181
votes
What is the difference between a certificate and a key with respect to SSL?
These two pictures together explained everything to me:
Source: linuxvoice
Source: infosecinstitute
- 2,707
101
votes
Why does my browser think that https://1.1.1.1 is secure?
The GoDaddy documentation is mistaken. It is not true that Certification Authorities (CAs) must revoke certificates for all IP addresses… just reserved IP addresses.
Source: https://cabforum.org/...
- 19.6k
99
votes
Accepted
Why does my browser think that https://1.1.1.1 is secure?
English is ambiguous. You were parsing it like this:
(intranet names) or (IP addresses)
i.e. ban the use of numeric IP addresses entirely. The meaning that matches what you're seeing is:
intranet (...
- 5,920
60
votes
Accepted
cURL on Ubuntu 14: all Let's Encrypt certificates are expired (error 60)
The reason is that the "DST Root CA X3" certificate has expired yesterday.
To fix it, just disable the certificate on your server. Run:
sudo dpkg-reconfigure ca-certificates
On the first ...
- 1,121
45
votes
Why does my browser think that https://1.1.1.1 is secure?
Looks like the Certificate Subject Alt Name includes the IP address:
Not Critical
DNS Name: *.cloudflare-dns.com
IP Address: 1.1.1.1
IP Address: 1.0.0.1
DNS Name: cloudflare-dns.com
IP Address: 2606:...
- 7,955
34
votes
ERR_SSL_KEY_USAGE_INCOMPATIBLE Solution
I solve this problem by changing keyUsage = keyEncipherment, dataEncipherment to keyUsage = nonRepudiation, digitalSignature, keyEncipherment in the section v3_req in file req.conf like acme.sh does, ...
- 441
31
votes
cURL on Ubuntu 14: all Let's Encrypt certificates are expired (error 60)
Edit the file /etc/ca-certificates.conf
Find and comment with ! the line like this
!mozilla/DST_Root_CA_X3.crt
Save the file and update certificates with command
sudo update-ca-certificates
- 459
28
votes
What is the difference between a certificate and a key with respect to SSL?
Let me explain with an example.
In normal key-pair based PKI, there are private key and public key.
In a certificate-based system, there are private key and certificate. Certificate holds more ...
- 471
27
votes
Accepted
How to provide a verified server certificate for Remote Desktop (RDP) connections to Windows 10
You can set this host machine to use and present your (existing) externally-verified SSL certificate thus (instructions probably also work for Windows 8 & 8.1, may or may not work for Windows 7) (...
- 1,386
27
votes
How to add a domain to existing certificate generated by Let’s Encrypt/Certbot?
With certbot 0.34.0, the procedure is simple and easy (depending on your system, substitute certbot-auto or ~/certbot-auto for certbot):
First, list your existing certificate and domains:
sudo ...
- 695
22
votes
Accepted
Create Certificate Signing Request (CSR) with Subject Alternative Name (SAN) on Windows without third party tools
Found the way to do it:
MMC -> Certificates(Local Computer) -> Right click on the Personal folder -> All Tasks -> Advanced Operations -> Create Custom Request...
I choose Proceed without enrollment ...
- 2,074
21
votes
Accepted
How do I use the openssl command to decode a certificate/public key .PEM file?
If you want to view a public key in PKCS#1 format, you can use:
openssl rsa -pubin -in <file> -text
- 4,084
20
votes
How to fix Firefox 59 no longer accepting my self signed SSL certificate on .dev virtualhost
There is an easy way around this.
Go to about:config
Search for "network.stricttransportsecurity.preloadlist".
Set it to false.
WARNING: This will disable HSTS entirely. Take a look at the ...
- 343
19
votes
How to provide a verified server certificate for Remote Desktop (RDP) connections to Windows 10
Here are the basic steps I use:
Get a valid certificate that for the host, (it doesn't have to come from an external CA, but all your machines have to trust it). Make sure it has the correct hostname,...
- 13.7k
19
votes
Accepted
Getting SSL certificate error on valid certificate when accessing via Curl
You didn't provide the actual address of the website, nor the SSL provider's name, nor any other information about the certificate, and basically want us to guess at various possible causes.
My guess ...
16
votes
Accepted
How to fix Firefox 59 no longer accepting my self signed SSL certificate on .dev virtualhost
I still am not entirely clear on how this all fits together exactly, but as pointed out in this answer .dev domains are now official TLDs. As such, it seems that browsers force some kind of HSTS ...
- 540
14
votes
How to fix Firefox 59 no longer accepting my self signed SSL certificate on .dev virtualhost
Setting security.enterprise_roots.enabled to true on the about:config page solved this for me and allowed my self-signed certificate to work during development.
There's a bit of discussion around the ...
- 241
14
votes
How do I use the openssl command to decode a certificate/public key .PEM file?
how do I use the oppenssl command to decode it into a list of human-readable fields.
openssl x509 -in NAME.pem -text -noout
Replace 'NAME' with whatever filename your .pem file has.
- 737
11
votes
How to make Chrome trust Windows system root CA certificate?
Chrome uses the Certificate Store on Windows for validating certificates. If Chrome is complaining, then the certificate is not installed on Trusted Root Certificates on your local machine or the ...
- 329
11
votes
Accepted
netsh "Error: 87 The parameter is incorrect" when using hostnameport
The problem is a bug in the netsh command. When using "hostnameport" you must also add the "certstorename=MY" parameter. This is the default value for certstorename, and it is explicitly documented ...
- 337
10
votes
Can't make Chrome to trust my certificate
certificate need to contain Subject Alternativ Name
I had a similar issue with our internal websites. I have certificate of my certification authority in computer root trusted store without no result....
- 101
9
votes
How is ESET Smart Security able to intercept my HTTPS traffic?
How do I disable "Banking & Payment protection"?
I don’t want ESET to be able to intercept my HTTPS traffic at all!
You can permanently disable "Banking & Payment protection" as follows:
...
- 157k
9
votes
Accepted
Installing vagrant plugin on the corporate network
The Ruby file hackery in the comments/answers is definitely not recommended as it negates the benefits of having SSL protecting your connections.
The "right" way (aka IT won't hunt you down way) is ...
- 1,042
8
votes
How to view SSL-certificate details in Firefox mobile
They have a ticket open for it:
https://bugzilla.mozilla.org/show_bug.cgi?id=1612336
You can sign in and vote for it and the feature might be added sooner.
- 267
7
votes
Permissions for SSL key?
I had an issue getting nginx setup and came across this question. The other answer here has already directly answered the question but I thought a little more information would be helpful.
Normally, ...
- 330
7
votes
Avoid password prompt for keys and prompts for DN information
The accepted answer needs a couple of small corrections.
EC Lines:
-newkey ec
-pkeyopt ec_paramgen_curve:prime256v1
should be:
-newkey ec \
-pkeyopt ec_paramgen_curve:prime256v1 \
On MacOS - ...
- 217
7
votes
cURL on Ubuntu 14: all Let's Encrypt certificates are expired (error 60)
FYI on CentOS like (RPM Based) systems, use:
yum reinstall ca-certificates
- 179
6
votes
Wildcard SSL common name - can it be called anything?
Actually, you should use dnsName entries in the subjectAltName section of the certificate to specify the FQDNs, not the CN part of the subject. Using the subject for this purpose has been deprecated ...
- 201
6
votes
google.com versus google [.pl | .fr | .ca | ...] SHA-256 fingerprint?
The Google servers choose different certificates based on which cipher suites the client offers in client_hello. The certificate your OpenSSL client gets contains a RSA public key. The certificate ...
6
votes
ERR_SSL_KEY_USAGE_INCOMPATIBLE Solution
This issue is related to the value of the 'KeyUsage' parameter in the SSL config of 'v3_req'.
Removing 'KeyUsage' from the config will imply that any usage is valid for the certificate. For some ...
- 71
Only top scored, non community-wiki answers of a minimum length are eligible