu:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem


18

You can avoid the message for trusted sites by installing the certificate. This can be done by clicking on the warning icon in the address bar, then click "Certificate Information" -> Details Tab -> Copy to file Save the certificate, then double click on the certificate file. On the certificate window that opens, click install certificate, then walk ...


17

Using PowerShell: Get-ChildItem -Recurse Cert:


17

man update-ca-certificates: update-ca-certificates is a program that updates the directory /etc/ssl/certs to hold SSL certificates and generates certificates.crt, a concatenated single-file list of certificates. It reads the file /etc/ca-certificates.conf. Each line gives a pathname of a CA certificate under /usr/share/ca-certificates that ...


16

Some options to view PFX file details: Open a command prompt and type: certutil -dump <path to cert> Install OpenSSL and use the commands to view the details, such as: openssl pkcs12 -info -in <path to cert> (unverified)


16

This is a summary of the answers from the thread Disable Google Chrome warning if security certificate is not trusted. You can avoid the message for trusted sites by installing the certificate. This can be done by clicking on the warning icon in the address bar, then click Certificate Information -> Details Tab -> Export... Save the ...


16

On Ubuntu 12.04 (precise), you have to drop the certificate file to /usr/local/share/ca-certificates and it has to end ".crt". Then run update-ca-certificates. It should tell you: "1 added, 0 removed; done." Note that unfortunately firefox does not honor the system installed certificates ( http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=316436 ). You can ...


16

There are three types of certificate stores in Windows. User Account store Service Account store Local Computer store Each of the three stores contain a number of folders which certificates go into Personal (can be known as My when using scripts to add certs) Trusted Root Certification Authority (can be known as Root) Enterprise Trust Intermediate ...


14

For Chrome on OSX, here's a relatively easy way to add the self-signed certificate to the system's Keychain, which is used by Chrome: Google Chrome, Mac OS X and Self-Signed SSL Certificates. No more annoying red warning screen! (I do wish Chromium would simplify adding the exception though.)


13

Yes, it is a different level of certificate, as you say. It's green when it is an Extended Validation Certificate. See Extended Validation Certificate at Wikipedia: "[...] a special type of X.509 certificate which requires more extensive investigation of the requesting entity[2] by the Certificate Authority before being issued. [...]" The cheapest of ...


13

Thanks to the link posted by harrymc, I spent almost a day investigating this problem and figured out it was Windows Server 2008 default domain policy. I suspect this problem only applies to Windows PC in a domain network environment. The default domain policy doesn't allow user to install additional certificate to Trusted Root Certification Authorities, ...


10

In Internet Explorer: Go to Tools (Alt+X) → Internet Options → Content → Certificates.


10

Start mmc via Search files or Command Prompt: Menu File → Add/Remove Snap-In... → Add... → Certificates → Add → My User account and/or Computer account → Finish → Close → OK → Browse.


10

Or run (Start -> Run or just hit WIN+R): certmgr.msc


10

Follow the instructions linked here: http://stackoverflow.com/questions/681695/what-do-i-need-to-do-to-get-internet-explorer-8-to-accept-a-self-signed-certifica It's pretty much the same for IE9, except you have to press the Alt key on your keyboard to get the menu bar to pop up.


10

By definition, a self-signed certificate can be trusted only through direct trust, i.e. what Web browsers like Firefox show as the "allow exception" process. One very specific certificate, down to the last bit, is declared as "trusted". Nothing can be changed in a certificate without exiting from this model, and, in particular, the expiry date, which is part ...


9

https://gmail.com/ does not use a bad certificate. Here is its current certificate, as intercepted by Fiddler2: == Server Certificate ========== [Subject] CN=gmail.com, O=Google Inc, L=Mountain View, S=California, C=US [Issuer] CN=Google Internet Authority G2, O=Google Inc, C=US [Serial Number] 4F4A246099981C2C [Not Before] 16/07/2014 10:04:37 PM ...


9

dig [zone] dnskey That will show you if there is the required DNSKEY RRset in the zone that will be used to validate the RRsets in the zone. If you want to see if your recursive server is validating the zone, dig +dnssec [zone] dnskey This will set the DO (dnssec OK) bit on the outbound query and cause the upstream resolver to set the AD (authenticated ...


9

Question: What will happen if the private key of a CA is leaked? Meet answer: make fake certificates for any other website


9

If your system date or time is not wrong, and your problem is still not resolved, try the following. Because this problem is occurring only in your Firefox, but not IE, navigate to the secure site in IE, and determine which certificate is being used, which will be an icon somewhere around the menu bar. Then go to IE > Tools > Internet options > Content > ...


8

Instructions for Linux (Chrome 12+): Certificate Information -> Details -> Export Save the certificate as a file of your choice. Preferences -> Under the hood -> Manage certificates -> Authorities Import the file and check all the boxes when it asks. You are done. It is very important to import under the Authorities tab, and not other!


8

You can trying using this batch file : @echo off cls :: Set the varibles - Use Quotes "" if there are spaces in the source or log path set log_path=C:\EFS_Find :: Find Encrypted Files cipher /s C:\ | findstr "^.E" >> %log_path%\found.txt && echo:Encrypted files found" :: Find Hidden Files attrib /s C:\ 2>nul | findstr "^....H" >> ...


7

Does this Microsoft article help: Manage Trusted Root Certificates


7

No, proceeding is not safe; your ISP is performing a man-in-the-middle attack on your encrypted traffic, and can therefore read all traffic if they choose so. Is there any solution for this Yes: Get a new ISP. As a side note: I am very surprised; I have never heard of an ISP doing this, and I would not even consider such a company a proper ISP (since ...


7

Certificate storeNames are as follows (source) : AddressBook: Certificate store for other people and resources. AuthRoot: Certificate store for third-party certification authorities (CAs). CertificationAuthority: Certificate store for intermediate certification authorities (CAs). Disallowed: Certificate store for certificates that have been revoked so they ...


7

gmail.com uses a good certificate, but the server you are connecting to is using Server Name Indication to run virtual hosts on a single address+port. For this to work, the client must tell the server what virtual host it's looking for before the SSL/TLS negotiation is done. Firefox and Chromium (and other clients of similar size) do this automatically. To ...


7

The bug has no relation to certificates themselves. The bug is in the implementation of OpenSSL library, which makes it possible for malicious attacker to retrieve the private key of the server and other confidential information. With the private key, the attacker can impersonate your web site, and possibly eavesdrop the traffic between your server and the ...



Only top voted, non community-wiki answers of a minimum length are eligible