Getting self-signed certificates from an internal server...

Hi!
Thanks to the beautiful [Andreas Sterbenz's|http://blogs.sun.com/andreas/entry/no_more_unable_to_find] article I was able to download the two self generated certificates from the mail server and store them in a single file. So I expected things to work like a charm but soon I had to change my mind due to the (usual) error:
javax.mail.MessagingException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target;
nested exception is:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at com.sun.mail.imap.IMAPStore.protocolConnect(IMAPStore.java:571)
at javax.mail.Service.connect(Service.java:288)
at javax.mail.Service.connect(Service.java:169)
at com.agiletec.plugins.webmail.aps.system.services.webmail.WebMailManager.initInboxConnection(Unknown Source)
at com.agiletec.plugins.webmail.aps.tags.WebmailIntroTag.doStartTag(Unknown Source)
[etc etc]
So here's the first question: Is it correct to store the certificates in the system properties with the following code?
System.setProperty("javax.net.ssl.trustStore", certificateInUse); // <--- path of the file where I've stored the certificates
System.setProperty("javax.net.ssl.trustStorePassword", "changeit"); // password used
System.setProperty("javax.net.ssl.trustStoreType","JKS");
I haven't gone in the depth of the SSL theory but it seems to me that my webapp stores the certificates and keeps on connecting in the standard (non SSL) way....
Thanks in advance for the time spent reading!
Matteo

Have you tried setting the "Always trust" property? Double click the certificate in Keychain Access and allow it to have always trust for email.
Also, make sure that bundles are enabled for mail.
(Forget the command, google for "defaults write com.apple.mail enableBundles")
That did it for me.
Br,
T

Similar Messages

Generating Self Signed Certificate for iPlanet Directory Server for testing

Hi Experts,
I am unable to find how to generate self signed certificate for iPlanet Directory Server for testing purpose. Actually what i mean is i want to connect to the iPlanet LDAP Server with LDAPS:// rather than LDAP:// for Secured LDAP Authentication. For this purpose How to create a Dummy Certificate to enable iPlanet Directory Server SSL. I searched in google but no help. Please provide me the solution how to test it.
Thanks in Advance,
Kalyan

Here's one I did earlier.
Refers to Solaris 10
SSL Security
add a new certificate that lasts for ten years (120 months).
stop the instance:
dsadm stop <instance>
Remove DS from smf control:
dsadm disable-service <instance>
Change Certificate Database Password:
dsadm set-flags <instance> cert-pwd-prompt=on
     Choose the new certificate database password:
     Confirm the new certificate database password:
Certificate database password successfully updated.
Restart the instance from the dscc:
DSCC -> start <instance>
Now add a new Certificate which lasts for ten years (120 months; -v 120):
`cd <instance_path>`
`certutil -S -d . -P slapd- -s "CN=<FQDN_server_name>" �n testcert �v 120 -t T,, -x`
     Enter Password or Pin for "NSS Certificate DB":
Stop the Instance.
On the DSCC Security -> Certificates tab:
     select option to "Do not Prompt for Password"
Restart the instance.
On the Security -> General tab, select the new certificate to use for ssl encryption
Restart the instance
Stop the instance
Put DS back into smf control:
dsadm enable-service <instance>
Check the smf:
svcs -a | grep ds
# svcs -a|grep ds
disabled Aug_16 svc:/application/sun/ds:default
online Aug_16 svc:/application/sun/ds:ds--var-opt-SUNWdsee-dscc6-dcc-ads
online 17:04:28 svc:/application/sun/ds:ds--var-opt-SUNWdsee-dsins1

Getting self-signed certificates working with mail

Hi all,
I am having trouble getting email certificates created with keychain access to work in mail.
According to the Leopard help file, you simply have to go to Keychain access and create the certificate, which I did. After that if you create a message in mail with that account, there should be an icon showing that the message will be signed or encrypted if you have the recipients certificate installed. I cannot seem to get this to work. I have created the certificates specifically for email, the certificate shows in Keychain as well as a public and private key entry, but mail refuses to see it.
Has anyone gotten this to work with Mail and self-signed certificates?
Any help would be most appreciated.
Thanks,
RacerX

Have you tried setting the "Always trust" property? Double click the certificate in Keychain Access and allow it to have always trust for email.
Also, make sure that bundles are enabled for mail.
(Forget the command, google for "defaults write com.apple.mail enableBundles")
That did it for me.
Br,
T

Removing Self-Signed Certificates from Personal Store (Lync)

I believe a member of my team has a solution to the below but I wanted to weigh in on the PS forum area and see if there were additional thoughts.
Short story, the Lync client self-signed cert is creating an issue with our updated PKI infrastructure. In testing, when a user logs in with the new Infra. PKI chain the Lync client give a certificate error. When the *usersup*.cer is deleted
from the personal store, everything is fine. I've turned off the issuing of the client cert on the server side and running off AD authentication is fine. I need to automate the removal of 6K+ user's personal certs. Below is a PS script
that does what I need to do but the prompt has to be elevated and elevating prompts for that many users poses an issue, if anyone has experience with this and has an alternative solution, please feel free to share.
$certs = Get-ChildItem cert:\CurrentUser\My | where { $_.Issuer –like 'CN=Communications Server' }
foreach ($cert in $certs) {
    $store = Get-Item $cert.PSParentPath
    $store.Open('ReadWrite')
    $store.Remove($cert)
    $store.Close()

Since you're trying to remove certificates from the user store, elevation shouldn't be required. I'm able to remove certs from a non-elevated prompt. What's the error you're getting?
Also, you might be able to simplify your script to the following:
Get-ChildItem cert:\CurrentUser\My | where { $_.Issuer –like 'CN=Communications Server' } | Remove-Item -WhatIf
If that looks right, you can remove the -WhatIf and let it do its thing (you can also add the -Confirm switch if you want to answer Yes/No to each certificate).

Can't get self signed certificates working

Is this by design? I built an AIR app with a certificate that I created (and completely filled out) inside FB4.5.1. When I launched it, I got:

Disregard - the help file covers this.

Can you use a self signed certificate on an external Edge Server interface?

Hi,
I have a small lab deployment for evaluation purposes. The Lync FE server works great for internal users. I have now added an Edge server. For the internal interface, I have a self signed certificate from our internal CA. (no problem there) For the external
interface, I have a self signed certificate from our own external CA. I have installed the cert on the client machine of the external user and installed it for trusted operation. I have used the RUCT and digicert tools to prove that the external self signed
cert is valid (root and intermediate have been checked for validity).
At first, when logging in from the Lync 2013 client on the external users machine, I would get an error from Lync about the cert being untrusted. I have now fixed that error by adding it as trusted. At this point, there are no errors or warnings in the Event
Viewer (in the application or system logs) However, I receive the following error from the Lync client, "Were having trouble connecting to the server... blah, blah".
Here is my question. Does the Microsoft Lync 2013 client and/or the "testconnectivity.microsoft.com" tool specifically prevent or forbid the use of self signed certificates on the external interface of an Edge server? They seem too.
I can tell if the certificate is my problem or something else. Any ideas on how to trouble shoot this?
Thx

Drago,
Thanks for all your help. I got it working.
My problem with the Lync client error, "Were having trouble connecting to the server... blah, blah", was NOT a certificate error. It was a problem with my Lync Server Topology. (My sip default domain needed to match my user login domain.)
Let me update everyone about self-signed certificates:
YES, you can self-sign a certificate on your external edge server. It is a pain, but possible.
I have a self signed certificate from our own external CA. I have installed the cert on the client machine of the external user for trusted operation. I have used the RUCT and digicert tools to prove that the external self signed cert is valid (root and
intermediate have been checked for validity).
Here are my notes:
Create/enable your own external Certificate Authority (CA) running on a server with internet access.
On the Lync Edge Server, run the "Lync Server 2013 - Development Wizard".
Click "Install or Update Lync Server System". (Lync will automatically determine its deployment state)
You should have already completed: Step1 and Step 2.
Run or Run Again "Step 3: Request, Install or Assign Certificates".
Install the "Edge internal" certificate.
Click "Request" button to run the "Certificate Request" wizard.
You use can "Send the request immediately to an online certificate authority" option to connect to your internal CA, and create the certificate.
Once the certificate has been created, use "Import Certificate" to import it.
Once imported, on the Edge Server, go to: (Control Panel -> Administrative Tools -> Internet Information Services (ISS) Manager -> Server Certificates -> Complete Certificate Request...
In the Lync deployment wizard - Certificate Wizard, "Assign the newly imported "edge internal" certificate.
Install the "Edge External" certificate (public Internet).
Click the "Request" button to run the "Certificate Request" wizard.
Press "next"
Select "Prepare the request now, but send it later (offline certificate request).
Supply the "Certificate Request File" name and location. (You will need the file later. It should have the file extension ".req").
Click next on the "Specify Alternate Certificate Template". (which means you are using the default options)
Give it a Friendly Name. Bit Length = 2048. I selected "Mark the certificate's private key as exportable" option.
Fill in the organization info.
Fill in the Geographical Information.
The wizard should automatically fill-in the "Subject name:" and "subject alternative name:' fields.
Select your "Configured SIP domains"
"Configure Additional Subject Alternative Names" if you want. Otherwise, next.
Verify the "certificate Request Summary". Click next.
Run the wizard script to "Complete". The wizard will create a file containing the certificate request with the file extension ".req". (Let's assume the file name is "myCert.req")
Move your myCert.req file to your external CA. Have your CA issue the cert (based on myCert.req) and export the new cert to a file. I save it as a P7B certificate. (Let's call it "ExternalCert.p7b")
In the Lync Deployment wizard - Certificate Wizard, click on "Import Certificate" for ExternalCert.p7b.
Once imported, on the Edge Server, go to: (Control Panel -> Administrative Tools -> Internet Information Services (ISS) Manager -> Server Certificates -> Complete Certificate Request... (assign it a friendly name. Let's say "EXTERNAL-EDGE")
For the "External Edge certificate (public Internet), click "Assign".
The "Certificate Assignment" wizard will run.
Click next.
From the list, select your cert "EXTERNAL-EDGE".
Finish the wizard to "complete".
You are finished on the server.
Move the "ExternalCert.p7b" file to the machine running the lync client. Install the cert via the "Certificate Import Wizard".
When installing it to a particular Certificate Store, select the "Place all certificates in the following store" option.
Browse
Select "Trusted Root Certification Authorities"
Finish the wizard.

Some clients migrated from 2007 is presented with the self signed certificate in 2013

I have migrated from 2007 to 2013. I did a couple of test migrations and on the ones with domain member computers Outlook is giving a certificate warning. The certificate they are presented with is the default self signed certificate on the 2013 server.
Even though I have added a trusted public certificate to Exchange and checked of to use With IIS.
I see that the default certificate is also checked of to use With IIS and it cant be removed in ECS. Shouldnt this be removed from IIS all together when adding a New certificate? And why does some Clients gets presented With the self signed and some With
the Public? For instance owa is presented With the Public cert. Also and Outlook I tested from outside the domain.
Regards

Only the UCC certificate should be bound to IIS.
Are any clients using POP or IMAP, which also use SMTP? In this case clients can be presented with the "wrong" certificate as well.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Lion server erased self signed certificate

Help!!! I accidentally deleted the self signed certificate that had the right keys for my third party SSL. Now I cannot replace the self signed certificate with the new SSL. Now what????

I will begin my answer by making an emphasis that the best way to protect your data in-transit is using a 2048 bit certificate signed by a trusted certificate authority (CA) instead of relying on the self-signed certificate created by SQL Server.
Please remember that the self-signed certificate created by SQL Server usage for data in-transit protection was designed as a mitigation against passive traffic sniffers that could potentially obtain SQL Server credentials being transmitted
in cleartext, but nothing more. Think of it as a mitigation against a casual adversary.
The self-signed certificate usage was not intended to replace real data in-transit protection using a certificate signed by a trusted CA and encrypting the whole communication channel. Remember, if it is self-signed, it is trivial to spoof.
After making this clarification, the self-signed certificate generated by SQL Server uses a 1024 bit key, but that size may be subject to change in future versions of the product. Once again, I would like to strongly discourage relying on the self-signed
certificate created by SQL Server for data in transit transmission.
BTW. Azure SQL Database uses a 2048 certificate issued by a valid certificate authority.
I hope this information helps,
-Raul Garcia
SQL Server Security
This posting is provided "AS IS" with no warranties, and confers no rights.

SQL Server 2008 self-signed certificate is 1024bit or 2048bit?

When there is no user defined certificate available, SQL Server will generate a self-signed certificate when service starts, We have a tool scans and finds that in SQL 2005 the self-signed certificate is 1024bit, does someone know the default self-signed
certificate is still 1024bit or is it 2048bit in SQL 2008? Thanks a lot!!!

I will begin my answer by making an emphasis that the best way to protect your data in-transit is using a 2048 bit certificate signed by a trusted certificate authority (CA) instead of relying on the self-signed certificate created by SQL Server.
Please remember that the self-signed certificate created by SQL Server usage for data in-transit protection was designed as a mitigation against passive traffic sniffers that could potentially obtain SQL Server credentials being transmitted
in cleartext, but nothing more. Think of it as a mitigation against a casual adversary.
The self-signed certificate usage was not intended to replace real data in-transit protection using a certificate signed by a trusted CA and encrypting the whole communication channel. Remember, if it is self-signed, it is trivial to spoof.
After making this clarification, the self-signed certificate generated by SQL Server uses a 1024 bit key, but that size may be subject to change in future versions of the product. Once again, I would like to strongly discourage relying on the self-signed
certificate created by SQL Server for data in transit transmission.
BTW. Azure SQL Database uses a 2048 certificate issued by a valid certificate authority.
I hope this information helps,
-Raul Garcia
SQL Server Security
This posting is provided "AS IS" with no warranties, and confers no rights.

Web Server 7 Admin Server and Self-Signed certificate

Is it possible to create and install a self-signed certificate for the administration server in Sun Web Server 7. The default installation comes with a self-signed certificate but we would like to install our own certificate and not the certificate issued by "admin-ca-cert"
Message was edited by:
aar

As far as I know its not a problem. You can install your own certificate. Make sure that the certificate nick name is changed accordingly in "server-cert-nickname" in server.xml section as shown below :
<http-listener>
<name>admin-ssl-port</name>
<port>2224</port>
<server-name>alamanac.india.sun.com</server-name>
<default-virtual-server-name>admin-server</default-virtual-server-name>
<ssl>
<server-cert-nickname>Admin-Server-Cert</server-cert-nickname>
</ssl>
</http-listener>

Step by Step Instructions for Installing Self Signed Certificate using Certificate Modification Tool

I am looking for some step by step instructions for installing the self signed certificate from my Microsoft SBS 2003 server on a Treo 755p and 750p. In particular I need some help with the form of the actual certificate and how to use the Certificate Modification tool.
Some questions I have are as follows:
1. When I install the certificate on a Windows Mobile device I used an exported version of the certificate. This export is done using the DER x.509 format. Is that the same form I’ll need for the Palm? Do I need some other form? Can/should I just use sbscert.cer file that is generated when SBS is configured?
2. Does the self signed cert need to be installed on the computer being used to update the Palm or do we just need to be able to access the appropriate .CER file?
3. There are three things included in the PalmCertificatesTool.zip file:
                                Trusted CAs (folder)
                                Cert2pdb.exe
                                PalmCertificates.exe
   How do I use these tools?
4. It looks like the PalmCertificates.exe file opens an interface that will allow me to browse to the desired .CER file. Then I suppose I use the < Generate PDB > to create something that needs to then be uploaded to the Palm device? Not having any real experience with a Palm device how do I upload and install this file?
5. Once uploaded do I do something on the device to install it?
If there is some white paper that provides step by step instructions on doing this that would be great.
Thanks,
Walt Bell
Post relates to: Treo 755p (Verizon)
Post relates to: Treo 755p (Verizon)

Thanks for that.
I have one question after reading the article 43375:
The article has you "Turn of AutoSync" and then "Reset the device". It then indicates the device should be left idle.
The next step relates to running the PalmCertificates.exe, navigate to the certificate file and add it and then run the < Generate PDB > button. Should the device be connected to the computer during this process? If so, at what point after the reset do you connect it to the computer?
Thanks!
Post relates to: Treo 755p (Verizon)

Creating a self signed certificate - how do you set the 'storepass'

Hi, I'm trying to use the ADT to create an AIR 2.7 file, but it's the first time i've used the command line tool to build one and am having problems understanding the signing process.
I can generate a cert.p12 keystore file from within the flash IDE, and this asks for a password for the file (-storepass)
I can also use ADT to create a self-signed certificate from the command line, here you can specify the -keystore (cert location) and -keypass (password for the key in the store)
I cannot find a way of generating a self-signed certificate where you can specify both passwords though, one for the store (-storepass) and one for the key (-keypass).
This is a problem because when i go to package my AIR file using ADT it needs both passwords -storepass and -keypass before it can publish it.
Does anyone know how to generate a self-signed .p12 certificate and have control over both the keys...?
I have spent hours playing and searching now so may have the wrong end of the stick, could do with some help getting past this issue.
Thanks
Sean

There is only one password is required to package for ipa as far I know
Sample command:
C:\AdobeAIRSDK\bin\adt.bat -package -target ipa-test -storetype pkcs12 -keystore [KEYFILE].p12 -storepass [KEY PASSWORD] -provisioning-profile [MOBILE PROVISION FILE].mobileprovision [IPA NAME].ipa [XML FILE NAME].xml [SWF FILE NAME].swf Icon_29.png Icon_48.png Icon_57.png Icon_72.png Icon_512.png Default-Landscape.png Default-Portrait.png Default-PortraitUpsideDown.png Default-PortraitLandscapeLeft.png Default-PortraitLandscapeRight.png

Self Signed Certificate for Web Proxy 4.0.2

Does anyone have instructions on how to create and install self signed Certificate for Web Proxy Server 4.0.2? My OS is RHEL 4.
Shed.

Unfortunately you will not be able to do that from the GUI.
You will have to use certutil frin proxy-install/bin/proxy/admin/bin/certutil
Make sure that your LD_LIBRARY_PATH includes proxy-install/bin/proxy/lib
(start -shell will give you a shell with all necessary paths set.)
create a file called password-file which contains your password to your cert database
your cert database resides in the alias directory of proxy installation.
certutil -S -s "CN=My Issuer" -n myissuer -x -t "C,C,C" -1 -2 -5 -m 1234
-f password-file -d certdir

Safari could not establish secure connection to my localhost with self signed certificate

was using maven+grizzly+jersey to start my own server. I created self signed certificate so that my server can support https. I case you are curious, following is how I generated my certificate
I was testing this on my iMac (Running Mavericks) Now, I added the server.cert to the system keychain so that all users can trust this certificate. Also, I change the trust level to "Always Trust".
I get this work in Chrome and Firefox. They asked me to add exception for this certificate, I did and then everything goes fine. However, I have never make Safari(7.0) happy. I always get the error saying that Safari cannot establish secure connection to my localhost.
Does anyone have any idea why it happened? Or is there better way to debug this problem so that I will be able to tell at which step things goes wrong.
Thank you in advance. I really appreciated it.

Any help much appreciated!

Importing self-signed certificate

Hi there!
I have some problems in importing SSL certificates on my macbook.
There are 2 certificates that needs to be imported: the root CA certificate, which is self-signed naturally and private user certificate, which is signed by above-mentioned CA.
The first file in .crt format, which is consists of CA public key and sign. The second file in .p12 format, which is consists of encrypted public and private keys.
The problem is:
I can't import nor CA neither my personal certificate.
The CA cert should be imported at "CA" tab in keychain, but the import button ("+") is inaccesible here:
http://img.200133883.info/big//%D0%A1%D0%B2%D1%8F%D0%B7%D0%BA%D0%B0_%D0%BA%D0%BB %D1%8E%D1%87%D0%B5%D0%B9-20120313-143521.png
When I tried to double-click CA.crt I got the import error # -67762 which saying that attribute "key length" was invalid. The same thing with my personal certificate.
Could somebody explain me, how should I import those two SSL certificated?

I'm using self-signed certificate from SBS. Right now it's not the question, if something is misconfigured within my certificate (I'm aware of SBS certificate problems), the problem is that E90 WILL NOT recognize .cer or .der files as certificates.
There must be someone, who can answer this really simple question, which certificate formates are supported on E90.
You will find this type of question posted many times on different forums, with diiferent suggestion, but they simply don't work.
Again my error is "file format not supported"

Getting self-signed certificates from an internal server...

Similar Messages

Maybe you are looking for