Hot answers tagged

78

There is a new problem as of July 26h, 2014 when an old, apparently quasi-wide spread certificate expired. Based on https://www.yesthatallen.com/fixing-an-old-digicert-issue/ Instructions for clearing expired DigiCert SSL certificate on OSX   Launching Keychain Access via Spotlight ⌘-Space Type "Keychain Access" Hit return Ensure ...


75

Installing a CA Copy your certificate in PEM format (the format that has ----BEGIN CERTIFICATE---- in it) into /usr/local/share/ca-certificates and name it with a .crt file extension. Then run sudo update-ca-certificates. Caveats: This installation only affects products that use this certificate store. Some products may use other certificate stores; if ...


41

man update-ca-certificates: update-ca-certificates is a program that updates the directory /etc/ssl/certs to hold SSL certificates and generates certificates.crt, a concatenated single-file list of certificates. It reads the file /etc/ca-certificates.conf. Each line gives a pathname of a CA certificate under /usr/share/ca-certificates that ...


41

this worked for me: Keychain.app > Preferences > General > Reset My Default Keychain UPDATE A less drastic option is to delete the DigiCert certificate from the login Keychain: you should already have one in the root keychain, anyway. This error appears to occur when the two do not match.


15

Start mmc.exe (as administrator), menu File -> Add/Remove Snap-in.., select "Certificates", press Add, select radio button "Computer account", press Finish and OK.


7

certlm.msc will open the local machine's certificate store in the same GUI style as certmgr.msc.


7

I had same issue, and I had to copy the .pem file to /usr/local/share/ca-certificates, renaming it as .crt. The .cer file can easily be converted to .pem, with openssl, for example, if you don't have the .pem. After copying the file you must execute sudo update-ca-certificates.


6

The other answers regarding update-ca-certificates are correct for applications that read from the system certificate store. For Chrome and Firefox, and probably some others, the certificate must be put in the nssdb, the backend for the Mozilla NSS library. From https://code.google.com/p/chromium/wiki/LinuxCertManagement: For example, to trust a root ...


6

Absolutely. As this root certificate is part of the Windows Trust List, the mere act of browsing to such a site (even as a non-admin user) would cause the certificate to be automatically and silently added to your machine trust store. See this blog post for more info and a test site: http://hexatomium.github.io/2015/08/29/why-is-windows/


5

One can edit the certificates on the local computer this way : Start → Run: mmc.exe Menu: File → Add/Remove Snap-in… Under Available snap-ins, select Certificates and press Add. Select Computer Account for the certificates to manage. Press Next. Select Local Computer and press Finish. Press OK to return to the management console. Once the local ...


4

This is mostly a link only answer, however I do know that if the signing CA isn't marked as trusted by the app (Acrobat in this case) then it won't be marked as trusted. That being said, this link talks about exactly what your asking: http://helpx.adobe.com/acrobat/kb/approved-trust-list2.html


4

Where are the digital certificates storage location on Mac OS X Apple's Mac OS X includes a built-in key and password manager, Keychain, which stores user passwords, user and server certificates, and keys. Source Certificate and Key Management in Mac OS X Where is the Keychain data stored? The keychain data is stored in ~/Library/Keychains/, ...


3

Actually I just ran sfc /scannow and now it works again...thanks!


3

When you enable checking of email for malware, Avast! (and any other anti-malware suite with email protection) must be able to intercept the mail before it gets to the browser or mail client, using the certificate you mention. This is intentionally allowing "man-in-the-middle" interception, though for a good purpose -- preventing malware from being activated....


2

From the same page: Suggested Actions All supported editions of Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2 use the Microsoft Certificate Trust List to validate the trust of a certificate authority. There is no action required for users of these operating systems because Microsoft has removed the DigiNotar root ...


2

I have found 4 organizations, trusted by Adobe Acrobat so that the signatures will be considered "valid" in Acrobat Reader, Standard, or Pro, that sell these certificates. They are all expensive (typically $300/year). Note that Adobe has built things so that the person who signs a PDF document MUST use "two-factor authentication" at the time they sign the ...


2

For newer builds based on Debian, you may need to run: sudo dpkg-reconfigure ca-certificates NOTE: sudo dpkg-reconfigure ca-certificates calls update-ca-certificates internally You'll of course still need to copy the certificate (.crt file) to /usr/share/ca-certificates before you do any of this :)


2

None of these answers worked for me. Instead, I found the DigiCert root certificates, downloaded them, and installed them manually by clicking on them in Finder. Find them here under Checking the Intermediate Certificate Store: https://www.digicert.com/ssl-support/windows-cross-signed-chain.htm


2

If you generate self sign certificate then the browser will not recognize it as a trusted certificate. You have to get your certificate from trusted CA or from its reseller and you need to follow online procedure for certificate generation. Certificate issued by Certificate Authority will be recognized by 99.9% browsers including chrome, Firefox etc. You do ...


2

This is normal behavior. The DirName in the Authority Key Identifier is actually the Subject name of the Issuer of the Issuer. Just including the Subject of the Issuer would be duplicating the Issuer DN already available in the certificate. This is a common question that is also answered in the OpenSSL FAQ


2

You can do that by just moving it to the "Untrusted Certificates" yourself. Which is all Microsoft would do if they were to blacklist the root certificate, although they would do it at a higher level, and it would effect all users if they were to do so. This only works for browsers that respect the operating system's certificate store. Since Firefox uses ...


1

The openssl configuration defaults an intermediate certificate to have basicConstraints=CA:TRUE however in my case since I am using the intermediate certificate as an end user certificate, I need to make it basicConstraints=CA:FALSE. On windows/linux/firefox this doesn't seem to matter, but security settings on a mac make it required.


1

There can be a number of resons for this. From the top of my head: Check the validity of the cert, as in start date and end date. Check the date on your PC Is the site name on the certificate the same you are using to connect to the machine ? (for instance, the certificate may be published by a machine called SERVER.contoso.com, but you are using another ...


1

Firefox uses its own certificate-storage. So if you add a certificate to one firefox you should be able to determine the changed file(s) inside the users firefox-profile and deploy them to every other user. Alternatively find the main certificate store inside the Firefox.app and replace that with a certificate store containing your root cert. UPDATE The ...


1

For me, the problem was solved by starting the Keychain Access utility, selecting Keychain First Aid from the Keychain Access menu, and selecting Repair.


1

I just tried John's solution, and it didn't help. Although in my case, I didn't find any of the "blue +" icons in Class. So, all I did was delete the two cache files suggested and reboot. In my case, I am trying to update an application in Macports, that uses git to connect to github to download the source, and that is giving the error. And, I see the ...


1

If you don't recognize the common name of the certificate, or don't know where it came from, delete it. If it's from a website, it will likely prompt you to accept it again when you revisit anyway. If this is a work machine you should consult your IT Personnel, but if this is a personal machine, I would just get rid of it and keep going. It's a self signed ...


1

It sounds like you might benefit from Perspectives or possibly Convergence.


1

Did you try it manually (by double-clicking on the CER file)? If even manually it's not working, you might be encountering a Vista bug. Manual steps to install a Root CA certificate Double-click on the .cer file. On the Certificate dialog box, click Install Certificate to start the Certificate Import Wizard. On the Welcome page, click Next. On the ...


1

Although I still do not see the "install certificate" even when on fresh installation of Win 8, these steps did it: click on "view certificate" > "details" tab save the certificate to file with "copy to file.." button double-click on just saved certificate file import it into proper store (trusted root CA in my case)



Only top voted, non community-wiki answers of a minimum length are eligible