KeyStore.deleteEntry deletes CA certs that are used in other entries
I think there is a problem with KeyStore deleteEntry wher it deletes more certs than it should do. I have a keystore (in this case a PKCS11 although I expect it will apply to file based keystores as well) with 2 entries:
IFMPROD_SIGN_008
IFMPROD_SIGN_007
all key entries are under the same CA hierarchy (issuing and root CA). I can use keytool to list with verbose and in each case see a nice 2 cert chain for each entry. I then use the deleteAlias to remove IFMPROD_SIGN_007 (either within a Java app or by running keytool -delete -alias). Then when I list my keystore again, IFMPROD_SIGN_008 is still there but the cert chain is missing i.e. each cert is shown on its own without the issuing and root CA certs. Using low leve tools I can see tha tthese CA certs have been removed.
Now this causes issues when trying to use these entries with e.g. SunJSSE client auth because the server hello mesage specifies the trusted root but the client hasn't got the full chain in the HSM anymore and bombs the ssl neg.
So I thought well I guesss I just need to import each ca cert on its own - except you cant do that with PKCS11 because root CA certs cannot be imported on their own into the HSM using keytool (although you can import them as a cert chain but thats a different story......
Here I have recreated it using keytool alone.
keytool -keystore NONE -storepass 123456 -storetype PKCS11 -list -v
Keystore type: PKCS11
Keystore provider: SunPKCS11-BTHSM
Your keystore contains 2 entries
Alias name: IFMPROD_SIGN_007
Entry type: keyEntry
Certificate chain length: 3
Certificate[1]:
Owner: CN=CUS-GW-2002.intra.ifm.bt.com, OU=MSM, O=SMITHSBANK
Issuer: CN=TESTISSCA, OU=MSM, O=BT
Serial number: 1bc9d9a30000000002e6
Valid from: Fri Apr 30 08:37:17 GMT 2010 until: Sat Apr 30 08:37:17 GMT 2011
Certificate fingerprints:
MD5: 7A:77:2F:64:BB:CA:31:E7:55:5B:4E:8D:04:93:6B:21
SHA1: B5:0D:F5:A7:6F:11:31:12:00:CA:A1:B8:F5:DC:7B:6B:13:CD:68:36
Certificate[2]:
Owner: CN=TESTISSCA, OU=MSM, O=BT......
Issuer: CN=DEVROOTCA, OU=IFM, O=BT Syntegra, L=Fleet, ST=Hants, C=GB, EMAILADDRE
[email protected]
Serial number: 51e90a42000100000012
Valid from: Mon Nov 17 13:48:12 GMT 2008 until: Sun Mar 17 12:18:55 GMT 2024
Certificate fingerprints:
MD5: 66:E1:25:FA:CC:02:74:95:E9:A7:E6:A7:E9:32:DF:F1
SHA1: 07:47:3B:06:FB:11:E9:F5:94:99:1E:6E:7F:67:81:E1:63:A3:46:21
Certificate[3]:
Owner: CN=DEVROOTCA, OU=IFM, O=BT Syntegra, L=Fleet, ST=Hants, C=GB, EMAILADDRES
[email protected]
Issuer: CN=DEVROOTCA, OU=IFM, O=BT Syntegra, L=Fleet, ST=Hants, C=GB, EMAILADDRE
[email protected]
Serial number: 5c3ad550252cd1804d9b9d256ed9cbbd
Valid from: Wed Mar 17 12:03:38 GMT 2004 until: Sun Mar 17 12:18:55 GMT 2024
Certificate fingerprints:
MD5: 19:98:5A:49:6F:E6:94:73:B1:06:3F:07:E0:08:F0:D9
SHA1: 28:14:A1:F7:8B:89:2D:1A:A1:AB:AE:C7:17:01:BF:60:06:32:D6:1F
Alias name: IFMPROD_SIGN_008
Entry type: keyEntry
Certificate chain length: 3
Certificate[1]:
Owner: CN=CUS-GW-2002.intra.ifm.bt.com, OU=MSM, O=SMITHSBANK
Issuer: CN=TESTISSCA, OU=MSM, O=BT
Serial number: 1be98fcd0000000002e8
Valid from: Fri Apr 30 09:11:55 GMT 2010 until: Sat Apr 30 09:11:55 GMT 2011
Certificate fingerprints:
MD5: 30:7B:7A:8A:4F:A0:5E:42:87:C6:ED:B3:A9:08:6A:74
SHA1: 82:C9:DB:66:DF:12:DB:5A:ED:46:B9:79:3B:20:68:83:97:8A:57:EC
Certificate[2]:
Owner: CN=TESTISSCA, OU=MSM, O=BT
Issuer: CN=DEVROOTCA, OU=IFM, O=BT Syntegra, L=Fleet, ST=Hants, C=GB, EMAILADDRE
[email protected]
Serial number: 51e90a42000100000012
Valid from: Mon Nov 17 13:48:12 GMT 2008 until: Sun Mar 17 12:18:55 GMT 2024
Certificate fingerprints:
MD5: 66:E1:25:FA:CC:02:74:95:E9:A7:E6:A7:E9:32:DF:F1
SHA1: 07:47:3B:06:FB:11:E9:F5:94:99:1E:6E:7F:67:81:E1:63:A3:46:21
Certificate[3]:
Owner: CN=DEVROOTCA, OU=IFM, O=BT Syntegra, L=Fleet, ST=Hants, C=GB, EMAILADDRES
[email protected]
Issuer: CN=DEVROOTCA, OU=IFM, O=BT Syntegra, L=Fleet, ST=Hants, C=GB, EMAILADDRE
[email protected]
Serial number: 5c3ad550252cd1804d9b9d256ed9cbbd
Valid from: Wed Mar 17 12:03:38 GMT 2004 until: Sun Mar 17 12:18:55 GMT 2024
Certificate fingerprints:
MD5: 19:98:5A:49:6F:E6:94:73:B1:06:3F:07:E0:08:F0:D9
SHA1: 28:14:A1:F7:8B:89:2D:1A:A1:AB:AE:C7:17:01:BF:60:06:32:D6:1F
keytool -debug -keystore NONE -storepass 123456 -storetype PKCS11 -delete -alias IFMPROD_SIGN_007
keytool -keystore NONE -storepass 123456 -storetype PKCS11 -list -v
Keystore type: PKCS11
Keystore provider: SunPKCS11-BTHSM
Your keystore contains 1 entry
Alias name: IFMPROD_SIGN_008
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=CUS-GW-2002.intra.ifm.bt.com, OU=MSM, O=SMITHSBANK
Issuer: CN=TESTISSCA, OU=MSM, O=BT
Serial number: 1be98fcd0000000002e8
Valid from: Fri Apr 30 09:11:55 GMT 2010 until: Sat Apr 30 09:11:55 GMT 2011
Certificate fingerprints:
MD5: 30:7B:7A:8A:4F:A0:5E:42:87:C6:ED:B3:A9:08:6A:74
SHA1: 82:C9:DB:66:DF:12:DB:5A:ED:46:B9:79:3B:20:68:83:97:8A:57:EC
JRE is 1.5.0_22 but 1.6.0_13 also does the same thing.
I think that it should check the usage of each cert in the chain and if it is used elsewhere then leave it in place. What my app does is annually generate new RSA keys and gt them recertified and while thats happeneing the system can continue to use the old key+cert until the new one has been issued by the CA and can be loaded. I then import the new entry (as a cert chain) then if that looks good I then remove the old entry. The problem is that by removing the old entry it blows the cet chain away for the new netry and you end up with bustd keystore that hasn't got the cert chain in there.
Hi,
Firstly, I’d like to explain, the issuer name is the local CA name not must be your Exchange server name. only one certificate can deploy to the IIS services in one environment. In Exchange 2013, there is an empty certificate which deploy none:
http://exchangeserverpro.com/exchange-server-2013-ssl-certificates/
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make
sure that you completely understand the risk before retrieving any suggestions from the above link.
For ease of administration, as well as for lower costs, it is recommended to provision as few certificates as possible. As long as all needed names are added in the certificate, we can install one certificate in one organization.
And here is the minimized namespace which we need to add in our certificate:
Autodiscover.domain.com
The host name in all URLs of IIS services and Outlook Anywhere
Legacy.domain.com
If you have any question, please feel free to let me know.
Thanks,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Angela Shi
TechNet Community Support
Similar Messages
-
I am not able to Sync. My iPOD classic 80Gb. It tells that as iTunes can not read the contents-restore to factory settings- after restoring – it tells that it can not be restored bcause there are files that are used by other application. My iPOD appears in My Computer in drive H as a mass storage generick volume
Try disabilng the Enable Disk Use option from under the iPod's Summary tab, applying the changes, and seeing if that helps.
Otherwise, temporarily disabling any antivirus, security, firewall, or file indexing software that may be running on your system and then try restoring your iPod again.
B-rock -
I am having iPOD classic 80GB . I Have the 10.5Latest Version of iTunes installed. When I go for Sync.It tells me to restore to factory settings as it is unable to read the contents. On restoring it tells : unable to restore as this has files that are in use by another application. I have no idea what to do now. Pl advise. Thanks
Try disabling any and all A/V or security software you are running on your system and see if that helps.
B-rock -
My macbook pro keeps saying I have 450 gigabytes out of 500 that are used. But when I look on finder there are no files that are anywhere close to that amount. I went through and deleted files from my mac and now I only have 10 gigabytes of additional space free. My mac now says I have 440 gigs of other that is used. But does not make sense, do I have a virus?
Since you have not identified the OS your MBP is using, these extract may or may not assist you.
http://pondini.org/OSX/LionStorage.html
http://pondini.org/OSX/DiskSpace.html
You may also download from the Internet OmniDiskSweeper (free) and open it it will show all of the files on your MBP and the respective sizes.
ciao. -
How do I copy photos from my Mac to my iPad without deleting the ones that are there?
I understand how to sync photos from my iPhoto library to my iPad. I want to copy photos from my Mac to the iPad without syncing, because syncing deletes everything on the iPad that isn't included in my sync selections. In addition,I have several iPhoto libraries and want to copy photos from each of them to the iPad. A further issue is that apparently photos can be synced from only one computer to the iPad -- how would I copy photos from a different computer? (What happens when I buy a new Mac?) I am extremely experienced with Mac, iPhoto/Aperture, iPad, etc. A year or two ago I transferred 1000 photos to the iPad but I don't remember how, and it was probably done with my previous Mac. Now I just want to add some recent photos without deleting the ones that are there. Bottom line: is there a way to add photos to an iPad without syncing and losing what's there?
You can still sync the photos and keep the photos that are already on the device. You have to include all of the albums or events in the pictures folder that you sync from. If you are using iPhoto, select that in the Sync Photos from drop down menu and then select all of the albums or events that you want to sync. Make sure to check Selected Albums, events, faces and automatically include (no events). Using that option will allow you to choose exactly which albums and events to sync.
You have to remember that all photos must be included in every sync so you cannot sync photos from iPhoto today and then try to sync photos from another folder tomorrow, or you will erase all of the photos that were synced from iPhoto. You need to maintain one main Photos syncing folder for the photos that you want to transfer to the iPad. You can have subfolders within that one main folder and you can selectively sync those subfolders. You just have to place all of the photos that you want to sync into one main iPad syncing photos folder.
There are WiFi transfer apps that allow you to transfer photos to the iPad without having to sync with iTunes. I use this one. This app (and others like it) will allow you to use multiple computers to transfer photos.
Wireless Transfer App Easily send photos to iPhone/iPad ... -
What are main events in that are used in ALV reports
hi gurus
what are main events in that are used in ALV reports....
regards
baskarhi
i think this will help u.
Events in alv and their FM The main events in alv and their FM and why we use these:
1. SLIS_PRINT_ALV.
2. SLIS_T_LISTHEADER.
3. SLIS_T_EVENT.
4. SLIS_T_SORTINFO_ALV.
5. SLIS_T_LAYOUT_ALV.
6. SLIS_T_FIELDCAT_ALV.
and in classic reports what is the sequence of events: === Events are
At selection-screen output.
Initialization.
At selection-screen on field
At selection-screen on end of field
At selection-screen on Radiobutton Group R1. (If you have any radio buttons)
At selection-screen on block b1. (If you have any blocks)
Start-of-selection.
Get node. (if the data is retreived from a logical database)
Get node late. (if the data is retreived from a logical database)
Top-of-page. (if the write statement is in the end-of-selection event or we can say that before the first write statement)
end-of-selection.
and fuction modules are
LISTHEADER - Is used to print the header information in the ALV List. Name, Date, Time, ALV Name and other details are called as Header information. EVENT - Basically this is the FM to handle Event's. When the user needs to do some event operation like when double clicking the a particular field we need to perform some operation. These events are captured by this FM. LAYOUT - This FM is used to define the layout of the List. There are many options available in this FM to define the Layout style. FIELDCAT - These are used to populate the List header. We can change them according to our req.
User-defined Text Output Event
Application
print_end_of_list
Define output text to be printed at the end of the entire list
print_top_of_list
Define output text to be printed at the beginning of the entire list
print_end_of_page
Define output text to be printed at the end of each page
print_top_of_page
Define output text to be printed at the beginning of each page
subtotal_text
Define self-defined subtotals texts
Mouse-controlled Actions in the Grid Control Event
Application
button_click
Query a click on a pushbutton in the ALV Grid Control
double_click
Query a double-click on a cell of the ALV Grid control
hotspot_click
Query a hotspot click on columns defined for this purpose in advance
onDrag
Collect information when elements of the ALV Grid Control are dragged
onDrop
Process information when elements of the ALV Grid Control are dropped
onDropComplete
Perform final actions after successful Drag&Drop
onDropGetFlavor
Distinguish between options for Drag&Drop behavior
Processing of Self-defined and Standard Functions Event
Application
before_user_command
Query self-defined and standard function codes
user_command
Query self-defined function codes
after_user_command
Query self-defined and standard function codes
Definition of Self-defined Functions Event
Application
toolbar
Change, delete or add GUI elements in the toolbar
menu_button
Define menus for menu buttons in the toolbar
context_menu_request
Change context menu
onf1
Define self-defined F1 help
All of these can be found under type group SLIS.
Events
SLIS_EV_ITEM_DATA_EXPAND TYPE SLIS_FORMNAME VALUE 'ITEM_DATA_EXPAND',
SLIS_EV_REPREP_SEL_MODIFY TYPE SLIS_FORMNAME VALUE 'REPREP_SEL_MODIFY', SLIS_EV_CALLER_EXIT_AT_START TYPE SLIS_FORMNAME VALUE 'CALLER_EXIT',
SLIS_EV_USER_COMMAND TYPE SLIS_FORMNAME VALUE 'USER_COMMAND',
SLIS_EV_TOP_OF_PAGE TYPE SLIS_FORMNAME VALUE 'TOP_OF_PAGE',
SLIS_EV_DATA_CHANGED TYPE SLIS_FORMNAME VALUE 'DATA_CHANGED',
SLIS_EV_TOP_OF_COVERPAGE TYPE SLIS_FORMNAME VALUE 'TOP_OF_COVERPAGE',
SLIS_EV_END_OF_COVERPAGE TYPE SLIS_FORMNAME VALUE 'END_OF_COVERPAGE',
SLIS_EV_FOREIGN_TOP_OF_PAGE TYPE SLIS_FORMNAME
VALUE 'FOREIGN_TOP_OF_PAGE', SLIS_EV_FOREIGN_END_OF_PAGE TYPE SLIS_FORMNAME
VALUE 'FOREIGN_END_OF_PAGE',
SLIS_EV_PF_STATUS_SET TYPE SLIS_FORMNAME VALUE 'PF_STATUS_SET',
SLIS_EV_LIST_MODIFY TYPE SLIS_FORMNAME VALUE 'LIST_MODIFY',
SLIS_EV_TOP_OF_LIST TYPE SLIS_FORMNAME VALUE 'TOP_OF_LIST',
SLIS_EV_END_OF_PAGE TYPE SLIS_FORMNAME VALUE 'END_OF_PAGE',
SLIS_EV_END_OF_LIST TYPE SLIS_FORMNAME VALUE 'END_OF_LIST',
SLIS_EV_AFTER_LINE_OUTPUT TYPE SLIS_FORMNAME VALUE 'AFTER_LINE_OUTPUT', SLIS_EV_BEFORE_LINE_OUTPUT TYPE SLIS_FORMNAME VALUE 'BEFORE_LINE_OUTPUT',
SLIS_EV_SUBTOTAL_TEXT TYPE SLIS_FORMNAME VALUE 'SUBTOTAL_TEXT'.
with regards
sravani
award points if found useful. -
How do I delete multiple photos that are stored on my IPAD imported folder? I have a first generation IPad
The links below have instructions for deleting photos.
iOS and iPod: Syncing photos using iTunes
http://support.apple.com/kb/HT4236
iPad Tip: How to Delete Photos from Your iPad in the Photos App
http://ipadacademy.com/2011/08/ipad-tip-how-to-delete-photos-from-your-ipad-in-t he-photos-app
Another Way to Quickly Delete Photos from Your iPad (Mac Only)
http://ipadacademy.com/2011/09/another-way-to-quickly-delete-photos-from-your-ip ad-mac-only
How to Delete Photos from iPad
http://www.wondershare.com/apple-idevice/how-to-delete-photos-from-ipad.html
How to: Batch Delete Photos on the iPad
http://www.lifeisaprayer.com/blog/2010/how-batch-delete-photos-ipad
(With iOS 5.1, use 2 fingers)
How to Delete Photos from iCloud’s Photo Stream
http://www.cultofmac.com/124235/how-to-delete-photos-from-iclouds-photo-stream/
Cheers, Tom -
When trying to install Reader 9.2 updates it wants me to close applications that are using reader. There is nothing listed and no applications are running. Any ideas?
Make sure your browser is closed and check to see if there are any processes related to Acrobat still running. If you are using Windows, Control-Alt-Delete > Processes tab. Look for AcroRd32.exe or Acrobat.exe or Acrotray.exe and stop these processes from running before you try your update again. A good ol' computer reboot might do the trick for you too.
-
How to find out FICO user exits that are used by User
How to find out the FICO user exits that are used by user.
Go to tcode CMOD. In the project field drop down your list there. Put a Z* there and run the list. These should be all the exits that are activated. Search for the ones that pertain to FI. You can also search by development class. You need a little ABAP knowledge to search easily. You get this by going to the tcode then to status then to the program then to the attributes. There you find the development class. Ie FBAS.
pls assign points if helpful as a way to say thanks. -
How do I delete an app on iTunes? I can delete the apps that are shown in the library of iTunes by right clicking and hitting "delete". But all of my apps aren't shown in the library (I don't understand that either). I can see all downloaded apps in my account though. But I don't see how to delete them from there.
If you plug in your iphone, click on it in iTunes, and go to the apps section, it should be checked to sync apps if you want them to show up in iTunes as well as your iPhone. Once synced they will show on both.
Then if you click Apps under the Library header in the left panel of iTunes, you'll be able to permanently delete apps, removing them entirely from iTunes. Highlight an app's icon or a group of icons by holding down Shift and hit the delete key (or select Edit > Delete from the top menu or right-click on an icon and selecting delete). -
HT204380 Can you FaceTime between 2 iPads that are using the same apple ID but separate emails?
Can you FaceTime between 2 iPads that are using the same apple ID but separate emails?
Yes......I do so all the time.
-
How can I sync my iPod with my computer without deleting the songs that are on my ipod
how can I sync my iPod with my computer without deleting the songs that are on my ipod
See this post by forum regular Zevoneer on transferring files from the iPod to your computer.
tt2 -
How to identify reports that are using a specific universe object?
Any idea how to use BO Auditor or Metadata Manager to identify webi reports that are using a specific universe object or universe prompt in the report SQL?
Hi Samuel,
In case you are using BOXIR2 you can do this by editing the crystalenterprise.webi.xml file.
Replace the CrystalEnterprise.Webi.xml file (Take a backup) with the edited one.
Path where you can find this file- Tomcat/webapps/businessobjects/enterprise115/desktoplaunch/WEB-INF/classes/META-INF/CrystalEnterprise.Webapps/ePortfolio/plugins
Paste the Custom Documentation folder in Tomcat\webapps\businessobjects\enterprise115\desktoplaunch\
May I know your email Id so that I can send you the edited crystalenterprise.webi.xml file.
Regards,
Sarbhjeet Kaur -
How do I get files from multiple DVDs that are using thesame file names?
How do I get files from multiple DVDs that are using thesame file names? Message says "file already exists in catalog"
Message was edited by: marcr56marcr56
I am viewing your question from different perspective, that is, the issue that you face when you are ripping VOBs from a second DVD-VIDEO on DVD disc using Premiere Elements,
It is best to give the Premiere Elements version and computer operating system that it is running on. In the absence of that, I will generalize.
Assuming that you are using
Premiere Elements 12
Add Media
"DVD Camera or Computer Drive"
Video Importer
Typically the Video Importer Save In: is C:\Users\Owner\Videos
Each of your DVD discs is going to have the same names for the ripped VOBs (VTS_01_1.VOB and so on depending on the duration of the movie). Consequently, after the ripping of the first DVD's VOBs and their save to Videos, you will end up with that "files already existing..." block for the ripping of the VOBs from the second DVD.
The answer is, for each DVD disc VOB ripping, to plan ahead and create and set for different folders in Videos in the Save In field of the Video Importer.
Please review and then let us know if that works for you. Please do not hesitate to ask if you need clarification on anything that I have written.
Thank you.
ATR. -
Editing a movie that was already cut together without transcoding .h264 footage to proresslt. I want to transcode full clips that are used in the edit, but not any of the leftovers. Is there an efficient way to this?
I'm thinking I can convert the files with Compressor and place them in a new folder with their original file names (not sure how to get compressor to do this yet) and then do a major "Reconnect Clip" afterwards.
Not sure if there's a more efficient way to get all the clips in the timeline to compressor. I want the full files, not a sequence export. I can go through one clip and a time and add the master file. I'd rather not.
The more automated processes the better.
Thank you. I'm currently working so I don't have the time to scour the forums. Help or links to help would be greatly appreciated.
Byeah Media reconnect can be an issue.
Will Media Manager convert files? Another thing I was thinking was to Media Manage the sequence out, copying all the used files to a new folder, and then running that through compressor. But it still leads to a massive reconnect. Fine tuning all those edits would be less involved than re-editing the whole thing, I hope.
Maybe you are looking for
-
MuVo² Buttons Problem - Completely Block
Hello all,i have a major problem...and i wish to know if i can solve it without going to any service centre.Here's the problem: Some days ago, my player went batt empty,so I charged it,and when I pushed play button to start it, it all went ok, it loa
-
Which Macbook Pro is better for a Music Tech major?
I am going to convert to a Macbook Pro from a PC because of the vast numbers of music programs it offers. I just want to know some opinions of which of the 13.3 inch ones would be best. I know there is a difference between processors, but I'd like to
-
Hey Everyone im working in FCP 7.0.3 i have shot some footage on a Canon 5DMKII at 1920x1080 25fps in FCP sequence settings im using. frame size 1920 x 1080 - HDTV 1080i (16:9) pixel aspect - square compressor - apple prores 422 HQ but my editing tim
-
Is there any way of loading pdf files with flash player????
-
What is utp and who will do this ?how you do unit testing?
Hi.... he asked me like this 1...what is utp and who will do this ?how you do unit testing? thanks and regards, k.swaminath reddy.