Tag Info

Hot answers tagged

70

You can supply all of that information on the command line. One step self signed passwordless certificate generation: openssl req \ -new \ -newkey rsa:4096 \ -days 365 \ -nodes \ -x509 \ -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \ -keyout www.example.com.key \ -out www.example.com.cert All of the ...


28

Yes, your common name should be *.yourdomain.com for a wildcard certificate. Basically, the Common Name is what states what domain your certificate is good for, so it has to specify the actual domain. Clarification: It shouldn't "contain" the domain name of the sites, it should be the domain of the sites. I'm guessing there is no difference in your ...


22

You need to specify the subject as part of your command. This command is one step, non-interactive, self-signed certificate creation. openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \ -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \ -keyout www.example.com.key \ -out www.example.com.cert


14

No. See IBM SSL overview The SSL client sends a "client hello" message that lists cryptographic information such as the SSL version and, in the client's order of preference, the CipherSuites supported by the client. The message also contains a random byte string that is used in subsequent computations. The SSL protocol allows for the "client hello" to ...


13

Export the certificate from Chrome, and then import the certificate into your trusted root certification authority store. Unfortunately Microsoft made this difficult to do. Go to Start | and run the command certmgr.msc. Expand the tree to get to Trusted Root Certification Authorities | Certificates. Go to All Tasks, choose Import and import the certificate ...


13

Be sure that the date of your computer is accurate. A dead CMOS battery might reset the date to the early 2000 every time the computer boots which will prevent a certificate from being valid, since they have an expiration date and a validity date.


12

There are plenty of people that feel that this system is broken. Here's the logic behind why your browser will give you such an alarming warning when an SSL cert is invalid: One of the original design purposes of the SSL infrastructure was to provide authentication of web servers. Basically, if you go to www.bank.com, SSL allows the webserver that responds ...


10

Follow the instructions linked here: http://stackoverflow.com/questions/681695/what-do-i-need-to-do-to-get-internet-explorer-8-to-accept-a-self-signed-certifica It's pretty much the same for IE9, except you have to press the Alt key on your keyboard to get the menu bar to pop up.


10

A certificate contains a public key. The certificate, in addition to the public key, contains additional information, such as issuer, what it's supposed to be used for, and any other type of metadata. Typically a certificate is itself signed with a private key, that verifies its authenticity.


9

It looks like you are missing an intermediate CA (Certificate Authority). Certificates are only trusted because they are signed by a trusted certificate authority (the issuer), which is in turn signed by another trusted CA, up to those listed as explicitly trusted by whatever is verifying them (a root CA). Browsers (and OSes) come with a list of root CAs. ...


9

The answer above didn't resolve the issue for me, but I found a similar easy solution with MacPorts: sudo port install curl-ca-bundle To install the Certificate Authrity bundle and then push its reference to the wget settings profile: echo CA_CERTIFICATE=/opt/local/share/curl/curl-ca-bundle.crt >> ~/.wgetrc


7

Safari's client certificates and related preferences are stored in Keychain Manager with a kind of certificate. When you select a certificate to use with a web site, it stores another entry in the Keychain Manager with a kind of identity preference. Unfortunately, by default it stores it only for the exact page you were on. Both the name and location are ...


7

Better late than never. Yes, browsers will cache intermediate certificates, and use them between different sites. Because of that, if you are missing the intermediate certificate, random users will receive a trust error, while others won't. For example, in Firefox, it will be cached in a file called cert8.db (in your profile folder). To test this, either ...


6

Follow these steps to trust a certificate system-wide: Double-click the .crt file. Click Install certificate..., then Next >. Choose Place all certificates in the following store and click Browse... Choose Trusted Root Certification Authorities and click OK. Click Next >, then Finish. This has however the drawback that Windows will trust any ...


6

The Public Key is one way. You can not decrypt the communication with it. You need the private part of the key pair to do the decryption.


6

Sending credentials from page to page is basically doing HTTP POST. There is nothing special about sending credentials comparing to sending e.g. Search terms via POST.If any post to unsecure page would trigger warning, users would be bombarded by pointless warnings. Using secure channel indicates programmer intention to secure the transfer. In this case, ...


6

This seems to be a problem with the latest chrome that a lot of people are having, see here http://www.slashgear.com/google-chrome-hit-by-ssl-bug-restricting-google-services-06221921/


5

Some secure web-sites with certificates from trusted authorities have incorrect configuration such that they don't include a chain of intermediate certificates of trust when serving their own certificate. If you have a system/browser that has seen its share of valid certificates, such intermediaries may already be cached, and you won't be getting any error ...


5

I had the same issue and wrote this... It's quick and dirty, but should work. It'll log (and print to screen with debugging on) any certs which aren't yet valid or expire in the next 90 days. Might contain some bugs, but feel free to tidy it up. #!/bin/sh DEBUG=false warning_days=90 # Number of days to warn about soon-to-expire certs ...


5

This is a known issue that deals with having the incorrect system time set. Verify your system time against a network time server first then see if the issue reoccurs. Here's the info on the bug: http://code.google.com/p/chromium/issues/detail?id=22796


5

Your problem might be that your new computer is missing some root certification authority (CA) certificates. See this article: Windows root certificate program members where you can manually download and install all third-party root certificates that are distributed via the Windows Root Certificate Program.


5

On Linux, the certificates are kept in a read-only database, and would reappear on upgrading Chromium. However, you can mark them as untrusted, since the trust bits are stored separately as user preferences. Just click Edit... (Bearbeiten...) and disable all three trust bits. However, keep in mind what @nkvp and others have said – this will make you ...


4

If it's a public CA it is likely an operational error which they would very much want to know about. If it's a private CA or cert then the signer should resign it with a new serial number to get rid of the error (bad form to reuse a serial number... unless you are willing to revoke all certs with that # at the same time). You could download the cert (use ...


4

You can install OpenSSL for Windows, which is free. After installation, open command line (cmd.exe), go to installation directory and run appropriate openssl commands. openssl.exe req -x509 -newkey rsa:2048 -keyout server.key -out server.crt -days 1000 -nodes This generates server.key (private key for your Apache) and server.crt (self-signed ...


4

Below is my script that as a check within nagios. It connects to a specific host, it verifies that the certificate is valid within a threshold set by the -c/-w options. It can check that the CN of the certificate matches the name you expect. You need the python openssl library, and I did all the testing with python 2.7. It would be trivial to have a ...


4

I have had the same problem you have had.....To prevent the re-occcurrence of a specific message do the following when you see it. Select the Security Tab It will have a checkbox option to say something like remember your selection.... Then press the Approve Button. I suspect it is some problem with the incomplete distribution of all the base root ...


4

One can edit the certificates on the local computer this way : Start → Run: mmc.exe Menu: File → Add/Remove Snap-in… Under Available snap-ins, select Certificates and press Add. Select Computer Account for the certificates to manage. Press Next. Select Local Computer and press Finish. Press OK to return to the management console. Once the local ...


4

You will need a new certificate if you want to change anything. A FQDN means a complete name: host.domain.tld You are right.


3

As long as the hostname is the same, there is no technical reason why you can't use the same certificate. However, there may be legal reasons -- some certificate issuers only license them for use on a single server. If it's two services on the same server it may be OK anyway, but you should carefully read the terms and conditions of your certificate issuer.



Only top voted, non community-wiki answers of a minimum length are eligible