How to install self-signed certificate with iOS 4?

I've been trying to install a self-signed certificate in iOS 4 with no avail. I have a webserver at home in which I connect to via SSL using a self-signed cert. It used to work in 3.1.3; it would kick out a dialog, but you were able to continue to the page. Now with iOS 4, that is no longer the case, I am unable to view the site.
I have tried several things. I have tried emailing the cert. to myself and installing it. I get it installed but says it's untrusted and am not able to view the site. I have tried converting my .pem that is on my server to .p12 and that didn't work. I tried going to the site in Safari on my Mac and adding the cert. to the keychain and then syncing; that didn't work. I tried taking that cert. in the keychain, making sure it was trusted, exporting it to .cer and adding that to a configuration profile I created in the iPhone Configuration Utility.. that did not work despite the fact that it showed it as trusted. Am I doing something wrong or missing something here?

Similar Messages

How to use Self Signed certificate with SSLServerSocket?

Hello to all.
I'm trying to build a simple client/server system wich uses SSLSocket to exchange data. (JavaSE 6)
The server must have it's own certificate, clients don't need one.
I started with this
http://java.sun.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore
To generate key for the server and a self signed certificate.
To sum it up:
     Create a new keystore and self-signed certificate with corresponding public/private keys.
keytool -genkeypair -alias mytest -keyalg RSA -validity 7 -keystore /scratch/stores/server.jks
     Export and examine the self-signed certificate.
keytool -export -alias mytest -keystore /scratch/stores/server.jks -rfc -file server.cer
     Import the certificate into a new truststore.
keytool -import -alias mytest -file server.cer -keystore /scratch/stores/client.jksThen in my server code I do
System.setProperty("javax.net.ssl.keyStore", "/scratch/stores/server.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "123456");
SSLServerSocketFactory sf = sslContext.getServerSocketFactory();
SSLServerSocket sslServerSocket = (SSLServerSocket)sf.createServerSocket( port );
Socket s = sslServerSocket.accept();I am basically missing some point because I get a "javax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled." when I try to run the server.
Can it be a problem with the certificate? When using -validity <days> in keytool the certificate gets self-signed, so it should work if I'm not wrong.
I have also tried this solution
serverKeyStore = KeyStore.getInstance( "JKS" );
serverKeyStore.load( new FileInputStream("/scratch/stores/server.jks" ),
     "123456".toCharArray() );
tmf = TrustManagerFactory.getInstance( "SunX509" );
tmf.init( serverKeyStore );
sslContext = SSLContext.getInstance( "TLS" );
sslContext.init( null, tmf.getTrustManagers(),secureRandom );
SSLServerSocketFactory sf = sslContext.getServerSocketFactory();
SSLServerSocket ss = (SSLServerSocket)sf.createServerSocket( port );and still it doesn't work.
So what am I missing?

You were right. I corrected the mistakes in the server code, now it's
     private SSLServerSocket setupSSLServerSocket(){
          try {
               SSLContext sslContext = SSLContext.getInstance( "TLS" );
               KeyManagerFactory km = KeyManagerFactory.getInstance("SunX509");
               KeyStore ks = KeyStore.getInstance("JKS");
               ks.load(new FileInputStream(_KEYSTORE), _KEYSTORE_PASSWORD.toCharArray());
               km.init(ks, _KEYSTORE_PASSWORD.toCharArray());
                * Da usare con un truststore se serve autenticazione dei client
                * TrustManagerFactory tm = TrustManagerFactory.getInstance("SunX509");
               tm.init(ks);*/
               sslContext.init(km.getKeyManagers(), null, null);
               SSLServerSocketFactory f = sslContext.getServerSocketFactory();
               SSLServerSocket ss = (SSLServerSocket) f.createServerSocket(_PORT);
               return ss;
          } catch (UnrecoverableKeyException e) {
               e.printStackTrace();
          } catch (KeyManagementException e) {
               e.printStackTrace();
          } catch (NoSuchAlgorithmException e) {
               e.printStackTrace();
          } catch (KeyStoreException e) {
               e.printStackTrace();
          } catch (CertificateException e) {
               e.printStackTrace();
          } catch (FileNotFoundException e) {
               e.printStackTrace();
          } catch (IOException e) {
               e.printStackTrace();
          return null;
     }and on the client code
private SSLSocket setupSSLClientSocket(){
     try {
          SSLContext sslContext = SSLContext.getInstance( "TLS" );
          /* SERVER
          KeyManagerFactory km = KeyManagerFactory.getInstance("SunX509");
          km.init(ks, _KEYSTORE_PASSWORD.toCharArray());
          KeyStore clientks = KeyStore.getInstance("JKS");
          clientks.load(new FileInputStream(_TRUSTSTORE), _TRUSTSTORE_PASS.toCharArray());
          TrustManagerFactory tm = TrustManagerFactory.getInstance("SunX509");
          tm.init(clientks);
          sslContext.init(null, tm.getTrustManagers(), null);
          SSLSocketFactory f = sslContext.getSocketFactory();
          SSLSocket sslSocket = (SSLSocket) f.createSocket("localhost", _PORT);
          return sslSocket;
     } catch (KeyManagementException e) {
          e.printStackTrace();
     } catch (NoSuchAlgorithmException e) {
          e.printStackTrace();
     } catch (KeyStoreException e) {
          e.printStackTrace();
     } catch (CertificateException e) {
          e.printStackTrace();
     } catch (FileNotFoundException e) {
          e.printStackTrace();
     } catch (IOException e) {
          e.printStackTrace();
     return null;
}and added a System.out.println(sslSocket); after every incoming message (server side) and SSL is now fully working!
So my mistakes were:
[] Incorrect setup done by code
[] Incorrect and insufficient println() of socket status
Now that everything works, I've deleted all this manual setup and just use the system properties. (They MUST be set before getting the Factory)
SERVER SIDE:
System.setProperty("javax.net.ssl.keyStore", _KEYSTORE);
System.setProperty("javax.net.ssl.keyStorePassword", KEYSTOREPASSWORD);
SSLServerSocketFactory f = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket sslServerSocket = (SSLServerSocket) f.createServerSocket(_PORT);
CLIENT SIDE:
System.setProperty("javax.net.ssl.trustStore", "/scratch/stores/client.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "client");
SSLSocketFactory f = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket sslSocket = (SSLSocket) f.createSocket(_HOST, _PORT);
And everything is working as expected. Thank you!
I hope my code will help someone else in the future.

How to use self-signed Certificate or No-Check-Certificate in Browser ?

Folks,
Hello. I am running Oracle Database 11gR1 with Operaing System Oracle Linux 5. But Enterprise Manager Console cannot display in Browser. I do it in this way:
[user@localhost bin]$ ./emctl start dbconsole
The command returns the output:
https://localhost.localdomain:1158/em/console/aboutApplication
Starting Oracle Enterprise Manager 11g Database Control ... ...
I open the link https://localhost.localdomain:1158/em/console/aboutApplication in browser, this message comes up:
The connection to localhost.localdomain: 1158 cannot be established.
[user@localhost bin]$ ./emctl status dbconsole
The command returns this message: not running.
[user@localhost bin]$ wget https://localhost.localdomain:1158/em
The command returns the output:
10:48:08 https://localhost.localdomain:1158/em
Resolving localhost.localdomain... 127.0.0.1
Connecting to localhost.localdomain|127.0.0.1|:1158... connected.
ERROR: cannot verify localhost.localdomain's certificate, issued by `/DC=com/C=US/ST=CA/L=EnterpriseManager on localhost.localdomain/O=EnterpriseManager on localhost.localdomain/OU=EnterpriseManager on localhost.localdomain/CN=localhost.localdomain/[email protected]':
Self-signed certificate encountered.
To connect to localhost.localdomain insecurely, use `--no-check-certificate'.
Unable to establish SSL connection.
A long time ago when I installed Database Server Oracle 11gR1 into my computer, https://localhost.localdomain:1158/em in Browser comes up this message:
Website certified by an Unknown Authority. Examine Certificate...
I select Accept this certificate permanently. Then https://localhost.localdomain:1158/em/console/logon/logon in Browser displays successfully.
But after shut down Operating System Oracle Linux 5 and reopen the OS, https://localhost.localdomain:1158/em/console/logon/logon in Browser returns a blank screen with nothing, and no more message comes up to accept Certificate.
My browser Mozilla Firefox, dbconsole, and Database Server 11gR1 are in the same physical machine.I have checked Mozilla Firefox in the following way:
Edit Menu > Preferences > Advanced > Security > View Certificates > Certificate Manager > Web Sites and Authorities
In web sites tab, there is only one Certificate Name: Enterprise Manager on localhost.localdomain
In Authorities tab, there are a few names as indicated in the above output of wget.
My question is: How to use self-signed certificate and no-check-certificate in Mozilla Firefox for EM console to display ?
Thanks.

Neither problem nor solution do involve Oracle DB
root cause of problem & fix is 100% external, detached, & isolated from Oracle DB.
This thread is OFF TOPIC for this forum.

How to monitor self signed certificates using scom 2007 R2

How to monitor self signed certificates using scom 2007 R2. i need to monitor specifically self signed certificates expiration. if possible in two state monitor...please suggest me the best way..
B John

Hi,
Based on my understanding, that you want to create a monitor to monitor certificate expiration, with two state, when the certificate is about expiration for 21 days,, send warning, when the certificate is about expiration for 10 days, then send
alert. I think we need to create scripts to do so, hope the below links can be helpful:
Monitoring Certificates In SCOM
http://blogs.technet.com/b/omx/archive/2013/01/30/monitoring-certificates-in-scom.aspx
Monitoring Expiring Certificates using SCOM
http://blogs.technet.com/b/sgopi/archive/2012/05/18/monitoring-expiring-certificates-using-scom.aspx
Regards,
Yan Li
Regards, Yan Li

How to replace self-signed certificate for enterprise manager console

Does anyone know how to change self-signed certificate for https access to Enterprise Manager console, which is issued during installation of Oracle 11g?

Well, this might not be much help, but for 10g, on AIX, docID 1171558.1 describes how to create a new certificate.
Not sure how relevant it will be for 11g, sorry :(

How to register iOS device when using self signed certificate with apple Server?

Hi,
I have installed the server.app by Apple and used a slef signed certificate for my server. Now I want to register my different devices (iMac, iPhone etc.). I could register the iMac without problesm (I just had to add my self signed certificate to the trusted certificates)
Sadly, with the iPhone it is not that easy. I can install the "trust profile", but still after that I can not register my device. It seems like it does not accept my self signed certificate for device registration. When adding a registration profile, I get the error "www._mydomain_.tld/devicemanagement/api/device/auto_join_ota_service" is not valid.
Nethertheless, I can install a profile with setting, e.g. my imap settings, via the profile management without problems.
Does anyone have an idea how to get around the problem with the self signed certificate?
Best regards

Try deleting the Server.app and download it again from the App Store, restart.
My Server is also using self signed certificates and is working with iOS device (Trust Profile needed first).

Does anyone know how to use a self signed certificate with apple mail??

Ive read about it in mail's help and tried to set it up according to it. Ive created a self-signed certificate but have no idea how to set it up as it would work with Mail so that i would be able to send signed messages. could anyone help me??

Hello rado:
Welcome to Apple discussions.
I am assuming this is what you read:
http://docs.info.apple.com/article.html?path=Mac/10.5/en/8916.html
If you follow the instructions when you set up the certificate, you should be fine.
Incidentally, most +"ordinary users"+ (like me) do not use this function. I am curious as to why you want to jump through hoops in your Mail application.
Barry

Step by Step Instructions for Installing Self Signed Certificate using Certificate Modification Tool

I am looking for some step by step instructions for installing the self signed certificate from my Microsoft SBS 2003 server on a Treo 755p and 750p. In particular I need some help with the form of the actual certificate and how to use the Certificate Modification tool.
Some questions I have are as follows:
1. When I install the certificate on a Windows Mobile device I used an exported version of the certificate. This export is done using the DER x.509 format. Is that the same form I’ll need for the Palm? Do I need some other form? Can/should I just use sbscert.cer file that is generated when SBS is configured?
2. Does the self signed cert need to be installed on the computer being used to update the Palm or do we just need to be able to access the appropriate .CER file?
3. There are three things included in the PalmCertificatesTool.zip file:
                                Trusted CAs (folder)
                                Cert2pdb.exe
                                PalmCertificates.exe
   How do I use these tools?
4. It looks like the PalmCertificates.exe file opens an interface that will allow me to browse to the desired .CER file. Then I suppose I use the < Generate PDB > to create something that needs to then be uploaded to the Palm device? Not having any real experience with a Palm device how do I upload and install this file?
5. Once uploaded do I do something on the device to install it?
If there is some white paper that provides step by step instructions on doing this that would be great.
Thanks,
Walt Bell
Post relates to: Treo 755p (Verizon)
Post relates to: Treo 755p (Verizon)

Thanks for that.
I have one question after reading the article 43375:
The article has you "Turn of AutoSync" and then "Reset the device". It then indicates the device should be left idle.
The next step relates to running the PalmCertificates.exe, navigate to the certificate file and add it and then run the < Generate PDB > button. Should the device be connected to the computer during this process? If so, at what point after the reset do you connect it to the computer?
Thanks!
Post relates to: Treo 755p (Verizon)

Steps to create your own self signed certificate with java plugin working

You need two tools that comes with your jdk which are keytool and jarsigner.
Steps explain below in detail. Don't use netscape signtool, it will NEVER work!
* keytool -genkey -keyalg rsa -alias tstkey -keypass 2br2h2m -dname "cn=Test Object Signing Certificate, o=AI Khalil, ou=Java Products, c=AU"
cn = Certificate name
o = organistation
ou = organistation unit
c = country (first two letters)
If don't put the -dname, you can fill it line by line.
The -keypass has to be verify at the end, and you have to wait for it to create the rsa signing keys.
On NT by default it will put the alias information at D:\WINNT\Profiles\Administrator (if log in as administrator) with the default file called ".keystore". Windows 98 etc, don't know, search for .keystore
file. When you update it, check for the timestamp change and you know if you at the right spot.
You can store your alias information via the -storepass option to your current directory you work on, if you don't want to update the default .keystore file?
The .keystore contains a list of alias so you don't have to do this process again and again.
Another tip if you want your certificate encryption validity to be more than the default one month is simply
add the -validity <valDays>, after the -genkey option, to make your certificate usage for encryption to last much longer.
Note: You MUST use the -keyalg rsa because for starters the rsa encyption alogorthim is supported on ALL browsers instead of the default DSA and the other one SHA. Java plugins must work with the RSA algorthim when signing applets, else you will get all sorts of weird errors :)
Do not use signtool because thats a browser dependant solution!! Java plugin is supposed to work via running it owns jre instead of the browser JVM. So if you going to use netscape signtool, it starts to become a mess! ie certificate will install, but applet won't start and give you funny security exception errors :)
* keytool -export -alias tstkey -file MyTestCert.crt
It will read the alias information in the .keystore information picking up the rsa private/public keys info and
create your self sign certificate. You can double click this certificate to install it? But don't think this step is needed but maybe for IE? Someone else can check that part.
If you make a mistake with the alias, simply keytool -delete -v -alias <your alias key>
If not in default .keystore file, then simply keytool -delete -v -alias <your alias key> -keystore <your keystore filename>
* Put your classes in your jar file, my example is tst.jar.
* jarsigner tst.jar tstkey
Sign your testing jar file with your alias key that supports the RSA encryption alogorthim.
* jarsigner -verify -verbose -certs tst.jar
Check that its been verified.
The last step is the most tricky one. Its to do with having your own CA (Certified Authority) so you don't
have to fork out money straight away to buy a Verisign or Twarte certificate. The CA listing as you see in
netscape browsers under security/signers, is NOT where the plugin looks at. The plugin looks at a file called
CACERTS. Another confusion is that the cacerts file is stored in your jre/lib/security AND also at your
JavaSoft/Jre/<Java version>/lib/security. When you install the Java plugin for the first time in uses your
JavaSoft folder and its the cacerts file that has to be updated you add your own CA, because thats where
the plugin look at, NOT THE BROWSER. Everything about plugin is never to do with the browser!! :)
* keytool -import -file MyTestCert.crt -alias tstkey -keystore "D:\Program Files\JavaSoft\JRE\1.3.1\lib\security/cacerts"
Off course point to your own cacerts file destination.
Password to change it, is "changeit"
Before you do this step make a copy of it in its own directory in case you do something silly.
This example will add a CA with alias of my key called "tstkey" and store to my example destination.
* keytool -list -v -keystore "E:/jdk/jdk1.3/jre/lib/security/cacerts"
List to see if another CA is added with your alias key.
Your html, using Netscape embed and Internet explorer object tags to point to the java plugin,
your own self sign applet certificate should work
Cheers
Abraham Khalil

I follow Signed Applet in Plugin, and it's working on
my computer. Thanks
But When I open my applet from another computer on
network, why it does not work ..?
How to make this applet working at another computer
without change the policy file ..?
thanks in advance,
AnomYou must install the certificate on that computers plugin. Can this be done from the web? can anyone suggest a batch file or otherwise that could do this for end users?
I want a way for end users to accept my cert as Root or at least trust my cert so I dont have to buy one. I am not worried about my users refusing to accept my cert. just how do I make it easy for them? IE you can just click the cert from a link, but that installs for IE, and not the plugin where it needs to be.

Installing self signed certificate

I'm trying to install a self signed certificate in iPhone OS 3.1.3 so that I can securely access a web service at home via mobile Safari and an application that uses the same web service. I've tried emailing myself the certificate and installing it but Safari still prompts with it's "Accept Website Certificate" warning. The certificate is clearly installed under Settings->General->Profiles.
I've also tried installing the certificate via iPhone Configuration Utility with the same result. I also followed these steps on my iPad and everything worked flawlessly which points to an OS issue. I was wondering if anyone else has seen this behavior?
Thanks!

I have a self-signed cert on my 5.2 DS. I used a version of certutil that ships with DS52. The cert DB files have the following name format under the alias directory, slapd-instancename-cert7.db. For auto startup you;ll need to create a slapd-instancename-pin.txt file that contains the string "Internal (Software) Token: yourDBpassword"
If you have more questions, ask away.
HTH,
Roger S.

How to deploy self signed certificate using GPO

Hello,
I am applying a self-signed certificate for HTTPS inspection, as you know Firefox is not using Windows root certificate as IE & chrome did, so I did some research about this issue and check admx & FF GPO, nothing helped me !!
Do anyone have any new idea on how to solve this issue?

Well, this might not be much help, but for 10g, on AIX, docID 1171558.1 describes how to create a new certificate.
Not sure how relevant it will be for 11g, sorry :(

How to use self-signed certificate to verify others certificate?

the self-signed certificate and keys acts as CA like VeriSign
alias =SelfSignCA
keystore = SelfSignLib
certificate = SelfSign.cer
certificate to be verify
alias = companyCA
certificate = companyLib
csr file = company.csr
how to use keytool to verify/sign the company certificate?thank you.

Well, this might not be much help, but for 10g, on AIX, docID 1171558.1 describes how to create a new certificate.
Not sure how relevant it will be for 11g, sorry :(

How to install self-signed ROOT CA certs in safari 4 for windows?

Hello, I do some web development and I use Safari for windows to test all my works for mac users, since v4 I haven't been able to test my apps because safari ask me for a certificate to use for connecting to the test environment (uses self signed cert chain) while other browsers (opera, firefox, IE) just alert me of an untrusted CA certificate. How do I install the CA certificate or whatever I need to do to test my apps on safari 4 windows? thanks for your support

For what it's worth, you can install a self signed cert only for pages that you go directly to. So if the self signed page is one that is included in page from another server (like images being served from a separate content server) you can install the cert but it still won't serve that content until.....you go directly to that self signed page. Also, this solution only works for the currently running browser and as soon as you shut down the browser the cert is apparently lost. Annoying as heck especially if you happen to be a shop setup that way and you are testing your site on Safari for Windows. arrrgggg! Dear Apple, please fix so we can test that our sites work with your browser.....help us help you!

Is it possible to install a self-signed certificate to a phone?

I made a self-signed certificate with KeyTool and I use the corresponding private key sign a MIDLet with jarsign tool.
Now I don't know how to install the certificate to my phone. I also want to is it possible to do this?
thanks.

Hi,
Check out this
http://www.spindriftpages.net/pebble/dave/2006/06/18/1150641917692.html
thanks,
anup

Two way ssl with self signed certificate?

How can I use a self signed certificate with two-way SSL with weblogic 7sp4?
Specfically, I don't want to use any CA authority.
Is it possible to simply have the clients certificate in the servers truststore or not?
I pull out the certificate via
javax.servlet.request.X509Certificate
but when I use a self signed certificate it's never there.
If I instead use a certificate that was created with CertGen it works. But CertGen uses the GenCertCA to create the certificate chain.

How can I use a self signed certificate with two-way SSL with weblogic 7sp4?
Specfically, I don't want to use any CA authority.
Is it possible to simply have the clients certificate in the servers truststore or not?
I pull out the certificate via
javax.servlet.request.X509Certificate
but when I use a self signed certificate it's never there.
If I instead use a certificate that was created with CertGen it works. But CertGen uses the GenCertCA to create the certificate chain.

How to install self-signed certificate with iOS 4?

Similar Messages

Maybe you are looking for