Because of security error...... - X509 Certificates problem

Good Morning everyone.
I`ve got W2008 R2 with Terminal License already activated by telephone. My server is running and is active, I`ve got licenses (CAL 5 per User). Despite this fact my server still creates X509 Certifictates, which block my second, third, etc connection to
server.
Other workstation - Windows XP - try to connect via RDP to server and use RemoteApps (IE, Acrobat Reader). Connection was working in "trial version" of Terminal Server - 120 days, but when I`ve activated it, install all licenses can`t connect
to server, cause "Security error" message. I found that X509 Cert. are the reason and I should activate server as Terminal License Server using phone activation with Microsoft and then other certificate will be create, but not. I`ve done this
several times, with deleting X509 entriers in Windows Registry, restart server. Every time, when workstation is trying to connect to W2008 Server new X509 are creating in Registry and error message apears.
Could You help me please in this case?
Best Regards.
Dawid

Hi Dawid,
Thank you for your posting in Windows Server Forum.
Initially please check whether you have RDP 7 installed on Windows XP as suggested by TP. In addition, suggest you to try creating new certificate and check the result. please check below articles.
1. Create Trusted Remote Desktop Services (RDP) SSL Certificate
2. Remote Desktop disconnected or can’t connect to remote computer or to Remote Desktop server (Terminal Server) that is running Windows Server 2008 R2
Hope it helps!
Thanks,
Dharmesh

Similar Messages

Remote Desktop disconnected because of security error from Windows 8.1 Surface to Server 2008

Hello,
I am trying
to connect to a remote app on a 2008 server from a surface pro 3 with 8.1
through Netilla SSL VPN and I getting the following error message.
Remote Desktop Disconnected
Because of a security error, the client could not connect to the remote computer Verify that you are logged on to the network and then try connection again
if I am connected to the network and use the RDP file, it connects fine.
This
was previosluly working, but when I changed the terminal server to per user
license mode from trial mode this happen
This works fine from Windows 7 machines.<o:p></o:p>
Any ideas?
Thanks,
Derek

Hi Derek,
Thank you for posting in Windows Server Forum.
From the error itself it seems that there is some network connection issue with VPN. Kindly see that you get network when you are using VPN connection, also VPN must be running. You can also try to “ping” the remote computer and see whether there is successful
ping result.
Also try to use “Allow connections from computers running any version of Remote Desktop” option on server side and check whether you can remote desktop successfully.
Apart this issue can also be caused due to certificate as VPN can’t resolve the certificate properly and facing this issue because you are facing issue only with usage of VPN (as you have commented). Please check
this link for detail.
Hope it helps!
Thanks.
Dharmesh Solanki
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Web Services Security using X509 certificate

Hi,
I have secured a web service using X509 certificate. i also secured the proxy of it but when i run the proxy client it says.
javax.security.auth.login.LoginException: Cannot authenticate X509 certificate, User CN=Sam, OU=Technology, O=FS, L=Dallas, ST=Texas, C=US does not exist in our system
Any idea on this. Do i need to configure the X509 certificate in the server. I am using Oracle SOA Suite and JDeveloper 10.1.3.1
Thanks

Hi,
I have secured a web service using X509 certificate. i also secured the proxy of it but when i run the proxy client it says.
javax.security.auth.login.LoginException: Cannot authenticate X509 certificate, User CN=Sam, OU=Technology, O=FS, L=Dallas, ST=Texas, C=US does not exist in our system
Any idea on this. Do i need to configure the X509 certificate in the server. I am using Oracle SOA Suite and JDeveloper 10.1.3.1
Thanks

Secure Mobility Client Certificate Problem | scep-forwarding-url

Hi All,
I am having a problem configuring SCEP for my secure mobilty client. I have created a connection profile to allow certificate requestes but when I fill in the scep-forwarding-url field I get an error.
The CA we are using is an internal MS CA with SCEP already enabled. This has been configured for a long time with our current Cisco VPN client using certificate authentication. The ASA is running 8.4.1.
Here is the error I get when I try to enter the command into the group policy associated with my certificate enrollement connection profile:
group-policy SSLGP attributes
scep-forwarding-url value http://10.1.1.2/certsrv/mscep/mscep.dll
Attempting to retrieve the CA/RA certificate(s) using the URL. Please wait ...
Received 3 CA/RA certificate(s) using the SCEP URL.
NON-RESIDENT CERT: serial: 11111111000100000145, subject: cn=SCEP_ADD_ON,o=OUNIT,c=UK
NON-RESIDENT CERT: serial: 11111111000100000146, subject: cn=SCEP_ADD_ON,o=OUNIT,c=UK
NON-RESIDENT CERT: serial: 11111111478AAB288393FAFf2a3E274, subject: cn=CERTSVR-01
WARNING: Please check if you have all the required certificate(s) in the config to authenticate the certificates that will be issued using this SCEP URL
Can someone explain why this is happening as it will not take the config?
Thanks in advance.
Ian

Ian:
I'am a roockie working on CA. I did the instalation over 2003 server and I checked and scep server is reachable in fact if I enter ther scep url I get a message regarding the thumbprint and password. I got the same messege regarding the additional trustpoints, but in my environment I just have only one CA server. I notice by the certificate serial that I have the certificates generated on the CA numbered as 2 and 3 respectively but I have three questions.
1 .- I checked If the certificates could be exported as a .cer file but I just have two options as .dat or as text but I dont know how to import the text because the format looks different from the text chains we use to generate the trust points.
2.- Because my config was not working I erased the ASA config and gave a different hostname to the ASA in fact I create an identity certificate with this name ¿Do i need to return to the original hostname?
3.- Does the TAC gave You additional information on how to deal with CA server?

Invoking secure services inside bpel with x509 certificate and weblogic

Hi, everyone. Here we have a problem with invoking secure webservices (*client authentication*) from a bpel deployed in weblogic that is consuming so much time (more than a week) and don't know what else to try.
The scenario: we have a bpel process which invokes a series of web services without any security mechanisms. Now, we have to change it to invoke a series of webservices that do exactly the same, but using ssl and client authentication with x509 certificates. The first part of it, the ssl one, is done without any problems. But the second part is not working at all, and we (I) are running out of ideas how to configure it in weblogic.
The situation: I want to invoke a webservice, say, Service1. It requires client authentication, so I should pass a certificate (*which I already have*). I put that certificate inside a keystore (with keytool -importkeystore, from p12 to jks). With SoapUI I have no problem now to invoke the service now. But, I'm not sure what should I do to make it work in weblogic; after all, the provider keeps answering with a HTTP 403 Forbidden error.
The actions: inside the weblogic's enterprise manager, in SOA deployments (SOA / soa-infra / default ) I selected my composite, and in the Dashboard (down at Services and references), clicked the particular service (Service1). Then, it took me to another page where I can see statistics about that service, and a tab named Policies. There (in Policies) I have the chance to attach a policy, but I don't know which one is the approppriate; I guest it should be WSS11_x509_token_with_message_protection_service_policy, which in turn asks me to provide a value for keystore.recipient.alias, keystore.sig.csf.key and keystore.enc.csf.key. For this keys, I provide values that I configured in Credentials (Weblogic Domain / Security / Credentials, subtree oracle.wsm.security). My own logic tells me that what I have done is what I should have done, but still no luck :(
I am sure the keystore is ok (if I rename the keystore file it tells me that the keystore file cannot be found, and if I specify an alias which is not inside the keystore it tells me that the alias is not found and list me valid aliases). I guess I am missing something, somewhere, but after many hours (days, almost 2 weeks) googling, still cannot make it work.
Any ideas would be apreciated. If anyone knows about a post or article about this, it would be apreciated too, but I can tell is not that I just googled for 25 minutes, but I have spent more than a week googling, trying, analyzing and reading formal documentation, with no results.
Thanks in advance!

Try to enable SSL and WS debugging on your WLS. Add the following to your startup script:
-Dweblogic.webservice.verbose=true
-Dssl.debug=true
..then you might be able to spot if the rejection is based on some handshake problem.

When trying to empty trash, (securely or not), I get this: The operation can't be completed because an unexpected error occurred (error code -8003).

When trying to empty trash, (securely or not), I get this: The operation can’t be completed because an unexpected error occurred (error code -8003). FWIW, there are nearly 3000 items in my Trash - although this does not seem the source of the problem.

Have you read for possible solutions over in the "More Like This" thread over here?----------------------->

Java security error after 8u31 (Timestamped Jarsigned Applet within valid period of Code Signing certificate)

Hello,
I have an applet running in embeddad systems. This program runs without any problem since 8u31 update! After this update it starts to give java security warning and stops running.
Here is the warning message:
"Your security settings have blocked an application signed with an expired or not-yet-valid certificate from running"
What it says is true; my Code Signing Certificate (CSC) is valid between 24 Jan 2014 and 25 Jan 2015. And it expired! However, while i was signing my applet with this certificate i used "timestamp". The authority i choosed was DigiCert. My signing date was 26 Jan 2014 (when my CSC was valid).
When i started to have this Java Security Error, first i thought i mis-timestamped my code, and check by using the jarsigner -verify command. Here is a partial result:
s      19607 Mon Jan 27 13:17:34 EET 2014 META-INF/MANIFEST.MF
      [entry was signed on 27.01.2014 13:19]
      X.509, CN=TELESIS TELECOMMUNICATION SYSTEMS, OU=ARGE, O=TELESIS TELECOMMUNICATION SYSTEMS, STREET=TURGUT OZAL BLV.NO:68, L=ANKARA, ST=ANKARA, OID.2.5.4.17=06060, C=TR
      [certificate is valid from 24.01.2014 02:00 to 25.01.2015 01:59]
      X.509, CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB
      [certificate is valid from 24.08.2011 03:00 to 30.05.2020 13:48]
      X.509, CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US
      [certificate is valid from 07.06.2005 11:09 to 30.05.2020 13:48]
      X.509, CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
      [certificate is valid from 30.05.2000 13:48 to 30.05.2020 13:48]
sm       495 Thu Jan 23 14:55:22 EET 2014 telesis/WebPhone$1.class
As you may see the timestamp was correctly done. And it is in the valid period of CSC.
Than i started to check how Java confirms the Certificate, and found some flowcharts.
Here is an example from DigiCert:
Code Signature Verification Process
After the Web browser downloads the Applet or Web Start application, it checks for a timestamp, authenticates the publisher and Certificate Authority (CA), and checks to see if the code has been altered/corrupted.
The timestamp is used to identify the validation period for the code signature. If a timestamp is discovered, then the code signature is valid until the end of time, as long as the code remains unchanged. If a timestamp is not discovered, then the code signature is valid as long as the code remains unchanged but only until the Code Signing Certificate expires. The signature is used to authenticate the publisher and the CA, and as long as the publisher (author or developer) has not been blacklisted, the code signature is valid. Finally, the code is checked to make sure that it has not been changed or corrupted.
If the timestamp (or Code Signature Certificate expiration date) is verified, the signature is validated, and the code is unchanged, then the Web browser admits the Applet or Web Start application. If any of these items do not check out, then the Web browser acts accordingly, with actions dependent on its level of security.
So according to this scheme, my applet had to work properly, and without security warning.
However i also found that from Oracle, which also includes the timestamping authorities Certification validity period??? :
The optional timestamping provides a notary-like capability of identifying
when the signature was applied.
    If a certificate passes its natural expiration date without revocation,
trust is extended for the length of the timestamp.
    Timestamps are not considered for certificates that have been revoked,
as the actual date of compromise could have been before the timestamp
occurred.
source: https://blogs.oracle.com/java-platform-group/entry/signing_code_for_the_long
So, could anyone please explain why Java gives security error when someone tries to reach that applet?
Here is a link of applet: http://85.105.68.11/home.asp?dd_056
I know the situation seems a bit complicated, but i tried to explain as simple as i can.
waiting for your help,
regards,
Anıl

Hello,
I have an applet running in embeddad systems. This program runs without any problem since 8u31 update! After this update it starts to give java security warning and stops running.
Here is the warning message:
"Your security settings have blocked an application signed with an expired or not-yet-valid certificate from running"
What it says is true; my Code Signing Certificate (CSC) is valid between 24 Jan 2014 and 25 Jan 2015. And it expired! However, while i was signing my applet with this certificate i used "timestamp". The authority i choosed was DigiCert. My signing date was 26 Jan 2014 (when my CSC was valid).
When i started to have this Java Security Error, first i thought i mis-timestamped my code, and check by using the jarsigner -verify command. Here is a partial result:
s      19607 Mon Jan 27 13:17:34 EET 2014 META-INF/MANIFEST.MF
      [entry was signed on 27.01.2014 13:19]
      X.509, CN=TELESIS TELECOMMUNICATION SYSTEMS, OU=ARGE, O=TELESIS TELECOMMUNICATION SYSTEMS, STREET=TURGUT OZAL BLV.NO:68, L=ANKARA, ST=ANKARA, OID.2.5.4.17=06060, C=TR
      [certificate is valid from 24.01.2014 02:00 to 25.01.2015 01:59]
      X.509, CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB
      [certificate is valid from 24.08.2011 03:00 to 30.05.2020 13:48]
      X.509, CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US
      [certificate is valid from 07.06.2005 11:09 to 30.05.2020 13:48]
      X.509, CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
      [certificate is valid from 30.05.2000 13:48 to 30.05.2020 13:48]
sm       495 Thu Jan 23 14:55:22 EET 2014 telesis/WebPhone$1.class
As you may see the timestamp was correctly done. And it is in the valid period of CSC.
Than i started to check how Java confirms the Certificate, and found some flowcharts.
Here is an example from DigiCert:
Code Signature Verification Process
After the Web browser downloads the Applet or Web Start application, it checks for a timestamp, authenticates the publisher and Certificate Authority (CA), and checks to see if the code has been altered/corrupted.
The timestamp is used to identify the validation period for the code signature. If a timestamp is discovered, then the code signature is valid until the end of time, as long as the code remains unchanged. If a timestamp is not discovered, then the code signature is valid as long as the code remains unchanged but only until the Code Signing Certificate expires. The signature is used to authenticate the publisher and the CA, and as long as the publisher (author or developer) has not been blacklisted, the code signature is valid. Finally, the code is checked to make sure that it has not been changed or corrupted.
If the timestamp (or Code Signature Certificate expiration date) is verified, the signature is validated, and the code is unchanged, then the Web browser admits the Applet or Web Start application. If any of these items do not check out, then the Web browser acts accordingly, with actions dependent on its level of security.
So according to this scheme, my applet had to work properly, and without security warning.
However i also found that from Oracle, which also includes the timestamping authorities Certification validity period??? :
The optional timestamping provides a notary-like capability of identifying
when the signature was applied.
    If a certificate passes its natural expiration date without revocation,
trust is extended for the length of the timestamp.
    Timestamps are not considered for certificates that have been revoked,
as the actual date of compromise could have been before the timestamp
occurred.
source: https://blogs.oracle.com/java-platform-group/entry/signing_code_for_the_long
So, could anyone please explain why Java gives security error when someone tries to reach that applet?
Here is a link of applet: http://85.105.68.11/home.asp?dd_056
I know the situation seems a bit complicated, but i tried to explain as simple as i can.
waiting for your help,
regards,
Anıl

Problem with creating a third party signed x509 certificate

Dear all
I'm working on pki project, in which i need to generate a key pair and and using it to create a self-signed x509 certificate, it will act as the CA and using it private key to sign all other x509 certificate, I have no problem on creating the self-signed cert, but when try to create other cert using CA private, I got the following exception
Caught exception: java.security.InvalidKeyException: Public key presented not for certificate signature
I'm using bouncycastle to do the cert generation, here is an example of my code
   Security.addProvider(new BouncyCastleProvider());
   //be sign key pair
   KeyPairGenerator keyGen=KeyPairGenerator.getInstance("DSA");
   keyGen.initialize(1024, new SecureRandom());
   KeyPair keypair=keyGen.generateKeyPair();
   PrivateKey prikey=keypair.getPrivate();
   PublicKey pubkey=keypair.getPublic();
   //ca key pair
   KeyPair cakeypair=keyGen.generateKeyPair();
   PrivateKey caprikey=cakeypair.getPrivate();
   PublicKey capubkey=cakeypair.getPublic();
   Hashtable attrs = new Hashtable();
   attrs.put(X509Principal.CN, "Test");
   //generate cert
   X509V3CertificateGenerator certGen=new X509V3CertificateGenerator();
   certGen.setSerialNumber(BigInteger.valueOf(1));
   certGen.setIssuerDN(new X509Principal(attrs ));
   certGen.setNotBefore(new Date(System.currentTimeMillis() - 50000));
   certGen.setNotAfter(new Date(System.currentTimeMillis() + 50000));
   certGen.setSubjectDN(new X509Principal(attrs));
   certGen.setPublicKey(pubkey);
   //certGen.setSignatureAlgorithm("MD5WithDSAEncryption");
   certGen.setSignatureAlgorithm("SHA1withDSA");
   X509Certificate cert=certGen.generateX509Certificate(caprikey);
   cert.checkValidity(new Date());
   cert.verify(pubkey);
   Set dummySet=cert.getNonCriticalExtensionOIDs();
   dummySet=cert.getNonCriticalExtensionOIDs();I have no idea what problem is
I hope that bouncycastle supporter or anyone could help me or give some guidance and I'm much appreciate that.

Hi tkfi
your problem is you'er not using the ca public key to do the verification, replace the
cert.verify(pubkey);
to
cert.verify(capubkey);
and it should be work

Problem in importing a SHA256 X509 certificate in Oracle Wallet Manager 10g

Dear All,
As a certification authority, we stops issuing SHA1 X509 certificates and now we deliver only SHA256 Certificates. Some of our customers encounter problems when importing these new certificates in Oracle Wallet Manager 10g.
Is there any Oracle Security Updates able to solve this problem?
Thank you in advance
Nizar BN
Tunisia

Hi, I am having the same issue with the certificate. Can anyone tell me how to fix this?
Thank You!
Kathie

Error message trying to install Adobe Download Assistant (Sorry an Error has occured... certificate problem)

I am trying to download the free trial of Acrobat XI. I am using an iMac running Mac OSX 10.6.8. When I click on the Installer I have downloaded for Adobe Download Assistant, it gives me the following error message while trying to open/install the Download Assistant:s
Sorry, an error has occured.
The application cannot be installed due to a certificate problem. The certificate does not match the installed application certificate, does not support application upgrades, or is invalid. Please contact the application author.
Can anybody help?

Lmslugo please move your current installation to the trash can, empty the trash, and reinstall. This should give you a new copy of the application with a current certificate.

I've got a problems with my Iphone 4, I've recently upgraded to the new software (5.1), since then the iTunes doesn't recognize my iphone, as the error comes up:' iTunes could not connect to this iPhone because an unknown error (ex8000022)

I've recently upgraded to the new software (5.1), since then the iTunes doesn't recognize my iphone, as the error comes up:' iTunes could not connect to this iPhone because an unknown error (ex8000022).
Are you guys facing the same problem?
Let me know your opinions, solutions and even problems.
Thank You !

http://support.apple.com/kb/HT4137
How to restore as new.
and this for itunes message
http://support.apple.com/kb/HT1808

Please help.. I have just tried to install lion on my iMac and it can't complete because of 'disk error'.. can i delete lion and go back to leopard as there was no problem there?? can't get past grey screen

Please help.. I have just tried to install lion on my iMac and it can't complete because of 'disk error'.. can i delete lion and go back to leopard as there was no problem there?? can't get past grey screen

Just restore your bootable backup/clone or Time Machine backup.

Certificate problem--safari says it couldn't establish a secure connection.

Certificate problem. How do I fix a corrupted cert? I think what's going on is that the cert that is installed for this site is bad. But Safari just gives an error and I can't find a way to remove the bad one and add a new one? Can anyone help me?

I haven't experienced any issues like this.
What's a corrupted certificate?

There is a problem with this connection's security certificate The remote computer cannot be authenticated due to problems with its security certificate. Security certificate problems might indicate an attempt to fool you or intercept any data you send

Hi,
I have this Windows 2008 R2 on which I installed remoteapp some years ago.
Now the certificate expired and I get the message
"There is a problem with this connection's security certificate
The remote computer cannot be authenticated due to problems with its security certificate.
Security certificate problems might indicate an attempt to fool you or intercept any data you send to the remote computer."
How should I renew the certificate? I already went to certification store and tried to renew certificate with same key but then it says "the request contains nor certificate template information".
Please advise.
J.
J.
Jan Hoedt

Does the computer account have Enroll permission to the certificate template?
From the Server running your CA, run mmc, click File then Add/Remove Snap-in...
Add Certificate Templates and click OK.
Find the certificate template, then right click and select properties. On my CA its call ed RemoteDesktopComputers but might be called something different depending on what what template your certificate is based on.
On the security tab, click Oblect types, check Computers then OK. Enter the Computername and click OK. Then give your computer account Enroll permisssion.
HTH,
JB

Problem to configure Blink Pro (App). Error SSL certificate verification error (PJSIP_TLS_ECERTVERIF) (503)

Problem to configure Blink Pro (App). Error SSL certificate verification error (PJSIP_TLS_ECERTVERIF) (503)

Hi, William
My question is if you can help me and support me to configure the Blink Pro App, I have a Mac Book Air, OS X 10.9.1.
hope for your answer

Because of security error...... - X509 Certificates problem

Similar Messages

Maybe you are looking for