Hot answers tagged

78

There is a new problem as of July 26h, 2014 when an old, apparently quasi-wide spread certificate expired. Based on https://www.yesthatallen.com/fixing-an-old-digicert-issue/ Instructions for clearing expired DigiCert SSL certificate on OSX   Launching Keychain Access via Spotlight ⌘-Space Type "Keychain Access" Hit return Ensure ...


45

Installing a CA Copy your certificate in PEM format (the format that has ----BEGIN CERTIFICATE---- in it) into /usr/local/share/ca-certificates and name it with a .crt file extension. Then run sudo update-ca-certificates. Caveats: This installation only affects products that use this certificate store. Some products may use other certificate stores; if ...


41

this worked for me: Keychain.app > Preferences > General > Reset My Default Keychain UPDATE A less drastic option is to delete the DigiCert certificate from the login Keychain: you should already have one in the root keychain, anyway. This error appears to occur when the two do not match.


38

man update-ca-certificates: update-ca-certificates is a program that updates the directory /etc/ssl/certs to hold SSL certificates and generates certificates.crt, a concatenated single-file list of certificates. It reads the file /etc/ca-certificates.conf. Each line gives a pathname of a CA certificate under /usr/share/ca-certificates that ...


13

Start mmc.exe (as admin) and add the snapin named "Certificates" and point it to your local machine (Computer Account).


6

certlm.msc will open the local machine's certificate store in the same gui style as certmgr.msc


6

The other answers regarding update-ca-certificates are correct for applications that read from the system certificate store. For Chrome and Firefox, and probably some others, the certificate must be put in the nssdb, the backend for the Mozilla NSS library. From https://code.google.com/p/chromium/wiki/LinuxCertManagement: For example, to trust a root ...


6

Absolutely. As this root certificate is part of the Windows Trust List, the mere act of browsing to such a site (even as a non-admin user) would cause the certificate to be automatically and silently added to your machine trust store. See this blog post for more info and a test site: http://hexatomium.github.io/2015/08/29/why-is-windows/


5

One can edit the certificates on the local computer this way : Start → Run: mmc.exe Menu: File → Add/Remove Snap-in… Under Available snap-ins, select Certificates and press Add. Select Computer Account for the certificates to manage. Press Next. Select Local Computer and press Finish. Press OK to return to the management console. Once the local ...


5

I had same issue, and I had to copy the .pem file to /usr/local/share/ca-certificates, renaming it as .crt. The .cer file can easily be converted to .pem, with openssl, for example, if you don't have the .pem. After copying the file you must execute sudo update-ca-certificates.


3

Actually I just ran sfc /scannow and now it works again...thanks!


3

This is mostly a link only answer, however I do know that if the signing CA isn't marked as trusted by the app (Acrobat in this case) then it won't be marked as trusted. That being said, this link talks about exactly what your asking: http://helpx.adobe.com/acrobat/kb/approved-trust-list2.html


3

Where are the digital certificates storage location on Mac OS X Apple's Mac OS X includes a built-in key and password manager, Keychain, which stores user passwords, user and server certificates, and keys. Source Certificate and Key Management in Mac OS X Where is the Keychain data stored? The keychain data is stored in ~/Library/Keychains/, ...


2

If you generate self sign certificate then the browser will not recognize it as a trusted certificate. You have to get your certificate from trusted CA or from its reseller and you need to follow online procedure for certificate generation. Certificate issued by Certificate Authority will be recognized by 99.9% browsers including chrome, Firefox etc. You do ...


2

None of these answers worked for me. Instead, I found the DigiCert root certificates, downloaded them, and installed them manually by clicking on them in Finder. Find them here under Checking the Intermediate Certificate Store: https://www.digicert.com/ssl-support/windows-cross-signed-chain.htm


2

I have found 4 organizations, trusted by Adobe Acrobat so that the signatures will be considered "valid" in Acrobat Reader, Standard, or Pro, that sell these certificates. They are all expensive (typically $300/year). Note that Adobe has built things so that the person who signs a PDF document MUST use "two-factor authentication" at the time they sign the ...


2

From the same page: Suggested Actions All supported editions of Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2 use the Microsoft Certificate Trust List to validate the trust of a certificate authority. There is no action required for users of these operating systems because Microsoft has removed the DigiNotar root ...


2

You can do that by just moving it to the "Untrusted Certificates" yourself. Which is all Microsoft would do if they were to blacklist the root certificate, although they would do it at a higher level, and it would effect all users if they were to do so. This only works for browsers that respect the operating system's certificate store. Since Firefox uses ...


1

Update 08-Sep-2011 Microsoft have now issued an official fix that covers XP and server 2003 so the code below is no longer required. See the following: http://www.microsoft.com/technet/security/advisory/2607712.mspx http://support.microsoft.com/kb/2607712 Further to my comment about XP and Windows 2003, Microsoft have not (as of 06-Sep-2011) issued an ...


1

For some reason, to stop this happening, I had to add the certificate to both the Registry & Local stores under Trusted Root Certification storage. Odd, but it works.


1

If the server and the workstations are all members of the same Windows domain, you can create a Windows certificate authority for the domain and have it issue a certificate to the web server. The CA's root certificate will automatically be published in Active Directory and all computers that are part of the domain will trust that root certificate and any ...


1

You should add RapidSSL_CA_bundle.pem (the intermediate cert) to the Java keystore. Refer below enlisted url to solve an error of RapidSSL root installation. http://wiki.zimbra.com/index.php?title=Installing_a_RapidSSL_Commercial_Certificate


1

For newer builds based on Debian, you may need to run: sudo dpkg-reconfigure ca-certificates NOTE: sudo dpkg-reconfigure ca-certificates calls update-ca-certificates internally You'll of course still need to copy the certificate (.crt file) to /usr/share/ca-certificates before you do any of this :)


1

Did you try it manually (by double-clicking on the CER file)? If even manually it's not working, you might be encountering a Vista bug. Manual steps to install a Root CA certificate Double-click on the .cer file. On the Certificate dialog box, click Install Certificate to start the Certificate Import Wizard. On the Welcome page, click Next. On the ...


1

It sounds like you might benefit from Perspectives or possibly Convergence.


1

If you don't recognize the common name of the certificate, or don't know where it came from, delete it. If it's from a website, it will likely prompt you to accept it again when you revisit anyway. If this is a work machine you should consult your IT Personnel, but if this is a personal machine, I would just get rid of it and keep going. It's a self signed ...


1

I just tried John's solution, and it didn't help. Although in my case, I didn't find any of the "blue +" icons in Class. So, all I did was delete the two cache files suggested and reboot. In my case, I am trying to update an application in Macports, that uses git to connect to github to download the source, and that is giving the error. And, I see the ...


1

If you are using FireFox then you can use the Certificate Patrol add-in. Set it to warn on new and changed certificates. Then check each warning and accept the certificate.


1

The security preference set to Use expired timestamps means that an expired signature / expired validity is treated as valid. However, a signature date after the end of the validity of document doesn't make sense, which is the case here. Hence, the problem is with the document signer, and not with the person who was issued this PDF from the Indian ...


1

Although I still do not see the "install certificate" even when on fresh installation of Win 8, these steps did it: click on "view certificate" > "details" tab save the certificate to file with "copy to file.." button double-click on just saved certificate file import it into proper store (trusted root CA in my case)



Only top voted, non community-wiki answers of a minimum length are eligible