Questions tagged [certificates]
A public-key certificate states that a specific public key belongs to a specific identity. Use this tag for all questions on certificates and authentication of public keys (not public-key authentication, which is authentication _using_ public-keys). If certificates are not a central issue in your question, then don't use this tag.
295
questions
0
votes
0answers
8 views
How to get vsftpd working with signed SSL certificate
I have vsftpd working with a self-signed certificate, but would like to use our CA signed certificate instead. However, when configuring vsftpd to use the CA signed certificate (.pem file) and private ...
0
votes
1answer
16 views
VPN configuration on Kali Linux with certificate PFX
I need to connect to my organization using VPN. For this I have PFX user certificate file, VPN Group, VPN username and password and gateway itself. Everything was simple on windows, just installed pfx ...
0
votes
2answers
15 views
existing x509 certificate how to add extended key usage
I have an existing X509 certificate, can I still add an extended key usage item to it now (codesigning) ?
Or do I have to create a new cert?
The extended key usage is written to the public key, right?
...
0
votes
1answer
11 views
How can I fix broken https on Cockpit?
I've just installed cockpit on my CentOS 8 box:
dnf install cockpit
systemctl start cockpit.socket
systemctl enable cockpit.socket
Once I'd let it through the firewall, I can get it up on a.b.c.d:...
1
vote
1answer
20 views
How Should I Move SSL Certificates (Made With Certbot) From One Ubuntu Server To Another?
I have an ubuntu bionic server on which I set up ssl with my own domain name by following this guide.
I would now like to decommission this server and move the ssl domain name to a different ubuntu ...
0
votes
1answer
43 views
How can I use an unsigned public key to encrypt a large file using openssl?
openssl this way can only encrypt small files:
openssl rsautl -encrypt -pubin -inkey public_key.pem -in secret.txt -out secret.enc
openssl as I found suggested here throws an error:
openssl smime -...
0
votes
0answers
10 views
How do I create a VPN certificate (IPSec / IKEv2) which contains an FQDN as identifier?
Obviously, I have a serious lack of understanding of how X.509-based authentication in IPSec VPNs works.
More than one time, I have setup VPNs, based on IPSec / IKEv2, where one of the gateways was ...
1
vote
1answer
124 views
Add custom CA certificate to Ubuntu 20.04 works fine, but fails on Debian
I went through the process of adding a new CA certificate on Ubuntu (20.04), but the same steps did not work on Debian (10)
in both environments, I have downloaded the custom CA certificate (via ...
0
votes
0answers
5 views
Alfresco SSO with client certification authentication - alfresco 5.2.1
Team,
I want to setup Alfresco SSO with client certificates authentication
I reffered few of blogs and configuration
e.g. https://www.seedim.com.au/alfresco-certificate-based-sso/
Even I generaeted ...
0
votes
0answers
88 views
Handshake Failure when cloning a git repository which requires a certificate
The Problem
I have been having issues connecting to a Atlassian Stash which requires a certificate issued by my company. When I connect using Firefox (which has the certificate) it will allow me to go ...
2
votes
1answer
514 views
Certificates on WSL
I am working with Debian, installed on Windows through WSL and I am having some annoying problems with certificates. I am behind a corporate network and not entirely sure how is setup (proxy, self ...
0
votes
0answers
26 views
How to generate a self signed certificate from openssl having the SPIFFE URI
I have a requirement of generating a SPIFFY Cert from the openssl similar to this here Local SSL Certificates in Chrom(e/ium) 63 can any one suggest on what need to be added to generate the spiffe uri ...
0
votes
0answers
68 views
How to create a oracle wallet with chain certificates?
I have three certificates, root, intermediate and server. Intermediate certificate is signed by root certificate and server certificate is signed by intermediate certificate.
What are the steps to ...
0
votes
1answer
35 views
How do I verify the certificate of a specific computer when the DNS gives me one of many IP addresses?
I have a cloud setup with 6 front end computers using Apache. I installed a new SSL certificate. Now I want to verify that all the machines have the certificate.
The problem is if I just use https://...
2
votes
1answer
37 views
Trust a x509 certificate that is already trusted on another host
I have two hosts, one with Debian Buster and one with CentOS 7.
I'd like to connect to an SMTP server over SSL from both of them. However, I can only do it from CentOS:
CentOS:
$ openssl s_client -...
0
votes
1answer
629 views
Compile Linux Kernel 5.x on CentOS 8.2, certs
I'm using CentOS 8.2 with Kernel (4.18.0-193.6.3.el8_2.x86_64) and I'm interested into compile the Kernel version 5.7.
Really, I need to extract some libraries for these reason I don't want to install ...
1
vote
1answer
97 views
How should I add a root CA certificate for a git remote on NixOS?
I am currently writing some software for a company and they have asked me to push the code to a git remote located on their server. They sent through a CA certificate (*-root-CA.crt) that apparently ...
1
vote
0answers
93 views
SSH - Key signing of ED25519 style keys does not work
Trying to set up a SSH Cert Authority so I can centralize new key setup rather than modifying the authorized keys on each of my machines. I found something really odd - the keys that I develop work ...
1
vote
2answers
996 views
Unable to locally verify the issuer's authority even after using certificate
When executing
wget https://docs.conda.io/projects/conda/en/4.6.0/_downloads/52a95608c49671267e40c689e0bc00ca/conda-cheatsheet.pdf
I have this error:
--2020-06-03 20:55:06-- https://docs.conda.io/...
2
votes
1answer
310 views
One client fails with “certificate has expired”, while other clients work just fine
I have two machines. One is running Fedora (30) and the other one is running Debian (buster).
When I run curl https://www.ultimate-guitar.com/ on the Fedora machine, I get the expected response.
...
0
votes
0answers
25 views
I get NET::ERR_CERT_COMMON_NAME_INVALID when I try to use certbot for let´s encrypt in more than one domain
I am following the recommendations of Digital Ocean to configure several SSL certificates in Let´s Encrypt for more than one domain. Both domains have www subdomains.
The first domain I have ...
0
votes
1answer
52 views
How to query openLDAP servers cert?
From the "service sssd status" we can see:
Could not start TLS encryption. TLS: hostname does not match CN in
peer certificate
But how could we query the cert to know, that it is really some ...
0
votes
2answers
80 views
Is it possible to recover the ca.crt and ca.key after i deleted them?
I accidentally removed my OpenVPN ca.crt, ca.key, server.crt and server.key with the ./clean-all command. I didn't know that the server config (currently also the "signing machine") pointed to the ...
0
votes
0answers
209 views
gnome-keyring: couldn't find any place to import files
I need to use a client certificate. I was able to import it successfully on Windows and Mac, however when I am trying to import it on Linux I am getting the following error:
$ gnome-keyring import ...
0
votes
1answer
337 views
openssl: local installation caused certificate issue
To install Python from source without root permission, I had to install openssl, which I did using the following commands:
wget https://www.openssl.org/source/openssl-1.1.1e.tar.gz
tar -xzvf openssl-...
0
votes
1answer
82 views
ssh access with private certificate works from localhost and not from remote
I'm a noob on Gnu/Linux and UNIX. I am playing a game to learn basics of this OS.
As part of the game I'm playing, I have to logon a remote server using ssh, having only the private key certificate ...
0
votes
1answer
276 views
Apache web server not starting when I set it up for ssl using custom certificates
I have setup Apache webserver on RHEL 7 instance
yum install mod_ssl openssl
openssl genrsa -out ca.key 2048
openssl req -new -key ca.key -out ca.csr
openssl x509 -req -days 365 -in ca.csr -signkey ...
0
votes
0answers
105 views
error loading CA certificate
I did certificate request CSR with SHA256 sign and put it in generator of fake CA certificate (generates my university system) as part of work on my university virtual... It generated me CA ...
0
votes
0answers
170 views
Install crt certificate on Ubuntu 18.04
I have a .crt certificate and I've tried installing it in .local/share/ca-certificates (I've created this last folder because It didn't exist) and put my ca.crt into it , then I executed this command :...
1
vote
0answers
976 views
How do I disable zypper's certificate check?
I'm using SLES 2015 behind a firewall. All of my outgoing communications go over a proxy; specifically, zypper tries to use the proxy when I write, say,
zypper search-packages foo
but the proxy ...
1
vote
1answer
187 views
openssl is not finding any certificates
When I use git or curl I get an error which may be related to certificates:
With git:
> git clone https://github.com/vim/vim.git
Cloning into 'vim'...
fatal: unable to access 'https://github.com/...
0
votes
0answers
12 views
Web App for Host Certificate Management
Does the Linux ecosystem have a web application that will take host
certificate requests and give an administrator a web interface method
of signing them? And manage CRLs/OCSP, as well?
Dogtag's ...
0
votes
0answers
55 views
Encode/Decode by certutils.exe on windows
How to decode file on Linux, which was encoded on Windows by certutil?
certutil.exe -encode orig.zip orig.zip.txt
0
votes
0answers
49 views
Unable to import a certificate into java keystore
I am trying to import a certificate into java keystore. This is what I have done.
Created the keystore:
# keytool -keystore keystore.jks -storepass password -alias tomcat -genkeypair -validity 730 -...
1
vote
1answer
409 views
apt certificate chain uses insecure algorithm
we host a local mirror for Ubuntu and Debian packages.
root@apt-mirror:~# dpkg -l | grep mirror
ii apt-mirror 0.5.4-1 all ...
2
votes
1answer
391 views
Setting up Apache Mutual Authentication
I was asked to setup an Apache webserver to use Mutual Authentication in order to protect access to a specific folder/file.
The access to this specific file/folder should be granted only if the ...
0
votes
1answer
175 views
Create certificate with subject alternative names
Creating CA certificate that should contain subject alternative names (SAN).
openssl genrsa -des3 -out ca.key 2048
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -config ca_server.cnf
...
0
votes
0answers
59 views
What does the “Certificates” section in seahorse do?
What does the "Certificates" / "System Trust" section of seahorse do?
I am trying to sign a document in LibreOffice and the menu there uses the word "Certificate", so I am thinking that I need to ...
0
votes
0answers
38 views
Connecting to WPA2 Enterprise PEAP MSCHAPV2 with client authentication certificate
I'm working on implementing wireless access for some of our employees that exclusively use Ubuntu and have been stuck trying to get machine certificates to work.
On the NPS server it keeps throwing: ...
6
votes
2answers
107 views
ssh-keygen and its -Z option on OpenBSD and on RHEL
I'm following along a rather good text about SSH certificates written for RHEL 6 and openssh-5.3p1-94.el6 (which makes it about 10 years old) while trying to mimic the examples on my OpenBSD-current ...
0
votes
1answer
56 views
SSL and login not working after replacing certificate
I am running Webmin on Debian, configured to use SSL. The certificate is about to expire, so I generated a new one and imported it using the GUI (pasted cert and key in PEM format, reused existing ...
0
votes
0answers
29 views
Is it possible to encrypt traffic if I have only CA certificate?
I have simple secure (I guess) Mosquitto sever described in my previous question.
Client machine has no any keys or certificate installed except single ca.crt certificate file generated and taken ...
0
votes
1answer
19 views
How to distinct parts of a ssl CA bundle
I have a .pem file with four distinct sections. The first is obviously the private key because it says so. The latter three parts however I don't know which is which. This cert has been provided to me ...
0
votes
0answers
101 views
Apache stopped working after reboot
My Apache server on CentOS7 suddenly stopped working after a reboot.
I had SSL configuration with .crt and .key wildcard certificates obtained from a valid CA.
When I restart the httpd service I ...
1
vote
2answers
457 views
SSH User CA: Sign a user certificate with selected hosts instead of all hosts?
I have many servers that shares a common TrustedUserCAKeys. I want to sign a user certificate so it grants some access on specific servers instead of all of them.
For example, the following command ...
0
votes
1answer
183 views
Enable OCSP stapling with Freeipa - Apache
I have 3 machines with Centos 7.
I have FreeIPA server installed on the first machine. This serves as a certificate authority in my network; it's my CA.
I have an other machine with FreeIPA client ...
1
vote
2answers
701 views
How to configure device to trust root certificate when using a SOCKS5 proxy?
I am routing a Linux machine through a SOCKS5 proxy. The internet works as expected and I am presented with the proxy's IP when viewing http://whatismyip.com.
However, some sites are reporting that I ...
3
votes
0answers
90 views
SSH CA: How to sign a host key with custom port?
I have a server whose sshd listens on a non-standard port, say for example, 8022. I tried to sign its host key like this:
ssh-keygen -s ibug_ca -I example -h -n '[example.com]:8022' ssh_host_rsa_key....
0
votes
0answers
2k views
How to generate a self-signed certificate in DER format with private key included, using OpenSSL?
As the title says:
Using OpenSSL, how do I generate a self-signed certificate in DER format which includes the private key? Is this possible at all?
I have found a myriad of posts which explain how ...
0
votes
1answer
2k views
AIX How to import CA certificate
I need to import my company's CA certificate to AIX6. I copied .crt file to /var/ssl/certs and /opt/freeware/etc/ssl/certs/ where all CA certificates are located, but I it's not enough. How should I ...
