Questions tagged [certificates]

A public-key certificate states that a specific public key belongs to a specific identity. Use this tag for all questions on certificates and authentication of public keys (not public-key authentication, which is authentication _using_ public-keys). If certificates are not a central issue in your question, then don't use this tag.

Filter by
Sorted by
Tagged with
0
votes
1answer
27 views

openssl: local installation caused certificate issue

To install Python from source without root permission, I had to install openssl, which I did using the following commands: wget https://www.openssl.org/source/openssl-1.1.1e.tar.gz tar -xzvf openssl-...
0
votes
1answer
39 views

ssh access with private certificate works from localhost and not from remote

I'm a noob on Gnu/Linux and UNIX. I am playing a game to learn basics of this OS. As part of the game I'm playing, I have to logon a remote server using ssh, having only the private key certificate ...
0
votes
1answer
30 views

Apache web server not starting when I set it up for ssl using custom certificates

I have setup Apache webserver on RHEL 7 instance yum install mod_ssl openssl openssl genrsa -out ca.key 2048 openssl req -new -key ca.key -out ca.csr openssl x509 -req -days 365 -in ca.csr -signkey ...
0
votes
0answers
26 views

error loading CA certificate

I did certificate request CSR with SHA256 sign and put it in generator of fake CA certificate (generates my university system) as part of work on my university virtual... It generated me CA ...
0
votes
0answers
34 views

Install crt certificate on Ubuntu 18.04

I have a .crt certificate and I've tried installing it in .local/share/ca-certificates (I've created this last folder because It didn't exist) and put my ca.crt into it , then I executed this command :...
1
vote
0answers
55 views

How do I disable zypper's certificate check?

I'm using SLES 2015 behind a firewall. All of my outgoing communications go over a proxy; specifically, zypper tries to use the proxy when I write, say, zypper search-packages foo but the proxy ...
1
vote
1answer
42 views

openssl is not finding any certificates

When I use git or curl I get an error which may be related to certificates: With git: > git clone https://github.com/vim/vim.git Cloning into 'vim'... fatal: unable to access 'https://github.com/...
0
votes
0answers
10 views

Web App for Host Certificate Management

Does the Linux ecosystem have a web application that will take host certificate requests and give an administrator a web interface method of signing them? And manage CRLs/OCSP, as well? Dogtag's ...
0
votes
0answers
21 views

Encode/Decode by certutils.exe on windows

How to decode file on Linux, which was encoded on Windows by certutil? certutil.exe -encode orig.zip orig.zip.txt
0
votes
0answers
36 views

Unable to import a certificate into java keystore

I am trying to import a certificate into java keystore. This is what I have done. Created the keystore: # keytool -keystore keystore.jks -storepass password -alias tomcat -genkeypair -validity 730 -...
1
vote
1answer
92 views

apt certificate chain uses insecure algorithm

we host a local mirror for Ubuntu and Debian packages. root@apt-mirror:~# dpkg -l | grep mirror ii apt-mirror 0.5.4-1 all ...
1
vote
1answer
51 views

Setting up Apache Mutual Authentication

I was asked to setup an Apache webserver to use Mutual Authentication in order to protect access to a specific folder/file. The access to this specific file/folder should be granted only if the ...
0
votes
1answer
48 views

Create certificate with subject alternative names

Creating CA certificate that should contain subject alternative names (SAN). openssl genrsa -des3 -out ca.key 2048 openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -config ca_server.cnf ...
0
votes
0answers
17 views

What does the “Certificates” section in seahorse do?

What does the "Certificates" / "System Trust" section of seahorse do? I am trying to sign a document in LibreOffice and the menu there uses the word "Certificate", so I am thinking that I need to ...
0
votes
0answers
31 views

Connecting to WPA2 Enterprise PEAP MSCHAPV2 with client authentication certificate

I'm working on implementing wireless access for some of our employees that exclusively use Ubuntu and have been stuck trying to get machine certificates to work. On the NPS server it keeps throwing: ...
4
votes
1answer
69 views

ssh-keygen and its -Z option on OpenBSD and on RHEL

I'm following along a rather good text about SSH certificates written for RHEL 6 and openssh-5.3p1-94.el6 (which makes it about 10 years old) while trying to mimic the examples on my OpenBSD-current ...
0
votes
1answer
38 views

SSL and login not working after replacing certificate

I am running Webmin on Debian, configured to use SSL. The certificate is about to expire, so I generated a new one and imported it using the GUI (pasted cert and key in PEM format, reused existing ...
0
votes
0answers
29 views

Is it possible to encrypt traffic if I have only CA certificate?

I have simple secure (I guess) Mosquitto sever described in my previous question. Client machine has no any keys or certificate installed except single ca.crt certificate file generated and taken ...
0
votes
1answer
13 views

How to distinct parts of a ssl CA bundle

I have a .pem file with four distinct sections. The first is obviously the private key because it says so. The latter three parts however I don't know which is which. This cert has been provided to me ...
0
votes
0answers
41 views

Apache stopped working after reboot

My Apache server on CentOS7 suddenly stopped working after a reboot. I had SSL configuration with .crt and .key wildcard certificates obtained from a valid CA. When I restart the httpd service I ...
0
votes
0answers
26 views

OCSP stapling + CRL on Apache

Please imagine an architecture with a root certificate authority (CA) and a subordinate CA. Is it possible for a client: to connect to an https server verify the validity of the server's ...
0
votes
0answers
18 views

OCSP: multi stapling on Apache

I am very interested in setting up multi stapling and I can not find a lot of documentation on it, or in any case, recent information. I have a certificate authority (CA) and a root CA above. They ...
1
vote
1answer
113 views

SSH User CA: Sign a user certificate with selected hosts instead of all hosts?

I have many servers that shares a common TrustedUserCAKeys. I want to sign a user certificate so it grants some access on specific servers instead of all of them. For example, the following command ...
0
votes
1answer
85 views

Enable OCSP stapling with Freeipa - Apache

I have 3 machines with Centos 7. I have FreeIPA server installed on the first machine. This serves as a certificate authority in my network; it's my CA. I have an other machine with FreeIPA client ...
1
vote
2answers
374 views

How to configure device to trust root certificate when using a SOCKS5 proxy?

I am routing a Linux machine through a SOCKS5 proxy. The internet works as expected and I am presented with the proxy's IP when viewing http://whatismyip.com. However, some sites are reporting that I ...
3
votes
0answers
48 views

SSH CA: How to sign a host key with custom port?

I have a server whose sshd listens on a non-standard port, say for example, 8022. I tried to sign its host key like this: ssh-keygen -s ibug_ca -I example -h -n '[example.com]:8022' ssh_host_rsa_key....
0
votes
0answers
19 views

Update Linux secure log to show escalation to root not as the user but as its RSA Cert ID

I looked all over Google.com but I couldn't find any answers. I am hoping someone could help me here. Background Info: We use a Certificate Authority Server that signs our engineers Public/Private ...
0
votes
0answers
583 views

How to generate a self-signed certificate in DER format with private key included, using OpenSSL?

As the title says: Using OpenSSL, how do I generate a self-signed certificate in DER format which includes the private key? Is this possible at all? I have found a myriad of posts which explain how ...
0
votes
1answer
974 views

AIX How to import CA certificate

I need to import my company's CA certificate to AIX6. I copied .crt file to /var/ssl/certs and /opt/freeware/etc/ssl/certs/ where all CA certificates are located, but I it's not enough. How should I ...
1
vote
1answer
68 views

Certificate Authority Not Working

If my understanding is correct, a CA acts like a parent certificate that is used to verify other certificates that have been signed by the CA certificate without having to install multiple server ...
1
vote
0answers
57 views

How to compile a Linux kernel with certificate / public key builtin?

I'd like to compile Linux Kernel 4.1.3 with a Public Key or self signed certificate built into the kernel. Is there a kernel option where I can specify the certificate/public key I want to add to ...
2
votes
1answer
731 views

Ansible get a list of certification files and check their expiration date

I am trying to figure out how to get a list of .crt files from one of our web servers and check the expiration date of these certification files (actually check if these certs are valid within a time ...
0
votes
0answers
728 views

HAProxy as a reverse proxy for backend already ssl enabled and SSL terminator for a backend exposed in port 80

I have 4 servers: proxy_server, $BK_SERVER_001, $BK_SERVER_002 and $BK_SERVER_003 The "proxy_server" only has an HAProxy enabled service with this configuration: (please look at the rows marked ...
4
votes
2answers
2k views

update-ca-trust extract not adding certificates to ca-bundle

CentOS Linux release 7.6.1810 (Core) Kernel 5.1.11-1.el7.elrepo.x86_64 I put a cert-file to /etc/pki/ca-trust/source/anchors File looks like that: -----BEGIN CERTIFICATE----- ...
0
votes
1answer
173 views

rsyslogd as a syslog forwarder over TLS (certificate based authentication required)

I want to configure a machines rsyslogd (redhat OS7 in this case) to connect via TLS to a central log collector. The resyslogd needs to authenticate with a client certificate. I already have the key, ...
-2
votes
1answer
94 views

How to convert a certificate in .pfx format to .jks in HP-UX server

I have a task to convert a .pfx SSL certificate to .jks format in a HP-UX B.11.31 server to be configured in our application's server.xml file, (keystoreFile=) for our 8090 connector port.
0
votes
1answer
606 views

Default Directories Not Working In OpenSSL Configuration File

I have set the directory in the /etc/ssl/openssl.cnf file but every time I issue the command openssl req -x509 -newkey rsa:4096 -keyout cakey.pem -out cacert.pem -days 3650 it places the files in ...
1
vote
2answers
367 views

SSH: Permission denied as given IdentityFile is not used

I'm using this .ssh/config: Host myserver HostName 12.34.67.89 User anyuser IdentityFile /root/.ssh/anything_rsa But running ssh myserver returns a Permission denied (publickey) error. ...
2
votes
2answers
584 views

What certificate format does /usr/local/share/ca-certificates accept?

There are different methods of storing a certificate file? DER, PEM, PKCS: PKCS7 & PKCS12? Are all of these formats accept as valid in /usr/local/share/ca-certificates?
0
votes
0answers
28 views

It seems that my cron task doesn't run [duplicate]

I have cron task for root that should run daily: $ whoami main_usr $ sudo crontab -l -u root 0 23 * * * certbot renew --cert-name app.my_domain123.com --pre-hook "systemctl nginx stop" --post-hook ...
1
vote
1answer
217 views

bash: awk write each match to a file and increment filename

I want to read a file without whitespaces, filled with root certificates and seperate them into new files per match. I can select all matching certificates at once and insert to a single file, but I ...
1
vote
1answer
506 views

How to parse openssl certificate output into hostname and verification codes?

I have this shell code that reads lines of host names from input file, performs an openssl command to print ssl certificate info, and outputs the results in the terminal. while read x; do echo $x; ...
0
votes
1answer
164 views

SSL Cert in Keystore and Browser cert are different

Bitbucket and Jenkins, in-order to talk to each other we have installed SSL certs in Bitbucket server. Issue started when Jenkins team used to mess up with their configuration and end up changing ...
3
votes
0answers
322 views

NGINX OCSP stapling not working when CRL enabled?

I have an NGINX proxy set up to do OCSP stapling so new certificates work in google chrome. I also set up client certificate checks on NGINX. when I use the ssl_crl module to check the client ...
0
votes
2answers
85 views

Varying a certificate based on client TLS version in ClientHello

I've got a scenario where some older clients are only able to support MD5 and SHA1 signatures. Obviously these are generally considered deprecated but I do still need to support them. Upgrading ...
0
votes
1answer
162 views

Can I specify which hostname to check an SSH certificate against?

I've set up an SSH certificate for *.example.com, but not yet got around to setting up CNAMEs. Rather than mapping hostnames to IPs in /etc/hosts (and subsequently forgetting about the CNAMEs), is it ...
0
votes
0answers
1k views

How to config HTTPS on Apache tomcat

I have installed the Apache Tomcat/7.0.76 on centos7. I want to enable SSL on the tomcat. I have root, intermediate, domain certificate. Like this 85163c004aa3625d.crt gd_bundle-g2-g1.crt gdig2....
1
vote
1answer
761 views

How to install self signed .pem certificate for an application in OpenSuse?

Recently my workplace has updated the internet usage policies and imposed a Sophos security layer to monitor the traffic. I am trying to clone a git repo (using git clone command) but getting this ...
0
votes
2answers
387 views

split (one-line) cert bundle into 2 file

I have one RSA PRIVATE KEY and one CERTIFICATE in one line, and I have to split it to one .key and .crt file. Is it possible with sed or/and awk? EDI1: example (as you can see its literally one line)...
2
votes
2answers
2k views

Void linux XBPS broke: certificate verification failed

I installed my first distro: Void Linux, the version without any desktop environment. I got my wifi to work and the package manager (xbps) worked fine; I installed things like htop, i3, etc without ...

1
2 3 4 5 6