A public-key certificate states that a specific public key belongs to a specific identity. Use this tag for all questions on certificates and authentication of public keys (not public-key authentication, which is authentication _using_ public-keys). If certificates are not a central issue in your ...

learn more… | top users | synonyms

2
votes
1answer
519 views

How do I deal with a certificate based transparent proxy in Arch Linux?

I have setup an Arch Linux VM at work, and my company uses a transparent (cut-through) proxy with a self-signed certificate and requires authentication. Whenever I try to install any packages through ...
3
votes
1answer
89 views

Why openssl s_client verifies a cert against a mismatching CAfile?

I am trying to yield a certificate verification error with openssl s_client like this: $ openssl s_client -crlf -verify 9 \ -CAfile /etc/ssl/certs/TURKTRUST_Certificate_Services_Provider_Root_1.pem ...
1
vote
3answers
169 views

specify certificate of CA in Dovecot

In Postfix, I have specified my private key, my certificate, and the certificate of my CA smtpd_tls_CAfile = /etc/ssl/cacert.pem smtpd_tls_key_file = /etc/ssl/server.key smtpd_tls_cert_file = ...
1
vote
1answer
463 views

How to make local system CA certificates known to Firefox?

Recently, the CAcert root certificates have been removed from Debian (more precisely, from the ca-certificates package). Since I want to keep them, I backed up the directory ...
6
votes
1answer
101 views

Open signed PDFs in Linux

We have some PDF files which are secured by a .pfx certificate. On Windows we can use Adobe Reader to read these PDF files (with previously imported certificate). I've googled for a long time but I ...
2
votes
1answer
43 views

FreeBSD 10 root certificate store

Is on a default FreeBSD 10 no root certificate store? When I install one by hand it is in /usr/local/share/certs/ca-root-nss.crt, which I symlink to /etc/ssl/cert.pem and thats the main places I ...
0
votes
1answer
577 views

Certificate extensions in generating and signing certificartes using openssl

References: SSL Configurations for Intermediate certificate How to add my own created certificate authority to system trusted repositories Why I can't find a page which tell me what's the kind of ...
1
vote
1answer
668 views

Apache fails to start after changing cert and key

The problem appeared after I changed https certificate and key. sudo /etc/init.d/httpd restart shows this: Stopping httpd: [FAILED] Starting httpd: [FAILED] Apache's error_log: [Tue Dec 03 ...
2
votes
3answers
1k views

`openssl`: Subject Alternative Name

I wrote this bit of code to get the Common Name of the subject field in the SSL certificate for a given domain: $ echo -e "GET / HTTP/1.1\nEOT" | openssl s_client -connect google.com:443 2>&1 ...
1
vote
1answer
48 views

Parse expirydate from openssl command

Was about to ask how to check the date of SSL certificates automatically but then figured it out, so below you can find my answer too.
7
votes
2answers
4k views

adding SSL certificate for Github only (not all certificates from ca-certificates package)

I get the following error when accessing Github over HTTPS: error: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none This is because I don't have any ...
3
votes
1answer
42 views

certificate errors trying to create a virtualenv on old Ubuntu

On an old Ubuntu 8.04 (cannot upgrade yet) I need to create a Python virtualenv, install some packages and then my software. I do get certificate errors: Could not fetch URL ...
4
votes
1answer
30 views

How to configure kmail2 to use client certificates for POP3 and IMAP access

I would like to run a POP3 server with TLS transport security such that a client must authenticate with a client certificate. (This shields the server from brute force password guessing attacks.) How ...
3
votes
1answer
46 views

Add a single key to to CA certificates from an automated script

I'm doing some automation for a local machine in Vagrant using Puppet. I need to add a CA certificate to the trusted list in Ubuntu Trusty 14.04 LTS. I simply add the file to the right place: file ...
3
votes
1answer
137 views

Verifying a SSL certificate's fingerprint?

I'm toying around with a Puppet agent and a Puppet master and I've noticed that the Puppet cert utility provides a fingerprint for my agent's public key as it has requested to be signed: $ puppet ...
1
vote
1answer
78 views

SSL no certificate

I'm trying to make a bash script who will check the SSL status of my web site client and return the error. But for every IP, wget https://$ip:$port gives me the following error: ERROR: The ...
0
votes
1answer
91 views

Generating server and client certificates with multiple hostnames

When starting up my Puppet Master for the first time, it automatically generates its own server certificate, which is awesome. My server's hostname is kungfumaster and the Puppet Master generates a ...
1
vote
1answer
127 views

Wget or curl a self-signed certificate from server

From my browser, I can browse to a machine in my companies local intranet and (after marking the certificate as trusted) export that certificate to a file. I'm trying to automate this process into a ...
3
votes
1answer
173 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
0
votes
3answers
540 views

Obtain .cer file from .pem file

I have generated RSA private key using below command: openssl genrsa -out privkey.pem 2048 And created a self signed certificate using below command: openssl req -new -x509 -key privkey.pem -out ...
1
vote
1answer
540 views

Linux openssl CN/Hostname verification against SSL certificate

How does an Enterprise Linux system with openssl 1.0.1+ verify that the CN=hostname value in the cert matches the server it resides on? Does it use a plain old reverse DNS lookup on the IP address of ...
2
votes
2answers
4k views

How do I install a system-wide SSL certificate on openSUSE?

I have a PEM certificate that I just downloaded from a webserver. I want to install it system-wide so I can curl the server without it complaining about a missing certificate. I tried putting the ...
1
vote
1answer
293 views

How to remove SSL certificate?

I've been asked to remove certificates from some of our servers, but I don't know anything about httpd configuration. If I have one server where if I do this /usr/sbin/httpd -t -DDUMP_CERTS ...
1
vote
0answers
37 views

Add cacert certificates to kopete

ca-cert was recently removed from the ca-certificates bundle, and I would like to readd it, at least to kopete so I don't get the invalid certificate warnings because one of the jabber servers I ...
2
votes
0answers
165 views

SSL Configurations for Intermediate certificate

I had implement a mutual certificate authentication and it worked successfully for following steps : create root ca (self-signed) create server certificate and sign it with ca private key create ...
2
votes
1answer
223 views

Chrome certificate

How do I add trusted certificates for google-chrome through command line ? For firefox, I can use certutil binary. For google-chrome which binary or what steps are required ?
0
votes
1answer
43 views

Extend validity time of APACHE certificate

I have in /etc/httpd/ssl subdir two files: apache.crt and apache.key. How can I extend time of validity of APACHE http server, without creating new certificate and without necessity of interaction ...
3
votes
0answers
2k views

Installing the JMeter CA certificate for HTTPS recording

I got stuck in between while installing the JMeter CA certificate for HTTPS recording in the Firefox browser. I have followed the steps and successfully been able to generate the ...
1
vote
1answer
610 views

Installed root certificate authority doesn't appear to be working?

OS : archlinux Openssl dir : /etc/ssl I just installed a root certificates authority. The xxx.pem and yyy.0 file exists in the /etc/ssl/certs folder. Then I verify the vimeo.com:443 via bash: $ ...
9
votes
3answers
3k views

Where does Chrome gets its list of certificate authorities from?

On Fedora, I'm talking about the list displayed when you go to settings > manage certificates > authorities tab. I've read that it should be in the NSS shared DB, but this command returns an empty ...
2
votes
1answer
928 views

stunnel - how to setup stunnel to handle ssl and attach http with it?

I am running Google App Engine which is a http web server with some redirecting and other real-time stuff. But it does not have SSL to include so its unable to make HTTPS. Therefore, i was trying ...
2
votes
1answer
56 views

How it is decided which certificate of a Certificate Authority will be used in a system certificate chain [closed]

I am looking for PKI (Public Key Infrastructure) knowledge and particularly at OS's built-in certificate chain list. Of course on Windows the company decides which certificate will be built-in, but ...
5
votes
2answers
429 views

How to get server's ssl certificate in a human readable form?

For example, I want to find out when the certificate for encrypted.google.com expires (i.e. Not After date), and what other domains may use it for authentication (Subject Alternative Names).
3
votes
1answer
249 views

How do I change the Java Security level?

We've got an ancient (internal use only) self-signed app that refuses to run now with the changes to the JRE. Working on getting a code signing certificate and rebuilding it, but that's horribly slow ...
1
vote
2answers
194 views

HTTPS Redirecting to Subdomain

I have a subdomain at https://mail.example.com with a valid certificate. However, if someone were to accidentally type in https://example.com to the address bar, the certificate for the mail server is ...
3
votes
2answers
3k views

How to make ldapsearch working on SLES over tls using certificate?

We need to connect our php script to LDAP over tls using a certificate. LDAP connection works nicely without tls. More details here ...
1
vote
1answer
627 views

How can I add an x509 certificates bundle (ca-bundle.crt) to NSS database (~./pki/nssdb)

I'm currently using RedHat Enterprise 6. Git had issues cloning Github repos using HTTPS. After some investigation (e.g. enabling GIT_CURL_VERBOSE and GIT_TRACE) the problem was narrowed to a ...
2
votes
0answers
97 views

SSH + Certificate Authority server?

Is it possible to setup SSH (via pam for instance) to check the public key of the connecting client against a CA server? I've tried with gnupg (via gpg-agent --daemon --enable-ssh-support) and also ...
2
votes
2answers
2k views

Get common name (CN) from SSL certificate?

I have a SSL CRT file in PEM format. Is there a way that I can extract the common name (CN) from the certificate from the command line?
2
votes
2answers
63 views

generating CSR correctly

When generating a CRS for private purposes (non-comercial) which of the fields are mandatory? Country Name (2 letter code) [US]: US State or Province Name (full name) []: Texas Locality Name ...
3
votes
0answers
101 views

Creating a signed subordinate CA for client certificates

I have a root self-signed CA which I've created for myself. With this CA (we'll call it country), I've created a server certificate and key for my webserver, nginx. I now would like to create a ...
2
votes
1answer
222 views

Configure SSL Mutual (Two-way) Authentication

I was asked to do it "Configure SSL Mutual (Two-way) Authentication" and I don't know where to start or how to test it . server and many clients . they can access code on server only if they have a ...
0
votes
0answers
1k views

'Git clone' times out with 443 error message

git clone -v https://github.com/me/myproj Cloning into 'myproj'... <minutes pass> error: Failed connect to github.com:443; Operation now in progress while accessing ...
2
votes
2answers
339 views

Dovecot POP3S & IMAPS SSL Certificate that works for all user domains

This may be a really stupid question, but I can't seem to put my head around it. I have a mail server I'm trying to setup to service 6 domains. I will have multiple mail users accessing the server via ...
3
votes
3answers
99 views

Appending a pem to another

I found a blog that helped me relay postfix through smtp.gmail.com with SASL authentication. One of the steps was: cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | \ sudo tee -a ...
3
votes
1answer
404 views

How to generate just a key with openssl

I run this command to generate a CSR and a new key with openssl: openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout ...
0
votes
1answer
131 views

stream a certificate to stdout to download it in php

Related Questions : when downloading certficate binary data , result is invalid certificate Download binary stream data from browser using PHP with web service “ downloaded file is corrupted ” ...
1
vote
0answers
327 views

ngircd / xchat SSL issues

I'm trying to setup a ngircd IRC server on Fedora 18 (which was installed using yum), but I'm having some SSL issues. I can connect to the server locally and remotely if I choose to "accept invalid ...
0
votes
0answers
110 views

How to determine the sequence of ordering certificates by browser?

I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram: ---------- | ...
0
votes
1answer
155 views

LPIC-1 for non-professional experienced user

I am interested in trying out the LPIC-1 certification however I am slightly worried that I may not have the needed professional experience to pass. I am still studying hard and running a lab with a ...