Tagged Questions

A public-key certificate states that a specific public key belongs to a specific identity. Use this tag for all questions on certificates and authentication of public keys (not public-key authentication, which is authentication _using_ public-keys). If certificates are not a central issue in your ...

learn more… | top users | synonyms

3
votes
1answer
528 views

Why openssl s_client verifies a cert against a mismatching CAfile?

I am trying to yield a certificate verification error with openssl s_client like this: $ openssl s_client -crlf -verify 9 \ -CAfile /etc/ssl/certs/TURKTRUST_Certificate_Services_Provider_Root_1.pem ...
2
votes
1answer
110 views

FreeBSD 10 root certificate store

Is on a default FreeBSD 10 no root certificate store? When I install one by hand it is in /usr/local/share/certs/ca-root-nss.crt, which I symlink to /etc/ssl/cert.pem and thats the main places I ...
1
vote
1answer
68 views

Parse expirydate from openssl command

Was about to ask how to check the date of SSL certificates automatically but then figured it out, so below you can find my answer too.
4
votes
1answer
75 views

certificate errors trying to create a virtualenv on old Ubuntu

On an old Ubuntu 8.04 (cannot upgrade yet) I need to create a Python virtualenv, install some packages and then my software. I do get certificate errors: Could not fetch URL ...
7
votes
2answers
161 views

Open signed PDFs in Linux

We have some PDF files which are secured by a .pfx certificate. On Windows we can use Adobe Reader to read these PDF files (with previously imported certificate). I've googled for a long time but I ...
4
votes
1answer
34 views

How to configure kmail2 to use client certificates for POP3 and IMAP access

I would like to run a POP3 server with TLS transport security such that a client must authenticate with a client certificate. (This shields the server from brute force password guessing attacks.) How ...
1
vote
3answers
350 views

specify certificate of CA in Dovecot

In Postfix, I have specified my private key, my certificate, and the certificate of my CA smtpd_tls_CAfile = /etc/ssl/cacert.pem smtpd_tls_key_file = /etc/ssl/server.key smtpd_tls_cert_file = ...
3
votes
1answer
69 views

Add a single key to to CA certificates from an automated script

I'm doing some automation for a local machine in Vagrant using Puppet. I need to add a CA certificate to the trusted list in Ubuntu Trusty 14.04 LTS. I simply add the file to the right place: file ...
3
votes
1answer
241 views

Verifying a SSL certificate's fingerprint?

I'm toying around with a Puppet agent and a Puppet master and I've noticed that the Puppet cert utility provides a fingerprint for my agent's public key as it has requested to be signed: $ puppet ...
1
vote
1answer
97 views

SSL no certificate

I'm trying to make a bash script who will check the SSL status of my web site client and return the error. But for every IP, wget https://$ip:$port gives me the following error: ERROR: The ...
0
votes
1answer
128 views

Generating server and client certificates with multiple hostnames

When starting up my Puppet Master for the first time, it automatically generates its own server certificate, which is awesome. My server's hostname is kungfumaster and the Puppet Master generates a ...
1
vote
1answer
181 views

Wget or curl a self-signed certificate from server

From my browser, I can browse to a machine in my companies local intranet and (after marking the certificate as trusted) export that certificate to a file. I'm trying to automate this process into a ...
3
votes
1answer
233 views

Linux equivalent of “Trusted Root Certification Authorities” on Windows?

Where I live we have a corporate firewall which is configured to need a certificate installed on the computers in the house for it to be able to scan for vulnerabilities in secure connections. Without ...
0
votes
3answers
1k views

Obtain .cer file from .pem file

I have generated RSA private key using below command: openssl genrsa -out privkey.pem 2048 And created a self signed certificate using below command: openssl req -new -x509 -key privkey.pem -out ...
1
vote
1answer
490 views

How to remove SSL certificate?

I've been asked to remove certificates from some of our servers, but I don't know anything about httpd configuration. If I have one server where if I do this /usr/sbin/httpd -t -DDUMP_CERTS ...
1
vote
1answer
733 views

Linux openssl CN/Hostname verification against SSL certificate

How does an Enterprise Linux system with openssl 1.0.1+ verify that the CN=hostname value in the cert matches the server it resides on? Does it use a plain old reverse DNS lookup on the IP address of ...
1
vote
0answers
46 views

Add cacert certificates to kopete

ca-cert was recently removed from the ca-certificates bundle, and I would like to readd it, at least to kopete so I don't get the invalid certificate warnings because one of the jabber servers I ...
1
vote
1answer
589 views

How to make local system CA certificates known to Firefox?

Recently, the CAcert root certificates have been removed from Debian (more precisely, from the ca-certificates package). Since I want to keep them, I backed up the directory ...
2
votes
1answer
309 views

Chrome certificate

How do I add trusted certificates for google-chrome through command line ? For firefox, I can use certutil binary. For google-chrome which binary or what steps are required ?
0
votes
1answer
46 views

Extend validity time of APACHE certificate

I have in /etc/httpd/ssl subdir two files: apache.crt and apache.key. How can I extend time of validity of APACHE http server, without creating new certificate and without necessity of interaction ...
3
votes
0answers
3k views

Installing the JMeter CA certificate for HTTPS recording

I got stuck in between while installing the JMeter CA certificate for HTTPS recording in the Firefox browser. I have followed the steps and successfully been able to generate the ...
1
vote
1answer
716 views

Installed root certificate authority doesn't appear to be working?

OS : archlinux Openssl dir : /etc/ssl I just installed a root certificates authority. The xxx.pem and yyy.0 file exists in the /etc/ssl/certs folder. Then I verify the vimeo.com:443 via bash: $ ...
2
votes
1answer
1k views

stunnel - how to setup stunnel to handle ssl and attach http with it?

I am running Google App Engine which is a http web server with some redirecting and other real-time stuff. But it does not have SSL to include so its unable to make HTTPS. Therefore, i was trying ...
2
votes
1answer
56 views

How it is decided which certificate of a Certificate Authority will be used in a system certificate chain [closed]

I am looking for PKI (Public Key Infrastructure) knowledge and particularly at OS's built-in certificate chain list. Of course on Windows the company decides which certificate will be built-in, but ...
3
votes
1answer
288 views

How do I change the Java Security level?

We've got an ancient (internal use only) self-signed app that refuses to run now with the changes to the JRE. Working on getting a code signing certificate and rebuilding it, but that's horribly slow ...
1
vote
2answers
217 views

HTTPS Redirecting to Subdomain

I have a subdomain at https://mail.example.com with a valid certificate. However, if someone were to accidentally type in https://example.com to the address bar, the certificate for the mail server is ...
8
votes
2answers
5k views

adding SSL certificate for Github only (not all certificates from ca-certificates package)

I get the following error when accessing Github over HTTPS: error: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none This is because I don't have any ...
1
vote
1answer
707 views

How can I add an x509 certificates bundle (ca-bundle.crt) to NSS database (~./pki/nssdb)

I'm currently using RedHat Enterprise 6. Git had issues cloning Github repos using HTTPS. After some investigation (e.g. enabling GIT_CURL_VERBOSE and GIT_TRACE) the problem was narrowed to a ...
2
votes
0answers
103 views

SSH + Certificate Authority server?

Is it possible to setup SSH (via pam for instance) to check the public key of the connecting client against a CA server? I've tried with gnupg (via gpg-agent --daemon --enable-ssh-support) and also ...
5
votes
2answers
510 views

How to get server's ssl certificate in a human readable form?

For example, I want to find out when the certificate for encrypted.google.com expires (i.e. Not After date), and what other domains may use it for authentication (Subject Alternative Names).
1
vote
1answer
866 views

Apache fails to start after changing cert and key

The problem appeared after I changed https certificate and key. sudo /etc/init.d/httpd restart shows this: Stopping httpd: [FAILED] Starting httpd: [FAILED] Apache's error_log: [Tue Dec 03 ...
3
votes
2answers
3k views

Get common name (CN) from SSL certificate?

I have a SSL CRT file in PEM format. Is there a way that I can extract the common name (CN) from the certificate from the command line?
2
votes
2answers
66 views

generating CSR correctly

When generating a CRS for private purposes (non-comercial) which of the fields are mandatory? Country Name (2 letter code) [US]: US State or Province Name (full name) []: Texas Locality Name ...
3
votes
0answers
113 views

Creating a signed subordinate CA for client certificates

I have a root self-signed CA which I've created for myself. With this CA (we'll call it country), I've created a server certificate and key for my webserver, nginx. I now would like to create a ...
2
votes
1answer
592 views

How do I deal with a certificate based transparent proxy in Arch Linux?

I have setup an Arch Linux VM at work, and my company uses a transparent (cut-through) proxy with a self-signed certificate and requires authentication. Whenever I try to install any packages through ...
0
votes
0answers
2k views

'Git clone' times out with 443 error message

git clone -v https://github.com/me/myproj Cloning into 'myproj'... <minutes pass> error: Failed connect to github.com:443; Operation now in progress while accessing ...
2
votes
2answers
352 views

Dovecot POP3S & IMAPS SSL Certificate that works for all user domains

This may be a really stupid question, but I can't seem to put my head around it. I have a mail server I'm trying to setup to service 6 domains. I will have multiple mail users accessing the server via ...
3
votes
3answers
106 views

Appending a pem to another

I found a blog that helped me relay postfix through smtp.gmail.com with SASL authentication. One of the steps was: cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | \ sudo tee -a ...
3
votes
1answer
439 views

How to generate just a key with openssl

I run this command to generate a CSR and a new key with openssl: openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout ...
0
votes
1answer
143 views

stream a certificate to stdout to download it in php

Related Questions : when downloading certficate binary data , result is invalid certificate Download binary stream data from browser using PHP with web service “ downloaded file is corrupted ” ...
2
votes
2answers
4k views

How do I install a system-wide SSL certificate on openSUSE?

I have a PEM certificate that I just downloaded from a webserver. I want to install it system-wide so I can curl the server without it complaining about a missing certificate. I tried putting the ...
9
votes
3answers
3k views

Where does Chrome gets its list of certificate authorities from?

On Fedora, I'm talking about the list displayed when you go to settings > manage certificates > authorities tab. I've read that it should be in the NSS shared DB, but this command returns an empty ...
1
vote
0answers
342 views

ngircd / xchat SSL issues

I'm trying to setup a ngircd IRC server on Fedora 18 (which was installed using yum), but I'm having some SSL issues. I can connect to the server locally and remotely if I choose to "accept invalid ...
0
votes
0answers
113 views

How to determine the sequence of ordering certificates by browser?

I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram: ---------- | ...
0
votes
1answer
627 views

Certificate extensions in generating and signing certificartes using openssl

References: SSL Configurations for Intermediate certificate How to add my own created certificate authority to system trusted repositories Why I can't find a page which tell me what's the kind of ...
0
votes
1answer
159 views

LPIC-1 for non-professional experienced user

I am interested in trying out the LPIC-1 certification however I am slightly worried that I may not have the needed professional experience to pass. I am still studying hard and running a lab with a ...
1
vote
0answers
346 views

How to add my own created certificate authority to system trusted repositories

I was told that I can add my created CA to trusted repositories/authorities in my system instead of adding it from browser and configuring in in ssl.conf. Yet I can't find anything similar on the ...
2
votes
0answers
175 views

SSL Configurations for Intermediate certificate

I had implement a mutual certificate authentication and it worked successfully for following steps : create root ca (self-signed) create server certificate and sign it with ca private key create ...
4
votes
1answer
343 views

Configuring Apache to Require a Client Certificate

I want to implement mutual authentication (two - way ) with apache web server. References : 1.Failed to sign CSR with the CA root key 2.Firefox error message when adding client certificate ...
3
votes
1answer
854 views

Firefox error message when adding client certificate signed by CA

I'm getting this message when I'm trying to add a certificate to Firefox's "your certificate tab". I generated and signed it before by a server which also is a CA. Failed to decode the file. ...