Hot answers tagged

96

Edit: This is by far my most popular answer, and it's been a few years on now so I've added an ECDSA variant. If you can use ECDSA you should. You can supply all of that information on the command line. One step self signed passwordless certificate generation: RSA Version openssl req \ -new \ -newkey rsa:4096 \ -days 365 \ -nodes \ ...


31

Yes, your common name should be *.yourdomain.com for a wildcard certificate. Basically, the Common Name is what states what domain your certificate is good for, so it has to specify the actual domain. Clarification: It shouldn't "contain" the domain name of the sites, it should be the domain of the sites. I'm guessing there is no difference in your ...


24

Edit: This question was closed as a duplicate of OpenSSL without prompt. See my accepted answer there as well. This answer has now been updated with an ECDSA variant as well. If you can use ECDSA you should. You need to specify the subject as part of your command. This command is one step, non-interactive, self-signed certificate creation. RSA version ...


23

A certificate contains a public key. The certificate, in addition to the public key, contains additional information, such as issuer, what it's supposed to be used for, and any other type of metadata. Typically a certificate is itself signed with a private key, that verifies its authenticity.


17

Be sure that the date of your computer is accurate. A dead CMOS battery might reset the date to the early 2000 every time the computer boots which will prevent a certificate from being valid, since they have an expiration date and a validity date.


16

No. See IBM SSL overview The SSL client sends a "client hello" message that lists cryptographic information such as the SSL version and, in the client's order of preference, the CipherSuites supported by the client. The message also contains a random byte string that is used in subsequent computations. The SSL protocol allows for the "client hello" to ...


15

Export the certificate from Chrome, and then import the certificate into your trusted root certification authority store. Unfortunately Microsoft made this difficult to do. Go to Start | and run the command certmgr.msc. Expand the tree to get to Trusted Root Certification Authorities | Certificates. Go to All Tasks, choose Import and import the certificate ...


12

There are plenty of people that feel that this system is broken. Here's the logic behind why your browser will give you such an alarming warning when an SSL cert is invalid: One of the original design purposes of the SSL infrastructure was to provide authentication of web servers. Basically, if you go to www.bank.com, SSL allows the webserver that responds ...


11

It looks like you are missing an intermediate CA (Certificate Authority). Certificates are only trusted because they are signed by a trusted certificate authority (the issuer), which is in turn signed by another trusted CA, up to those listed as explicitly trusted by whatever is verifying them (a root CA). Browsers (and OSes) come with a list of root CAs. ...


11

None. As you said, SFTP is SSH2-based. It is not the same as FTPS (FTP over TLS) and does not use X.509 certificates in any way. The server authentication in SSH2 is mostly based around "trust on first use", so the keys are not signed at all. However, many of the problems with self-signed certificates don't apply. The only thing even remotely close is ...


10

Follow the instructions linked here: http://stackoverflow.com/questions/681695/what-do-i-need-to-do-to-get-internet-explorer-8-to-accept-a-self-signed-certifica It's pretty much the same for IE9, except you have to press the Alt key on your keyboard to get the menu bar to pop up.


9

The answer above didn't resolve the issue for me, but I found a similar easy solution with MacPorts: sudo port install curl-ca-bundle To install the Certificate Authrity bundle and then push its reference to the wget settings profile: echo CA_CERTIFICATE=/opt/local/share/curl/curl-ca-bundle.crt >> ~/.wgetrc


9

Better late than never. Yes, browsers will cache intermediate certificates, and use them between different sites. Because of that, if you are missing the intermediate certificate, random users will receive a trust error, while others won't. For example, in Firefox, it will be cached in a file called cert8.db (in your profile folder). To test this, either ...


9

I had the same issue and wrote this... It's quick and dirty, but should work. It'll log (and print to screen with debugging on) any certs which aren't yet valid or expire in the next 90 days. Might contain some bugs, but feel free to tidy it up. #!/bin/sh DEBUG=false warning_days=90 # Number of days to warn about soon-to-expire certs ...


8

Safari's client certificates and related preferences are stored in Keychain Manager with a kind of certificate. When you select a certificate to use with a web site, it stores another entry in the Keychain Manager with a kind of identity preference. Unfortunately, by default it stores it only for the exact page you were on. Both the name and location are ...


7

If you go to Tools -> Internet Options, Advanced tab, and scroll to the bottom, you'll find an option to "Warn about certificate address mismatch", which you can disable; the change will take effect after you restart IE, and should stop the browser from complaining about the cert. Unfortunately, it'll also stop the browser from complaining about address ...


7

Private keys should have reading heavily restricted. Setting permissions to 600 and owned by root should work. However, there are other secure permissions settings - Ubuntu stores keys in a directory with owner root and group ssl-cert and permissions 710. This means that only members of ssl-cert can access any files in that directory. Private keys then have ...


6

Sending credentials from page to page is basically doing HTTP POST. There is nothing special about sending credentials comparing to sending e.g. Search terms via POST.If any post to unsecure page would trigger warning, users would be bombarded by pointless warnings. Using secure channel indicates programmer intention to secure the transfer. In this case, ...


6

The Public Key is one way. You can not decrypt the communication with it. You need the private part of the key pair to do the decryption.


6

Follow these steps to trust a certificate system-wide: Double-click the .crt file. Click Install certificate..., then Next >. Choose Place all certificates in the following store and click Browse... Choose Trusted Root Certification Authorities and click OK. Click Next >, then Finish. This has however the drawback that Windows will trust any ...


6

This seems to be a problem with the latest chrome that a lot of people are having, see here http://www.slashgear.com/google-chrome-hit-by-ssl-bug-restricting-google-services-06221921/


6

Below is my script that as a check within nagios. It connects to a specific host, it verifies that the certificate is valid within a threshold set by the -c/-w options. It can check that the CN of the certificate matches the name you expect. You need the python openssl library, and I did all the testing with python 2.7. It would be trivial to have a ...


6

The following configuration is (or used to be) the best configuration according to SSLLabs: SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 SSLCompression off SSLHonorCipherOrder on SSLCipherSuite ...


5

Your problem might be that your new computer is missing some root certification authority (CA) certificates. See this article: Windows root certificate program members where you can manually download and install all third-party root certificates that are distributed via the Windows Root Certificate Program.


5

This is a known issue that deals with having the incorrect system time set. Verify your system time against a network time server first then see if the issue reoccurs. Here's the info on the bug: http://code.google.com/p/chromium/issues/detail?id=22796


5

Partial paths and wildcards are now supported in more recent versions of OS X. So you can use the Keychain Manager to create an identity preference for an entire web site and/or domain. Partial path example (note that the trailing slash is required!): https://server.mydomain.com/ Wildcard example: *.mydomain.com Full details here (from 'man security' ...


5

Some secure web-sites with certificates from trusted authorities have incorrect configuration such that they don't include a chain of intermediate certificates of trust when serving their own certificate. If you have a system/browser that has seen its share of valid certificates, such intermediaries may already be cached, and you won't be getting any error ...


5

For Mac OS X: Click on the Certificate icon in the address bar. Click on "Certificate Information", then drag and drop the certificate image to your desktop or any other folder. Double click the cer file you've just saved, it will open in the Keychain Access. Choose a keychain to store it (I think this step is specific to Yosemite), for example "login", ...


5

The chain was in crt file, that the original SSL was working off. For GoDaddy there is a 2nd cert - gd_bundle.crt Copy this info and add it to the crt installed on the server. So the original crt on the server had 1 certificate, and after it will have 3 on the same file. This is the chain. I still got contains anchor in chain issues on ssllabs.com ...



Only top voted, non community-wiki answers of a minimum length are eligible