Questions tagged [certificates]
A public-key certificate states that a specific public key belongs to a specific identity. Use this tag for all questions on certificates and authentication of public keys (not public-key authentication, which is authentication _using_ public-keys). If certificates are not a central issue in your question, then don't use this tag.
276
questions
0
votes
1answer
27 views
openssl: local installation caused certificate issue
To install Python from source without root permission, I had to install openssl, which I did using the following commands:
wget https://www.openssl.org/source/openssl-1.1.1e.tar.gz
tar -xzvf openssl-...
0
votes
1answer
39 views
ssh access with private certificate works from localhost and not from remote
I'm a noob on Gnu/Linux and UNIX. I am playing a game to learn basics of this OS.
As part of the game I'm playing, I have to logon a remote server using ssh, having only the private key certificate ...
0
votes
1answer
30 views
Apache web server not starting when I set it up for ssl using custom certificates
I have setup Apache webserver on RHEL 7 instance
yum install mod_ssl openssl
openssl genrsa -out ca.key 2048
openssl req -new -key ca.key -out ca.csr
openssl x509 -req -days 365 -in ca.csr -signkey ...
0
votes
0answers
26 views
error loading CA certificate
I did certificate request CSR with SHA256 sign and put it in generator of fake CA certificate (generates my university system) as part of work on my university virtual... It generated me CA ...
0
votes
0answers
34 views
Install crt certificate on Ubuntu 18.04
I have a .crt certificate and I've tried installing it in .local/share/ca-certificates (I've created this last folder because It didn't exist) and put my ca.crt into it , then I executed this command :...
1
vote
0answers
55 views
How do I disable zypper's certificate check?
I'm using SLES 2015 behind a firewall. All of my outgoing communications go over a proxy; specifically, zypper tries to use the proxy when I write, say,
zypper search-packages foo
but the proxy ...
1
vote
1answer
42 views
openssl is not finding any certificates
When I use git or curl I get an error which may be related to certificates:
With git:
> git clone https://github.com/vim/vim.git
Cloning into 'vim'...
fatal: unable to access 'https://github.com/...
0
votes
0answers
10 views
Web App for Host Certificate Management
Does the Linux ecosystem have a web application that will take host
certificate requests and give an administrator a web interface method
of signing them? And manage CRLs/OCSP, as well?
Dogtag's ...
0
votes
0answers
21 views
Encode/Decode by certutils.exe on windows
How to decode file on Linux, which was encoded on Windows by certutil?
certutil.exe -encode orig.zip orig.zip.txt
0
votes
0answers
36 views
Unable to import a certificate into java keystore
I am trying to import a certificate into java keystore. This is what I have done.
Created the keystore:
# keytool -keystore keystore.jks -storepass password -alias tomcat -genkeypair -validity 730 -...
1
vote
1answer
92 views
apt certificate chain uses insecure algorithm
we host a local mirror for Ubuntu and Debian packages.
root@apt-mirror:~# dpkg -l | grep mirror
ii apt-mirror 0.5.4-1 all ...
1
vote
1answer
51 views
Setting up Apache Mutual Authentication
I was asked to setup an Apache webserver to use Mutual Authentication in order to protect access to a specific folder/file.
The access to this specific file/folder should be granted only if the ...
0
votes
1answer
48 views
Create certificate with subject alternative names
Creating CA certificate that should contain subject alternative names (SAN).
openssl genrsa -des3 -out ca.key 2048
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -config ca_server.cnf
...
0
votes
0answers
17 views
What does the “Certificates” section in seahorse do?
What does the "Certificates" / "System Trust" section of seahorse do?
I am trying to sign a document in LibreOffice and the menu there uses the word "Certificate", so I am thinking that I need to ...
0
votes
0answers
31 views
Connecting to WPA2 Enterprise PEAP MSCHAPV2 with client authentication certificate
I'm working on implementing wireless access for some of our employees that exclusively use Ubuntu and have been stuck trying to get machine certificates to work.
On the NPS server it keeps throwing: ...
4
votes
1answer
69 views
ssh-keygen and its -Z option on OpenBSD and on RHEL
I'm following along a rather good text about SSH certificates written for RHEL 6 and openssh-5.3p1-94.el6 (which makes it about 10 years old) while trying to mimic the examples on my OpenBSD-current ...
0
votes
1answer
38 views
SSL and login not working after replacing certificate
I am running Webmin on Debian, configured to use SSL. The certificate is about to expire, so I generated a new one and imported it using the GUI (pasted cert and key in PEM format, reused existing ...
0
votes
0answers
29 views
Is it possible to encrypt traffic if I have only CA certificate?
I have simple secure (I guess) Mosquitto sever described in my previous question.
Client machine has no any keys or certificate installed except single ca.crt certificate file generated and taken ...
0
votes
1answer
13 views
How to distinct parts of a ssl CA bundle
I have a .pem file with four distinct sections. The first is obviously the private key because it says so. The latter three parts however I don't know which is which. This cert has been provided to me ...
0
votes
0answers
41 views
Apache stopped working after reboot
My Apache server on CentOS7 suddenly stopped working after a reboot.
I had SSL configuration with .crt and .key wildcard certificates obtained from a valid CA.
When I restart the httpd service I ...
0
votes
0answers
26 views
OCSP stapling + CRL on Apache
Please imagine an architecture with a root certificate authority (CA) and a subordinate CA.
Is it possible for a client:
to connect to an https server
verify the validity of the server's ...
0
votes
0answers
18 views
OCSP: multi stapling on Apache
I am very interested in setting up multi stapling and I can not find a lot of documentation on it, or in any case, recent information.
I have a certificate authority (CA) and a root CA above. They ...
1
vote
1answer
113 views
SSH User CA: Sign a user certificate with selected hosts instead of all hosts?
I have many servers that shares a common TrustedUserCAKeys. I want to sign a user certificate so it grants some access on specific servers instead of all of them.
For example, the following command ...
0
votes
1answer
85 views
Enable OCSP stapling with Freeipa - Apache
I have 3 machines with Centos 7.
I have FreeIPA server installed on the first machine. This serves as a certificate authority in my network; it's my CA.
I have an other machine with FreeIPA client ...
1
vote
2answers
374 views
How to configure device to trust root certificate when using a SOCKS5 proxy?
I am routing a Linux machine through a SOCKS5 proxy. The internet works as expected and I am presented with the proxy's IP when viewing http://whatismyip.com.
However, some sites are reporting that I ...
3
votes
0answers
48 views
SSH CA: How to sign a host key with custom port?
I have a server whose sshd listens on a non-standard port, say for example, 8022. I tried to sign its host key like this:
ssh-keygen -s ibug_ca -I example -h -n '[example.com]:8022' ssh_host_rsa_key....
0
votes
0answers
19 views
Update Linux secure log to show escalation to root not as the user but as its RSA Cert ID
I looked all over Google.com but I couldn't find any answers. I am hoping someone could help me here.
Background Info:
We use a Certificate Authority Server that signs our engineers Public/Private ...
0
votes
0answers
583 views
How to generate a self-signed certificate in DER format with private key included, using OpenSSL?
As the title says:
Using OpenSSL, how do I generate a self-signed certificate in DER format which includes the private key? Is this possible at all?
I have found a myriad of posts which explain how ...
0
votes
1answer
974 views
AIX How to import CA certificate
I need to import my company's CA certificate to AIX6. I copied .crt file to /var/ssl/certs and /opt/freeware/etc/ssl/certs/ where all CA certificates are located, but I it's not enough. How should I ...
1
vote
1answer
68 views
Certificate Authority Not Working
If my understanding is correct, a CA acts like a parent certificate that is used to verify other certificates that have been signed by the CA certificate without having to install multiple server ...
1
vote
0answers
57 views
How to compile a Linux kernel with certificate / public key builtin?
I'd like to compile Linux Kernel 4.1.3 with a Public Key or self signed certificate built into the kernel.
Is there a kernel option where I can specify the certificate/public key I want to add to ...
2
votes
1answer
731 views
Ansible get a list of certification files and check their expiration date
I am trying to figure out how to get a list of .crt files from one of our web servers and check the expiration date of these certification files (actually check if these certs are valid within a time ...
0
votes
0answers
728 views
HAProxy as a reverse proxy for backend already ssl enabled and SSL terminator for a backend exposed in port 80
I have 4 servers:
proxy_server,
$BK_SERVER_001,
$BK_SERVER_002 and
$BK_SERVER_003
The "proxy_server" only has an HAProxy enabled service with this configuration:
(please look at the rows marked ...
4
votes
2answers
2k views
update-ca-trust extract not adding certificates to ca-bundle
CentOS Linux release 7.6.1810 (Core)
Kernel 5.1.11-1.el7.elrepo.x86_64
I put a cert-file to /etc/pki/ca-trust/source/anchors
File looks like that:
-----BEGIN CERTIFICATE-----
...
0
votes
1answer
173 views
rsyslogd as a syslog forwarder over TLS (certificate based authentication required)
I want to configure a machines rsyslogd (redhat OS7 in this case) to connect via TLS to a central log collector.
The resyslogd needs to authenticate with a client certificate.
I already have the key, ...
-2
votes
1answer
94 views
How to convert a certificate in .pfx format to .jks in HP-UX server
I have a task to convert a .pfx SSL certificate to .jks format in a HP-UX B.11.31 server to be configured in our application's server.xml file, (keystoreFile=) for our 8090 connector port.
0
votes
1answer
606 views
Default Directories Not Working In OpenSSL Configuration File
I have set the directory in the /etc/ssl/openssl.cnf file but every time I issue the command
openssl req -x509 -newkey rsa:4096 -keyout cakey.pem -out cacert.pem -days 3650
it places the files in ...
1
vote
2answers
367 views
SSH: Permission denied as given IdentityFile is not used
I'm using this .ssh/config:
Host myserver
HostName 12.34.67.89
User anyuser
IdentityFile /root/.ssh/anything_rsa
But running ssh myserver returns a Permission denied (publickey) error.
...
2
votes
2answers
584 views
What certificate format does /usr/local/share/ca-certificates accept?
There are different methods of storing a certificate file? DER, PEM, PKCS: PKCS7 & PKCS12?
Are all of these formats accept as valid in /usr/local/share/ca-certificates?
0
votes
0answers
28 views
It seems that my cron task doesn't run [duplicate]
I have cron task for root that should run daily:
$ whoami
main_usr
$ sudo crontab -l -u root
0 23 * * * certbot renew --cert-name app.my_domain123.com --pre-hook "systemctl nginx stop" --post-hook ...
1
vote
1answer
217 views
bash: awk write each match to a file and increment filename
I want to read a file without whitespaces, filled with root certificates and seperate them into new files per match. I can select all matching certificates at once and insert to a single file, but I ...
1
vote
1answer
506 views
How to parse openssl certificate output into hostname and verification codes?
I have this shell code that reads lines of host names from input file, performs an openssl command to print ssl certificate info, and outputs the results in the terminal.
while read x;
do
echo $x;
...
0
votes
1answer
164 views
SSL Cert in Keystore and Browser cert are different
Bitbucket and Jenkins, in-order to talk to each other we have installed SSL certs in Bitbucket server. Issue started when Jenkins team used to mess up with their configuration and end up changing ...
3
votes
0answers
322 views
NGINX OCSP stapling not working when CRL enabled?
I have an NGINX proxy set up to do OCSP stapling so new certificates work in google chrome.
I also set up client certificate checks on NGINX.
when I use the ssl_crl module to check the client ...
0
votes
2answers
85 views
Varying a certificate based on client TLS version in ClientHello
I've got a scenario where some older clients are only able to support MD5 and SHA1 signatures. Obviously these are generally considered deprecated but I do still need to support them. Upgrading ...
0
votes
1answer
162 views
Can I specify which hostname to check an SSH certificate against?
I've set up an SSH certificate for *.example.com, but not yet got around to setting up CNAMEs. Rather than mapping hostnames to IPs in /etc/hosts (and subsequently forgetting about the CNAMEs), is it ...
0
votes
0answers
1k views
How to config HTTPS on Apache tomcat
I have installed the Apache Tomcat/7.0.76 on centos7.
I want to enable SSL on the tomcat.
I have root, intermediate, domain certificate. Like this
85163c004aa3625d.crt gd_bundle-g2-g1.crt gdig2....
1
vote
1answer
761 views
How to install self signed .pem certificate for an application in OpenSuse?
Recently my workplace has updated the internet usage policies and imposed a Sophos security layer to monitor the traffic.
I am trying to clone a git repo (using git clone command) but getting this ...
0
votes
2answers
387 views
split (one-line) cert bundle into 2 file
I have one RSA PRIVATE KEY and one CERTIFICATE in one line, and I have to split it to one .key and .crt file.
Is it possible with sed or/and awk?
EDI1: example (as you can see its literally one line)...
2
votes
2answers
2k views
Void linux XBPS broke: certificate verification failed
I installed my first distro: Void Linux, the version without any desktop environment. I got my wifi to work and the package manager (xbps) worked fine; I installed things like htop, i3, etc without ...
