178

A certificate contains a public key. The certificate, in addition to containing the public key, contains additional information such as issuer, what the certificate is supposed to be used for, and other types of metadata. Typically, a certificate is itself signed by a certificate authority (CA) using CA's private key. This verifies the authenticity of ...


120

These two pictures together explained everything to me: Source: linuxvoice Source: infosecinstitute


101

The GoDaddy documentation is mistaken. It is not true that Certification Authorities (CAs) must revoke certificates for all IP addresses… just reserved IP addresses. Source: https://cabforum.org/internal-names/ The CA for https://1.1.1.1 was DigiCert, which as of the writing of this answer, does allow buying site certificates for public IP addresses. ...


98

English is ambiguous. You were parsing it like this: (intranet names) or (IP addresses) i.e. ban the use of numeric IP addresses entirely. The meaning that matches what you're seeing is: intranet (names or IP addresses) i.e. ban certificates for the private IP ranges like 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, as well as for private names that ...


47

Lets say company A has a key pair and needs to publish his public key for public usage (aka ssl on his web site). Company A must make a certificate request (CR) to a certification authority (CA) to get a certificate for his key pair. The public key, but not the private key, of company A's key pair is included as part of the certificate request. The CA ...


45

Looks like the Certificate Subject Alt Name includes the IP address: Not Critical DNS Name: *.cloudflare-dns.com IP Address: 1.1.1.1 IP Address: 1.0.0.1 DNS Name: cloudflare-dns.com IP Address: 2606:4700:4700::1111 IP Address: 2606:4700:4700::1001 Traditionally I guess you would have only put DNS Names in here, but Cloudflare have put their IP Addresses in ...


22

Partial paths and wildcards are now supported in more recent versions of OS X. So you can use the Keychain Manager to create an identity preference for an entire web site and/or domain. Partial path example (note that the trailing slash is required!): https://server.mydomain.com/ Wildcard example: *.mydomain.com Full details here (from 'man security' ...


21

Export the certificate from Chrome. To view the certificate click Inspect on the page and go the the Tab Security: Now click on View Certificate and export the certificate by clicking on Copy to file... In the wizard choose Base 64 encoded .Cer. Now save the certificate on your Desktop. Import the certificate into your trusted root certification authority ...


21

Following up on zakjan's answer, I had a problem when I tried to use jquery to do an AJAX request on my newly secure server, in an android webview. It worked in the browser, but not in my app. I used this site: https://certificatechain.io/ I pasted in the text of my signed .crt file I got back from Comodo (positiveSSL), and it gave me back a ...


20

You can set this host machine to use and present your (existing, purchased) externally-verified SSL certificate thus (instructions probably also work for Windows 8 & 8.1, may or may not work for Windows 7) (parts of this based on a Microsoft KB 2001849): First, you need to have purchased a genuine verified ssl certificate. If you have this certificate ...


20

I solve this problem by changing keyUsage = keyEncipherment, dataEncipherment to keyUsage = nonRepudiation, digitalSignature, keyEncipherment in the section v3_req in file req.conf like acme.sh does, There's no error with chrome 75 now. My problem might be a little different. It is ok with original configuration with tls1.2, but ...


18

You didn't provide the actual address of the website, nor the SSL provider's name, nor any other information about the certificate, and basically want us to guess at various possible causes. My guess is that your certificate chain ends with "AddTrust External Root" as the topmost CA, and that root certificate just expired several hours ago. Sectigo, the ...


17

Private keys should have reading heavily restricted. Setting permissions to 600 and owned by root should work. However, there are other secure permissions settings - Ubuntu stores keys in a directory with owner root and group ssl-cert and permissions 710. This means that only members of ssl-cert can access any files in that directory. Private keys then have ...


17

There is an easy way around this. Go to about:config Search for "network.stricttransportsecurity.preloadlist". Set it to false. WARNING: This will disable HSTS entirely. Take a look at the comments on this answer for some discussion about the downsides of this method. I personally think the benefit outweighs the risk, but you are responsible for ...


16

I had the same issue and wrote this... It's quick and dirty, but should work. It'll log (and print to screen with debugging on) any certs which aren't yet valid or expire in the next 90 days. Might contain some bugs, but feel free to tidy it up. #!/bin/sh DEBUG=false warning_days=90 # Number of days to warn about soon-to-expire certs certs_to_check='...


16

I still am not entirely clear on how this all fits together exactly, but as pointed out in this answer .dev domains are now official TLDs. As such, it seems that browsers force some kind of HSTS behavior and force https connections. For those TLDs it seems my self-signed certificate no longer was accepted in Firefox. Changing my virtual hosts to use .test ...


14

Well, the answer by RedGrittyBrick is correct, but not really answering the question. The question was, if browsers do it, not if they should or need to do it. From what I've heard, both MSIE and Chrome actually do cache certificates, and don't replace them when they get a new version as long as the old one is valid. Why they do this is not for me to ...


14

Let me explain with an example. In normal key-pair based PKI, there are private key and public key. In a certificate-based system, there are private key and certificate. Certificate holds more information than the public key. Demo (You can generate a certificate and private key): http://www.selfsignedcertificate.com/ You can download open the private ...


13

The following configuration is (or used to be) the best configuration according to SSLLabs: SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 SSLCompression off SSLHonorCipherOrder on SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-...


13

Here are the basic steps I use: Get a valid certificate that for the host, (it doesn't have to come from an external CA, but all your machines have to trust it). Make sure it has the correct hostname, I had problems with wildcard certs. Install the cert on the host, like: certutil.exe -p myPassword -importPFX c:\mycert.pfx noExport find the thumbprint ...


13

With certbot 0.34.0, the procedure is simple and easy (depending on your system, substitute certbot-auto or ~/certbot-auto for certbot): First, list your existing certificate and domains: sudo certbot certificates This will return your certificate name and the domains currently on the certificate, for example: - - - - - - - - - - - - - - - - - - - - - -...


12

For Mac OS X: Click on the Certificate icon in the address bar. Click on "Certificate Information", then drag and drop the certificate image to your desktop or any other folder. Double click the cer file you've just saved, it will open in the Keychain Access. Choose a keychain to store it (I think this step is specific to Yosemite), for example "login", ...


11

Just run the command below and it will provide the expiration date: echo q | openssl s_client -connect google.com.br:443 | openssl x509 -noout -enddate You can use this command into a batch file, to gather this information for more remote servers.


11

Better late than never. Yes, browsers will cache intermediate certificates, and use them between different sites. Because of that, if you are missing the intermediate certificate, random users will receive a trust error, while others won't. For example, in Firefox, it will be cached in a file called cert8.db (in your profile folder). To test this, either ...


11

None. As you said, SFTP is SSH2-based. It is not the same as FTPS (FTP over TLS) and does not use X.509 certificates in any way. The server authentication in SSH2 is mostly based around "trust on first use", so the keys are not signed at all. However, many of the problems with self-signed certificates don't apply. The only thing even remotely close is ...


11

Found the way to do it: MMC -> Certificates(Local Computer) -> Right click on the Personal folder -> All Tasks -> Advanced Operations -> Create Custom Request... I choose Proceed without enrollment policy and clicked next. Choose (No Template) Legacy key for compatibility and more options and use PKCS #10. Click on next and click on Properties. Enter a ...


10

The chain was in crt file, that the original SSL was working off. For GoDaddy there is a 2nd cert - gd_bundle.crt Copy this info and add it to the crt installed on the server. So the original crt on the server had 1 certificate, and after it will have 3 on the same file. This is the chain. I still got contains anchor in chain issues on ssllabs.com ...


10

certificate need to contain Subject Alternativ Name I had a similar issue with our internal websites. I have certificate of my certification authority in computer root trusted store without no result. The main problem was in the little detail, my certificate doesnt contain section: Subject Alternativ Name. Google Chrome showing that error itself ["F12" ">>" ...


10

Setting security.enterprise_roots.enabled to true on the about:config page solved this for me and allowed my self-signed certificate to work during development. There's a bit of discussion around the merits of this being on by default here: Set security.enterprise_roots.enabled to true by default. Although the intent of this flag is to allow Firefox to ...


9

How do I disable "Banking & Payment protection"? I don’t want ESET to be able to intercept my HTTPS traffic at all! You can permanently disable "Banking & Payment protection" as follows: Open ESET Smart Security. How do I open my ESET product? Click "Setup" then click "Security tools" Click the green slider bar next to "Banking &...


Only top voted, non community-wiki answers of a minimum length are eligible