Problem with importing and creating self signed SSL certificate

Mac Pro, 10.7.2 Server. Attempting to import or create a self signed certificate for use as ichat.domain.com to encrypt iChat service. Server is acutally called server.domain.com but has an alias of ichat.domain.com. I understand that this is probably not best practice but I would like to keep things this way since we have one server, run multiple services on it, but want to continue to connect to each service at SERVICE.domain.com. We have been using this type of mismatched certificate with success since 10.4 or so.
I am working through setup of 10.7 Server to replace our 10.6 server.
Tried upgrade of 10.6 to 10.7 installation. The installation made a mess of some services and our Open Directory, but did move the certificate over and allowed iChat service to function properly.
Clean install and setup of 10.7 Server. Exported self signed certificate, private key, and encryption password from 10.6 Server and functioning 10.7 upgraded Server.
On import or manual creation of certificate get the following error:
Error
Check your server's logs for more information. The error (code 5001) was: Expected SecKeychainItemImport to return a SecIdentityRef, but it did not
Log shows:
Dec 29 17:56:55 server servermgrd[498]: -[CertsRequestHandler(HelperAdditions) importP12Data:passphrase:error:]: importedItems = (
"<SecCertificate 0x7fcf6ed43c00 [0x7fff78d96f40]>"
I have tried importing and manually creating other certificates with a variety of names with success. I assume that there is something buried somewhere that is causing this particular one to be a problem. Other than manually removing any remnants of the certificate from /etc/certficates I do not have any ideas what to try. I am essentially ready to move this server to 10.7 except for this problem and would like to avoid a reinstall.
Suggestions?
-Erich

Take a look here.
https://bbs.archlinux.org/viewtopic.php?id=146649
Maybe it's a problem with your network.

Similar Messages

E-Mail Setup fails with self-signed SSL certificat...

Hi, one of my e-mails is with a small provider who just moved the mail server to Imap and SSL. In Thunderbird, everything works fine, setup on my Nokia C-6-fails with an unspecific error message (and trows away the settings). I asked the provider, and it seems that the problem comes up because the Nokia e-mail application doesn't asked me if I want to accept the certificate but instead rejects it. Is there a workaround to this problem? Is there a way to setup the mail account without using the wizard? Or to take over the settings from Thunderbird? Or a way to put the certificate in the right place manually? In Opera mobile I have no trouble with self-signed SSL certificates. Thanks Cave

Any one around who can help? Self-Signed certificates are rather common, after all. I would be grateful cave

IPhone LDAP contacts and Self signed SSL certificates

Hi,
I am using OpenLDAP with self signed SSL certificate, and i am unable to get SSL work with LDAP contacts on the IPhone (4.x). I have tried to add a CA cert with a server certificate for the LDAP server and downloaded it to the IPhone by web, it adds the CA, but even with it, it does not want to connect to the LDAP server with SSL enabled.
Does LDAP contacts should work by adding new CA ? if yes, what is the exact procedure to do it ? (maybe I used a wrong CA export format, or wrong SSL certificate encryption format ...)
can someone tell me how to do it ?
This is really anoying, since we have multiple iphones on the company.
Thanks for the help.

Hello, found your post. I realize it's been 6 months since you posted, but I have a solution for you since I have struggled with the same problem since 2009.
I discovered that when the iPhone is using LDAPS, it tries to bind with LDAPv2. After it binds, it speaks LDAPv3 like it is supposed to. Apparently this is a somewhat common practice since OpenLDAP includes an option for it.
You'll want to set the following option in OpenLDAP:
dn: cn=config
olcAllows: bind_v2
Walla! LDAPS works! (assuming you've correctly done all the certificate stuff). Took some deep reading through the debug logs to figure out this problem. Figured I'd share my answer with others.

Abandoning Self-Signed SSL Certificates?

Hello,
I'm working on remediation of some security flaws and have encountered a finding that calls out each of my domain-added workstations as having self signed SSL certificates. I'm not an expert on the subject, but I do know the following things:
1) An earlier finding lead to me disabling all forms of SSL on my servers and workstations
2) Workstations use certificates to identify themselves to other domain assets.
Now my servers all have their own certs signed by an outside authority. However, it would be a huge amount of work to go through the process for each and every workstation. So my questions are these:
1) Can I create a NON-SSL self signed cert for these machines to use?
2) How do I remove these current SSL certs without having to hover over each workstation?
Basically, what's the least effort to remove self-signed SSL certs and replace them with something more secure?
Thanks,
M.

What do you mean when you say that you've disabled all forms of SSL on your servers and workstations? SSL serves to provide secure communications for all of your domain operations, so disabling SSL, in general, would likely break your entire domain. If you're
using certificates on your workstations, then you're using certificate-based security (IPSec) in some manner.
Do you have AD CS or some other certificate signing authority/PKI in your environment? If not, you would have to pay a public provider (i.e. VeriSign) to provide certificates, and I can assure you that gets very expensive.
If you have Microsoft servers in your environment, you can install and use Certificate Services to provide an internal signing mechanism which can be managed through group policy. You can replace all of the workstation certificates with ones signed by your
internal certificate authority (CA,) and those will pass muster with any auditor provided the appropriate safeguards are put into place elsewhere in your environment.
Least effort for you would be to implement an internal CA, which admittedly isn't a low-effort endeavor, and have the CA assign individual certificates to all of your machines, users, and any other assets you need to protect. If your auditors are requiring
the removal of the self-signed certificates, you might find a way to script the removal of the certificates. In my experience, however, most auditors just want IPSec to be done with certificates that terminate somewhere other than the local workstation (i.e.
an internal CA).

Create self signed ssl cert

I'm trying to test the app server. Is there a quick way to install a self signed server certificate (I'm running Windows 2000 pro).
Thanks
Mark

Download the NSS tools from here:
http://wwws.sun.com/software/download/products/3e3afa8e.html
Documentation for NSS tools can be found here (see certutil):
http://www.mozilla.org/projects/security/pki/nss/tools/

Self signed SSL Certificates no longer work after upgrade to 37.0.1

I followed these two articles to create local self signed certificates and they have been working fine since February. Now with the update to 37.0.1 I get "Secure Connection Failed" while trying to access my local website through FireFox. IE and Google Chrome have no problem accessing the local site.
http://www.jayway.com/2014/09/03/creating-self-signed-certificates-with-makecert-exe-for-development/
http://www.jayway.com/2014/10/27/configure-iis-to-use-your-self-signed-certificates-with-your-application/
I have already deleted cert8.db, restarted FF, then re-imported the self signed certificates but get the same error. No other software has changed on this box except the automatic upgrade to FF 37.0.1.
The network setting is already set to use "No Proxy"
How do I fix this?
Windows 8.1 Pro
IIS 8

I have exactly the same problem. All servers and devices that use a self-signed certificate are not reachable anymore via FF37.0.1 after upgrade to FF 37.0.1.
Firefox prints:
"Secure Connection Failed
The connection to the server was reset while the page was loading.
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem."
I'm not getting the chance to add an exception hence no access to the server anymore.
This is a severe problem, because all internally used Glassfish servers in our test environments run with self-signed certificates. As Firefox blocks access to them I cannot maintain my servers anymore.
I have the same problem with Chrome but not with IE - IE is the offers to add an exception but suffers the blank page problem when accessing Glassfish.
I tried to adjust the following values in the FF config:
security.tls.version.min = 0 ;default
deleted cert8.db and restarted FF
I'm really lost, kindly advise.

Extend self-signed SSL certificate beyond one year

Hi all,
How can I extend SSL Certificate created by Windows 2008 R2's Certificate Service beyond 1 year?
Thanks.

Hi,
For self-signed certificate, you can use IIS Manager to create new one. For more detailed steps, please refer to the below steps.
Create a Self-Signed Server Certificate in IIS 7
http://technet.microsoft.com/library/cc753127(WS.10)
If it’s a certificate issued by a CA, we just need to renew the certificate with the CA to extend the valid date.
Best Regards,
Aiden
Aiden Cao
TechNet Community Support

Mail.app: Self-Signed SSL Certificates

How can I make mail trust self signed mail certificates FOREVER? As it is now, I have to tell Mail.app to always trust the cert for each email account, every time I launch mail. Then it remembers to trust it until I quit mail, then I have to re-tell it all over again. This is bearable on my desktop but on my laptop, where I need SSL the most, I'm constantly logging in and out and rebooting, and it drives me crazy.
FYI it's my own server, running Mac OS X Server. And I'm not buying a certificate, it's the encryption I'm after

First, the certificate must match the name Incoming Mail Server that your clients are using. For example 'mail.acme.com'. So, when creating the self-signed certificate, the common name that you enter would be 'mail.acme.com'. If you don't do this, you will always be prompted about the certificate when you relaunch Apple mail.
Just for clarification, here is how you should trust the self-signed certificate on the Macs that are using Apple Mail:
1. When you get the prompt about the certificate, click the show certificate button.
2. Drag the icon of the Certificate on the left in the Show Certificate dialog box to the desktop. This will create a document on your desktop named 'mail.acme.com.cer'.
3. Double click the certificate on the desktop which will open an Add Certificate dialog box.
4. Depending on the version of Mac OS X that you are running, what you do next will vary a little.
Leopard
1. Click the drop down next to keychain and select System
2. Open Keychain Access (Applications/Utilities) if it is not already open
3. Click System on left hand side under Keychains
4. Locate the 'mail.acme.com' certificate on the right and double-click it to open it. (NOTE: I had to quit Keychain Access and reopen it before the certificate showed up under System for me for some odd reason)
5. Click the gray triangle next to Trust to expand the Trust section of the Certificate.
6. Select Always Trust from the drop down next to 'When using this certificate'
7. Close the certificate window and then quit out of Keychain Access
8. Click the continue button back in Apple Mail if the Certificate dialog is still present.
9. Quit out of Apple Mail and the relaunch it again. This time you should not see the certificate dialog alert.
Tiger
1. Click the drop down next to keychain and select X509Anchors
2. Open Keychain Access (Applications/Utilities) if it is not already open
3. Click System on left hand side under Keychains
4. Locate the 'mail.acme.com' certificate on the right and double-click it to open it.
5. Click the gray triangle next to Trust to expand the Trust section of the Certificate.
6. Select Always Trust Settings from the drop down next to 'When using this certificate'
7. Close the certificate window and then quit out of Keychain Access
8. Click the continue button back in Apple Mail if the Certificate dialog is still present.
9. Quit out of Apple Mail and the relaunch it again. This time you should not see the certificate dialog alert.
This worked for me. I hope this works for you too.

Problem with Import and Export Data Wizard

Downloaded and installed SQL Server Express 2008 R2 today because I want to explore how Access interacts with SQL Server (using my home computer). I'm using Access 2010 (under Windows 7), so the 2008 version of SQL Server Express seemed to be the version
to use.
After a couple of false starts, installation appeared to go okay. After the installation. My Start menu listed Microsoft SQL Server 2008 and Microsoft SQL Server 2008 R2. The latter listed Import and Export Data (64-bit). When I clicked that, the first Import
and Export Data Wizard page was displayed. I wasn't ready at that time to explore the wizard, so I closed it. An hour or so later I again attempted to open the Import and Export Data wizard. This time, the wizard didn't open. Instead this error message was
displayed: "The SSIS Runtime object could not be created. Verify that DTS.dll is available and registered."
I found DTS.dll on my computer at C:\Program Files\Microsoft SQL Server\100\DTS\Binn, so the file is available, but don't know whether it is registered.
How can I correct this problem?

First can you please post all log file errors
>> I can't really give you a solution or specific recommendation since I did not saw this error yet myself, but on your own risk you can try:
1. You may try to just register 'dts.dll' using regsvr32.exe, but this error may indicate a bigger problem with setup.
If you are running SQL Server 64bit then try running this at the command prompt: %windir%\syswow64\regsvr32 "%ProgramFiles(x86)%\Microsoft SQL Server\90\dts\binn\dts.dll"
2. You can try reinstall from start (In this case you have to make sure that you un-install all)
[Personal Site] [Blog] [Facebook]

Problem with Import and Base Object

Hi everyone
Last week, I downloaded Flash CS5. I am trying different thing and here is the problem that I dont understand
I wrote a package like that
package {
    import flash.text.TextField;
    import fl.controls.Button;
    public class ex1 extends Sprite {
        public function ex1() {
           var myButton:Button = new Bu
tton();
            var label:TextField         = new TextField();
            addChild(label);
If I try to execute that script, the compiler returns error
1046: Type was not found or was not a compile-time constant: Button.
1180: Call to a possibly undefined method Button.
If I insert in the main stage (with the Componet Editor) a Button in the main stage, and recompile it, no error.
If I delete the Button in the main stage and recompile again, no error
But, If I save the projet and reload it again, I've got the same error
By the way, I dont have any problem with the textField()
What is wrong with my setup.
OTHER QUESTION:
If in the ACTION FRAME (F9), I insert the folowing code:
import ex1;
var a:ex1 = new ex1();
one more time, I've got error from the compiler. Why ?
We cannot include a package in the ACTION FRAME ?
Thanks for your help

There are some things (including $.fileName) that just do not work in jsxbin's.
I don't thing the exception hook will work either.
Either use an ini file in a well known location (~/Desktop) or make sure your
files are put in Presets/Scripts. That location can be determined with this bit
of code:
var SCRIPTS_FOLDER =
new Folder(app.path + '/' +
localize("$$$/ScriptingSupport/InstalledScripts=Presets/Scripts"));
-X

EPrint problems with registering and trying to sign in

I have a HP Photosmart 6510 printer. I have installed the disk that came with it onto my desktop and also my laptop. I also installed the apps that were recommended on my iPad3 and iPhone4S. I believe that I have done everything correctly and I registered my printer with HP and open an account with ePrint. Here lies the problem, when I try to sign into ePrint it will not do anything. I have tried clicking on the sign in button on all 4 units and nothing. So now I go to the internet and try using the HP web site to get to ePrint which I can. I try to sign in there and I get an error message telling me that my password is incorrect. It tells me to enter my correct password or if I have forgotten my password to click here and it will send password to email that was used to open account. So I try to have password sent. When I enter my email address and hit submit it tells me to use the email address that was used to set up account. I have checked over and over again and the email address is correct. I can sign into my HP account without a problem, I can't get into ePrint. So I figure I will try as if I did not have an account in ePrint. I enter my name, email address and password and it tells me that the email address is not available as it is in use, no kidding, it is mine, but it will not permit me to sign in. It seems like there is a problem with the software for this program. Any ideas. I really like the print jobs that come off this printer. I have no problem printing within my home, but when I go out, that is where the problems start. I was able to send a picture to printer and I received an email telling me to go to ePrint to check on the status, well here we go again, I can't get sign into ePrint. I can't even find on HP website where I can go to get help. Please help

Hello rrs110,
It may be that you have a SnapFish.com account. Alot of long time customers of HP have SnapFish.com accounts and do not realize it. One of the printer software releases signed customers up automatically, and most people did not know, or forgot, because they never used it. Try going to SnapFish.com and using the forgot password link at the log in screen there. Once you have the password reset, go to ePrintCenter.com and use the SnapFish.com log in information to log in. If that does not help you may need to contact SnapFish.com directly to have them delete the account, or use a different email to register with.
-------------How do I give Kudos? | How do I mark a post as Solved? --------------------------------------------------------

How to createa Self Signed SSL

Hi,
I am trying to create a Self Signed Certificate to enable SSL for Sun Directory Server 2005Q1 P4.
We donot have any External or Internal CA.
How do i generate a self signed certificate to use in my Directory Server
Thanks

Hi,
I have just followed the entire instructions. When i tried to enable the SSL from the directory console, it is not listed in the Certificate drop down list. any ideas why i am not getting the cert in the list?
Thanks,
Ramnath

How do I install this self-signed SSL certificate?

I haven't been able to connect to the jabber server I've been using (phcn.de) for quite some time now, so I filed a bug report with mcabber. The friendly people there told me to install phcn.de's self-signed certificate, but I can't figure out for the life of me how to do that.
I know I can download something resembling a certificate using
$ gnutls-cli --print-cert -p 5223 phcn.de
Which does give me something to work with:
Resolving 'phcn.de'...
Connecting to '88.198.14.54:5223'...
- Ephemeral Diffie-Hellman parameters
- Using prime: 768 bits
- Secret key: 767 bits
- Peer's public key: 767 bits
- PKCS#3 format:
-----BEGIN DH PARAMETERS-----
MIHFAmEA6eZCWZ01XzfJf/01ZxILjiXJzUPpJ7OpZw++xdiQFBki0sOzrSSACTeZ
hp0ehGqrSfqwrSbSzmoiIZ1HC859d31KIfvpwnC1f2BwAvPO+Dk2lM9F7jaIwRqM
VqsSej2vAmAwRwrVoAX7FM4tnc2H44vH0bHF+suuy+lfGQqnox0jxNu8vgYXRURA
GlssAgll2MK9IXHTZoRFdx90ughNICnYPBwVhUfzqfGicVviPVGuTT5aH2pwZPMW
kzo0bT9SklI=
-----END DH PARAMETERS-----
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
- subject `CN=phcn.de', issuer `CN=phcn.de', RSA key 1024 bits, signed using RSA-SHA, activated `2009-05-04 08:26:21 UTC', expires `2014-04-08 08:26:21 UTC', SHA-1 fingerprint `d01bf1980777823ee7db14f8eac1c353dedb8fb7'
-----BEGIN CERTIFICATE-----
MIIBxzCCATCgAwIBAgIINN98WCZuMLswDQYJKoZIhvcNAQEFBQAwEjEQMA4GA1UE
AwwHcGhjbi5kZTAeFw0wOTA1MDQwODI2MjFaFw0xNDA0MDgwODI2MjFaMBIxEDAO
BgNVBAMMB3BoY24uZGUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALqS+tnB
tNruBGdcjw0o+BWSdfkKH4T3VpS7bkrsS0q7RD5iUIao7jH2lJqTk1TrLbQe28+R
H0X9Ya+w22iYFea2l3wkrTnBfgdSZbRhpSxgVvC2QEBMoSrEQoRpo5lzXadRlob/
RQ+rhu/cWCNeiRJzfkmNirPVEciGKQHrwKxxAgMBAAGjJjAkMCIGA1UdEQQbMBmg
FwYIKwYBBQUHCAWgCwwJKi5waGNuLmRlMA0GCSqGSIb3DQEBBQUAA4GBALFBalfI
oESZY+UyVwOilQIF8mmYhGSFtreEcUsIQvG1+cgD16glKehx+OcWvJNwf8P6cFvH
7yiq/fhMVsjnxrfW5Hwagth04/IsuOtIQQZ1B2hnzNezlnntyvaXBMecTIkU7hgl
zYK97m28p07SrLX5r2A2ODfmYGbp4RD0XkAC
-----END CERTIFICATE-----
- The hostname in the certificate matches 'phcn.de'.
- Peer's certificate issuer is unknown
- Peer's certificate is NOT trusted
- Version: TLS1.0
- Key Exchange: DHE-RSA
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed
- Simple Client Mode:
Unfortunately, the above command spits out more than a certificate. Do I need the additional information? If so, what do I need it for? Where do I need to put the certificate file?

Hi,
I recently found out a way how to install test or self-signed certificates and use it with S1SE.
See:
http://www.gtlib.cc.gatech.edu/pub/linux/docs/HOWTO/other-formats/html_single/SSL-Certificates-HOWTO.html
Follow the instructions there
1. Create CA
2. Create root ca certificate
Now install the root-ca-certificate in S1SE -> Security>Certificate Management and Install a "Trusted Certificate Authority".
Paste the contents of the file: cacert.pem into the message-text box.
Then restart the server. Now your CA-Cert should be visible in the Manage Certificates menu.
The next step is to send a certificate-request from S1SE to your e-mail-address.
The contents of the e-mail the server sends to you (certificate request) must be pasted into the file: newreq.pem.
Now just sign the Request:
CA.pl -sign
The last step is that you have to paste the contents of the file newcert.pem into the message-box of the Security>Certificate Management - now under the option Certificate for "This Server".
Then you have to reboot the server/instance again and it should work with your certificate.
Regards,
Dominic

Problems with importing and burning

Could you help me as well? I'm having similiar issues?
Microsoft Windows Vista Business Edition Service Pack 2 (Build 6002)
HP-Pavilion GN636AAR-ABA a6250z
iTunes 10.1.1.4
QuickTime 7.6.9
FairPlay 1.10.14
Apple Application Support 1.4.1
iPod Updater Library 10.0d2
CD Driver 2.2.0.1
CD Driver DLL 2.1.1.1
Apple Mobile Device 3.3.0.69
Apple Mobile Device Driver not found.
Bonjour 2.0.3.0 (214.3)
Gracenote SDK 1.8.2.457
Gracenote MusicID 1.8.2.89
Gracenote Submit 1.8.2.123
Gracenote DSP 1.8.2.34
iTunes Serial Number FC453AB706D7C0B5
Current user is not an administrator.
The current local date and time is 2010-12-28 20:11:15.
iTunes is not running in safe mode.
WebKit accelerated compositing is enabled.
HDCP is not supported.
Core Media is supported.
Video Display Information
NVIDIA, NVIDIA GeForce 6100 nForce 430 (Microsoft Corporation - WDDM)
** External Plug-ins Information **
No external plug-ins installed.
iPodService 10.1.1.4 is currently running.
iTunesHelper 10.1.1.4 is currently running.
Apple Mobile Device service 3.3.0.0 is currently running.
** CD/DVD Drive Tests **
No drivers in LowerFilters.
UpperFilters: GEARAspiWDM (2.2.0.1),
E: TSSTcorp CDDVDW TS-H653N, Rev 0208
Audio CD in drive.
Found 10 songs on CD, playing time 30:15 on Audio CD.
Track 1, start time 00:02:00
Track 2, start time 04:26:50
Track 3, start time 07:08:52
Track 4, start time 09:49:37
Track 5, start time 12:10:52
Track 6, start time 14:55:15
Track 7, start time 18:34:65
Track 8, start time 22:15:05
Track 9, start time 24:38:15
Track 10, start time 27:40:57
Audio CD reading succeeded.
Get drive speed succeeded.
The drive CDR speeds are: 4 8 16 24 32 40.
The drive CDRW speeds are: 4.
The drive DVDR speeds are: 4.
The drive DVDRW speeds are: 4.
The last failed audio CD burn had error code 4000(0x00000fa0). It happened on drive E: TSSTcorp CDDVDW TS-H653N on CDR media at speed 16X.
Thanks.

E: TSSTcorp CDDVDW TS-H653N, Rev 0208
Interesting ... I'm pretty sure that there's later HP-supplied firmware (409 and 609) available for that drive, but it isn't showing up on the Downloads page for your particular HP model.
There's also another problem we need to check on with a TS-H653N supplied by HP: whether or not you need to get a free replacement.
So we'd better try downloading and running the following HP utility (it checks to see if you've got an affected drive):
[DVD-R/RW Drive Replacement|http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?softwareit em=pv-54948-3&cc=us&lc=en&dlc=en]

Program (ERD) with import and create options ??

Hello ! I am searching now a program (free or cheap) for create and import from oracle diagram erd. Anybody can help me ?

You can try the Data Modeler. It will import from Designer and Erwin.
http://www.oracle.com/technology/products/database/sql_developer/index.html#
It is cheaper than most of the others.

Problem with importing and creating self signed SSL certificate

Similar Messages

Maybe you are looking for