Questions tagged [certificates]
A public-key certificate states that a specific public key belongs to a specific identity. Use this tag for all questions on certificates and authentication of public keys (not public-key authentication, which is authentication _using_ public-keys). If certificates are not a central issue in your question, then don't use this tag.
0
votes
0answers
6 views
update-ca-trust extract not adding certificates to ca-bundle
CentOS Linux release 7.6.1810 (Core)
Kernel 5.1.11-1.el7.elrepo.x86_64
I put a cert-file to /etc/pki/ca-trust/source/anchors
File looks like that:
-----BEGIN CERTIFICATE-----
...
0
votes
0answers
13 views
rsyslogd as a syslog forwarder over TLS (certificate based authentication required)
I want to configure a machines rsyslogd (redhat OS7 in this case) to connect via TLS to a central log collector.
The resyslogd needs to authenticate with a client certificate.
I already have the key, ...
-1
votes
0answers
10 views
Issue with an EV SSL Cert and Nginx [closed]
I am working in the company facilities. This issue is not related to a hosting provider:
The thing is that I am working with a CentOS server and I have finished the cert installation following the ...
-2
votes
1answer
35 views
How to convert a certificate in .pfx format to .jks in HP-UX server
I have a task to convert a .pfx SSL certificate to .jks format in a HP-UX B.11.31 server to be configured in our application's server.xml file, (keystoreFile=) for our 8090 connector port.
0
votes
1answer
26 views
Default Directories Not Working In OpenSSL Configuration File
I have set the directory in the /etc/ssl/openssl.cnf file but every time I issue the command
openssl req -x509 -newkey rsa:4096 -keyout cakey.pem -out cacert.pem -days 3650
it places the files in ...
1
vote
2answers
46 views
SSH: Permission denied as given IdentityFile is not used
I'm using this .ssh/config:
Host myserver
HostName 12.34.67.89
User anyuser
IdentityFile /root/.ssh/anything_rsa
But running ssh myserver returns a Permission denied (publickey) error.
...
2
votes
2answers
65 views
What certificate format does /usr/local/share/ca-certificates accept?
There are different methods of storing a certificate file? DER, PEM, PKCS: PKCS7 & PKCS12?
Are all of these formats accept as valid in /usr/local/share/ca-certificates?
0
votes
0answers
18 views
It seems that my cron task doesn't run [duplicate]
I have cron task for root that should run daily:
$ whoami
main_usr
$ sudo crontab -l -u root
0 23 * * * certbot renew --cert-name app.my_domain123.com --pre-hook "systemctl nginx stop" --post-hook ...
1
vote
1answer
64 views
bash: awk write each match to a file and increment filename
I want to read a file without whitespaces, filled with root certificates and seperate them into new files per match. I can select all matching certificates at once and insert to a single file, but I ...
1
vote
1answer
135 views
How to parse openssl certificate output into hostname and verification codes?
I have this shell code that reads lines of host names from input file, performs an openssl command to print ssl certificate info, and outputs the results in the terminal.
while read x;
do
echo $x;
...
0
votes
1answer
53 views
SSL Cert in Keystore and Browser cert are different
Bitbucket and Jenkins, in-order to talk to each other we have installed SSL certs in Bitbucket server. Issue started when Jenkins team used to mess up with their configuration and end up changing ...
0
votes
0answers
111 views
Network Manager: use gnome keyring to store WPA Enterprise CA cert
I am using a network which is a WPA2 enterprise WiFi network using PEAP and MSCHAPv2. The certificates are self-signed, so I have received a .pem certificate file which has to be selected on the ...
3
votes
0answers
122 views
NGINX OCSP stapling not working when CRL enabled?
I have an NGINX proxy set up to do OCSP stapling so new certificates work in google chrome.
I also set up client certificate checks on NGINX.
when I use the ssl_crl module to check the client ...
0
votes
2answers
38 views
Varying a certificate based on client TLS version in ClientHello
I've got a scenario where some older clients are only able to support MD5 and SHA1 signatures. Obviously these are generally considered deprecated but I do still need to support them. Upgrading ...
0
votes
1answer
70 views
Can I specify which hostname to check an SSH certificate against?
I've set up an SSH certificate for *.example.com, but not yet got around to setting up CNAMEs. Rather than mapping hostnames to IPs in /etc/hosts (and subsequently forgetting about the CNAMEs), is it ...
0
votes
0answers
284 views
How to config HTTPS on Apache tomcat
I have installed the Apache Tomcat/7.0.76 on centos7.
I want to enable SSL on the tomcat.
I have root, intermediate, domain certificate. Like this
85163c004aa3625d.crt gd_bundle-g2-g1.crt gdig2....
1
vote
1answer
309 views
How to install self signed .pem certificate for an application in OpenSuse?
Recently my workplace has updated the internet usage policies and imposed a Sophos security layer to monitor the traffic.
I am trying to clone a git repo (using git clone command) but getting this ...
0
votes
2answers
102 views
split (one-line) cert bundle into 2 file
I have one RSA PRIVATE KEY and one CERTIFICATE in one line, and I have to split it to one .key and .crt file.
Is it possible with sed or/and awk?
EDI1: example (as you can see its literally one line)...
0
votes
2answers
665 views
Void linux XBPS broke: certificate verification failed
I installed my first distro: Void Linux, the version without any desktop environment. I got my wifi to work and the package manager (xbps) worked fine; I installed things like htop, i3, etc without ...
11
votes
1answer
2k views
how to make Gnu/Linux trust a certificate that's trusted by Windows out-of-the-box?
There is a server with a broken SSL chain, as reported by this SSL check:
I know this is a problem that should be solved on the server itself, but sometimes this is hard to have fixed (I'm not the ...
0
votes
0answers
36 views
Generate KeyStore and TrustStore for SSL 1.2
I need to understand the process to generate keystore and truststore to setup a webservice with mutual ssl authentication.
I generated a key and CSR
openssl genrsa –out mykey.key 2048
openssl req -...
0
votes
1answer
82 views
How to run apache httpd 2.4.6 with a self-signed certificate signed with an elliptic curve key brainpoolP384t1, on CentOS 7.6?
I'm trying to run apache httpd 2.4.6 on CentOS 7.6 with a self-signed certificate signed with an elliptic curve key brainpoolP384t1, but apache is not accepting this as a valid key. I ensured all ...
-1
votes
1answer
1k views
CA certificates location in Ubuntu 18.04
Can you please point to me where can I locate the CA certificates file in Ubuntu 18.04? I have a program that needs the path that point to the CAs directory for certs. validation.
0
votes
1answer
751 views
Unable to install Let's Encrypt certificate on CentOS 7
I am trying to install a Let's Encrypt SSL certificate to my website using Securing Apache with Let's Encrypt on CentOS 7.
My web server is (include version): Apache (cPanel)
My hosting provider is: ...
2
votes
0answers
2k views
Add LDAP server certificate to trusted list and enable certificate verification
I am trying to use a secure LDAP connection via TLS ldaps://<server_name>:<port> for various applications (e.g. Gitlab). However, the connection raises certificate errors which is due to ...
1
vote
3answers
54 views
Certbot does not force Apache2 to read newly generated certificates
System: GNU/Linux Debian 9.5 headless.
Situation & Question
I have just caught the Let's Encrypt Certbot to re-generate the SSL certificate but did not reload Apache2. This has resulted in a ...
0
votes
1answer
413 views
zscaler certificate issue
Do any one have idea what could be error reason and how it can be resolved?
[root@Linux ~]$ wget https://www.google.com
--2018-10-19 07:46:25-- https://www.google.com/
Resolving www.google.com... ...
2
votes
1answer
1k views
How can I view certificate details on a smart card
I am using p11tool on CentOS to read a PIV smart card. The card is being read via the coolkey package driver (using libcoolkeypk11.so, per p11-kit list-modules)
I can get a listing of the certs on ...
3
votes
0answers
31 views
Authentication of users via HTTPd with certificates and two CAs
I would like to implement an internal site for our company, with certificate authentication used wherever possible. I have run into (and tried) various examples where one creates their own self-signed ...
0
votes
0answers
191 views
Centos 7.5: MOK Manager does not show up
I'm going to install VMWARE drivers, i.e. vmmon and vmnet, on my CentOS. However since their signature and certificate are not installed on CentOS, I had to sign them myself and install my sign/...
5
votes
1answer
4k views
Adding a root certification authority to a java application
I've installed Jenkins on CentOS7 and I was getting an SSL error when trying to update/install plugins. After some investigation, it turned out I had a missing root CA certificate in the Java CA store....
0
votes
1answer
55 views
Create self-signed certificate on Suse Linux 4.4
I try to create a self-signed certificate for a intranet.
I am following this suse documentation.
It says:
Change into the directory /usr/share/doc/packages/apache2 and run the
following command:...
1
vote
1answer
160 views
Temporary SSH access for SFTP
I have a home server which hosts shared files to a set of users. When adding new users I have (in the past) set up user accounts which belong to an 'SFTP only' group that chroots them to the shared ...
0
votes
1answer
465 views
valid SSL certificate verification reports as “Self-signed” and fails on ubuntu 14.04 for godaddy CA signed sites, despite root CAs being installed
System: Ubuntu 14.04, apt-upgraded to the latest. openssl, ca-certificates, wget installed
Symptoms:
wget https://api.tcell.io will result in this error:
ERROR: cannot verify api.tcell.io's ...
2
votes
1answer
2k views
how to update ca-bundle.crt with local company-root.crt
I am on RHEL 6.9
When I run the command
sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc
I get the following message
curl performs SSL certificate verification by default, using ...
3
votes
3answers
10k views
Can't connect to remote server using RDP remmina after upgrade
I recently upgraded my Ubuntu to 18.04, and now my Remmina cannot connect to a windows server we use at work. Now I am getting a popup about certificates. It asks if I want to accept the certificate, ...
1
vote
2answers
2k views
How to verify that ssh certificate was signed by specified ssh CA private key?
I am trying to harden my ssh setup using this material. It works fine, but I've got a question which I'm struggling to find the answer to.
Does anyone know if there is a way to check the ssh host/...
1
vote
2answers
3k views
Self-signed certificate gives error “x509: certificate signed by unknown authority”
I want to establish a secure connection with self-signed certificates. I used the following conf file for openssl
[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = ...
-2
votes
2answers
398 views
Which certificate gives more skills LPIC or RHCSA and which distro to choose CentOS or RedHat? [closed]
Can you give me some advise on which cert should I focus? LPIC or RHCSA? I want to do one of the certifications to learn some more skills and prove that I know the things at some level.
From what I ...
0
votes
1answer
299 views
Command to get ssl certificate pinning from certificate
There is a new certificate in pem format. How to get from it (using openssl?) a format expeced by ios? (example: https://github.com/Alamofire/Alamofire/blob/master/Source/ServerTrustPolicy.swift)
I've ...
1
vote
0answers
402 views
Using curl with certificates on Ubuntu 16.04
I'm trying to use the API for the Swedish payment service Swish on my Ubuntu server, but I can't get it to work. I believe the problem is with the certificates.
I have generated a CSR (without a pass ...
1
vote
3answers
102 views
Copying second occurrence pattern to a new file in sed
I H
have a certificate file which has 2 certificates in it. Starts with ---BEGIN CERTIFICATE-- and ends with ---END CERTIFICATE----.
Example:
---BEGIN CERTIFICATE--
blah1 blah1
---END CERTIFICATE--...
2
votes
2answers
1k views
Problems with ldap userCertificate attribute
I'm trying to use the 'userCertificate' attribute to hold a 'der' file.
I can happily add my certificate using the ldif:
dn: cn=bob,ou=users,dc=home
changetype: modify
add: userCertificate;...
0
votes
0answers
230 views
Where to put information from `key` entry of OpenVPN config file in pfSense?
I have the following config file which works well with native OpenVPN client
client
dev tap
proto udp
port 1198
remote myhost.com 1194
persist-key
persist-tun
tls-client
ca my-ca.crt
cert my-...
0
votes
2answers
2k views
Curl not returning response
I have a scenario where I was using curl --noproxy "*" https://.. to get the response but suddenly when I use it now it doesn't return me the response instead it says
curl: (60) Peer certificate ...
1
vote
3answers
412 views
Checking whether a date is within the next week
Trying to create a script for automatic SSL renewal with LetsEncrypt.
Daily script begins with checking when SSL expiry is:
response="$(openssl x509 -enddate -noout -in ~/letsencrypt/www.mydomain....
4
votes
2answers
2k views
Apache: I have lost my private.key, is it possible to re-create it from certificate.crt?
I lost my private.key file, which is necessary for the proper operation of my SSL certificate. I have only the certificate.crt file.
Is it possible to generate private.key file from certificate.crt ...
2
votes
2answers
1k views
OpenSSL fetches different SSL certificate than the one obtained via a browser
I need to download a SSL cert in PEM format from a HTTPS website, https://api.paczkomaty.pl . So I am using OpenSSL to do that:
openssl s_client -connect api.paczkomaty.pl:443 > myfile
openssl ...
1
vote
1answer
480 views
openssl -showcerts with -servername gives wrong anchor/root?
Despite reading multiple SO posts on this topic (eg and eg), openssl s_client -showcerts -servername downloads the wrong anchor/root certificate, whereas my web browser shows the correct anchor/root ...
2
votes
0answers
939 views
Timeout error after https configuration on CentOS 7
I have an app that has been running for 2 years now via http. Now we want to move to https for better security. Our OS is CentOS Linux 7. We have a virtual host config in /etc/httpd/sites-available ...
