Tag Info

Hot answers tagged

35

You can supply all of that information on the command line. One step self signed passwordless certificate generation: openssl req \ -new \ -newkey rsa:4096 \ -days 365 \ -nodes \ -x509 \ -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \ -keyout www.example.com.key \ -out www.example.com.cert All of the ...


21

Yes, your common name should be *.yourdomain.com for a wildcard certificate. Basically, the Common Name is what states what domain your certificate is good for, so it has to specify the actual domain. Clarification: It shouldn't "contain" the domain name of the sites, it should be the domain of the sites. I'm guessing there is no difference in your ...


19

You need to specify the subject as part of your command. This command is one step, non-interactive, self-signed certificate creation. openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -keyout www.example.com.key -out www.example.com.cert


11

No. See IBM SSL overview The SSL client sends a "client hello" message that lists cryptographic information such as the SSL version and, in the client's order of preference, the CipherSuites supported by the client. The message also contains a random byte string that is used in subsequent computations. The SSL protocol allows for the "client hello" to ...


10

Follow the instructions linked here: http://stackoverflow.com/questions/681695/what-do-i-need-to-do-to-get-internet-explorer-8-to-accept-a-self-signed-certifica It's pretty much the same for IE9, except you have to press the Alt key on your keyboard to get the menu bar to pop up.


10

There are plenty of people that feel that this system is broken. Here's the logic behind why your browser will give you such an alarming warning when an SSL cert is invalid: One of the original design purposes of the SSL infrastructure was to provide authentication of web servers. Basically, if you go to www.bank.com, SSL allows the webserver that responds ...


9

The answer above didn't resolve the issue for me, but I found a similar easy solution with MacPorts: sudo port install curl-ca-bundle To install the Certificate Authrity bundle and then push its reference to the wget settings profile: echo CA_CERTIFICATE=/opt/local/share/curl/curl-ca-bundle.crt >> ~/.wgetrc


7

It looks like you are missing an intermediate CA (Certificate Authority). Certificates are only trusted because they are signed by a trusted certificate authority (the issuer), which is in turn signed by another trusted CA, up to those listed as explicitly trusted by whatever is verifying them (a root CA). Browsers (and OSes) come with a list of root CAs. ...


6

This seems to be a problem with the latest chrome that a lot of people are having, see here http://www.slashgear.com/google-chrome-hit-by-ssl-bug-restricting-google-services-06221921/


6

Export the certificate from Chrome, and then import the certificate into your trusted root certification authority store. Unfortunately Microsoft made this difficult to do. Go to Start | and run the command certmgr.msc. Expand the tree to get to Trusted Root Certification Authorities | Certificates. Go to All Tasks, choose Import and import the certificate ...


6

The Public Key is one way. You can not decrypt the communication with it. You need the private part of the key pair to do the decryption.


6

Be sure that the date of your computer is accurate. A dead CMOS battery might reset the date to the early 2000 every time the computer boots which will prevent a certificate from being valid, since they have an expiration date and a validity date.


6

Sending credentials from page to page is basically doing HTTP POST. There is nothing special about sending credentials comparing to sending e.g. Search terms via POST.If any post to unsecure page would trigger warning, users would be bombarded by pointless warnings. Using secure channel indicates programmer intention to secure the transfer. In this case, ...


5

This is a known issue that deals with having the incorrect system time set. Verify your system time against a network time server first then see if the issue reoccurs. Here's the info on the bug: http://code.google.com/p/chromium/issues/detail?id=22796


5

Here you should have wrong SSL for wrong domain: https://tv.eurosport.com/ Here is expired SSL https://testssl-expire.disig.sk/index.en.html EDIT: Why not to create SSL certs and apache yourself?


4

Below is my script that as a check within nagios. It connects to a specific host, it verifies that the certificate is valid within a threshold set by the -c/-w options. It can check that the CN of the certificate matches the name you expect. You need the python openssl library, and I did all the testing with python 2.7. It would be trivial to have a ...


4

Safari's client certificates and related preferences are stored in Keychain Manager with a kind of certificate. When you select a certificate to use with a web site, it stores another entry in the Keychain Manager with a kind of identity preference. Unfortunately, by default it stores it only for the exact page you were on. Both the name and location are ...


4

On Linux, the certificates are kept in a read-only database, and would reappear on upgrading Chromium. However, you can mark them as untrusted, since the trust bits are stored separately as user preferences. Just click Edit... (Bearbeiten...) and disable all three trust bits. However, keep in mind what @nkvp and others have said – this will make you ...


4

You will need a new certificate if you want to change anything. A FQDN means a complete name: host.domain.tld You are right.


3

Follow these steps to trust a certificate system-wide: Double-click the .crt file. Click Install certificate..., then Next >. Choose Place all certificates in the following store and click Browse... Choose Trusted Root Certification Authorities and click OK. Click Next >, then Finish. This has however the drawback that Windows will trust any ...


3

Better late than never. Yes, browsers will cache intermediate certificates, and use them between different sites. Because of that, if you are missing the intermediate certificate, random users will receive a trust error, while others won't. For example, in Firefox, it will be cached in a file called cert8.db (in your profile folder). To test this, either ...


3

I've been struggling with this myself and the above answer made me realize what was going on. If you had a certificate for a website and it expired, what you should do is remove the old certificate. Then also remove the identity preference type items for that website. These old items are just as much expired as the certificate is. After you remove them, any ...


3

Certificates you get from a CA can not be used to sign other certificates.


3

justhost is a hosting service provider and if you/your company host your mail services on their non-dedicated servers, this umbrella wildcard certificate will be used to secure the connection. There's a limitation in SSL/TLS that the host name the client is connecting to is not revealed to the server until a secure socket has been established. This means ...


3

Apache2 makes this very easy with the additional tools packaged with it. If you have the apache2-common package installed, you can enable the mod_ssl module (required for HTTPS) in one easy command: sudo a2enmod ssl Apache2 also includes a command to help you easily generate self-signed certificates called apache2-ssl-certificate. Generate your ...


3

elance.com is presenting a certificate for akamai.net rather than for itself. Akamai is a well known Content Delivery Network used by many websites to spread the load of servicing many users. It's likely that elance.com contracts with Akamai to provide CDN services and there is some misconfiguration where pages on elance.com are being served by Akamai but ...


3

Connections that are secured by the https:// protocol are indicated by the browser to be "secured". For example, a little Padlock is shown or parts of the URL are marked in green. The user therefore is supposed to trust that the pages he is visiting are indeed from the URL he had entered and are not from someone else. If he is using no https://, the user ...


3

I can't comment, so I'll post this information that complements the correct information of user40350. Yet the same browser has no problem allowing credentials to be sent across unsecured pages. That is actually not even true. Most browsers will show a warning like you're about to submit data over an unsecured connection when you first try that, ...


3

The CA does not need to be online. However, the CA public certificate may point to a web server which has revocation lists. This should be online. Most implmenatations have a list of public CA certificates installed. Users can usually opt to trust a certificate even without the public CA certificate. The webserver will supply its public certificate if ...



Only top voted, non community-wiki answers of a minimum length are eligible