Tag Info

Hot answers tagged

48

You can supply all of that information on the command line. One step self signed passwordless certificate generation: openssl req \ -new \ -newkey rsa:4096 \ -days 365 \ -nodes \ -x509 \ -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \ -keyout www.example.com.key \ -out www.example.com.cert All of the ...


22

Yes, your common name should be *.yourdomain.com for a wildcard certificate. Basically, the Common Name is what states what domain your certificate is good for, so it has to specify the actual domain. Clarification: It shouldn't "contain" the domain name of the sites, it should be the domain of the sites. I'm guessing there is no difference in your ...


20

You need to specify the subject as part of your command. This command is one step, non-interactive, self-signed certificate creation. openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \ -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \ -keyout www.example.com.key \ -out www.example.com.cert


12

Be sure that the date of your computer is accurate. A dead CMOS battery might reset the date to the early 2000 every time the computer boots which will prevent a certificate from being valid, since they have an expiration date and a validity date.


12

No. See IBM SSL overview The SSL client sends a "client hello" message that lists cryptographic information such as the SSL version and, in the client's order of preference, the CipherSuites supported by the client. The message also contains a random byte string that is used in subsequent computations. The SSL protocol allows for the "client hello" to ...


11

There are plenty of people that feel that this system is broken. Here's the logic behind why your browser will give you such an alarming warning when an SSL cert is invalid: One of the original design purposes of the SSL infrastructure was to provide authentication of web servers. Basically, if you go to www.bank.com, SSL allows the webserver that responds ...


10

Follow the instructions linked here: http://stackoverflow.com/questions/681695/what-do-i-need-to-do-to-get-internet-explorer-8-to-accept-a-self-signed-certifica It's pretty much the same for IE9, except you have to press the Alt key on your keyboard to get the menu bar to pop up.


10

Export the certificate from Chrome, and then import the certificate into your trusted root certification authority store. Unfortunately Microsoft made this difficult to do. Go to Start | and run the command certmgr.msc. Expand the tree to get to Trusted Root Certification Authorities | Certificates. Go to All Tasks, choose Import and import the certificate ...


9

The answer above didn't resolve the issue for me, but I found a similar easy solution with MacPorts: sudo port install curl-ca-bundle To install the Certificate Authrity bundle and then push its reference to the wget settings profile: echo CA_CERTIFICATE=/opt/local/share/curl/curl-ca-bundle.crt >> ~/.wgetrc


7

It looks like you are missing an intermediate CA (Certificate Authority). Certificates are only trusted because they are signed by a trusted certificate authority (the issuer), which is in turn signed by another trusted CA, up to those listed as explicitly trusted by whatever is verifying them (a root CA). Browsers (and OSes) come with a list of root CAs. ...


6

This seems to be a problem with the latest chrome that a lot of people are having, see here http://www.slashgear.com/google-chrome-hit-by-ssl-bug-restricting-google-services-06221921/


6

Safari's client certificates and related preferences are stored in Keychain Manager with a kind of certificate. When you select a certificate to use with a web site, it stores another entry in the Keychain Manager with a kind of identity preference. Unfortunately, by default it stores it only for the exact page you were on. Both the name and location are ...


6

The Public Key is one way. You can not decrypt the communication with it. You need the private part of the key pair to do the decryption.


6

Sending credentials from page to page is basically doing HTTP POST. There is nothing special about sending credentials comparing to sending e.g. Search terms via POST.If any post to unsecure page would trigger warning, users would be bombarded by pointless warnings. Using secure channel indicates programmer intention to secure the transfer. In this case, ...


5

This is a known issue that deals with having the incorrect system time set. Verify your system time against a network time server first then see if the issue reoccurs. Here's the info on the bug: http://code.google.com/p/chromium/issues/detail?id=22796


5

Your problem might be that your new computer is missing some root certification authority (CA) certificates. See this article: Windows root certificate program members where you can manually download and install all third-party root certificates that are distributed via the Windows Root Certificate Program.


5

Some secure web-sites with certificates from trusted authorities have incorrect configuration such that they don't include a chain of intermediate certificates of trust when serving their own certificate. If you have a system/browser that has seen its share of valid certificates, such intermediaries may already be cached, and you won't be getting any error ...


4

A certificate contains a public key. The certificate, in addition to the public key, contains additional information, such as issuer, what it's supposed to be used for, and any other type of metadata. Typically a certificate is itself signed with a private key, that verifies its authenticity.


4

I had the same issue and wrote this... It's quick and dirty, but should work. It'll log (and print to screen with debugging on) any certs which aren't yet valid or expire in the next 90 days. Might contain some bugs, but feel free to tidy it up. #!/bin/sh DEBUG=false warning_days=90 # Number of days to warn about soon-to-expire certs ...


4

Below is my script that as a check within nagios. It connects to a specific host, it verifies that the certificate is valid within a threshold set by the -c/-w options. It can check that the CN of the certificate matches the name you expect. You need the python openssl library, and I did all the testing with python 2.7. It would be trivial to have a ...


4

Hej, I just ran into a similar problem, and this thread is one of the first hits on google regarding links and certificates, so I'll answer even if the question is already relatively old. ;) I quickly peeked into the code, and it seems that the relevant function is verify_cert in https.c. The behavior seems to be hard-coded, so there's nothing a user can ...


4

On Linux, the certificates are kept in a read-only database, and would reappear on upgrading Chromium. However, you can mark them as untrusted, since the trust bits are stored separately as user preferences. Just click Edit... (Bearbeiten...) and disable all three trust bits. However, keep in mind what @nkvp and others have said – this will make you ...


4

You will need a new certificate if you want to change anything. A FQDN means a complete name: host.domain.tld You are right.


3

Follow these steps to trust a certificate system-wide: Double-click the .crt file. Click Install certificate..., then Next >. Choose Place all certificates in the following store and click Browse... Choose Trusted Root Certification Authorities and click OK. Click Next >, then Finish. This has however the drawback that Windows will trust any ...


3

Better late than never. Yes, browsers will cache intermediate certificates, and use them between different sites. Because of that, if you are missing the intermediate certificate, random users will receive a trust error, while others won't. For example, in Firefox, it will be cached in a file called cert8.db (in your profile folder). To test this, either ...


3

I've been struggling with this myself and the above answer made me realize what was going on. If you had a certificate for a website and it expired, what you should do is remove the old certificate. Then also remove the identity preference type items for that website. These old items are just as much expired as the certificate is. After you remove them, any ...


3

elance.com is presenting a certificate for akamai.net rather than for itself. Akamai is a well known Content Delivery Network used by many websites to spread the load of servicing many users. It's likely that elance.com contracts with Akamai to provide CDN services and there is some misconfiguration where pages on elance.com are being served by Akamai but ...


3

justhost is a hosting service provider and if you/your company host your mail services on their non-dedicated servers, this umbrella wildcard certificate will be used to secure the connection. There's a limitation in SSL/TLS that the host name the client is connecting to is not revealed to the server until a secure socket has been established. This means ...


3

Apache2 makes this very easy with the additional tools packaged with it. If you have the apache2-common package installed, you can enable the mod_ssl module (required for HTTPS) in one easy command: sudo a2enmod ssl Apache2 also includes a command to help you easily generate self-signed certificates called apache2-ssl-certificate. Generate your ...



Only top voted, non community-wiki answers of a minimum length are eligible