Linux NSS DB Issue with Personal User/Client Certificate Friendly Names.

I have an issue with the NSSDB lib and my browsers in which client certificates I use for an application (Nessus Vulnerability Scanner) show up in the list with the same friendly name/nickname, making it very difficult to distinguish which certificate goes with which server.
Each certificate is generated on a different server with a different hostname but the same username. Upon importing the certificate into my browser, or even the pk12util command, the first certificate will appear correctly. However, importing additional certificates will just reuse the nickname from the first certificate instead of the nickname I chose. I have tested many different scenarios, and it doesn't seem the problem is related at all to the content of the nickname, so I have no idea how to force it to work correctly. I've searched around and found some indications of "nickname conflicts" and things, but nothing that helps me resolve the issue. I'm not sure if it's a bug or if it's some weird condition I've encountered.

Maybe try to ask on the mozilla.dev.tech.crypto news group.
*https://developer.mozilla.org/en-US/docs/NSS
*news://news.mozilla.org/mozilla.dev.tech.crypto
*http://groups.google.com/group/mozilla.dev.tech.crypto

Similar Messages

Directory Caching issue with Cisco Jabber client for Windows

Hi ,
I am facing cache issue with Cisco Jabber client for Windows. If I do any change related to modification or deletion of contacts in Active Directory/ Callmanager, it does not reflect in the Jabber. Because jabber takes the contacts from the locally stored cache file in the Windows system.
Every time I have to remove the cache file to overcome this issue, practically it's not possible to do the same with all the Widows users. As, if any employee leaves the company and still I can see his contact appears in the "Cisco Jabber client". I have not seen this issue with Android/Apple iOS.
Is there any automated way to remove the cache file?
Here is the detail of CUCM,Presence and Jabber.
CUCM version: 9.1.x
Presence : 9.1.X
Jabber : 10.5 and 10.6

Hello
On our environment we had to install a dedicated Microsoft Certificate Authority "just for Cisco Jabber usage" to house the
Network Device Enrollment Service.
Our certificate for the CUPS were generated on this Certification Authority too.
I discussed this certificate matter with my colleagues this afternoon and nobody seems to remember how these certificates were deployed into the
Enterprise Trust store for the users.
But I think they asked all 400 users to accept the 3 certificates by answering "yes" to the popup instead of using a script deployed by GPO...
I wish you success with that deployment and really hope you have a technical partner that *Knows* this subject.
Our partner left us alone with that unfortunately.
Florent
EDIT: If the "Certutil script method" works, please let me know. This could be useful in our own deployment.

Issue with pl/sql client

Hi All,
I am getting issue with pl/sql client saying readonly access to DMPROD(database).
could you help me out..what might be causing this problem or how to overcome it?
Thanks a lot.

tvenkatesh07 wrote:
Hi All,
I am getting issue with pl/sql client saying readonly access to DMPROD(database).
could you help me out..what might be causing this problem or how to overcome it?Well, it could be possible that your user, with whom you are trying to connect, is having only read-only access to the db? Did you try to change the user?
Aman....

Sign in issue with Lync Mobile client

Hi guys,
I'm trying to deploy a reverse proxy for mobile and external users, but I am having issues with the mobile client for android. It keeps saying "an unknown error occurred". Please try again.
I've got the log zip file outputted by the client here if someone could have a look and point me in the right direction? I've set
up server farms for the webservices, meet, and dialin.
Desktop clients can log in without any issue btw.
Cheers,
Gareth L. Armstrong

Verify from DNS Configuration and Check what is causing this issue from
Lync Connectivity analyzer
Also to troubleshooting Lync mobility, you can refer below link
http://blogs.technet.com/b/nexthop/archive/2012/02/21/troubleshooting-external-lync-mobility-connectivity-issues-step-by-step.aspx
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
Mai Ali | My blog: Technical | Twitter:
Mai Ali

JDBC Thin Connections with SSL and client certificates

Hi ,
we are going have a look at JDBC Thin Connections with SSL and client certificates.
I have two questions:
1. Is it possible to use SSL connections from JDBC Thin Driver and which release of the driver introduced it
2. Is it possible to use client certificates with JDBC Thin Driver and which release of the driver introduced it
Thanks for your help
regards
Markus Reichert

I could not reproduce the error after appending the SSL certificate to the certdb.txt file available under $Jinitiator_Home/lib/security folder.
Steps to add the SSL Certificate:
1. Run the form with the https mode in the IE Browser.
2. Security Alert is raised.
3. Click on the View Certificate button.
4. In the Certificate Window, click on the Details tab.
5. Click on the Copy to File button to copy the certificate.
6. Copy the certificate and append to the certdb.txt file.

Issue with "unknown user type 6" on Coherence 3.5.2

Having an issue with a cluster which is running using an internally developed cluster starter tool. This tool, and the associated cluster, all use POF, and upon attempting to connect a non-storing member to the cluster from java, the following exception is raised...
2011-07-11 15:54:58.338/2.469 Oracle Coherence GE 3.5.2/463p2 <Error> (thread=Cluster, member=n/a): This cluster node is
configured to use serializer com.tangosol.io.pof.ConfigurablePofContext {location=application-pof-config.xml}, which ap
pears to be different from the serializer used by Member(Id=1, Timestamp=2011-07-11 15:34:30.779, Address=10.74.82.193:8
088, MachineId=11188, Location=site:INTRANET.BARCAPINT.COM,machine:ldnpsm020006423,process:80976,member:ldnpsm020006423:
cacheserver:1).
java.io.StreamCorruptedException: unknown user type: 6
at com.tangosol.io.pof.PofBufferReader.readAsObject(PofBufferReader.java:3289)
at com.tangosol.io.pof.PofBufferReader.readObject(PofBufferReader.java:2600)
at com.tangosol.io.pof.ConfigurablePofContext.deserialize(ConfigurablePofContext.java:348)
at com.tangosol.coherence.component.util.daemon.queueProcessor.Service.readObject(Service.CDB:4)
at com.tangosol.coherence.component.util.daemon.queueProcessor.service.Grid$ServiceConfigMap.readObject(Grid.CDB
:1)
at com.tangosol.coherence.component.util.daemon.queueProcessor.service.Grid$MemberConfigResponse.read(Grid.CDB:1
3)
at com.tangosol.coherence.component.util.daemon.queueProcessor.service.Grid.onNotify(Grid.CDB:123)
at com.tangosol.coherence.component.util.daemon.queueProcessor.service.grid.ClusterService.onNotify(ClusterServi
ce.CDB:3)
at com.tangosol.coherence.component.util.Daemon.run(Daemon.CDB:42)
at java.lang.Thread.run(Thread.java:619)
There is no serialiser configured in the cache config, instead we just set tangosol.pof.enabled=true, and set the pof config file to what is seen above. The thing which is very confusing about this error is that unlike other clients which we connect, and in fact the servers they connect to, this client never attempts to load the cache configuration file. The point at which this should happen, prior to pof loading, shows:
2011-07-11 15:54:57.260/1.391 Oracle Coherence GE 3.5.2/463p2 <Info> (thread=Main Thread, member=n/a): Loaded cache conf
iguration from "jar:file:/C:/Program%20Files/Oracle/coherence/3.5.2b463P2/lib/coherence.jar!/reports/report-group.xml"
I have tried every combination of classpath entries I can think of, and no matter what, it never shows an attempt to load the application-cache-config.xml supplied in the startup. Does anyone have any experience with something like this?

I guess your non-storing JAVA code does not specify -Dtangosol.pof.enabled=true and the -Dtangosol.pof.config =<POF file location> on joining the cluster. Post the startup java command and the complete logs.
If application-cache-config is not loaded then coherence-cache-config.xml should be loaded by default and set -Dtangosol.coherence.cacheconfig=<application-cache-config>
Cheers,
NJ

SL Server Permission Issues with Windows XP Clients

I'm running into some permissions issues with Snow Leopard Server. I know it's specific to SL Server because I have two Leopard servers and neither one is affected. All servers are set up the same way.
I'm using this SL server as a file server in the golden triangle approach: AD for Users, OD for Groups that supply AD User membership. I have one volume per OD group, and that group has read/write privileges to that volume via the default Server Admin read/write ACL. POSIX permissions are 770 on the top level directory, and ownership is set to the AD user who owns the volume, and the OD group the volume belongs to.
The client is XP SP3. When the client accesses a share on the SL server, their access is correctly granted and they can browse the share and read any files inside the share. They can copy files to the share from wherever. They can open, edit, and save files. However, they cannot rename or delete files within the share. They cannot rename folders, but can delete them. This affects all AD users regardless of the OD group they're in.
I have a few Windows 7 and Vista clients on the network, and these two OS's are not affected by this so the problem is limited to XP. If I create a user in OD, and auth to the sever from the XP client as that user, the problem goes away, so it's something to do with AD and SMB.
I do have a ticket in with Apple support, which was escalated to Engineering. Still waiting on that.
Things I have tried that have not worked/helped:
-Modify the ACL to Full Privileges
-Tried removing/re-adding user to OD group.
-Remove darwin_streams from vfs_objects in smb.conf
stream support = no
ea support = yes/no (tried both ways)
darwin_streams:brlm = no
-Added nt acl support = no to smb.conf
per http://bit.ly/6aYycW
-Animal sacrifice..... ??
Help?

I need to do more testing, but I think the fix is to add "acl check permissions = no" to the bottom of /etc/smb.conf:
; Site-specific parameters can be added below this comment.
[global]
acl check permissions = no

Email issues with PC users

I am a web project manager and email daily with both PC & Apple users. I use Apple Mail as my default program. I have had countless issues with the formatting of my email appearing differently to PC users on Outlook when sending or forwarding Rich Text emails. I try to stick with plain text but sometimes Rich Text is required.
My current issue is orphan "B" characters are appearing through out the body of my email text when sending or forwarding Rich Text emails to PC users. This is NOT visible at all in my Apple mail program. This does not occur in plain text. I recently switched to sending in UTF-8 format - could this be the issue and if so what is the best solution.
I am interested in feedback on the best way to efficiently communicate with PC users using mail and what the appropriate configurations to do so would be. I really don't want to have to switch from Apple mail to use another program but when dealing with co-workers and clients who are not tolerant of these errors I must find a solution.
Thanks in advance to anyone that can help!
Powerbook G4 (1.67 GHz PowerPC) Mac OS X (10.4.8)

current issue is orphan "B" characters are appearing
through out the body of my email text when sending
or forwarding Rich Text emails to PC users. This is
NOT visible at all in my Apple mail program. This
does not occur in plain text. I recently switched to
sending in UTF-8 format - could this be the issue
and if so what is the best solution.
See this note and see if Fix C helps:
http://homepage.mac.com/thgewecke/woutlook.html

Issue with AD users restricted to certain machines.

Hi all,
So, we seem to have a bit of an issue with user accounts that are restricted to logging in to certain machines only. While the user is permitted to log in to the machine (Windows lets them), our ISE server denies the login and the trace looks like this:
24430 Authenticating user against Active Directory
24441 Account not permitted to log on using the current workstation
22057 The advanced option that is configured for a failed authentication request is used
22061 The 'Reject' advanced option is configured in case of a failed authentication request
11823 EAP-MSCHAP authentication attempt failed
12305 Prepared EAP-Request with another PEAP challenge
11006 Returned RADIUS Access-Challenge
5411 No response received during 120 seconds on last EAP message sent to the client
Has anyone seen this?
Version 1.1.1.268.
Thanks!
-Ryan

Well, as soon as I posted this, the idea hit me.
We added the two ISE servers' machine accounts in AD to the machines that this user is permitted to log in to, and it works like a charm now. Apparently when a user logs in, ISE passes through a generic machine name (of itself) to AD, and it wasn't matching the list of allowed machines.

Finder Wants Permission Every time File is moved on Server (issue with multiple users)

The Situation: I have a team of seven coworkers that uses a file structure on a server to move job folders from the 'active jobs' folder to "coworker x's" folder and then to a "waiting" folder once the job has been completed. Pretty much just moving folders into different folders. Seems pretty simple.
The Problem: At times, some folders will not move from one folder to another, and a message pops up asking "Finder wants to make changes. Type your password to allow this" and then it shows my computer's name and asks for a password. Now if typing in the password meant that the file would be moved, I would be fine with it, but when I type in my password in and accepts it, it does nothing! Like I said, there are seven of us that are using this system, and everyone has the same issue with the same folders, it is not like one person can move it and another cannot. To make it even harder to define where the issue is coming from: if you go back after a few minutes / hours, the folder will randomly be able to move with no issue. If you take the files out of the folder, you can move them, and when you move the now empty folder, it will gladly move into any folder, but when the files remain in the folder it asks for the password. And in some cases, folders that were just made and are empty have the same issue, which leads me to believe that this issue is not a result of the contents of the folder, but something else.
It is seemingly impossible to nail down the cause of our dilemma so I have come here in hopes of a great break through. The worst part is is that we are not doing anything that difficult, we are simply moving folders around. This is a windows based server, that might be important. Also, some of us are running Mavericks and others are still on Snow Leopard. Thank you for any information you might have! ( I have already tried the boot in recovery, resetpassword trick with no luck >_< )

If we're going to fix this, we will have to concentrate on one person to start with. Can that be you?
Some more information is required, only from you, your Mac and your windows user account on the server:
On the Windows server, are the 3 folders in question within the one shared folder?
What is the name of the Volume (share) that appears in Finder?
Are any of the folders being copied or moved to the local drive of the Mac?
On the windows server, what are the permissions that you have to:
The top-level shared folder
The 3 folders underneath the top-level shared folder
Do a Get Info of the Volume (share) in Finder and do a screen shot of both the area above Preview and the area below Preview (Preview itself is not required. Make sure all right-pointing arrows are expanded to down-pointing arrows so all info in each section can be seen.
(Did this discussion get re-assigned to the OS X Server Community? I've never been there, and I thought I found it in the OS X Mavericks community.) Are you actually running OS X Server on the Macs?
Message was edited by: SilverSkyRat: Additional Question

Business Contact Manager issue with New Users

I have an issue with a client when setting up Business Contact Manager for Outlook 2013. The client recently got a new employee and the employee was setup on an existing workstation that has BCM installed. When I launched Outlook 2013, and configured Oultook for
the new user, BCM started and needed to be configured. I went through the procedure for connecting to a 'Remote Database' on the server, typed in the server name as requested, and clicked Continue. BCM searched for the database but could not find it. The existing
user account on the workstation works just fine with BCM, and sees the remote database.
My next step was to remove BCM and re-install. This is the latest version/release of BCM for Outlook 2013. The existing user account was able to configure BCM with no issues, and found the remote database without an issue. The new user account had the same
issue as before and would not find the remote database.
I logged onto the same workstation as the administrator account we use to perform Admin tasks. I launched Outlook, configured Outlook 2013, and was able to successfully configure BCM and connect to the remote database with no issues.
I then created another New User on the server called Testaccount (TAccount), and logged onto the same workstation again, as this new user, and went through the same Outlook 2013 configuration and BCM setup. BCM has the same issue with this new user, and
cannot locate the remote database. From what I can determine, this looks to be something related to New Users that are created on the server and BCM not locating the remote database. Existing users do not have this issue when configuring BCM and connecting
to the remote database.
Has anyone had this issue or seen this issue and knows of a fix to correct this so my client can use BCM with the new user account, and any future new users they hire?
Thank you in advance for any assistance on this matter.

If you want to sync subfolders then you will need third party software. (Like Pocket Mirror)
Post relates to: None

Issues with Remote Users, VPN Connections, etc.

Hi there,
A few weeks ago I was asked to enable EWS and Outlook Anywhere which had not been previously enabled. I did so, but this seemed to cause issues (they may not have been implemented correctly) for users in remote offices; they would be prompted
for credentials to log into Outlook 2010, but no issues with OWA. I disabled Outlook Anywhere as it turned out we didn't need it, and this has caused VPN users to now not be able to open Outlook.
At this point I'm not sure what the issue is. I've tried implementing a few fixes from Googling around but haven't been able to determine the root cause and actually caused more issues this morning, where many local users were being prompted for credentials,
which was alleviated by creating new mail profiles for them.
We're using Exchange 2010 and Outlook 2010, with OWA being served by Forefront TMG.
I've seen in some other cases where results of the following queries were asked for, so here they are:
Get-OutlookProvider | fl
RunspaceId : a71467aa-c7ca-4a71-a349-41c860cb6db9
CertPrincipalName :
Server :
TTL : 1
OutlookProviderFlags : None
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : EXCH
DistinguishedName : CN=EXCH,CN=Outlook,CN=AutoDiscover,CN=Client Access,CN=Business Name,CN=Microsoft Exchan
ge,CN=Services,CN=Configuration,DC=domain,DC=com
Identity : EXCH
Guid : 0e397d7f-fecc-451f-8774-3b4225cce8c9
ObjectCategory : sunrype.com/Configuration/Schema/ms-Exch-Auto-Discover-Config
ObjectClass : {top, msExchAutoDiscoverConfig}
WhenChanged : 10/10/2013 2:56:34 PM
WhenCreated : 9/28/2011 2:42:58 PM
WhenChangedUTC : 10/10/2013 9:56:34 PM
WhenCreatedUTC : 9/28/2011 9:42:58 PM
OrganizationId :
OriginatingServer : server.domain.com
IsValid : True
RunspaceId : a71467aa-c7ca-4a71-a349-41c860cb6db9
CertPrincipalName : msstd:*.domain.com
Server :
TTL : 1
OutlookProviderFlags : None
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : EXPR
DistinguishedName : CN=EXPR,CN=Outlook,CN=AutoDiscover,CN=Client Access,CN=Business Name,CN=Microsoft Exchan
ge,CN=Services,CN=Configuration,DC=domain,DC=com
Identity : EXPR
Guid : 3bed6181-e70e-4c93-ac2d-bc57605cbeae
ObjectCategory : domain.com/Configuration/Schema/ms-Exch-Auto-Discover-Config
ObjectClass : {top, msExchAutoDiscoverConfig}
WhenChanged : 8/20/2014 9:32:10 PM
WhenCreated : 8/20/2014 3:21:11 PM
WhenChangedUTC : 8/21/2014 4:32:10 AM
WhenCreatedUTC : 8/20/2014 10:21:11 PM
OrganizationId :
OriginatingServer : server.domain.com
IsValid : True
RunspaceId : a71467aa-c7ca-4a71-a349-41c860cb6db9
CertPrincipalName :
Server :
TTL : 1
OutlookProviderFlags : None
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : WEB
DistinguishedName : CN=WEB,CN=Outlook,CN=AutoDiscover,CN=Client Access,CN=Business Name,CN=Microsoft Exchang
e,CN=Services,CN=Configuration,DC=domain,DC=com
Identity : WEB
Guid : 659f40b8-815e-43ac-95ed-49bed9766ebc
ObjectCategory : domain.com/Configuration/Schema/ms-Exch-Auto-Discover-Config
ObjectClass : {top, msExchAutoDiscoverConfig}
WhenChanged : 10/10/2013 2:56:34 PM
WhenCreated : 9/28/2011 2:42:58 PM
WhenChangedUTC : 10/10/2013 9:56:34 PM
WhenCreatedUTC : 9/28/2011 9:42:58 PM
OrganizationId :
OriginatingServer : server.domain.com
IsValid : True
Get-OutlookAnywhere | fl
No output.
I've also run the Microsoft Connectivity Analyzer locally, which appears to fixate on Outlook Anywhere connectivity and fails because OA isn't enabled. Specifically it reports that "The EXPR Provider section is missing in the Autodiscover response.
RPC over HTTP may not be enabled."

Hi Steve,
According to the description, my understanding as below:
1. To make users use Outlook externally, you want to enable Outlook Anywhere. However cannot connect to Exchange server via Outlook, it prompts password again and again.
2. Because Outlook Anywhere doesn't work, so you disable it and enable VPN. But it doesn't work neither.
Please correct me if there is any misunderstanding.
Based on the result of running Microsoft Connectivity Analyzer, it means that the Outlook Anywhere is disabled. However it isn't an error.
I suggest enable Outlook Anywhere on Exchange server 2010 and configure Outlook Anywhere on Outlook.
Find an article related Configuration on Outlook for your reference:
Configure Outlook Anywhere in Outlook 2013
http://technet.microsoft.com/en-us/library/cc179036(v=office.15).aspx
Thanks
Mavis
Mavis Huang
TechNet Community Support

What is the "best" way to configure iTunes on an iMac with personal user acounts so each user can access the media library but sync devices on their personal user account?

I am trying to determine the best way to set up our imac so each user account can access the same media (songs, movies etc.) through itunes and also back up and manage their personal devices under their own personal user account. There are 4 users on our iMac. Me, my wife, and our 2 children. We have built an extensive library of music/media together using the same iTunes store account. I would like to establish a seperate apple id and iTunes store account for each of us going forward but have the ability for each of us to share our purchases. What is the best way to configure our system and devices in order to allow shared access to media and at the same time allow for individual management of devices including contacts, apps, photos, etc. Please help, I would like to do this once!
Thank you in advance!

OK, seeing as no-one replied (presumably because a lot of this information is on the forums in bits elsewhere) here's how I've got on so far.
Applications - just went through them. About the only one I needed was my media server app. Just downloaded and re-installed, had a quick look back though my email to find the license key and it all went on fine. Installation never seemed quite right on my old machine so solved that problem too.
Movies - New iMovies just copied across the clips and projects into their respective folders. Seems to have worked but haven't checked it all that thoroughly. Some duplicate footage here but I can trim this out at some point when I get a chance to go through here.
Documents - Just copied these across.
Photos - used an app called iPhoto Library Manager. You can download for free but have to pay to use the part that consolidates your libraries. Possibly if I was willing to spend a bit more time I could have got away without using this but given I didn't know the state of my different libraries and just how many duplicates I had this was too much of a convenience to ignore. Also got my library into a state where I can now spend a few hours organising it a bit better with Faces / Events etc.
Not attempted Music or iPhone sync yet as been stuck trying to solve a problem with my power adapter.

Logitech Keyboard Issues with Fast User Switching

I'm running OSX 10.4 on an 800 MHz iMac, and using a Logitech Cordless Navigator keyboard. The keyboard's main feature (for me) is the ability to have the function keys (F1-F12) automatically open applications and folders and such. When I have multiple accounts running though, this feature seems to be tied to whichever one I first logged into. If I switch accounts and try to use one of the keyboard shortcuts nothing happens where I am, but when I switch back to the original account I find that the keyboard has opened the program there. The keyboard types fine in the new account, and I can even change the preferences so the function keys do different things in the different accounts, but the extra functionality seems to be only available for whichever account logs in first.
I realize this may just be a Logitech bug, but any ideas how to fix this? (Also even though I'm the only one using my computer this seems like a mild security issue, if theoretically another user could activate programs on my account without the password.)
800 MHz iMac G4 Mac OS X (10.4.3) 768 MB RAM

Logitech support is frustrating:
Dear tajmahall14,
Thank you for your recent inquiry about your Keyboards.
I understand you are having issues with the settings for the function keys becoming non-functional when fast switching from one user account to another.
Depending on the system configuration, the Fast User Switching may or may not work. Unfortunately this is not an issue I can address. You may need to contact Apple to see if they have a possible solution to your problem.

Firefox issues with multiple users on a single computer.

I have an issue with Firefox and multiple users on my computer. There are two users setup and I'm running Win7 Ultimate x64. When the other user logs in, my settings in Firefox get screwed up somehow. Even if that user does not open Firefox.
Examples of problems this causes:
Gmail - Cannot load the standard interface, however it will load the HTML only interface.
Facebook - Cannot post anything.
vBulletin Forums - Some forums will no longer normally load - a text-only version loads as if I was browsing from a mobile device.
There may be other issues, but these are the main ones. If I clear my cookies, cache and browsing and download history, then restart Firefox, everything works again.
This seems to happen most often when the other user logs in, and uses Firefox to log on to their Gmail account.
How can I fix this?

Create a new profile as a test to check if your current profile is causing the problems.<br />
See [[Basic Troubleshooting#Make_a_new_profile|Basic Troubleshooting: Make a new profile]]
There may be extensions and plugins installed by default in a new profile, so check that in "Tools > Add-ons > Extensions & Plugins"
If that new profile works then you can transfer some files from the old profile to that new profile (be careful not to copy corrupted files)
See http://kb.mozillazine.org/Transferring_data_to_a_new_profile_-_Firefox

Linux NSS DB Issue with Personal User/Client Certificate Friendly Names.

Similar Messages

Maybe you are looking for