Certificat question

Hello Friends.
PERFORM subroutine USING var.
The var field is known as what type of parameter?
A: Formal
B: Actual
C: Static
D: Value
thanks in advance,
Moderator message - Please see Please read "The Forum Rules of Engagement" before posting! HOT NEWS!! before posting. Certification questions not allowed - post locked
Edited by: Rob Burbank on Oct 22, 2009 11:34 AM

<< Content and points removed>>
Edited by: Rob Burbank on Oct 22, 2009 11:36 AM

Similar Messages

MAIL certificate question

Lately I get a question box when I open MAIL.   I have Snow Leopard, and opted to keep Mobile Me at the switch this summer.   It has been working just fine,
same as always with no change. Now I get this:    note: {   }   is a description from me for something I can not create here
Verify Certificate.
The certificate for this server is invalid. You might be connecting to a server that is pretending to be "mail.me.com" which could put your confidential infirmation at reks. Do you want to connect to the server anyway?
☐   Always trust "mail.mac.com" when connecting to "mail.me.com"
{then there is a box enclosure}
☐     {this one is bwown}   Verification Class 3 Public Primary Certification Authority - G5
{below, indented}    {an arrow like this one ↵ pointing to the right to this bluish box,} ☐     VeriSign Class 3 Extended Validation SSL SGC CA
{then a larger bluish box:     "Mail.mac.com"
Issued by: VeriSign Class 3 Extended Validation SSLSGC CA Expires: Friday, April 18, 2014.
{then a red circle with an X inside, statement in red}   This certificate is not valid (host name mismatch)
     Trust
     Details
{my choices}     Hide Certificate          Cancel     Connect {in blue}
--------------------------------end of warning--------
Thank you in advance.    What should I do?   Is anyone else getting this?   The emails still coming in are directed to my email address.
Tom

I have iCloud eMail running in 10.4.11 & 10.5.8...
Do not delete the old account yet. sign up for an iCloud account if you haven't.
I understand .mac mail will still come through. Do not delete the old account yet.
You cannot use .mac or MobileMe as type of Account, you have to choose IMAP when setting up, otherwise Mail is hard coded to change imap.mail.me.com to mail.me.com & smtp.mail.me.com to smtp.me.com, no matter what you try to enter.
iCloud Mail setup, do not choose .mac or MobileMe as type, but choose IMAP...
On second step where it asks "Description", it has to be a unique name, but you can still use your email address.
IMAP (Incoming Mail Server) information:
          •          Server name: imap.mail.me.com
          •          SSL Required: Yes
          •          Port: 993
          •          Username: [email protected] (use your @me.com address from your iCloud account)
          •          Password: Your iCloud password
SMTP (outgoing mail server) information:
          •          Server name: smtp.mail.me.com
          •          SSL Required: Yes
          •          Port: 587
          •          SMTP Authentication Required: Yes
          •          Username: [email protected] (use your @me.com address from your iCloud account)
          •          Password: Your iCloud password
Also, you must upgrade your password to meet the new criteria: 8 characters, including upper and lower case and numbers. If you have an older password that does not meet these criteria, when you try to setup mail on your mac, using all of the IMAP criteria listed above, it will still give a server error message. Go to   http://appleid.apple.com         then follow directions to change your password, then go back to setting up your mail using the IMAP instructions above.
Thanks to dpepper...
https://discussions.apple.com/thread/3867171?tstart=0

EAP-TLS User Certificate Question

I've setup a test ACS server and have everything functioning correctly including the WLAN. However, is there anyway for EAP-TLS to use ONLY the machine certificate and not the user certificate? We are not currently setup with per-user certificates. I'm guessing not on this... My primary question then is with User Certificates, how do you handle the following scenerio:
I have many CoW's (computer on wheels) through out the hospital that nurses use for inputting patient information. They all have a simple generic username/password (BADDD!!!!) so with this user it won't be hard to have default_user certificate install on the machines. But what if Doctor X decideds to walk up to one of these CoW's and wants to logout and log back in with his user/password on a machine he's never used before. How do we handle making sure he's able to connect if doesn't already have a cert on this computer? I'm quite mistified by this.
Thanks
-Raun

If you are using the MS Supplicant, you need the following registry settings:
"HKLM\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global\AuthMode", 2, "REG_DWORD"
"HKLM\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global\SupplicantMode", 3, "REG_DWORD"
This forces it to only use hardware certificates and sets the authentication to do the correct RFC polling.
As for the other issue, MS CA user certs do not "roam". Yet. There is discussion of roaming credentials being in Windows 7, but not entirely what that means. Roaming certificates can be easier with a product like Venafi. There "Encryption Management" tools are certificate management suites. The do have roaming management, or at least did when we talked to them.
Oh, and if you use two CAs (hardware and user), the separation keeps it straight too.

Client certificate question

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Tabla normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman";
mso-ansi-language:#0400;
mso-fareast-language:#0400;
mso-bidi-language:#0400;}
Hello,
I am novice with certs and I have a question. I want to implement EAP-TLS in a WPA deployment and I have a question about the client-side certificate.
When I install a client certificate in a machine for a specific user, is this certificate only valid for this machine and this user? Or can I export this certificate and use it in another machine but the same user?
Thanks in advance,

From my experience, you can copy the certificate to another computer (assuming a modern OS). There are two problems with this, though:
1 - You must be able to export the entire certificate, including the private key, to be able to use the certificate on another machine. Most PKI implementations prohibit/disable this.
2 - If you can export the certificate, including the private key, then you are risking the loss of integrity of your PKI. Someone else can get that cert with the private key and impersonate the user.

A PKI Code Signing Certificate question.

Hello,
Can someone please help me with the following question.
I have created and used a code Signing certificate from our Microsoft Enterprise CA before which works OK, but I am not sure I did it correctly, and have a few related questions please.
what I did.
1: Logged on the CA directly, went to the CertSvc web site, requested a code signing cert, issued it and exported it along with the private key.
2: Imported the above certificate into CurrentUser/My store on PC and used it to sign code
3: Took the came certificate (along with the private key, and this is where perhaps I made at least one mistake) and imported it into the 'Trusted Publishers' store the PC that will be running the signed code. This step was done so the user does not receive
a message asking if they want to run the code signed by "AAnotherUser" as it were, as although the code is signed by a trusted CA, the user still gets this warning message as the 'Publisher' is not in the 'Trusted Publishers' list. Therefore the
way I sorted this at the time was to take the whole certificate as above and import to this store.
The first mistake I made (as far as I can see as I am new to this area) I think I should have not imported the certificate 'along with its private key' into the trusted publishers store? in other words should I have imported the certificate 'minus its
private key' into the trusted publishers store?
Also, I understand you have to have the certificate along with is private key to sign code. I am 'assuming' a Hash of the code is taken and this is signed (encrypted) with the private key (in the same way a CA signs a CSR for a WEBServer cert for example),
is that correct i.e. is that what it mean to sign code?
if the above is correct then I assume you only need the 'public' key of the code signed cert in the 'Trusted Publishers Store' to verify the code was signed by a trusted CA and it has not been altered e.g. the Hash code still computes to the same value.
Is this correct?
My next question is regarding the private key. As I need to 'Login' to AD in order to request a code signing cert, can the 'private key' not be stored securely in AD along with my AD User account?
if the above is possible (which would make good sense to me I think) then I do not have to worry about looking after the safety of the private key as the system 'AD' can do this for me. It would also mean which every computer I logon to in the domain I would
have access to the private key (but no other user) and therefore be able to sign code I assume. Does this last paragraph make sense can this be done/is this done?
Basically I need to understand the above, in order to understand more about Crypto.
I also need create a code signing cert for a 'department' of about 10 people. Therefore I was thinking about creating and AD account called 'XYZCorpCodeSigning' or what ever, and issuing a code singing cert to this entity. If the private key could be stored
in AD then accessed used once signed in as this account (these 10 people would need to know the password for the account) this would make life easier/more secure, I think.
I know there are several question above, but it would be great it they would be answered as I would help me understand more about how it all works and to solve a problem too
Thanks very much
AAnotherUser__
AAnotherUser__

> The first mistake I made (as far as I can see as I am new to this area) I think I should have not imported the certificate 'along with its private key' into the trusted publishers store
yes, it is not correct. Only public part should be imported to a Trusted Publishers container.
> is that correct i.e. is that what it mean to sign code
exactly. Encryption with private key and decrypting with public key is called "digital signature".
> if the above is correct then I assume you only need the 'public' key of the code signed cert in the 'Trusted Publishers Store' to verify the code was signed by a trusted CA and it has not been altered e.g. the Hash code still computes to the same
value. Is this correct?
yes. Client uses only public part of the certificate to validate the signature.
> As I need to 'Login' to AD in order to request a code signing cert, can the 'private key' not be stored securely in AD along with my AD User account?
normally code signing certificates are not stored in Active Directory and should not be there, because signing certificate is included in the signature field.
> I do not have to worry about looking after the safety of the private key as the system 'AD' can do this for me.
this is wrong assumption. A user is responsible to protect signing private key from unauthorized use.
> If the private key could be stored in AD then accessed used once signed in as this account (these 10 people would need to know the password for the account) this would make life easier/more secure
wouldn't, because if something happens -- you will never know who compromised the key.
as a general practice, we recommend to purchase at least few smart cards to store signing keys. Depending on a particular code development practice, there might be a dedicated employee (for example, manager of devs) who the only has access to a smart card
(and PIN) and signs the code upon dev request. Or issue a dedicated smart card with unique signing certificate to each developer. However this will add a complexity in signing certificate trust management.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.

Exchange OWA Certificate Question

Hello All
I just have a question regarding exchange owa certificate which is about to expire. (owa.domain.com, autodiscover.domain.com, mail.domain.com )
I have
Site one
Mailbox 2013 Server1
CAS 2013 Server1
Edge 2013
Site 2
Mailbox 2013 Server2
Cas 2013 Server2
Edge 2007
Exchange high availability configured. On ECP I am seeing my OWA certificate about to expire on both CAS on the same day(same cert)
I would like to create a new certificate, not renew as I have some old domains to remove from the cert.
My question is, when I create the the new request from ECP - Cas Server1, send to the CA and then install the, how will this reflect for the certificate that is expired on CAS server2?
Thanks

Hi nricki,
Agree with Hinte, you can export the new certificate which was created in CAS1 server and then import it to CAS2 server.
The following article for your reference:
How to Export/Import an SSL Certificate to Multiple Exchange 2013 Servers
Best regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Niko Cheng
TechNet Community Support

WS Security digital certificate question

I have a BPEL process which I have secured using OWSM. I am using digital certificates which I have generated using the keytool command.
Say I have two clients A and B and both have their certificates and send the messages. The request contains a field called sender. A should specify this field as A, and B should specify this as B. How do I verify that A send the message in which the the sender is specified as A.
I want to validate against the digital certificate belongs to sender A. He does not fool me by providing the certificate of A but in the message sends the sender as B.
Is this scenario valid? If yes how to resolve if not why not?
Thanks in advance for your help.
Regards,
Sash

this is not really a certificate issue. Its more of your application / process and where you want to handle this validation. (either at OWSM or else where).
When Sender A is digitally signing the message it is coming only from A (unless the private key / cert is stolen, etc). It A itself sends wrong value for sender field, they are not sending message as per your schema.
To answer your question, yes you can validate if the sender field matches with one of the fields in your cert such as Organization Name or you can map to your database. You have to write a custom step in OWSM to match the certificate information with the sender field.
Thanks
Ram

Exchange 2013 Certificate Question

Hi,
I have an Exchange 2013 and AD servers running on server 2008 R2. When you go to create an outlook account you are prompted that a certificate for mydomain.com.au has expired. When you click to view this certificate, it is referring to "www.mydomain.com.au".
Once you accept the message it goes away, the outlook account sets up OK and the message does not show again unless you set up another account.
The internal domain name is internal.mydomain.com.au. The Exchange server has a valid purchased SSL certificate that applies to autodiscover.mydomain.com.au, mail.mydomain.com.au, mydomain.com.au and the exchange servers internal name until 2015. The "www."
cert and website for this domain is separate to the internal servers and mail. The cert for the website has indeed expired but my question is even though it is the same domain why would this internal exchange server be querying the www. certificate when creating
an outlook account.
Bit of a tricky question hope I have explained it OK.
Thanks Robbie

Hi Robbie,
Your certificate expired issue may occur when using the Autodiscover service and Outlook Anywhere service. Please follow these steps to have a check:
1. verify the FQDN that the client users to access the resource from Outlook:
a. Start Microsoft Outlook.
b. Click File > Account Settings, click Account Settings.
c. Click the E-mail tab, click the Exchange account, and then click Change.
d. Click More Settings, and then click the Connection tab.
e. “Connect to Microsoft Exchange using HTTP” should be checked, then click Exchange Proxy Settings.
f. Note the FQDN that is listed in the Only connect to proxy servers that have this principal name in their certificate box. For example, mail.contoso.com.
2. Run the following command in Exchange to determine the value for the CertPrincipalName attribute for EXPR name:
Get-OutlookProvider
For example, the command returns the following:
msstd:server1.contoso.com
3. Modify the CertPrincipalName attribute to match the FQDN that Outlook uses to access the resource:
Set-OutlookProvider EXPR -CertPrincipalName:"msstd:<FQDN the certificate is issued to>"
For the Autodiscover service checking, please open outlook - press CTRL key - right click on the Outlook icon from right bottom corner taskbar - Test Email AutoConfiguration. Put your email address - uncheck use guessmart and secure guessmart authentication
- click Test to check your Autodiscover service. If possible, please post the Results tab here for more troubleshooting.
Thanks,
Winnie Liang
TechNet Community Support

Oracle Identity Federation certificate question

It is a Oracle requirement to include the certificate when Assertion is signed. Isn't it possible for a someone to intercept a assertion message sent be IDP and act as the IDP since the assertion has valid certificate? How do a SP ensure the certificate embedded in the assertion comes from correct IDP?
Btw, since we import the certificate in JKS, why IDP is required to embed it in the assertion?
Thanks.
Vinay
Edited by: user504421 on Jul 17, 2009 10:44 AM

Hi Vinay,
Before any communication happens between IDP and SP, both systems will establish a mutual trusted relation ship by exchanging metadata.
When IDP initates request, IDP will encode the assertion and will send it to SP.
SP will decode assertion record and will determine if its trusted IDP.
Only after this is passed, the SP allows IDP to access the resource requested for.
Does this answer your question?
-Mahendra.

Gift Certificate Question

Christmas 2005 I received a $20 gift certificate for ITunes. I downloaded and redeemed it but I haven't used any of it yet. However, I've since gotten a new computer which I'm using now. My question: Is there a way where I can locate and still use the gift certificate? I don't have any info of it on this computer and the info is on my old puter which is not working.

Hi TmaXx,
I'm pretty certain you can. When you buy and email an electronic iTunes gift certificate, it'll simply email the recipient an email with a code. Anybody can use that code.
So in your scenarios, [email protected] would open the email sent to [email protected], get the code, login into which iTunes account he wants to redeem it against and use the code.
Hope this helps,
Thomas

Lync Server 2013 STD pool pairing - certificate questions & DNS entries

Hi guys!
We are thinking about paired pools scenario, but we have one question regarding about certificates requriments on 2nd std pool lync server.
Our current (and only one) front end server (std edition) has this certificate entries:
CN=lync.domain.local
DNS Name=lync.domain.local
DNS Name=sip.domain.com
DNS Name=admin.domain.local
DNS Name=LyncdiscoverInternal.domain.com
DNS Name=lyncreverseproxy.domain.com
DNS Name=Lyncdiscover.domain.com
DNS Name=dialin.domain.local
DNS Name=meet.domain.com
which certificate entries should then have a paired std pool lync server?
bostjanc

Are you talking about the default cert assigned to the Lync Front Ends or the public certs?
If you are talking about the Lync Front End default cert (and you are using an internal CA) then simply get the second Lync Front End servers cert using STEP 3 of deployment wizard.
Assuming the FQDN of the 2nd std edition is lyncFE2.domain.local, it should look something like this:
CN=lyncFE2.domain.local
DNS Name=lyncFE2.domain.local - Front End #2 FQDN
DNS Name=sip.domain.com - for Lync Phone Edition (2 x DNS entries, 1 to each FE)
DNS Name=admin.domain.local - CSCP (2 x DNS entries, 1 to each FE)
DNS Name=LyncdiscoverInternal.domain.com - mobile clients (2 x DNS entries, 1 to each FE)
DNS Name=Lyncdiscover.domain.com - mobile clients
DNS Name=lyncreverseproxy.domain.com - External Lync web services
DNS Name=dialin.domain.com (assume the .local was a typo?)
DNS Name=meet.domain.com - both meet and dialin (2 x DNS entries, 1 to each FE)
Please mark posts as answers/helpful if it answers your question.
Blog
LyncSorted

Points / Certificate question

I preordered Destiny and used (what I thought) was a combination of available certificates and gift cards. I have been unable to access my points history, but it is saying that I have $5 in certificates to use. I have two questions,
1) Looking at the order history, I see the gift cards were used, but the points do not seem to be. Can this be confirmed for me?
2) Can the existing certificate be applied to an existing order? I am concerned with cancelling and replacing the same order as it is for a high demand product and I do not want to lose my ability to get the item.
3) Since the points history has not been accessible for me, as it seems to be the case with others, will Best Buy make an exception to the policy of reissuing rewards certificates based on this issue?
4) I have my rewards certificates set to issue at $20. Is there a way to see when I changed this versus when the last two certificates were issued?
I understand the policy of reissuing, so if that is the final answer, you do not need to send me to the fine print link. I am just hoping the interest of customer service some sort of resolution can be found. If not, I'll chalk it up as lost money to a confusing and broken system.
Also, if this is Derek answering, you have helped me multiple times with other issues. This is not intended to criticize any individuals. Thanks!

Good morning ToxicLogics,
I am more than happy to see if I can help answer your questions!
Based on your pre-order, it does not appear that any My Best Buy certificates were redeemed.
If you want to apply any active My Best Buy certificates to your pre-order, then you would need to cancel the existing pre-order and place a new pre-order.
Are you trying to view your points history by logging into BestBuy.com? If you want to view the details of your account and access your points/certificates , then you are going to wan to login to MyBestBuy.com. Your My Best Buy and BestBuy.com accounts appear to be linked.
I am unable to see when you changed your certificate preference
I would like to go over your My Best Buy account with you to ensure it is up-to-date and that your certificate preference is correct, so I will be sending you a private message. You can check your private messages by logging into the forum and clicking on the little yellow envelope at the top of the page.
Thank you for posting to the forum!
Derek|Social Media Specialist | Best Buy® Corporate
Private Message

Reward Certificate question

Is it possible to purchase Reward Certificates using a Best Buy gift card? Thanks.

Hello daniel77733,
I hope that you enjoyed your weekend.
The easy answer to your question is no. A certificate is usually issued when points that have posted to a member's My Best Buy account are converted into a certificate. There are occasions where we will issue bonus certificates as part of a promotional offer; however, a My Best Buy certificate cannot be purchased using a Best Buy gift card or any other form of payment. Let me know if you have any other questions.
Thank you for posting your question and for being a My Best Buy member!
Derek|Social Media Specialist | Best Buy® Corporate
Private Message

Certificate Questions....

A question:
When the WebLogic server is talking to the web server over https, does the
WebLogic server require a digital server certificate or does it act like a
web client and connect using the digital certificate of the web server?
Or, does the WebLogic server need a digital server certificate to
communicate with the web server over https?
Any assistance will be very much appreciated!
Thanks,
Chana Campos

Anything communicating via SSL/https requires key negotiation, and thus, a
certificate. However, I don't quite understand the question. When you say
"talking to the web server over https", (1) are you referring to a servlet
that is making a request to another HTTP server over that server's secure
port? (2) Or are you referring to the proxy? (3) or are you trying to
distinguish the app server part of WLS from the http/https server part of
WLS?
(1) Like any http request, it's a client/server action. The client (in this
case the servlet in the WLS context) is making a request to another web
server. All HTTP request rules apply.
(2) The connection between the proxy module and the WLS is completely open.
That does raise a good question, though. Can it be configured to use SSL?
Cameron? Michael?
(3) Any HTTP request made from a servlet/JSP/application to the WLS is just
like a request from a browser. Remember, embedding a servlet path into a
response HTML simply tells the browser to then make that HTTP request.
Jesse
"Chana Campos" <[email protected]> wrote in message
news:399ce1dc$[email protected]..
A question:
When the WebLogic server is talking to the web server over https, does the
WebLogic server require a digital server certificate or does it act like a
web client and connect using the digital certificate of the web server?
Or, does the WebLogic server need a digital server certificate to
communicate with the web server over https?
Any assistance will be very much appreciated!
Thanks,
Chana Campos

Keychain and certificate questions

I hate to admit being less well-versed in the Keychain than I ought to be, but I just don't usually pay it much attention. I don't trust it with any of my really important passwords, but not for any real reason other than that I don't know enough to know how safe it is.
I just got a couple certificates for a couple e-mail addresses through Thawte, and now find myself with several questions:
• How secure is the keychain that unlocks at login? Assuming that I have logged out, is there any way for someone who steals my laptop to get access to the stuff in that keychain? I would hope that resetting the account password would not also reset the keychain password!
• In Keychain Access, I see two public keys, both simply titled "Key from www.thawte.com", with no other identifying information. The private keys are similarly titled, but seem to have an association with the certificate that has the e-mail address as its name. How can I tell which public key goes with which private key?
• If I want to distribute my public keys to colleagues, on a web site or via e-mail, how do I do that? It looks like I can export to a .pem file (the other options are grayed out) which contains an RSA Public Key block. Do I just e-mail/upload that file, or the text, or what?
Thanks in advance for the help!

• How secure is the keychain that unlocks at login? Assuming that I have logged out, is there any way for someone who steals my laptop to get access to the stuff in that keychain?
They can go to the sites or services tied to a keychain entry, and if you have Safari set to remember usernames and passwords, they will fill in. You can show the password from keychain access, but you must enter the password to see the individual passwords, unless you set it to Always Allow when you look at it.
I would hope that resetting the account password would not also reset the keychain password!
It doesn't.
• In Keychain Access, I see two public keys, both simply titled "Key from www.thawte.com", with no other identifying information. The private keys are similarly titled, but seem to have an association with the certificate that has the e-mail address as its name. How can I tell which public key goes with which private key?
I'm not sure on that one.
• If I want to distribute my public keys to colleagues, on a web site or via e-mail, how do I do that? It looks like I can export to a .pem file (the other options are grayed out) which contains an RSA Public Key block. Do I just e-mail/upload that file, or the text, or what?
If you sign an email, it will send the public key with the email.

Hyper-V Replication Certificate Question

Hi,
Possibly a common question so apologies if it's simple.
My main server is HV1.company.local
My second server will be cloud based and standalone in a workgroup, let's call it hv2 and for arguments sake I'll add the DNS entries of hv2.mydomain.co.uk
and a certificate for this address.
Certificates will obviously need to be internet facing so will go for HV1.companydomain.com for the first server.
Do I just use internal DNS to sort out the fact that the server name is .local?
Anyone with experience in this set up with best practice and any gotcha's would be much appreciated,
Cheers,
JJ

Hi Sir,
>>My second server will be cloud based
Based on my understanding of your case , first you may ensure two hosts can access the IP of each other directly (whatever dns or hosts file ).
If the network prerequisite is met , then we can think of it as a workgroup environment and build certificate-based replication for two hyper-v host :
https://social.technet.microsoft.com/Forums/en-US/c3e309b6-1d5d-4e52-b859-cf36bd5af47d/forum-faq-how-to-implement-hyperv-replica-in-workgroup-environment?forum=winserverhyperv
Best Regards
Elton Ji
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Certificat question

Similar Messages

Maybe you are looking for