89 votes

How to extract the Root CA and Subordinate CA from a certificate chain in Linux?

From a web site, you can do: openssl s_client -showcerts -verify 5 -connect stackexchange.com:443 < /dev/null That will show the certificate chain and all the certificates the server presented. ...
derobert's user avatar
  • 110k
79 votes

How to extract the Root CA and Subordinate CA from a certificate chain in Linux?

tl;dr - one liner bash magic to dump all certs in the chain openssl s_client -showcerts -verify 5 -connect wikipedia.org:443 < /dev/null | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN ...
estani's user avatar
  • 983
33 votes

Do I Need to Restart Nginx if I Renew My Security Certificate(s)?

On receiving SIGHUP nginx will reload updated configuration, verify it while opening log files and reading SSL certificates, then gracefully shut down worker processes relying on previous ...
sanmai's user avatar
  • 1,426
31 votes

apache2 Invalid command 'SSLEngine'

On CentOS 7 installing the package "mod_ssl" and restarting the apache server worked for me: yum install mod_ssl systemctl restart httpd
Falco Preiseni's user avatar
30 votes

How to convince dpkg that libssl1.0.2 is >= libssl1.0.0?

libssl1.0.2 and libssl1.0.0 are different packages, providing incompatible libraries; that’s why you can’t satisfy a libssl1.0.0 dependency using libssl1.0.2. To satisfy your package’s requirements, ...
Stephen Kitt's user avatar
22 votes

How to enable TLSv1.3 in Apache2?

Debian Buster = TLSv1.3 supported In Debian Buster (currently in testing), the TLSv1.3 is supported already. The following information is dated to: # date -I 2019-02-24 Apache2 version: # ...
Vlastimil Burián's user avatar
22 votes

Install Self Signed Certificate to Alpine Linux

Figured it out. Gosh. /etc/ssl/certs/ca-certificates.crt is actually appending each individual cert from /usr/local/share/ca-certificates. Get a clean environment (This was my first major issue) ...
Kurt's user avatar
  • 500
21 votes

How do I install a system-wide SSL certificate on openSUSE?

As already mentioned SUSE supports ca-certificates starting with openSUSE 13.1 / SLES 12. The difference to debian/Ubuntu is the directory for your certififcates. The SLES man page to update-ca-...
Christian's user avatar
  • 1,591
20 votes

Why am I getting 400 Bad Request?

Make sure you do not have illegal characters in your virtual hosts' ServerName. I ran into this issue while migrating "sub_domain.test.com" from Apache 2.2 to 2.4. The underscore in "sub_domain" ...
Chris78's user avatar
  • 301
19 votes

Adding a root certification authority to a java application

Simply copy your certificate files to this directory on CentOS 7.x: $ sudo cp <cert file> /etc/pki/ca-trust/source/anchors/ Once the certificate files put into this directory, run this command ...
slm's user avatar
  • 370k
18 votes

apache2 Invalid command 'SSLEngine'

httpd24 solution: yum install mod24_ssl
dtbarne's user avatar
  • 300
18 votes

What do I do if I can't find ssl.conf file in a CentOS server?

You need to install mod_ssl. Run: sudo yum install mod_ssl And it will place the default configuration file in /etc/httpd/conf.d/ssl.conf. If for some reason you have mod_ssl installed, but the ...
techraf's user avatar
  • 5,941
18 votes

How can I add subdomains to letsencrypt using certbots?

You have to use the --expand option of certbot --expand tells Certbot to update an existing certificate with a new certificate that contains all of the old domains and one or more additional new ...
Maxime Levesque's user avatar
15 votes

curl hangs after client hello

We suffered the same exact issue and the cause was an MTU misconfiguration, but there are many other possible causes. The key was to sniff traffic on our edge router, where we saw ICMP messages to ...
charli's user avatar
  • 251
15 votes

How do I list all available SSL CA certificates on CentOS 6?

// , Use the openssl command to get output from /etc/ssl/certs/ca-bundle.crt Anyway, I tried the following, mostly copied from https://unix.stackexchange.com/a/97249/48498, and it seemed to work if I ...
Nathan Basanese's user avatar
14 votes

Adding a self-signed certificate to the "trusted list"

Fedora On Fedora 23, add the .pem or .der file to /etc/pki/ca-trust/source/anchors/ and run sudo update-ca-trust extract. See man update-ca-trust for details, e.g. whether to use /etc or /usr. Alpine ...
user7610's user avatar
  • 2,058
13 votes

openssl s_client hangs

For fully automated solution, you can use echo -n: echo -n | openssl s_client -connect facebook.com:443
movermeyer's user avatar
13 votes

Apache SSL: server cert does not include ID which matches server name

Okay, I noticed that this post is viewed quite often recently and so it seems that a lot of people are facing the same issue that I did. If so then this might help you. I have followed a simple step-...
pixelmusik's user avatar
13 votes

Apache: I have lost my private.key, is it possible to re-create it from certificate.crt?

No, it is not possible to generate the private.key file from the certificate.crt file. You will need to generate a new key and a new certificate, if the below does not apply to you. You may ask your ...
John's user avatar
  • 17k
13 votes

How to enable TLSv1.3 in Apache2?

TLSv1.3 is now supported in Apache2 version 2.4.36 with OpenSSL 1.1.1 Source.
obeN's user avatar
  • 259
13 votes

aria2c had to connect to the other side using an unknown TLS protocol, why?

Your log indicates aria2c is using the GnuTLS library, which is choosing TLS 1.3, as both the GnuTLS library and the server supports it. But according to this patch, aria2c did not know about the ...
telcoM's user avatar
  • 97.1k
12 votes

Unable to locally verify the issuer's authority

I was having a similar error with https://excellmedia.dl.sourceforge.net/project/astyle/astyle/astyle%203.0.1/astyle_3.0.1_linux.tar.gz on a docker image(circleci/jdk8:0.1.1), In my case upgrading ca-...
Harsh Kumar Bhartiya's user avatar
12 votes

Can not download from an HTTPS site (ssl) with wget?

Using Wget 1.12 and OpenSSL 0.9.8 from Debian Squeeze 6.0.3 OpenSSL 0.9.8 supports only TLS 1.0 and lower protocol versions (i.e. SSL 3.0). According to ssllabs, github.com supports only TLS 1.2. ...
Steffen Ullrich's user avatar
12 votes

Downloading from a public server: SSL certificate problem: unable to get local issuer certificate

Curl is failing because that site is incorrectly configured Certificates are used to sign other certificates, forming chains. A CA has a root certificate, which is trusted by operating systems and ...
marcelm's user avatar
  • 2,485
11 votes

How to send mail to gmail account using ssmtp

The proper port is 465 Simplest way to send mail with image attachment from command line using gmail? EXCERPT: Install ssmtp with the following commands: sudo apt-get update sudo apt-get install ...
SDsolar's user avatar
  • 1,859
11 votes

Let' encrypt - nginx - OCSP stapling

Following the standard nginx setup, you should not need to specify a ssl_trusted_certificate chain. The following should be sufficient: ssl_certificate /etc/letsencrypt/live/myexample.org/fullchain....
Chris's user avatar
  • 211
11 votes

The correct way of implementing SSL on localhost

Warning: Before you dive into the minefield of running your own Certification Authority, you may need to study the security implications! But if you must, read on for a quick and dirty CA that will ...
garethTheRed's user avatar
11 votes

Trying to install debian package npm, makes apt-get to remove libssl-dev

You’re not doing anything wrong: npm depends on node-gyp, which depends on nodejs-dev, which depends on libssl1.0-dev, which conflicts with libssl-dev. Thus it is currently not possible to have npm ...
Stephen Kitt's user avatar
11 votes

CA certificates location in Ubuntu 18.04

Should be /etc/ssl/certs/ or /etc/ssl/certs/ca-certificates.crt. http://manpages.ubuntu.com/manpages/bionic/man8/update-ca-certificates.8.html Note this store is not necessarily used consistently by ...
sourcejedi's user avatar
  • 50.4k
11 votes

how to make Gnu/Linux trust a certificate that's trusted by Windows out-of-the-box?

The real fix for this is to ensure that your server presents all certificates in the chain and not just the end-entity (server) certificate. Point your server administrator to RFC 5246 Section 7.4.2 ...
garethTheRed's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible