Cacerts verisign certificate expires Jan 08 2004

Two Verisign Certificates in the jdk 1.4 keystore 'jdk1.41/jre/lib/security/cacerts' expire on Thu Jan 08 2004.
They are stored with alias 'verisignclass2ca' and 'verisignclass3ca'.
A Weblogic Server Message looks like this:
<Dec 16, 2003 5:39:13 PM CET> <Notice> <WebLogicServer> <BEA-000298> <Certificate expires in 22 days: [
Version: V1
Subject: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
Signature Algorithm: MD2withRSA, OID = 1.2.840.113549.1.1.2
Key: com.sun.net.ssl.internal.ssl.JSA_RSAPublicKey@3e
Validity: [From: Mon Jan 29 01:00:00 CET 1996,
To: Thu Jan 08 00:59:59 CET 2004]
Issuer: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
SerialNumber: [ e49efdf3 3ae80ecf a5113e19 a4240232]
Algorithm: [MD2withRSA]
Signature:
0000: 61 70 EC 2F 3F 9E FD 2B E6 68 54 21 B0 67 79 08 ap./?..+.hT!.gy.
0010: 0C 20 96 31 8A 0D 7A BE B6 26 DF 79 2C 22 69 49 . .1..z..&.y,"iI
0020: 36 E3 97 77 62 61 A2 32 D7 7A 54 21 36 BA 02 C9 6..wba.2.zT!6...
0030: 34 E7 25 DA 44 35 B0 D2 5C 80 5D B3 94 F8 F9 AC 4.%.D5..\.].....
0040: EE A4 60 75 2A 1F 95 49 23 B1 4A 7C F4 B3 47 72 ..`u*..I#.J...Gr
0050: 21 5B 7E 97 AB 54 AC 62 E7 5D EC AE 9B D2 C9 B2 ![...T.b.]......
0060: 24 FB 82 AD E9 67 15 4B BA AA A6 F0 97 A0 F6 B0 $....g.K........
0070: 97 57 00 C8 0C 3C 09 A0 82 04 BA 41 DA F7 99 A4 .W...<.....A....
]>
Does anybody know,
what that means for ssl ?
Is there a Patch or a new cacerts file for download ?
Thanks a lot.
Ede

I would assume that there are not that many certificates still
being used that use those CA certs for their CA.
As you probably noticed, there are a bunch of newer Verisign
CA certs in that trust store (cacerts). The newer CA certs are
probably the ones being used by certificates that are currently
in use.
I suppose you have to ship the older CA certs until they become
invalid. I doubt that Verisign issued any certificates with those
old CA anytime recently.
-Steve

Similar Messages

Can not import Verisign certificate

Dear all,
I am trying to import a Verisign certificate in my ABAP BW 3.5
Production system.This is a certificate renewal as I had a certificate there for a year that is to expire on the 12th of June. However, because of the fact that we had to change the SSL
PSE so that it contains field SP, it is more like installing a new
certificate.
What I did: I deleted the old PSE that didn't have any information about the "State" field and created a new one.
I then created the CSR request to Verisign. I received
the response from Verisign, which I pasted in a text file together with the Verisign Intermediate and Verisign Root certificate which I used last year as well when I installed a Verisign certificate in this server for the first time.
When I apply the response, by pasting the contents of the text
file created above, I get the message:
"CA Certificate missing in database"
I have already looked at notes 508307, 518185, 510007, 1074447, 511919
I am sure that the Verisign root and Intermediate certificates are ok because I have used them successfully in the past in the same server and recently to create the certificate chain for other system certificates of my EP 6.0 landscape.
I am also sure that the Verisign CA root certificate exists in the
database, I checked table STRUSTCERT and it is there. Also, if it didn't exist, I wouldn't have been able to import the Verisign certificate last year
I haven't restarted ICM so the previous certificate still works. After the 12th of June though it will expire and all funtionality based on HTTPS in BW will not work.
Many thanks in advance for your help
Regards
Andreas

Just created a new SSL PSE and imported the certificate chain again and this time it worked...

Have come full circle---k9-4235 server(https) certificate expired

Ok i have been running k94235's and idsm2's for a couple years and when I was munking around with a sig on one of the k9-4235 i discovered that the server certificate expired this past sat...When I tried to create a new sensor in IEV it gave the error "connection handshake failure"....
where/how do I get/make a new server certificate for https sessions on k9-4235, is the latest and greatest
sysinfo
Cisco Systems Intrusion Detection Sensor, Version 4.1(4)S178
MainApp 2004_Dec_17_16.03 (Eng4f) 2004-12-17T15:41:15-0600Running
AnalysisEngine 2004_Dec_17_16.03 (Eng4f) 2004-12-17T15:41:15-0600Running
Authentication 2004_Dec_17_16.03 (Eng4f) 2004-12-17T15:41:15-0600Running
Logger 2004_Dec_17_16.03 (Eng4f) 2004-12-17T15:41:15-0600Running
NetworkAccess 2004_Dec_17_16.03 (Eng4f) 2004-12-17T15:41:15-0600Running
TransactionSource 2004_Dec_17_16.03 (Eng4f) 2004-12-17T15:41:15-0600Running
WebServer 2004_Dec_17_16.03 (Eng4f) 2004-12-17T15:41:15-0600Running

You can try removing the expired certificate from the sensor by logging into the sensor's CLI and entering the following commands:
sensor# configure terminal
sensor(config)# no tls trusted-host ip-address 10.1.2.3
Next, tell the sensor to trust 10.1.2.3:
sensor(config)# tls trusted-host ip-address 10.1.2.3

Verisign certificate not trusted by Nokia phones..

Hi there,
I have E71 and E72 with latest firmwares, but when I go to web site using HTTPS, I got certificate warning (not trusted) if the certificate is signed by:
"verisign class 3 international server ca - g3"
How this can be happened?
I got this also with my old WM6.5 device.
Solved!
Go to Solution.

Few Nokia devices like X-Series , Asha series ,have the VeriSign Class 3 certificate expired or not present,so when the application tries to access a secure server where VeriSign Class 3 International Server CA - G3 certificate is present.The application fails to make secure connection and the message displayed is verification failed Certificate Type: X.509 type 3.
So how can the user uses any secure application launched in year 2012 in these devices.

Verisign Certificate Renewal - Help!!!

Hi Guys,
     I am a beginner in Adobe Flex.
     The digital certificate from verisign got expired which I used in my flex builder 3, packaging it while exporting an AIR application.
     My organisation renewed it and gave me a certificate .p12 file stating that it is a renewed one.
     I used that renewed file in place of the old .p12 file in the application package and exported it to an AIR application.
     But, I was not able to install that application anymore as it results in "The installation of this application is damaged. Try re-installing the application or contact the publisher for assistance." error.
     Later, I double clicked that .p12 file and registered it with trusted enterprise certificates. Now the application installed fine. But it did not work in another PC. Later It worked when I did the same process in that PC also(i.e. I double clicked that .p12 file and registered it with trusted enterprise certificates in that PC).
     In that process I found that the previous certificate was "VeriSign Class 3 Code Signing 2009-2 CA" and the renewed one is "VeriSign Class 3 Code Signing 2010 G5". Is this the reason???
     Or am I doing something wrong while exporting the release build???? Somebody please help me ASAP.
     FYI - I am using this verion SDK "<application xmlns="http://ns.adobe.com/air/application/1.5">" in my app.xml file.
Thanks & Regards,
Raj
Message was edited by: TomCruise06

What do you mean by "Call" a certificate? A certificate is not "called". It is a container for an asymmetric cryptographic key. What you normally do with the certificate is "extract" the key so that you can use it
for a cryptographic operation. In .Net, you typically use the classes in System.Security.Cryptography to do this. See example here:
http://www.ultradevelopers.net/Blog/21

How do I renew my Verisign certificate

Our Verisign certificate is about to expire and we need to replace it. Verisign can generate a new certificate based on our original request. Does this mean that all I should really have to do is to open Oracle Wallet, delete the old user certificate and add the new user certificate? Are there other steps?

I create a new request and a new wallet. Now I'm having trouble installing it on the app server. See Re: Install renew-ed user certificate in Wallet manager

Signed Applet and certificat expiration

Hi,
My applet was signed with a Thawte certificat because it must access printers and TCP/IP layer.
It's running in a JRE 1.3.1.
The certifcate will soon expire.
What will happen ?
Will my applet still keep on running ?
Will I be able to renew my certificate once expired or must i do it before ?
Thanks in advance.

I have a similar problem in that our company purchased a Verisign certificate last year that was renewed. However, you get a new certificate each year. The problem with this is that we have distributed tens of thousands of applets with one certificate that must now be replaced with a new certificate.
According to Verisign, this is a fault of Sun for not implementing timestamping within the JRE.
Is there a plan for timestamping signed certificates?

ISE - What happens when the on-boarded certificate expires?

I'm trying to design a good BYOD deployment model but have a few questions that need direct answers. I have down how to go about on-boarding and getting a certificate on a device, the ISE provides great flow for this to happen in many ways. My questions come from a design perspective before and after the BYOD deployment is completed.
1. Figuring out a method to validate the device is a Corporate asset or a BYOD asset.
     (I don't want to install a certificate on just any device, or perhaps I do but I need to give permissions to all resources if its a Corporate Device, and more resitrictions if it's BYOD, so how do I figure this out during the provisioning phase?)
     a. Use MDM (May not have one, or if you do we are still waiting on ISE 1.2 for that integration)
     b. Build a Group for provisioning admins, if user PEAP-MSCHAPv2 account is from this group install a certificate. (issue here is that the end user looses administration of the device in the my device portal as the device is now registered to the provisioning admin)
     c. Pre-populate MAC into ISE as all Corporate devices should be provisioned by I.T. before they go to the end user (I think this is good but can see push back from customers as they don't want to add more time to the process)
     d. Certs on any IOS or Android device, provide access based on user group and do not worry if device is Company asset or not (I believe that this is the easiest solution and seems to be what I find in the guides)
     e. Other options I have not thought about, would love input from the crowd
2. What happens to the device once the Certificate expires?
     (I don't know the answer to this, my thought would be the user or device will fail during the authentication policy and this creates a mess)
     a. Tell the user to delete the profile so they can start all over again (creates help desk calls and frustrated users)
     b. Use MDM for Cert management (may not have one)
     c. Perhaps the client uses SCEP to renew based on the cert template renew policy and there are no issues (this is me wishing)
Would appreciate some feed back and would like to know if anyone has run into these issues.

Neno,
Sorry but I don't have any other info on using a public CA, Cisco says to use internal CA's for PKI. I think the best practice in 1.2 comes out will be to use one interface for Web Management and a different interface for Radius, profiling, posture, and on boarding. This way you can use your private CA for EAP and a public CA for web traffic. Have you tried a public CA bound to management and a private CA for EAP yet?
I did do a session on EAP-TEAP, they explained how it will work and also discussed EAP-FASTv2. EAP-FASTv2 is available now but you must use anyconnect as your supplicant. Microsoft and all other vendors will have EAP-TEAP native once it is fully released and comissioned as it will be the new gold standard for EAP. It will support TLS, MD5, and CHAPv2. If you are interested I have the PDF of the presentation I attended that shows the flow of how EAP-TEAP will work. This is much better than wasMachineAuthenticated and machine auth caching, which has many down falls.
I currently do machine and user auth I just don't require them. If Machine auth then allow machine on vlan-x with access to AD, DNS, and blah blah. Then a seperate rule to say user auth gets more access, although I require EAP-TLS for both and if you think about it you are accomplishing the same thing if your PKI is setup correctly. Make it so users and machines can only auto enroll, that way you know the only way they got their cert was from GPO policy. I won't go into anymore detail, but there is lots you can do.

Signing in mail with a verisign certificate

I have 2 certificates bought from Verisign that I used previously under 10.6.
I made a clean install of 10.6 and then updated to 10.7, but even if I managed to import the certificates in the keychain access, the buttons in mail proposing the signature and encryption of emails doesn't appear.
Thank you in advance for your help

I haven't been able to resolve this issue using Mail and a Verisign certificate. So instead I tried Comodo and my Mail system now works perfectly with both signature and encryption. So perhaps the problem lies with Verisign rather than Apple......
And Comodo is free, see http://www.instantssl.com/ssl-certificate-products/free-email-certificate.html

ThinkVantage Toolbox with machines prior to Jan 2004

So I've got an OLD T23 that I'm trying to install the Toolbox on, and get errors during install. It's trying to send error messages to Microsoft (XP Home SP3) when it hiccups, and the message references pcdrcui.exe. Once the message sends, the process continues until completion (supposedly). But when trying to open Toolbox, get the initial banner screen, which goes away, then get the error message again.
I've noticed that there is a reference to systems that are Jan 2004 and later for the Toolbox. Is this the root of my problem (mfg date is 5/02)? If so, is there any kind of workaround or is it a complete dead-end? If workaround, what would that entail?
Any help much appreciated!
Solved!
Go to Solution.

I am running Toolbox V6.0.5849.3 on my ThinkPad A21m (2628 G1U) running with Windows XP Professional with SP3 with no problems other than the machine is extremely slow due to its 800 mz CPU. This machine is of the same vintage as that T23.
ThinkPad R61 8932-CTO T8300 2.40 Ghz 3GB RAM Win XP
ThinkPad R500 2714-CTO P8600 2.40 Ghz 3GB RAM Win XP; Two ThinkPad R500's 2714-CTO T9600 2.80 Ghz 4GB RAM Win 7
ThinkPad T500 2241-DB9 T9600 2.80 Ghz 4GB RAM Win 7
ThinkCenter A63 5237-CTO 3GB Ram Win XP; A21m and a pair of 380XD's

Computer certificates expiring within 6 weeks disappearing from machines when computer certificates from two certificate authorities are present

2008 R2 single tier enterprise certificate authority with root certificate expiring within 6 weeks, also domain controller
2012 R2 single tier enterprise certificate authority with root certificate valid for more than the next year, also domain controller
Both servers are approved as certificate authorities for the domain and can issue computer certificates using the computer certificate template. There is a group policy object applied to all workstations that contains an automatic computer certificate request,
but the actual "certificate services client auto-enrollment" element is "not configured". This process seems to work like a round robin in that computers with no certificate can wind up with a certificate from either certificate
authority. I need all PCs to have both certs for a DirectAccess migration. I have successfully used SCCM to ensure all PCs have both certificates using compliance rules and a script using certreq.exe.
A machine will keep both certs until the older computer certificate moves into the 6 week window of expiration, then it gets purged. I have observed this behavior for over a month, even when the CA root certificate wasn't so close to expiring. I
can't figure out what setting is triggering the purge, but need to stop it. Maybe it's coming from default settings in local machine policy for an element that should be disabled in the group policy object supplying the automatic certificate request?
The worst part of this issue is that I can't recreate the purging behavior with gpupdates or restarts on my test machines.

You should not be using Automatic Certificate Request Service (ACRS) for this - it was designed for Windows 2000 and is generally deprecated. Secondly, the reason it is acting like a round-robin as you describe it, is that templates are generally configured
to attempt to renew within 6 weeks of their expiration. Since the 2008 R2 CA is expiring within 6 weeks, it cant issue anything longer than its own remaining lifetime. It is a well known issue that issuing a certificate within the renewal period will cause
problems.
What you should do it use AutoEnrollment and issue a certificate with a very small renewal period (1 week perhaps) by creating a custom V2 template and issuing that from your 2008 R2 CA. Then on the 2012 R2 CA you will need ANOTHER template, as the computer
will only enroll for a certificate from each template. This one can be configured with a normal lifetime and renewal period.
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years. Connect with Mark at http://www.pkisolutions.com

HT201336 Hi I have a certificate expired and was wondering how can I update it ?

I have an apple Iphone certificate expired and I was wondering how do you renew it?

No answers, just some questions... (I'm not sure what you're asking.)
Where did the certificate originate? An Apple iPhone certificate? For what? For iOS development? For VPN? For accessing remote web services, on a server? This is the OS X Server 10.6 forum; are you working with certificates with that operating system, or with certificates on an iPhone?
If your OS X Server system has an expired certificate, you'll need to either purchase a new certificate, or generate a new self-signed certificate and load that via the Certificate Assistant and Server Admin tools.

How can I get an up to date Verisign certificate??

For an app I need the Verisign certificate. I downloaded one from a link provided in this forum but once installed I see it valid until "15-07-2009" -- no good for me, I'm in August.
Trawling the Verisign site didn't help ease the frustration.
Any pointers?
It's a VeriSign Class 3 Code Signing Certificate. I've already updated the Nokia firmware to the latest version.

I can't seem to find any other place to put this but here.
I have the same exact issue as the person who started this thread.
I have a valid VeriSign Class 3 code signing certificate and when trying to do a OTA for a E63 phone the message shows "certificate not recognizable".
VeriSign blames Nokia.
What can I do for this?

Yet another "certificate expired" post

I've tried all the solutions that I've found so far none have worked...tried setting the clock back, application manager settings-software inst.:all, online cert check: off, tried this: /t5/Pool-of-Knowledge/5800-XM-quot-Expired-Certificate-quot-error-message/td-p/442778 , application ...
still get the "certificate expired" error
5800 XpressMusic
software version v 40.2.005
Am I sol?

try to sign your app(s) through Opda site.
If you want to thank someone, just click on the blue star at the bottom of their post

FNPLicensingService.exe associated with Acrobat 9 Standard - unverified ... certificate expired

FNPLicensingService.exe associated with Acrobat 9 Standard - unverified ... certificate expired
Why is this?

Thanks. That worked! Back in the sunshine again
The message is as seen below : "signature is timestamped but TS has expired"
I am assuming this is the right message. If not, do respond.

Cacerts verisign certificate expires Jan 08 2004

Similar Messages

Maybe you are looking for