Questions tagged [certificates]

A public-key certificate states that a specific public key belongs to a specific identity. Use this tag for all questions on certificates and authentication of public keys (not public-key authentication, which is authentication _using_ public-keys). If certificates are not a central issue in your question, then don't use this tag.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
50 views

Understanding a PEM file and verifying the signature manually

I'm playing around with RSA for learning and understanding. i got the following PEM file from the browser (BASE 64) -----BEGIN CERTIFICATE----- MIIE/jCCA+...
Schmaehgrunza's user avatar
0 votes
2 answers
71 views

My SSD filled up mysteriously; now I can't boot Debian 12

I have a (new) Lenovo notebook and was using Debian 12.  I was working in a Google Docs file and suddenly received a message saying that I should empty my SSD because it was almost full.  When I ...
guilhwm's user avatar
1 vote
0 answers
56 views

Change IPSec IKEV2 VPN Default Ports 500 & 4500 To Anothers

For some reason OpenVPN is working on my local machine very well, But IPSec IKEV2 VPN not & it only works when OpenVPN is connect. I have a domain for IPSec IKEV2 VPN & in local machine vpn is ...
helius.dev's user avatar
0 votes
0 answers
438 views

Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown

When trying to update Google Chrome the following error message appears: Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. Could not handshake: ...
Jean Carlos Galhardi's user avatar
0 votes
0 answers
55 views

Digital Signature Manual Hash Verification

I'm trying to learn PKI and I want to do a test to verify my understanding of digital certificates by comparing hash values... Let me explain. As I understand it in laymens terms, if I have a ...
john smith's user avatar
0 votes
0 answers
87 views

Security certificate is issued to another domain after adding my self signed certificate to ca-certificates

following this post, I imported my self signed certificate into ca-certificates. But when I try to connect to the server using Dino, I get an error telling me that the security certificate is issued ...
Mateu Saiós's user avatar
0 votes
0 answers
788 views

Peer certificate cannot be authenticated with given CA certificates

Running on Alma Linux 8.8 but can't install the package. I get Peer certificate cannot be authenticated with given CA certificates. I have updated all packages with dnf update but the error is still ...
supmethods's user avatar
0 votes
1 answer
2k views

how to connect to wpa2/peap/mschapv2 w/no ca certificate without wpa_supplicant

i have followed posts on Network Manager looping to connect to enterprise networks and coming back again and again asking for logon/password. the answer seems to be to use wpa_supplicant. i did a log ...
rny1so's user avatar
  • 1
0 votes
0 answers
193 views

Fetchmail disconnecting on SSL mismatch

My fetchmail (v6.4.24) is connecting to an MTA that holds mail for many domains, and it has certs for each domain. The MTA (running dovecot) expects the client to use TLS SNI to present the right ...
TSG's user avatar
  • 1,698
0 votes
0 answers
712 views

error 18 at 0 depth lookup: self signed certificate

I have checked the following answer, and it doesn't seem to be relevant: I try to trust self signed CA certificate. I generated a certificate with the following config [req] prompt = ...
Alexander Kozachenko's user avatar
2 votes
1 answer
261 views

Creating PKCS#12 container from input from stdin

I want to create a PKCS#12 (a.k.a PFX) container for a private key and a certificate using openssl. My key and cert are contained in a single (unecnrypted) file: $ cat d.pem -----BEGIN CERTIFICATE-----...
mat's user avatar
  • 298
0 votes
0 answers
496 views

Install .cer certification file on Linux Red Hat 7.9

I got a .cer public key file,say noob.cer, that I must install or import to a Linux Red Hat server through command line in order to connect to a domain. I have searched and I only found info on how to ...
Haroldo Payares Salgado's user avatar
0 votes
0 answers
2k views

Failed to start The Apache HTTP Server

I'm having a problem with an SSL Certificate. I was using a Let's Encrypt certificate and everything was fine. I'm trying to switch to a certificate issued from DigiCert, and can't seem to get it ...
TexasTim's user avatar
1 vote
1 answer
41 views

Pull website's signing authority's certificate

There's a Docker registry running on my company's internal network at, say, registry.com. I know that the registry is legit but when I run docker login registry.com it complains that the certificate ...
Daniel Walker's user avatar
3 votes
1 answer
1k views

How to add a local CA authority on an air-gapped host of Debian

Given: an absolutely isolated LAN with a number of web-services using a local CA server. All user hosts have ca-certificates installed and .crt files were installed by update-ca-certificates. Browser-...
Swift's user avatar
  • 205
0 votes
0 answers
49 views

Only able to fix rclone certificate error over ethernet (it won't work over wifi) Why?

rclone will run fine for months at a time. The command I run most often is: rclone sync {{path/to/file_or_directory}} {{remote_name}}:{{path/to/directory}} Then - seemingly out of nowhere - I run my ...
jophuh's user avatar
  • 13
0 votes
1 answer
1k views

why am I unable to view Certificate Information

I run these command to generate private and public keys : openssl genrsa -out keypair.pem 2048 openssl rsa -in keypair.pem -pubout -out publickey.crt and then I tried to view certicate information ...
akaliza's user avatar
  • 101
1 vote
1 answer
47 views

Linux system logs

In one of our AWS Linux virtual machines, the ca-certificate.crt file has been modified, and our private CA has been deleted. How can I determine who made these changes and deletions?
Ahmed's user avatar
  • 11
1 vote
0 answers
44 views

Yubikey PIV not working without OTP

I just started using a Yubikey to do SSH logins by following this guide. It works fine - but only as long as the Yubikey is able to do OTP. After a few accidental touches on the key spewing a random ...
azzid's user avatar
  • 998
0 votes
0 answers
205 views

How to deploy root certificate in embedded Linux system?

I am working on an embedded Linux system (kernel-5.10.24). And there runs a web application, which connects to server through security protocol. So it links to libssl.so and libcrypto.so. When it is ...
wangt13's user avatar
  • 429
0 votes
0 answers
163 views

How to generate /etc/ssl/certs/ca-certificates.crt for embedded Linux?

I am working on an embedded Linux (kernel-5.10.24), and there is a web application running in this system. The web application failed with /etc/ssl/certs/ca-certificates.crt no such file or directory. ...
wangt13's user avatar
  • 429
0 votes
0 answers
641 views

CentOS - update-ca-trust extract not populating certificates to ca-bundle.crt

I am a new linux administrator and I have an issue with a certificate authority. I am working on that for a few days now and none of the manuals/blogs/forums I have read can help me (or maybe I am too ...
mauricio's user avatar
0 votes
1 answer
4k views

keytool error: java.io.IOException: Invalid keystore format

I have a 3-node ELK stack (Elasticsearch v7.17). After a reboot, the Kibana web interface reports an error "Kibana server is not ready yet". The SSL certs were expired, so I re-created them (...
dr_'s user avatar
  • 29.7k
0 votes
1 answer
1k views

Getting the issuer or subject hash from a server's SSL certificate

Is there a way to check the issuer of subject hash of some server's SSL certificate? I know that curl or wget search for the matching root certificate in /var/lib/ca-certificates/openssl or /etc/ssl/...
aviro's user avatar
  • 5,552
0 votes
0 answers
128 views

Newly created SSL certificate will not update

I have a self-hosted website and recently my SSL certificate expired. Tried creating a new one with the command sudo certbot certonly -d 'example.com,*.example.com' --manual --preferred-challenges dns....
leevii's user avatar
  • 1
0 votes
1 answer
2k views

How to disable TLS certificate validation in lynx?

I need to access some webpage for which the TLS certificate is invalid, but lynx refuses to connect. Is there an option similar to curl -k for lynx? Here's config file as request .h1 Auxiliary ...
ychaouche's user avatar
  • 998
0 votes
1 answer
489 views

CA certificate misses CA basicConstraint

I am trying to create a self signed CA by doing the following: ipsec pki --issue --cacert selfCA.pem --cakey ecdsaKEY.pem --ca --dn "..." --flag ikeintermediate --flag serverAuth --outform ...
Idomeneas's user avatar
2 votes
0 answers
67 views

Retain default behavior when AuthorizedPrincipalsFile set

I'm using certificate-based authentication for SSH. On one of my servers, I set AuthorizedPrincipalsFile to .ssh/authorized_principals in order to allow me to log into another user with my certificate....
Dessa Simpson's user avatar
0 votes
1 answer
48 views

Manually deploy LetsEncrypt certificate to Kubernetes

One of my systems (Rocky Linux 9) collects wildcard certificates from LetsEncrypt and distributes it to the various systems that require an SSL certificate. I also have AWX running on Kubernetes (...
Johan G's user avatar
  • 101
-1 votes
1 answer
1k views

No server certificate verification method has been enabled - Kali - OpenVPN

I am trying to install OpenVPN. I downloaded one .vpn from Deutch. Then just did on the terminal with this file ┌──(root㉿kali)-[~/Downloads/VPNBook.com-OpenVPN-DE4] └─# openvpn --config vpnbook-de4-...
succerplayer's user avatar
0 votes
2 answers
1k views

Certificate Based SSH Authentication still requires Private Key file

Most place I have read that should be able to login just with only the user certificate. Testing a loopback login I have followed the following tutorial: https://goteleport.com/blog/how-to-configure-...
rupert160's user avatar
  • 183
0 votes
0 answers
171 views

Regenerate SSL certificate?

Recently I'm dealing with a RHEL 7.8 host's Tenable Nessus Plugin #51192 issue which is "SSL Certificate Cannot Be Trusted". The Tenable Nessus report said this vulnerability was caused by &...
user53815's user avatar
1 vote
0 answers
1k views

curl SSL certificate problem: MITM proxy's self signed certificate in certificate chain

Problem: $ curl https://github.com/ curl: (60) SSL certificate problem: self signed certificate in certificate chain More details here: https://curl.se/docs/sslcerts.html curl failed to verify the ...
xpt's user avatar
  • 1,560
0 votes
1 answer
3k views

Is the private key included in the CA bundle?

Below you can see my apache2 virtual host SSL config from one of our domains, which works fine: ... # Example SSL configuration SSLEngine on #SSLProtocol all -SSLv2 #...
Black's user avatar
  • 2,079
2 votes
1 answer
2k views

MAC: Import .p12 certificate into the keychain via command line

I'm trying to import .p12 certificate into the keychain on my mac via bash script. So far, I've been trying: sudo security import command. It returns that import was successful but, in fact, it never ...
ArtemNovikov's user avatar
0 votes
1 answer
220 views

Connection to test server by editing hosts file results certificate error [closed]

My website running from centos 7 VPS have some compatibility issues, so I purchased a VPS and created a copy of the website and tried to fix them without affecting my website. But the problem is I ...
Biju Mathew's user avatar
1 vote
2 answers
1k views

Let's Encrypt Certs Fail "openssl verify" Verification

I've followed the guidance from other Stack answers- there's a gazillion related to this- in building my openssl verify command to validate my Let's Encrypt certs, shown below: openssl verify -...
F1Linux's user avatar
  • 2,486
0 votes
0 answers
66 views

Client Authentication in SSL Handshake

I am trying to understand on how Client Authentication works during SSL handshake process. Do we need to have Client Leaf certificate in Server truststore ? Is it referred anytime during Handshake ...
rizwan's user avatar
  • 11
0 votes
0 answers
583 views

Why does OpenSSL default the CRL to expire in 30 days?

EasyRSA sets the default CRL expiration to 180 days, and this other SE answer says the default is 30 days. In OpenVPN the CRL is just a static file named "crl.pem" and the file is never ...
KJ7LNW's user avatar
  • 495
0 votes
1 answer
111 views

Can I / should I import an old cacert.pem?

In my user directory on an older Linux installation, I have a cacert.pem file. I know it holds some sort CA certificates for use with SSL. But - in my newer user directory, I don't have such a file. ...
einpoklum's user avatar
  • 9,515
0 votes
1 answer
1k views

How can I remove the last certificate from a PEM file that contains three?

Some systems are still running in Ubuntu 16.04 that cannot be upgraded easily but they will be fully replaced by Ubuntu 22.04 machines later this year; unfortunately, to get LetsEncrypt to work on ...
Henry van Megen's user avatar
0 votes
1 answer
84 views

sendmail: does `TLS_Clt` support CIDR-formatted network blocks in /etc/mail/access?

Does sendmail support TLS_Clt access matching based on blocks of IPs? So far the official sendmail TLS documentation I have found does not indicate that it does (nor that it doesn't).
KJ7LNW's user avatar
  • 495
0 votes
1 answer
428 views

Can Postfix require TLS per-domain for inbound _and_ outbound addresses (or IPs)?

I want to reject email from certain senders (ie, the MAIL FROM sender) whose domain appears in a type:table map if the transport is not via STARTTLS. So if [email protected] sends an email then I ...
KJ7LNW's user avatar
  • 495
1 vote
1 answer
1k views

Using A3 Token (Safenet 5100) in Ubuntu

The company where I work is upgrading the certificates for VPN access from A1 to A3, but I am having trouble getting the new A3 Token to work in Ubuntu. By following a bunch of instructions from ...
Matheus Correia's user avatar
1 vote
1 answer
555 views

How do I view information contained in a file produced by `pdfsig -dump`?

pdfsig shows some information about digital signature of a PDF document, and also allows to -dump it to file. How do I view all information from that file in accessible form? It contains much more ...
Vi.'s user avatar
  • 5,698
0 votes
1 answer
393 views

keyUsage command not found (for create certificat in non interactive mode)

I would like to create a certificate files for my website. In the past, I use a non interactive script for doing that and it work perfectly. Now, I want to use again this script but it stop in this ...
darkomen's user avatar
  • 103
1 vote
1 answer
659 views

SSL: SAN not populated

I'm trying to create my self-signed certificate: CA private key creation: openssl genrsa -out ca.key 2048 CA certificate creation (see ca.cnf's content bellow): openssl req -x509 -new -key ca.key -...
Jordi's user avatar
  • 325
4 votes
1 answer
919 views

Why is curl, but not wget, having trust issues with software.download.prss.microsoft.com?

The following URL redirects to a microsoft.com subdomain: https://tb.rg-adguard.net/dl.php?go=3dd1ce66 Namely to https://software.download.prss.microsoft.com/db/Win10_20H2_v2_EnglishInternational_x64....
Forivin's user avatar
  • 847
6 votes
1 answer
1k views

Why are so many strange certificate filenames ending with 0 in /etc/ssl/certs?

As we know that CA certificates locate in /etc/ssl/certs in debian. cd /etc/ssl/certs ls | grep 0$ |wc -l 126 I paset part of them here: f081611a.0 f0c70a8d.0 f249de83.0 f30dd6ad.0 f3377b1b.0 ...
showkey's user avatar
  • 333
2 votes
1 answer
2k views

Adding custom field to the subject line in a opensssl X509 certificate via command line

I am attempting to generate a CSR for a certificate and wish to include a unique id as part of the certificate subject line. this information shall be used by the TLS client for some purpose after the ...
Anirban's user avatar
  • 141

1
2 3 4 5
8