How pass client credentials to ws client and accept self signed certificate

How do you connect to a web service over ssl and accept self-signed certificates. I generated the client using JAX-WS but i ran into two problems. First of all, how do you pass the client credentials? And second, how can you accept a self-signed certificate?

Thanks for your comments Jason.
I'm not quite sure why the certificate has client auth. It does seem to be a misconfiguration, but I do see both 7.3.1 & 7.3.2 on the cert. That seems like a possible fix, but in a backwards way. I can get those certificates reissued, but I'm confused
as to why config manager itself is not installing per the site settings.
My default install is via a vbs script you wrote (1.6.5). The other methods I've tried in this particular instance are by browsing to the server and running ccmsetup.exe from explorer out of my sms_<site> directory, and by using command line
specifying the /mp:mp.mysite.com
I looked for command line switches to use, but there's no /NoUsePKI switch or /UseSelfSigned...
any suggestions for a better installation method?

Similar Messages

DS6.3 replication and sun self signed certificate

1. I am creating a replication agreement using the dscc and am prompted to choose:
Authenticate using simple authentication and use a non-secure connection
Authenticate using simple authentication and use a secure connection
Authenticate using a certificate and use a secure connection
I would like to choose the second option "Authenticate using simple authentication and use a secure connection" since I am replicating to another company division on another subnet in another building.
Does this option take into account the installed certificates? Can I do this with a sun self signed certificate that I got by default at install? And if so can I renew it if it is expired?
In my deployments I have used my own self signed certs and store bought certs. Since I know the other server has the sun cert, I was thinking I could just use that, and not do any root cert exchanges.

Yes, you can. By default the certs that come when instance is created expire in 90 days and you can renew the cert easily using certutil. But you have to change the cert's trust properties so it can be used as a client as well.
It's best you use CA signed certificates that last for longer, that way you can use it with normal apps as well. If this does not help, please post again.
http://docs.sun.com/app/docs/doc/820-2763/bcarh

How to access Flash Apps over https with a self signed certificate?

I have a Flex app that needs to access data from a SOAP web service over https with a self signed certificate. The app needs to ignore the https warnings, just as a browser would warn & allow the user to proceed. Buying a valid signed certificate is not an option for us.
It works fine over http.
How can I achieve this?
I read that URLRequest has a property: authenticate, that I can set to false. However, this property is available only for Adobe AIR applications from what I can see. This doesn't seem available for Flex apps.
I have tried this in both Flex 3 & the latest Flash Builder 4. Have the same issue in both cases.
Help appreciated.
Thanks

You'd really need to ask in the Flex or Flash Builder forums as this is a front end code modification and Flash Player can't do any of that.

How to use Self Signed certificate with SSLServerSocket?

Hello to all.
I'm trying to build a simple client/server system wich uses SSLSocket to exchange data. (JavaSE 6)
The server must have it's own certificate, clients don't need one.
I started with this
http://java.sun.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore
To generate key for the server and a self signed certificate.
To sum it up:
     Create a new keystore and self-signed certificate with corresponding public/private keys.
keytool -genkeypair -alias mytest -keyalg RSA -validity 7 -keystore /scratch/stores/server.jks
     Export and examine the self-signed certificate.
keytool -export -alias mytest -keystore /scratch/stores/server.jks -rfc -file server.cer
     Import the certificate into a new truststore.
keytool -import -alias mytest -file server.cer -keystore /scratch/stores/client.jksThen in my server code I do
System.setProperty("javax.net.ssl.keyStore", "/scratch/stores/server.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "123456");
SSLServerSocketFactory sf = sslContext.getServerSocketFactory();
SSLServerSocket sslServerSocket = (SSLServerSocket)sf.createServerSocket( port );
Socket s = sslServerSocket.accept();I am basically missing some point because I get a "javax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled." when I try to run the server.
Can it be a problem with the certificate? When using -validity <days> in keytool the certificate gets self-signed, so it should work if I'm not wrong.
I have also tried this solution
serverKeyStore = KeyStore.getInstance( "JKS" );
serverKeyStore.load( new FileInputStream("/scratch/stores/server.jks" ),
     "123456".toCharArray() );
tmf = TrustManagerFactory.getInstance( "SunX509" );
tmf.init( serverKeyStore );
sslContext = SSLContext.getInstance( "TLS" );
sslContext.init( null, tmf.getTrustManagers(),secureRandom );
SSLServerSocketFactory sf = sslContext.getServerSocketFactory();
SSLServerSocket ss = (SSLServerSocket)sf.createServerSocket( port );and still it doesn't work.
So what am I missing?

You were right. I corrected the mistakes in the server code, now it's
     private SSLServerSocket setupSSLServerSocket(){
          try {
               SSLContext sslContext = SSLContext.getInstance( "TLS" );
               KeyManagerFactory km = KeyManagerFactory.getInstance("SunX509");
               KeyStore ks = KeyStore.getInstance("JKS");
               ks.load(new FileInputStream(_KEYSTORE), _KEYSTORE_PASSWORD.toCharArray());
               km.init(ks, _KEYSTORE_PASSWORD.toCharArray());
                * Da usare con un truststore se serve autenticazione dei client
                * TrustManagerFactory tm = TrustManagerFactory.getInstance("SunX509");
               tm.init(ks);*/
               sslContext.init(km.getKeyManagers(), null, null);
               SSLServerSocketFactory f = sslContext.getServerSocketFactory();
               SSLServerSocket ss = (SSLServerSocket) f.createServerSocket(_PORT);
               return ss;
          } catch (UnrecoverableKeyException e) {
               e.printStackTrace();
          } catch (KeyManagementException e) {
               e.printStackTrace();
          } catch (NoSuchAlgorithmException e) {
               e.printStackTrace();
          } catch (KeyStoreException e) {
               e.printStackTrace();
          } catch (CertificateException e) {
               e.printStackTrace();
          } catch (FileNotFoundException e) {
               e.printStackTrace();
          } catch (IOException e) {
               e.printStackTrace();
          return null;
     }and on the client code
private SSLSocket setupSSLClientSocket(){
     try {
          SSLContext sslContext = SSLContext.getInstance( "TLS" );
          /* SERVER
          KeyManagerFactory km = KeyManagerFactory.getInstance("SunX509");
          km.init(ks, _KEYSTORE_PASSWORD.toCharArray());
          KeyStore clientks = KeyStore.getInstance("JKS");
          clientks.load(new FileInputStream(_TRUSTSTORE), _TRUSTSTORE_PASS.toCharArray());
          TrustManagerFactory tm = TrustManagerFactory.getInstance("SunX509");
          tm.init(clientks);
          sslContext.init(null, tm.getTrustManagers(), null);
          SSLSocketFactory f = sslContext.getSocketFactory();
          SSLSocket sslSocket = (SSLSocket) f.createSocket("localhost", _PORT);
          return sslSocket;
     } catch (KeyManagementException e) {
          e.printStackTrace();
     } catch (NoSuchAlgorithmException e) {
          e.printStackTrace();
     } catch (KeyStoreException e) {
          e.printStackTrace();
     } catch (CertificateException e) {
          e.printStackTrace();
     } catch (FileNotFoundException e) {
          e.printStackTrace();
     } catch (IOException e) {
          e.printStackTrace();
     return null;
}and added a System.out.println(sslSocket); after every incoming message (server side) and SSL is now fully working!
So my mistakes were:
[] Incorrect setup done by code
[] Incorrect and insufficient println() of socket status
Now that everything works, I've deleted all this manual setup and just use the system properties. (They MUST be set before getting the Factory)
SERVER SIDE:
System.setProperty("javax.net.ssl.keyStore", _KEYSTORE);
System.setProperty("javax.net.ssl.keyStorePassword", KEYSTOREPASSWORD);
SSLServerSocketFactory f = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket sslServerSocket = (SSLServerSocket) f.createServerSocket(_PORT);
CLIENT SIDE:
System.setProperty("javax.net.ssl.trustStore", "/scratch/stores/client.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "client");
SSLSocketFactory f = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket sslSocket = (SSLSocket) f.createSocket(_HOST, _PORT);
And everything is working as expected. Thank you!
I hope my code will help someone else in the future.

How corba client and server find Naming service

hello
i want to ask how corba client and server find the Naming service ?
10x

By using a well-known port (I think the default for JavaIDL's NS is 1049) on a well-known address (localhost).
As these values are not really standard, you can specify them when starting the server and client (+-ORBInitialPort 1050 -ORBInitialHost localhost+). See the documentation .

New self signed certificate, how to mark as trusted for all users on clients

We have a new 10.8 server that we are currently using for iChat/Messages service. We have created a self signed certificate to encrypt the traffic to the Messages service since we have the service accessible for internet and phone users. We use network accounts and users need to log in on several different machines when in the office.
Can anyone suggest how to tell a client machine to trust the certificate for all users?
Currently, each user is asked to trust the certificate on each client they log into.
I have imported the server certificate into the client's system keychain in Kechain Access and asked it to trust the certificate for all items manually. This does not appear to allow all users to trust the certificate since subsequent users who have not yet trusted the certificate on the test client are still asked to confirm trust. When opening the iChat.app the users are still propmpted to verify the certificate which now indicates that it is trusted for all users.

Resolved.
- Drag certificate from verification dialog.
- Import into System Keychain
- Select certificate in System Keychain and select "i" button at bottom of window.
- Set all items to always trust.

Possible to select self-signed certificate for client validation when connecting to VPN with EAP-TLS

In windows 8.2, I have a VPN connection configured with PPTP as the outer protocol and EAP : "Smart card or other certificate ..." as the inner protocol. Under properties, in the "When connecting" section I've selected "Use a certificate
on this computer" and un-checked "Use simple certificate selection".
My preference would be to use separate self-signed certificates for all clients rather than having a common root certificate that signed all of the individual client certificates. I've tried creating the self-signed certificate both with and without the
client authentication EKU specified, and I've added the certificate to the trusted root certificate authority store on the client. But when I attempt to connect to the VPN I can not get the self signed certificate to appear on the "Choose a certificate"
drop down.
Are self signed certificates supported for this use in EAP-TLS? If it makes a difference, I'm working with makecert (not working with a certificate server).
TIA,
-Rick

Hi Rick,
Thank you for your patience.
According to your description, would you please let me know what command you were using to make a self-signed certificate by tool makecert? I would like to try to reproduce this issue. Also based on my experience, please let me
know if the certificate has private key associated and be present in the local machine store. Hence, please move the certificate from the trusted root certificate authority store to personal store.
Best regards,
Steven Song
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Some clients migrated from 2007 is presented with the self signed certificate in 2013

I have migrated from 2007 to 2013. I did a couple of test migrations and on the ones with domain member computers Outlook is giving a certificate warning. The certificate they are presented with is the default self signed certificate on the 2013 server.
Even though I have added a trusted public certificate to Exchange and checked of to use With IIS.
I see that the default certificate is also checked of to use With IIS and it cant be removed in ECS. Shouldnt this be removed from IIS all together when adding a New certificate? And why does some Clients gets presented With the self signed and some With
the Public? For instance owa is presented With the Public cert. Also and Outlook I tested from outside the domain.
Regards

Only the UCC certificate should be bound to IIS.
Are any clients using POP or IMAP, which also use SMTP? In this case clients can be presented with the "wrong" certificate as well.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

How to erase all self signed certificates and force Server to use Signed SSL

I have been using a poorly managed combination of self-signed SSL certificates and a free one. I have purchased a good SSL from Digicert and am trying to configure the server to use it across the board. All of the services seem to be using it, but when I try to manage the server remotely, I seeing a self-signed certificate instead.
I look under the system keychain in K-Access and there are several self signed certificates there (including the one that I am seeing when I try to remote manage).
Can I replace those self-signed certs with the new one some how?

Don't delete those. However, you are on the right track. Follow these steps to resolve.
1: Launch Keychain Access
2: Select the System Keychain
3: Find the com.apple.servermgrd IDENTITY PREFERENCE (looks like a contact card) and double click to open it
4: In the Preferred Certificate popup, change com.apple.servermgrd to your purchased certificate
5: Press Save Changes to save.
6: Reboot the server or kill the servermgrd process to restart the service.
That should resolve your issue.
R-
Apple Consultants Network
Apple Professional Services
Author "Mavericks Server – Foundation Services" :: Exclusively available on the iBooks store

How to replace an expiring self-signed certificate?

Well, I've successfully (I THINK) replaced two of the three certificates that are expiring.
First off - 90% of what's in the Security manual concerning certificates is useless to this issue. I don't want to know how the watch is made - I just want to tell time! In fact there is a GLARING typo on Page 167 of the Snow Leopard Server Security Configuration Manual showing a screenshot of the Certificate Assistant in Server Admin that is just plain wrong!
It's clear there is no way to RENEW the certificate. You have to delete the old one and replace it with a new certificate.
The issue I have is that with all the services using the certificate, I don't know what the impact to the end-users is going to be when I delete that expiring certificate.
It appears that a certificate is created automatically when the OS is installed, although I installed the OS Server on a virtual machine and I didn't see where it got created, nor was I given any input during the creation (like extending the expiration date).
I don't know whether those certificates are critical to the running of the OS or not, but I went through the process of creating a new certificate in Server Admin. I deleted the expiring certificate. Because the two servers on which the expiring certificate was deleted does not have any services running that require a certificate (such as SSL on my mail server), nothing bad seems to have happened or been impacted negatively.
I did, however, name the new certificate the exact same thing as the old certificate and tried to make sure that the parameters of the new certificate were at least as extensive as the old certificate. You can look at the details of the old certficate to see what they were.
Here's the "critical" area of the certificate that was "auto-created" on my virtual server. (It's the same as the one on my "real" server.
http://screencast.com/t/zlVyR2Hsc
Note the "Public Key Info" for "Key Usage": Encrypt, Verify, Derive. Note the "Key Usage" Extension is marked CRITICAL and it's usage is "Digital Signature, Data Encipherment, Key Cert Sign". Extended Key Usage is also critical and it's purpose is Server Authentication.
Here's a screenshot of the default certificate that's created if you create a new self-signed certificate in Server Admin:
http://screencast.com/t/54c2BUJuXO2
Note the differences between the two certificates. It LOOKS to me like the second certificate would be more expansive than the default issued at OS Install? Although I don't really care about Apple iChat Encryption.
Be aware that creating certificates starts to populate your server Keychain.
http://screencast.com/t/JjLb4YkAM
It appears that when you start to delete certificates, it leaves behind private keys.
http://screencast.com/t/XD9zO3n16z
If you delete these keys you get a message warning you about the end of the world if you delete private keys. I'm sorry if your world melts around you, but I'm going to delete them from my Keychain.
OK, now I'm going to try to create a certificate that is similar to the one that is created at start-up.
In Server Admin, highlight your server on the sidebar and click the "Certificates" tab in the icon bar.
Click the "+" button under your existing certificate and select "Create a Certificate Identity". (This is how I created the default certificate we just got through looking at except I clicked through all the defaults.)
Bypass "Introduction".
In the "Create Your Certificate" window I set the "Name" as exactly the same as the name of the expiring certificate. I'm HOPING when I do this for my email server, I won't have to go into the services using the certificate and select the new one. On the other hand, naming it the same as the old one could screw things up - I guess I'll know when I do it later this week.
The "Certificate Type" defaults to "SSL Server" and I think this is OK since that's what I'll be using this certificate for.
You HAVE to check the "Let me override defaults" if you want to, for example, extend the expiry period. So that's what I want to do, so I checked it.
In the next window you set the Serial Number and Validity Period. Don't try typing "9999" (for an infinite certificate) in the "Validity Period" field. Won't work - but you CAN type in 1826 (5 years) - that works - Go Figure!??? You can type in a bigger number than that but I thought 5 years was good for me.
The next part (Key Usage Extension) is where it gets sticky. OF COURSE there is NO DOCUMENTATION on what these parameters mean of how to select what to choose.
(OK here's what one of the "explanations" says: "Select this when the certificate's public key is used for encrypting a key for any purpose. Key encipherment is used for key transport and key wrapping (or key management), blah, blah, blah, blah, blah blah!") I'm sure that's a clear as day to you rocket scientists out there, but for idiot teachers like me - it's meaningless.
Pant, pant...
The next window asks for an email address and location information - this appears to be optional.
Key Pair Information window is OK w/ 2048 bits and RSA Algorithm - that appears to be the same as the original certificate.
Key Usage Extension window
Here's where it gets interesting...
I brought up the screenshot of the OS Install created certificate to guide me through these next couple of windows.
Since the expiring cert had "Digital Signature, Data Encipherment, Key Cert Sign" I selected "Signature, Data Encipherment and Certificate Signing".
Extended Key Usage Extension...
Hoo Boy...Well, this is critical. But under "Capabilities" it lists ANY then more stuff. Wouldn't you THINK that "ANY" would include the other stuff? Apparently not..."Learn More"?
Sorry, folks, I just HAVE to show you the help for this window...
+*The Extended Key Usage Extension (EKU) is much like the Key Usage Extension (KUE), except that EKU values are defined in terms of "purpose" (for example, signing OCSP responses, identifying an SSL client, and so on.), and are easily extensible. EKU is defined with object identifiers called OIDs. If the EKU extension is omitted, all operations are potentially valid.*+
KILL ME NOW!!!
OK (holding my nose) here I go...Well, I need SSL Server Authentication (I THINK), I guess the other stuff that's checked is OK. So...click "Continue".
Basic Constraints Extension...
Well, there is no mention of that on the original certificate, so leave it unchecked.
Subject Alternate Name Extension...
Nothing about that in the original certificate, so I'm going to UNCHECK that box (is your world melting yet?)
DONE!!!! Let's see what the heck we got!
http://screencast.com/t/QgU86suCiQH
Well, I don't know about you but that looks pretty close for Jazz?
I got some extra crap in there but the stuff from the original cert is all there.
Think we're OK??
Out with the old certificate (delete).
Oh oh - extra private key - but which is the extra one? Well, I guess I'll just keep it.
http://screencast.com/t/bydMfhXcBFDH
Oh yeah...one more thing in KeyChain Access...
See the red "X" on the certificate? You can get rid of that by double clicking on the certificate and expanding the "Trust" link.
http://screencast.com/t/GdZfxBkHrea
Select "Always Trust".
I don't know if that does anything other than get rid of the Red "X", but it looks nice. There seem to be plenty of certificates in the Keychain which aren't trusted so maybe it's unnecessary.
I've done this on both my file server and my "test" server. So far...no problems. Thursday I'll go through this for my Mail server which uses SSL. I'm thinking I should keep the name the same and not replace the certificates in the iCal and Mail service which use it and see what happens. If worse comes to worse, I may need to recreate the certificate with a different name and select the new certificate in the two services that use it.
Look...I don't know if this helps anyone, but at least I'm trying to figure this idiocy out. At least if I screw up you can see where it was and, hopefully, avoid it yourself.
If you want to see my rant on Apple's worthless documentation, it's here.
http://discussions.apple.com/thread.jspa?threadID=2613095&tstart=0

to add to countryschool and john orban's experiences:
using the + Create a Certificate Identity button in Server Admin is the same thing as running KeyChain Access and selecting Certificate Assistant from the app menu, and choosing Create a Certificate. Note that you don't need to create a Certificate Authority first.
in the second "extended key usage extension" dialog box, i UN-checked Any, PKINIT Server Authentication, and iChat Encryption. this produced the closest match to the server's default self-installed certificate.
when updating trust settings in Keychain Access, the best match to the original cert are custom settings - set Always Trust for only SSL and X.509 Basic Policy.
supposedly you can use Replace With Signed or Renewed certificate button from Server Admin and avoid needing to re-assign to services. however i was unable to get this to work because my new cert didn't match the private key of the old. for those interested in going further, i did figure out the following which might be helpful:
you can't drag and drop a cert from Keychain Access or Cert Manager. you need the actual PEM file. supposedly you can hold down the option button while dragging, but this didn't work for me. however you can view the certificates directly in etc/certificates. but that folder is hidden by default. a useful shortcut is to use Finder / Go To Folder, and type in "/private/etc/certificates"
now, on my system the modification date was the same for old and new certificates. why? because it seems to be set by when you last viewed them. so how do you know which is which? answer: compare file name to SHA1 Fingerprint at bottom of certificate details.
after you delete the old certificate, it will disappear in Keychain Access from "System" keychains. however in "login" keychains the old one will still be there but the new one won't. it seems to make sense to delete the old one from here and add the new one. somebody tell me if this is a bad idea. the + button does not work easily for this, you need to drag and drop from the etc/certificates folder.
lastly, the "common name" field is the server/host name the client will try to match to. you can use wildcard for this, e.g. *.example.com. if you need to, you can use the Subject Alternate Name to provide an alternative name to match to, in which case the common name field will be ignored, which is why by default the dNSName alternate field defaults to the common name. more info here: http://www.digicert.com/subject-alternative-name-compatibility.htm.
maybe that's hopeful to somebody. but i stopped there since things seem to be working.
last note, which you probably know already - if you don't want to bother installing the certificate in your client computers and phones, you can select Details when the first trust warning pops up and select Always Trust.
now, we'll see how everything works once people start really using it...

How to import the self-signed certificate in runtime

HI.
I work to connect between JSSE client and OpenSSL server with self-signed certificate.
But I met the SSLSocketException during handshaking.
Many Solutions registered in this page.
But their are all using keytool.
My application connect many site support the self-signed certificate.
So, I want to import the certificate in run time.
How Can I do??
Please, answer me..
Thanks,

did you figure this out??? I need to know how to accept a self-signed certificate, otherwise it's this exception...
D:\javatools\apis\jsse1.0.2\samples\urls>java -cp jcert.jar;jnet.jar;jsse.jar;. URLReader
Exception in thread "main" javax.net.ssl.SSLException: untrusted server cert chain
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.ssl.ClientHandshaker.a([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.ssl.Handshaker.process_record([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.ssl.AppOutputStream.write([DashoPro-V1.2-120198])
at java.io.OutputStream.write(OutputStream.java:61)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.www.protocol.https.HttpsClient.doConnect([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.www.protocol.https.NetworkClient.openServer([DashoPro-V1.2-12019
8])
at com.sun.net.ssl.internal.www.protocol.https.HttpClient.l([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.www.protocol.https.HttpClient.<init>([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.www.protocol.https.HttpsClient.<init>([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a([DashoPro-V1.2-120198])
at com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnection.connect([DashoPro-V1.2-120
198])
at com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnection.getInputStream([DashoPro-V
1.2-120198])
at java.net.URL.openStream(URL.java:798)
at URLReader.main(URLReader.java:46)

How to register iOS device when using self signed certificate with apple Server?

Hi,
I have installed the server.app by Apple and used a slef signed certificate for my server. Now I want to register my different devices (iMac, iPhone etc.). I could register the iMac without problesm (I just had to add my self signed certificate to the trusted certificates)
Sadly, with the iPhone it is not that easy. I can install the "trust profile", but still after that I can not register my device. It seems like it does not accept my self signed certificate for device registration. When adding a registration profile, I get the error "www._mydomain_.tld/devicemanagement/api/device/auto_join_ota_service" is not valid.
Nethertheless, I can install a profile with setting, e.g. my imap settings, via the profile management without problems.
Does anyone have an idea how to get around the problem with the self signed certificate?
Best regards

Try deleting the Server.app and download it again from the App Store, restart.
My Server is also using self signed certificates and is working with iOS device (Trust Profile needed first).

Does anyone know how to use a self signed certificate with apple mail??

Ive read about it in mail's help and tried to set it up according to it. Ive created a self-signed certificate but have no idea how to set it up as it would work with Mail so that i would be able to send signed messages. could anyone help me??

Hello rado:
Welcome to Apple discussions.
I am assuming this is what you read:
http://docs.info.apple.com/article.html?path=Mac/10.5/en/8916.html
If you follow the instructions when you set up the certificate, you should be fine.
Incidentally, most +"ordinary users"+ (like me) do not use this function. I am curious as to why you want to jump through hoops in your Mail application.
Barry

RV120W- How to create new unique self-signed certificate?

Hello,
how to create new unique self-signed certificate on RV120W? I can create request for singning by external CA, but I cannot create new unique self-signed certificate itself. Any idea? Did I miss something? Many thanks!
Abudef

So basically RV120W does not support self-signed certificate? It only allows to generate private key and certificate signin request. There is no chance to replace default generic ssl/vpn certifice within router itself? Could you please give me an advice, how to sign that request by some "CA"? I mean no commercial CA, I need something free running under Windows os. Many thanks!

How to use self-signed Certificate or No-Check-Certificate in Browser ?

Folks,
Hello. I am running Oracle Database 11gR1 with Operaing System Oracle Linux 5. But Enterprise Manager Console cannot display in Browser. I do it in this way:
[user@localhost bin]$ ./emctl start dbconsole
The command returns the output:
https://localhost.localdomain:1158/em/console/aboutApplication
Starting Oracle Enterprise Manager 11g Database Control ... ...
I open the link https://localhost.localdomain:1158/em/console/aboutApplication in browser, this message comes up:
The connection to localhost.localdomain: 1158 cannot be established.
[user@localhost bin]$ ./emctl status dbconsole
The command returns this message: not running.
[user@localhost bin]$ wget https://localhost.localdomain:1158/em
The command returns the output:
10:48:08 https://localhost.localdomain:1158/em
Resolving localhost.localdomain... 127.0.0.1
Connecting to localhost.localdomain|127.0.0.1|:1158... connected.
ERROR: cannot verify localhost.localdomain's certificate, issued by `/DC=com/C=US/ST=CA/L=EnterpriseManager on localhost.localdomain/O=EnterpriseManager on localhost.localdomain/OU=EnterpriseManager on localhost.localdomain/CN=localhost.localdomain/[email protected]':
Self-signed certificate encountered.
To connect to localhost.localdomain insecurely, use `--no-check-certificate'.
Unable to establish SSL connection.
A long time ago when I installed Database Server Oracle 11gR1 into my computer, https://localhost.localdomain:1158/em in Browser comes up this message:
Website certified by an Unknown Authority. Examine Certificate...
I select Accept this certificate permanently. Then https://localhost.localdomain:1158/em/console/logon/logon in Browser displays successfully.
But after shut down Operating System Oracle Linux 5 and reopen the OS, https://localhost.localdomain:1158/em/console/logon/logon in Browser returns a blank screen with nothing, and no more message comes up to accept Certificate.
My browser Mozilla Firefox, dbconsole, and Database Server 11gR1 are in the same physical machine.I have checked Mozilla Firefox in the following way:
Edit Menu > Preferences > Advanced > Security > View Certificates > Certificate Manager > Web Sites and Authorities
In web sites tab, there is only one Certificate Name: Enterprise Manager on localhost.localdomain
In Authorities tab, there are a few names as indicated in the above output of wget.
My question is: How to use self-signed certificate and no-check-certificate in Mozilla Firefox for EM console to display ?
Thanks.

Neither problem nor solution do involve Oracle DB
root cause of problem & fix is 100% external, detached, & isolated from Oracle DB.
This thread is OFF TOPIC for this forum.

How pass client credentials to ws client and accept self signed certificate

Similar Messages

Maybe you are looking for