Any way to bypass server certificate validation in AIR client?

Is there any way to bypass certificate validation and server identification for secure Channels or ChannelSets? I am aware of the existing workaround to import my own certificate into the user's CA chain, but I feel that having greater control on the client-side is preferred.
If there is not a way to bypass client-side certificate validation I will be filing this as a feature request at http://bugs.adobe.com
Thanks,
Karl
When producing a client-server solution it is occasionally useful to override the default behavior of HTTPS certificate validation and server identification. I would like to request the ability to override these systems in the AIR environment for applications installed with the "UNRESTRICTED" system access option.
Simply allowing the use of self-signed certificates without verification (perhaps signified by a secure protocol identifier other than "https") would provide adequate functionality, but some users may desire finer control.
This issue is partly addressed by bugs FP-711 and FP-214 but I feel it is important that any enhancement include the BlazeDS Channel in the case that the AIR application has unrestricted system access.
When deploying an AIR client application which is securely connected to a network appliance which is controlled by the same developer it is desirable to bypass the overhead of acquiring a PKI issued certificate for every customer. Independent, open-source, and not-for-profit developers could see increased ability to adopt the AIR platform with this improvement.
When deploying a network appliance to be used with an AIR application the requirement for a PKI issued certificate complicates the deployment of the network appliance by requiring DNS access, and thereby requiring Internet connectivity. Some customer sites require network isolation.
It is possible to generate a developer-specific certificate and import that certificate into the AIR client host's Trusted Root Certification Authorities list. This workaround deteriorates PKI best practices and complicates the installation of AIR software. It is not possible to depend solely on the ".air" packaging for installation with the added requirement to install a new CA on the user's host.
Java provides the requested functionality by allowing developers to provide their own implementations of javax.net.ssl.TrustManager for verification and javax.net.ssl.HostnameVerifier for identification. We have used this technique to communicate over the SDEE protocol with Cisco IDS devices which do not usually have PKI issued certificates.

Hi Robert,
No specific option to controle TOP/First features use.
However other options exist to control IQ resources.
Eg. Query_temp_sopace_limit, Query_Time, Max_IQ_Threads_Per_Connection, Max_Cartesian_Result.
Regards,
Tayeb.

Similar Messages

  • Cisco AP disable PEAP server certificate validation

    Hi,
    My question if it is possible on Cisco 1600 AP's  to  disable the server certificate validation on a dot1x peap authentication method (please provide if any the appropiate CLI)
    I now the in PEAP for a PEAP user implementation you want to validate the the server as that this is PEAP phase 1.
    But we want only user PEAP as machine authentication, which I don't care the validation of the server. hence like in Windows you have a check box, so you can disable the validation of it.
    Thanks in advance,
    Kind regards,
    Michel

    Not really, let me explain the toplogy;
    we want to enable 802.1x on the network switches and let the Cisco AP authenticate the AP (PEAP-MSCHAPv2) on the switch via 802.1x. Therefore we specify the following config on the AP:
    eap profile PEAP
    method peap
    dot1x credentials test
    username
    password xxxxxx
    interface GigabitEthernet0
    dot1x pae supplicant
    dot1x credentials test
    dot1x supplicant eap profile PEAP
    The question is the a possebility to disable the server certificate validation (as like in Windows) because we want to verify the AP, and yes I know for PEAP-user implementation it is a good practise to validate the server certificate.
    Kind regards,
    Michel

  • I have bought a used macbook, to bad i do not have the admin password. is there any way to bypass this issue with out the Mac OS X disk? (without loosing my obtained files?)

    i have bought a used macbook, to bad i do not have the admin password. is there any way to bypass this issue with out the Mac OS X disk? (without loosing my obtained files?)   I NEED HELP BADLY PLEASE....

    What version of the Mac OS X are you running. Go to the Apple in the upper left corner and select About This Mac and post the version.

  • I just bought a new Macbook Pro and loaded all my info from My old Macbook...now i can't remember for the life of me my Admin Password 9which i created 3 years ago)...is there ANY WAY to bypass this on my new Macbook Pro and begin again...?

    i just bought a new Macbook Pro and loaded all my info from My old Macbook...now i can't remember for the life of me my Admin Password (which i created 3 years ago)...is there ANY WAY to bypass this on my new Macbook Pro and begin again...?

    I assume that you don't have the installation discs, so:
    1. Reboot
    2. Hold command + s key down after you hear the chime.
    3. When you get a text prompt enter in these terminal commands to create a brand new admin account (hitting return after each line):
    (Type these commands very carefully)
    mount -uw /
    rm /var/db/.AppleSetupDone
    shutdown -h now
    4. You will go through the setup process again, create a new admin account, login to it and then change your existing account password or whatever else you need to do. You can delete the account you made in this process, or not.

  • Any way to bypass iPhone backup so I can upgrade to 2.1?

    I'm really looking forward to upgrading my iPhone to 2.1, but in order to upgrade it has to backup the iPhone first. It's been running for an hour now and the progress bar has barely moved! At this pace it'll take at least 10 hours to backup! And if I receive a phone call, I'm screwed. Since this is my business phone, chances are really high that I'm going to get a call in the next several hours.
    So is there any way to bypass the backup so I can install 2.1?

    You're suggestion works if you don't mind rebuilding everything afterwards. I was able to restore to 2.1 in a few minutes, but the iPhone wouldn't pull in stuff from my last backup. Something about it being incompatible.
    So now I'm in the process of rebuilding/updating everything. Luckily most of my stuff can quickly be added back like contacts, music, etc. All my email accounts are IMAP, so no big deal there either. And now since 3rd party apps update a LOT quicker, that part won't be so painful.

  • If I backed up with a newer version of iOS than the phone I am trying to backup to.. Is there any way to bypass the setup assistant in order to download the new iOS on the new phone then go back and restore from my old phone?

    if I backed up with a newer version of iOS than the phone I am trying to backup to.. Is there any way to bypass the setup assistant in order to download the new iOS on the new phone then go back and restore from my old phone?

    Try deleting your last backup by turning off iCloud Backup in Settings>iCloud>Storage & Backup, then tap Manage Storage, swipe across your backup and tap Delete, then go back and turn iCloud Backup back on again.  If it still won't back up, you may have an app that is preventing the backup from succeeding.  To locate which one, go to Settings>iCloud>Storage & Backup>Manage Storage, tap the name of your device under Backups, under Backup Options tap Show All Apps, then turn them all to Off (including camera roll) and try backing up again.  If it succeeds, then the camera roll and/or one of your apps is preventing the backup and you'll have to located by process of elimination. Turn the camera roll On and try backing up again.  If it succeeds, turn some of your apps to On and try backing up again.  If it succeeds again, turn some more apps to On then try again; repeat this process until it fails.  Eventually you'll be able to locate the problem app and exclude it from your backup.

  • Is there a way to generate server certificates in a multi-controller environment?

    Q: Is there a way to generate server certificates in a multi-controller environment? 
    A: 1.  For PEAP, only the Radius Server needs a certificate, not the controller.  Managing a certificate for each controller for 802.1x when you can  alternatively manage a single certificate for each radius server is a mistake.
    2.  For Captive Portal, if you don't want your guest or company users to have an untrusted error every time they hit the captive portal you will need a public certificate that all your users will trust.  That could either involve (1) A  different certificate for each controller with the subject being the fqdn of each controller or (2) a single, identical certificate that has the SAN or Subject ALT Name filled out with the FQDN of each controller listed in the SAN field (https://www.digicert.com/subject-alternative-name.htm)
    Here is an example of a cert with multiple fqdns in the Subject Alternative Name field below:  Of course, you will have to pay for each SAN that you have added to the certificate.  If you will have an environment where you have a VRRP and that is the ip address that the clients will be redirected to, you should make the SAN point to the VRRP.
    A document on certificates that is specifically geared toward ClearPass, instead of controllers is here:  Certificates 101 V1.0  It speaks to certificates on ClearPass, but the concepts are the same...
    Solution:-
    We can use ClearPass server to generate the CSR, where the CN is named after the 1st controller, which included all the Subject Alternate Names (SANs) for the other 3 controllers as well as the master controllers (in case of an N+1 failover).  This allows to save/export the private key as a file.
    After submitting the CSR for a UCC and after receiving the cert,  then proceed to chain the cert to include server, all intermediate and root CAs.  Then copy the chained cert as well as the private key file to a MacBook so that we can use OpenSSL to create a PFX formatted cert as follows:
    sudo openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.pem
    Once this generated a PFX cert,  upload it to all controllers and used it under Configuration > Management > General for both “WebUI Management Authentication Method” as well as “Captive Portal Certificate” (even though the ClearPass Guest captive portal is using a different cert for the captive portal page itself).
    https://arubanetworkskb.secure.force.com/pkb/articles/HowTo/Create-a-CSR-with-multiple-SANs

    Sorry I'm still confused here.  What you are describing makes no sense for properly using TestStand.
    Maybe I can help you find the right solution if I can understand your goal?
    Do you want to dynamically populate the variables (Locals and FileGlobals) with values?  Or do you want to dynamically create the variables from scratch (i.e. add subproperties to the sequence file) based on some file?
    Generally what happens is people want an ASCII file (in your case I'm guessing CVS) such that they can change the values of variable so that when TS is executing it will load those values and use them.  In this case NI recommends the Property Loader.  There is an example for this in <TestStand>\Examples.  Open the workspace and look for the PropertyLoader example.  Also, if you google "proprety loader teststand" then you will find various articles which may assist you.
    When you say "define the variables for the sequence/sequence file"  Are you actually referring to manually right clicking in the sequence file and saying Insert Local?  or are you just saying that you change the value of a variable?
    Thanks,
    jigg
    CTA, CLA
    teststandhelp.com
    ~Will work for kudos and/or BBQ~

  • My brother gave me his iPhone3 and has forgotten his passcode to the phone. Any way to bypass this without another visit to the store?

    My brother gave me his iPhone3 and has forgotten his passcode to the phone. Is there any way to bypass this feature without a visit to the phone store for a wipe?

    Try Here  >  http://support.apple.com/kb/HT1808
    You may have to try this More than Once... and if your Device has been Modified, this will Not necessarily work.

  • Is ther any way i can upgrade my mack book air 256gb to 512 gb ?

    Is ther any way i can upgrade my mack book air 256gb to 512 gb ?

    You can be it's very expensive.
    http://eshop.macsales.com/shop/SSD/OWC/Aura_Pro_Express

  • I have a 13" macbook pro and an 11" macbook air. Is there any way to charge the battery on the air with the power supply of the macbook pro?

    I have a 13" macbook pro and an 11" macbook air. Is there any way to charge the battery on the air with the power supply of the macbook pro?

    If the charging plug fits, use it.

  • Is there a way to bypass the form Validation

    I'm getting really upset with the Coldfusion built-in form validation for any HTML formfield ending by _date , _required, _time and so on...
    My application proposes to the users to create some Properties for an object and later on to modify the values for all these properties.
    I've got a piece of code building dynamically some form fields named just like the properties (by a simple cfloop on a DB query getting the property list).
    And a registering page to records the new value in the DB.
    But it crashes onto the classical "
    Form entries are incomplete or invalid.
    I can't control what the users set as property name (one of them was Checklist_required).
    Is there any way to prevent this error by disabling this auto validation ?
    (I'd like to avoid having to rename any field dynamically created and rename any forms variables before registering them on the DB : it's just NO WAY for me to rename the properties created by the users)

    Fober1, that's not how it works.  It's pretty much the ultimate example of the disjoint between how HTML forms work and how the naive CFML Cfform / cfinput design wished they work.
    When a request is being processed by the coldfusion server, it just looks at the list of FORM (POST) variable names (whether it came from cfform or not; URL/GET params are exempt), and for those with certain suffixes (_date, _required, etc.), and it assumes their existence is intended to request validation another field without that suffix.  It doesn't actually know or care whether form submission, nor the HTML rendered in the user's browser, actually came from "cfform" or "cfinput".   The composition of the request that comes in (when a user clicks on "submit", or a hacker uses any tool imaginable) is out of the server's hands.  The cfform code is not used during form submission processing, because the receiving template (the form action="this_one.cfm") doesn't even have to be the same template that has the cfform in it. There could be multiple conflicting cfforms directing users to request the same template on a single site, with or without the validation, even without considering what a whole other person might decide to send to your server.
    The fact that it can work as intended for a typical user is irrelevant, because the purpose of validation is to deal with the atypical situation.  A malicious or merely mischievous user that wanted to circumvent the validation would simply modify a copy of the page to leave out the "validation request" fields.    For the developer to truly validate the input, additional code must be written, making the feature not only inadequate, but a complete waste of time.  There absolutely should be a way to disable it at worst; Ideally, it would be taken out of coldfusion completely.  It's not only useless, it's a security risk, wooing programmers to write code that doesn't do what they think it does.
    The error message it gives isn't so great, either, and it's a pity that it can't show more than one validation message at a time, either.  If more than one input is invalid, you could end up going through one round after another of submit + back button.
    edit: I forgot to add the other important reason that this feature should never have existed: It is a nuisance to everyone else who doesn't want to use it at all, too!  Those suffixes simply couldn't have been a worse choice, colliding with probably thousands of peoples' variable names.  Why not "*_cfval_date" "*_cfval_time" etc?

  • I am trying to switch laptops with my mom, and successfully wiped mine and restored it, but now her password won't allow her into my computer, even though it says it's her account. Is there any way to bypass the password screen?

    I am trying to switch laptops with my mom, and successfully wiped mine and restored it, but now the password that she used on her computer isn't working on this computer. Is there any logical reason why the two passwords would be different, if I restored her information from a Time Machine backup? Aditionally, Is there a way to bypass the password page on startup to make a password that my mom knows?

    If Disk Warrior does not work you can try the following steps (but they may not work if the disk has a hardware error).
    Get the disk (DVD or CD) that came with the system (since you have it listed as 10.6.8).  If it is 10.7 or 10.8 use the Recovery partition to boot from or the USB installer if you have that option.
    Insert the disk then power down
    HOLDING the C key, power up to boot from the disc.
    Get to Disk Utility
    If Disk Utility will now show your hard drive, use DU to REPAIR the disk.
    When it completes the Repair process successfully as indicated in DU, do a shut down.  If Repair is not successful then an different course of action is indicated below.
    Then HOLDING THE APPLE (or Command key depending on your keyboard) KEY AND THE OPTION KEY AND THE LETTER P AND R KEYS, continue hiolding them until you hear the chime tone for the THIRD time then release all four keys.
    If REPAIR is not successful, use the Install disc as a boot and REINSTALL THE OS X OPERATING SYSTEM  DO NOT ERASE THE DISK OR VOLUME FIRST.  REPEAT DO NOT erase the disk or volume before trying to reinstall the OS X operating system.  After re-installing the OS do a software update.  Note that ERASING the disk is NOT required to do an OS re-install.  This allows your existing data and application files to remain.
    If that fails then you are down to the "bitter end" of erasing the volume and reinstalling the OS and then all the other software.
    If erasing the Volume fails then your last hope is to completely erase the entire hard drive, repartion the disk  and try a re-install.
    If that fasils then you may have a defective hard disk.

  • Is there any way to setup server side deferred delivery in Exchange 2013?

    We are utilizing 3rd party software to generate reports and email results.  Unfortunately, the software cannot be configured to execute at a specific time, date only.  This means that some reports are being processed and delivered at 12:00 am.
     For business reasons, management would prefer that those emails not be sent at midnight.
    We are looking for a solution that would allow the messages to be generated at midnight but not be delivered by Exchange until several hours later.
    Is there any way to set a deferred delivery option server side in Exchange?  It can be set through Outlook, but only applies to mail sent from Outlook.
    Any advise or recommendations would be greatly appreciated.
    Thanks

    I afraid that it can't be done in Exchange with native features. You might need to develop custom transport agent or need to utilize the 3rd party tool to achieve this...
    You can try in Development forum to see if you can get any help there...
    http://social.technet.microsoft.com/Forums/exchange/en-US/home?forum=exchangesvrdevelopment
    Blog |
    Get Your Exchange Powershell Tip of the Day from here

  • Is there any way to bypass MacBook Pro passwords?

    Hi everyone!
    I have the newest model MacBook pro and me and my moms side of the family are currently fighting and my stepdad decided to take my MacBook pro from me (which I worked all summer for to buy) and threatened me that if I don't give them them the password for it that I'll never see it again, it's going to get smashed, that he'll send it to on apple and have them give him the password (lol), or send it to his uncle who works on computers to bypass the passwords.
    I am moving out and I have the money to buy a new one if need be but I don't see the point in buying a new one if I have one that works perfectly... However at th same time I stand up for what I believe in and because they never asked once nicely for the computers password and have made these threats I put up the lost MacBook password through find my mac so now there's two.... Is there any way they'll be able to get through it if they send it to someone who "works" on computers.

    It is very user friendly, just read each step and follow directions
    At this point you should start over.   Connect via cable to the computer (turn off wifi) Use iTunes to restore to factory settings and content.  
    Then start the set up as a new device again.
    Pay close attention so you select English. 
    Select NO PASSCODE, it will question this, select no passcode again.
    If you want a passcode, set it up afterwards and carefully enter and record it.

  • Is there any way to disable runtime schema validation

    At runtime Kodo appears to validate that all of the tables and columns
    referenced in the mapping table exist in the datebase. Is there any way
    to disable this. It takes an extremely long time for the validation to
    complete and although it may be useful during certain stages of
    development or to verify a new deployment it isn't really all that
    desirable.
    Thanks,
    -Marc Sheftel

    Thanks!
    Abe White wrote:
    On Tue, 16 Sep 2003 11:44:36 -0500, Marc Sheftel wrote:
    At runtime Kodo appears to validate that all of the tables and columns
    referenced in the mapping table exist in the datebase. Is there any way
    to disable this.
    kodo.jdbc.SchemaFactory: dynamic
    Note that when using the dynamic schema factory Kodo can't detect foreign
    keys.

Maybe you are looking for