Microsoft certificate for SSL

Hi All,
I am trying to use the certificate generated from Microsoft Windows for SSL between
IIS and WLS. When I generated the certificate, I also export the private key.
Then I use this certificate and private key to create an identity keystore using
ImportPrivateKey, but failed - can not import. DOes anyone know:
(1) the certificate generated from Microsoft windows 2000 can be used in WLS for
SSL?
(2) If can, how to make this working?
Thanks a lot for any helps.
Weili

There should be no problem importing the Microsoft key and certificate as long
as they are in expected format and the password is correct. ImportPrivateKey can
import certificate and key in der or pem files with the key in pkcs8 format.
Pavel.
"Weili Zhong" <[email protected]> wrote:
>
Hi All,
I am trying to use the certificate generated from Microsoft Windows for
SSL between
IIS and WLS. When I generated the certificate, I also export the private
key.
Then I use this certificate and private key to create an identity keystore
using
ImportPrivateKey, but failed - can not import. DOes anyone know:
(1) the certificate generated from Microsoft windows 2000 can be used
in WLS for
SSL?
(2) If can, how to make this working?
Thanks a lot for any helps.
Weili

Similar Messages

Installing certificates for ssl mailservers

Hello all,
I tried to install the ssl certificates for all my mailservers as directed in mail help.
It says something like that. If you receive a warning for an unknown certificate choose "show certificate" and draw the certificate icon onto your desktop. Doubble click on it to put it to your keychain.
Meanwhile I put the certificates of all mailservers I use into my personal and the system keychain and I still receive the warning for all mailservers that they use an unknown certificate.
What shall I do now?

I found out that the names of the servers were not 100% identical.
I used pop.provider.com instead of pop3.provider.com, as mail was able to connect do pop.provider.com I didn't realize that this could be a problem.

Installing Verisign Certificate for SSL - please help

I'm trying to configure SSL for the first time on my WebLogic Server 6.1 SP1 instance
on a Win2K Server. I have used the built-in certificate generator servlet to
generate a CSR. I sent the CSR to Verisign and received a certificate back (looks
like it's in .pem format). Now, I've gone to the admin console and entered what
I thought were the right values in the right places, but WLServer doesn't seem
to like what I've entered and/or the files themselves. Here's what I have:
Server Key File Name: config/mydomain/my_domain_com-key.der (name changed of course
from the actual domain name) - This is the file generated automatically by the
certificate servlet that I moved into this directory.
Server Certificate File Name: config/mydomain/mycert.pem (this is the file that
was sent to me by Verisign, supposedly my 40-bit certificate).
Server Certificate Chain File Name: config/mydomain/verisignca.pem (I created
this file by going to the verisign site and copy/pasting their .pem format 'intermediate'
cert into this file - documentation real fuzzy on this step so it's probably wrong).
SSL is enabled, listening on the default port of 7001, client certificate not
enforced.
Now, when I boot the server, I get the following error in the log file: ####<Nov
19, 2001 12:45:03 PM EST> <Alert> <WebLogicServer> <VDWEB1> <myserver> <main>
<system> <> <000296> <Security configuration problem with certificate file config/mydomain/my_domain_com-key.der,
java.io.EOFException>.
What am I doing wrong here? I thought i put that file in the location I specified,
so does that error mean it can't find it or that the file itself is corrupt?
That's just the file that was autogenerated by the servlet, i don't see how it
could be corrupt! Also, I assume that's just the first error ... if I fix that
one, there likely will be more. I especially don't understand the part about
the chain file as the documentation is so unclear to me about putting multiple
certs in the chain file ...
Thanks for any pointers,
Josh

Hi Josh,
Jus to reconfirm are you sure that the Server key and Server Cert are not
interchanged ?
The error message indicates that private key is being read as a certificate.
Maybe its not a explicit error message and instead should be
Security configuration problem with private key file
config/mydomain/my_domain_com-key.der
Are you able to run with the democerts provided with weblogic ?
yeshwant
<system> <> <000296> <Security configuration problem with certificate
file config/mydomain/my_domain_com-key.der,Josh Daynard wrote:
Hey Yeshwant,
Thanks for the tip. I did not use a password when creating the CSR request and
the 'Key Encrypted' box is unchecked in my console. Any other thoughts???
Thanks,
Josh
Yeshwant <[email protected]> wrote:
Hi Josh
when you generated the csr using the certificate webapp , did you use
a password ie are you using a password
envrypted private key ?
if yes you will have to provide that value in the start sript using the
system property
weblogic.management.pkpassword=actualpassword and also make sure that
the Use Encrypted box is checked.
If not make sure that the Use Encrypted box in the console under the
ssl tab is unchecked.
Yeshwant
Josh Daynard wrote:
I'm trying to configure SSL for the first time on my WebLogic Server6.1 SP1 instance
on a Win2K Server. I have used the built-in certificate generatorservlet to
generate a CSR. I sent the CSR to Verisign and received a certificateback (looks
like it's in .pem format). Now, I've gone to the admin console andentered what
I thought were the right values in the right places, but WLServer doesn'tseem
to like what I've entered and/or the files themselves. Here's whatI have:
Server Key File Name: config/mydomain/my_domain_com-key.der (name changedof course
from the actual domain name) - This is the file generated automaticallyby the
certificate servlet that I moved into this directory.
Server Certificate File Name: config/mydomain/mycert.pem (this is thefile that
was sent to me by Verisign, supposedly my 40-bit certificate).
Server Certificate Chain File Name: config/mydomain/verisignca.pem(I created
this file by going to the verisign site and copy/pasting their .pemformat 'intermediate'
cert into this file - documentation real fuzzy on this step so it'sprobably wrong).
SSL is enabled, listening on the default port of 7001, client certificatenot
enforced.
Now, when I boot the server, I get the following error in the log file:####<Nov
19, 2001 12:45:03 PM EST> <Alert> <WebLogicServer> <VDWEB1> <myserver><main>
<system> <> <000296> <Security configuration problem with certificatefile config/mydomain/my_domain_com-key.der,
java.io.EOFException>.
What am I doing wrong here? I thought i put that file in the locationI specified,
so does that error mean it can't find it or that the file itself iscorrupt?
That's just the file that was autogenerated by the servlet, i don'tsee how it
could be corrupt! Also, I assume that's just the first error ... ifI fix that
one, there likely will be more. I especially don't understand thepart about
the chain file as the documentation is so unclear to me about puttingmultiple
certs in the chain file ...
Thanks for any pointers,
Josh

Upload certificates for SSL in Box-to-Box redundancy

Hello,
as for the configuration replication I use the commit_redundancy script, but how can I synchronize the certificates between the two boxes?
Do I have to do it independently in the two boxes? Can somebody give some detailed steps?
Thanks in advance,
Ruben

Hello Ruben,
As Gilles mentioned you would have to import the SSL files to each CSS. This can be accomplished with rcmd(remote commands) ran on the primary/master CSS.
#1. Ensure the SSL files you wish to import to the secondary CSS are already on the primary CSS.
#2. Create an FTP record with the APP session IP address of the primary/current master CSS.
ftp-record FTP username "password"
#3. Export the SSL files directly on the primary CSS using the new FTP record created. Doing this will place the SSL files in the FTP directory on the primary/master CSS which would allow the secondary/backup CSS to import the files.
copy ssl ftp export rsacert.pem "password used to import file"
#4. Once the files have been successfully exported on the primary/master CSS sync the configurations. You will still get the error message stating the new SSL files are not on the secondary/backup CSS however, doing this will create/place the new FTP record you have just created on the secondary/backup CSS.
#5. Now import the SSL files to the secondary/backup CSS using rcmd commands on the primary/master CSS.
rcmd "copy ssl ftp import rsacert.pem PEM 'password'"
Once completed and both the rsacert/key have been imported to the secondary/backup CSS you can sync the configurations again and should not receive an error. For this to work properly ensure both CSS's are not restricting FTP connections and rcmd commands are enabled.
no restrict ftp
I hope this info helps you out!
Jason Espino

Certificate for SSL

Another question after watching videos and reading books about setting up a mail server...
It seems like I really want to use SSL encryption for sending mail back and forth to the server, will I be able to use the Default certificate that appears in Server Admin? Or do I need to purchase something from somewhere?
Thanks.

Either will work, but a self signed certificate (like the default one), will not be seen as trusted. If it is only you using your mail server, then there is nothing to worry about. Encryption will still take place, you just need to accept the certificate as trusted.

Details required for ssl certificate

Hi
u r going to be implement ssl on WEBAS. For this is it requires client certificates for ssl for the webbrowser .So if is it requires to renew.
regards...

Hi All,
got an answer from SAP Support and ICM restart isn't requrired anymore since >= NetWeaver 710.
Please see SAP Note 510007 - Setting up SSL on Web Application Server ABAP under:
When, as of NetWeaver 710, you save or overwrite an SSL PSE, STRUST signals the PSE change to the icman, whereby the PSEs used for SSL are reloaded at runtime. Existing communication connections are not impaired as a result. However, all SSL session caches are emptied in icman so that all new SSL connections go through a complete SSL Handshake. On servers with a very large number of simultaneous connections, this could lead to an increase in the CPU load and increased response times.
You are able to see respective information's as well at ICM trace.
Regards,
Jochen

Using HttpSupport library for SSL with User Id/Password

Does anybody know how to use UDS HttpSupport library for SSL connection which requires user id and password?
Got no problem so far in getting pages using https and HttpBaseRequest but can't figure out how to setup user id and password for logging in to server. Have tried https://userid:password@server/... but UDS treated password@server as the port!
Any help is appreciated.

I assume you mean that you need to provide the password needed for a certificate for SSL authentication.
For both client and server, these are configuration items.
If you want to do HTTP authorization, which is not related to SSL, you should use the Authorization and WWW-Authenticate (in a 401 response) to get a user name and password to the server.

Renew SSL Certificate for for two Exchange 2010 Server and the new rules.

I find DigitCert's website always helpful with cert questions.They've got a pretty helpful page here: https://www.digicert.com/internal-names.htmIt looks like they've got a tool for Exchange, but I've not used it myself, so can't say if it works or how well: https://www.digicert.com/internal-domain-name-tool.htmI bet Microsoft have something on their website too that helps with this sort of question.I'd say you register a completely new domain and use that for public facing and internal servers. Or you could just create a sub domain of an existing one, i.e. subdomain.mydomain.com and use that, i.e. public_exchange.subdomain.mydomain.com and internal_exchange.subdomain.mydomain.com.

Hi there ,
My exchange 2010 Server Certificate is about to expire and i am going to renew it but according to the new rules for SSL Certificate Issuing we can not include our Local Servers Names and Local FQDN such as myserver.contoso.local, my issue is that i have 2 exchange servers one is internet-facing Server (where the certificate is initiated and installed) and one is non-internet-facing Exchange server.
if i am going to renew my certificate with public only name, I have to create a split Domain that reflects my external links to the internal Users, what shall i do for the non-internet-facing server? do i need to create another record in my split DNS Server and add it to my Certificate Request ?
This topic first appeared in the Spiceworks Community

How we can get SSL certificate for any site?

i want to know how can get SSL certificate for any website and what is the main benefit for particular website with the help of this certificate.

Hi,
Would you please let me know edition information of the SBS server? Was it SBS 2008 or SBS 2011?
Based on your description, I’m a little confused with your question. Did you mean that want to know why need
SSL certificate for website?
Certificate Services and SSL protect sensitive information by encrypting the data sent between client browsers
and your server.
An SSL Certificate is used for two reasons (1) to validate the remote server to the client before the client sends any data to that server (2) to encrypt the data between the client and server over an un-secure network (ie. the Internet). You can use
a self-issued certificate or a third-party trusted certificate. For more details, please refer to following articles and check if can help you.
Managing Certificates
SSL and Certificates
Understanding Self-Issued
Certificates in SBS 2003 & SBS 2008
Installing a GoDaddy Standard
SSL Certificate on SBS 2008
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft
does not guarantee the accuracy of this information.
If anything I misunderstand or any update, please don’t hesitate to let me know.
Hope this helps.
Best regards,
Justin Gu

Installing SSL Certificate for ITS WGate with sapgenpse

Hello.
We have setup Web Dispatcher and ITS WGate on the same host. Dispatcher accepts connections from 443 and ITS accepts connections from 8000.
We have done SSL Settings for Web Dispatcher with sapgenpse successfully.
But as WGate is running on Microsoft IIS Server, we couldn't install the same certificate response to Microsoft IIS. Is there a way to install certificate for ITS Server with sapgenpse tool or IIS Server's tool?
Or should we demand another SSL response from CA generated from Microsoft IIS Server?
Thanks in advance.
Edited by: teknikdanisman on Jan 15, 2010 10:42 AM

I have solved the problem. I have exported the SSL key with sapgenpse in format P12 and imported from IIS.

Is it possible to use single ssl certificate for multiple server farm with different FQDN?

Hi
We generated the CSR request for versign secure site pro certificate
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
SSL Certificate for cn=abc.com considering abc.com as our major domain. now we have servers in this domain like www.abc.com, a.abc.com , b.abc.com etc. we installed the verisign certificate and configured ACE-20 accordingly for ssl-proxy and we will use same certificate gerated for abc.com for all servers like www.abc.com , a.abc.com , b.abc.com etc. Now when we are trying to access https//www..abc.com or https://a.abc.com through mozilla , we are able to access the service but we are getting this message in certfucate status " you are connected to abc.com which is run by unknown "
And the same message when trying to access https://www.abc.com from Google Chrome.
"This is probably not the site you are looking for! You attempted to reach www.abc.com, but instead you actually reached a server identifying itself as abc.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of adgate.kfu.edu.sa. You should not proceed"
so i know as this certficate is for cn=abc.com that is why we are getting such errors/status in ssl certficate.
Now my question is
1. Is is possible to remove above errors doing some ssl configuration on ACE?
2. OR we have to go for VerisgnWildcard Secure Site Pro Certificate for CSR generated uisng cn =abc.com to be installed on ACE and will be used for all servers like www.abc.com , a.abc.com etc..
Thanks
Waliullah

If you want to use the same VIP and port number for multiple FQDNs, then you will need to get a wildcard certificate. Currently, if you enter www.abc.com in your browser, that is what the browser expects to see in the certificate. And right now it won't beause your certificate is for abc.com. You need a wildcard cert that will be for something like *.abc.com.
Hope this helps,
Sean

How to Use a Certificate for Two Way SSL and another certificate for WS Security Header at Client Console Application(C# Dotnet)

Hi,
I want to consume a Java Web service from Dotnet based client Application. The service require one Certificate("abc.PFX") for Two Way SSL purpose and another certificate("xyz.pfx") for WS security purpose to be passed from client Application(Dotnet
Console based). I tried configuring the App.config of Client application to pass both the certs but getting Error says:
Could not establish secure channel for SSL/TLS with authority "******aaaa.com"
Please suggest how to pass both the certs from client Application..

Hi,
This problem can be due to an Untrusted certificate. So you need just full permissions to certificates.
And for more information, you could refer to:
http://contractnamespace.blogspot.jp/2014/12/could-not-create-secure-channel-fix.html
Regards

Is there a way to change the CSR for install SSL Certificate for CCMADMIN

HI there,
Our customer want a solution for the https failure on CCMAdmin and CCMUser sites.
For that, I have exported a csr to buy a ssl certificate from verisign.
The problem is the csr includes fqdn an not just the servername
But the users just have to type in the servername to reach the server.
Is there a way to export a csr which include as common name only the server name without changing the domain settings in the cucm?
thanks
Marco

Hi
You can go to the server via SSH, and enter the 'set web-security' command with the alternate-host-name parameter:
Command Syntax
set web-security orgunit orgname locality state country alternate-host-name
Parameters
• orgunit represents the organizational unit.
• orgname represents the organizational name.
• locality represents the organization location.
• state represents the organization state.
• country represents the organization country.
• alternate-host-name (optional) specifies an alternate name for the host when you generate a
web-server (Tomcat) certificate.
Note When you set an alternate-host-name parameter with the set web-security command,
self-signed certificates for tomcat will contain the Subject Alternate Name extension with
the alternate-host-name specified. CSR for Cisco Unified Communications Manager will
contain Subject Alternate Name Extension with the alternate host name included in the CSR.
Typically you would still use an FQDN, but a less specific one (e.g. ccm.company.com)...
Regards
Aaron
Please rate helpful posts...

Wildcard * SSL Certificates for TTA??

Is there any way I can use a wildcard SSL certificate like:
*.mycompany.com
in my TTA server?
I was able to run all the cert commands successfully using the
*.mycompany.com cert:
Generated the CSR (tarantella security certrequest)
Installed the Cert File (tarantella security certuse)
Installed the Chained CA cert (tarantella security customca)
Review/validate certinfo (tarantella security certinfo)
The TTA-installed Apache webserver was fine with the wildcard certificate
since I was able to goto:
https://subdomain.mycompany.com (FYI, the subdomain is NOT "www")
But after I went to:
https://subdomain.mycompany.com/tarantella/
I got the following errors in my Java Console:
Secure Global Desktop 4.10.903: Connecting to Secure Global Desktop
server...
Secure Global Desktop 4.10.903: Using secure connection to
Secure Global Desktop server subdomain.mycompany.com:443
Secure Global Desktop 4.10.903: Certificate (*.mycompany.com) not accepted
for this Secure Global Desktop server (subdomain.mycompany.com) due to name
mismatch.
Secure Global Desktop 4.10.903: Client dropping connection.
Secure Global Desktop 4.10.903: Unable to connect: Certificate
(*.mycompany.com) not accepted for this Secure Global Desktop server
(subdomain.mycompany.com) due to name mismatch.
Secure Global Desktop 4.10.903: Missing negotiation feature cgi script
Is there a way that I can get the applet to do a regex-ish match on the name
for wildcard certs?
Cyrus

Hi Cyrus
I was loosely referring to PKI rules e.g.
http://www.ietf.org/proceedings/98mar/98mar-edited-110.htm
http://www.iihe.ac.be/internal-report/1997/stc-97-19.html
Wildcarding isn't supported. I understand what you are trying to do now
but it won't work because the software is looking for a certificate
matching a single server.
The certrequest command is just a wrapper script for openssl so it won't
stop you doing anything the openssl command believes may be valid. You don't
actually need to use this command it's just there for convenience, you
could do everything just using openssl.
The current documentation doesn't explictly state that you can't use
wildcards in certificates but it does say you need a certificate for a
SGD server. My understanding of the wildcard issue is that it is up to
a particular application to decide what is appropriate.
http://www.tarantella.com/support/documentation/sgd/ee/4.1/help/en-us/tsp/gettingstarted/whatare_certs.html
Regards
Barrie
On 2005-08-15, Cyrus Mehta <[email protected]> wrote:
May I inquire as to where these rules are listed regarding SSL Certs, I
didn't see anything to the effect in the documentation. Also why weren't
the rules enforced at certificate generation time. Even the validation
command (tarantella security certinfo) had no problems.
The CSR generation/signing went through flawlessly and created a wildcard
cert that Apache could use. It's one thing if the whole cert process
couldn't handle a wildcard, but it seems like everything would have worked
if only the applet accepted a wildcard regex match.
Regards,
Cyrus
barrie wrote:
Hi Cyrus
No, sorry. The rules say you can't do that. You are required to have a
certificate for a node not a network.
Regards
Barrie
On 2005-08-05, CM <[email protected]> wrote:
Is there any way I can use a wildcard SSL certificate like:
*.mycompany.com
in my TTA server?
I was able to run all the cert commands successfully using the
*.mycompany.com cert:
Generated the CSR (tarantella security certrequest)
Installed the Cert File (tarantella security certuse)
Installed the Chained CA cert (tarantella security customca)
Review/validate certinfo (tarantella security certinfo)
The TTA-installed Apache webserver was fine with the wildcard certificate
since I was able to goto:
https://subdomain.mycompany.com (FYI, the subdomain is NOT "www")
But after I went to:
https://subdomain.mycompany.com/tarantella/
I got the following errors in my Java Console:
Secure Global Desktop 4.10.903: Connecting to Secure Global Desktop
server...
Secure Global Desktop 4.10.903: Using secure connection to
Secure Global Desktop server subdomain.mycompany.com:443
Secure Global Desktop 4.10.903: Certificate (*.mycompany.com) not accepted
for this Secure Global Desktop server (subdomain.mycompany.com) due to
name
mismatch.
Secure Global Desktop 4.10.903: Client dropping connection.
Secure Global Desktop 4.10.903: Unable to connect: Certificate
(*.mycompany.com) not accepted for this Secure Global Desktop server
(subdomain.mycompany.com) due to name mismatch.
Secure Global Desktop 4.10.903: Missing negotiation feature cgi script
Is there a way that I can get the applet to do a regex-ish match on thename
for wildcard certs?
Cyrus

SSL Certificate for Software LifeCycle Management

Dear Friends,
We have Solution Manger 70 with EhancementPack 1 (Java 7.01 SP4). Trying to configure the Software LifeCycle Management and I am stuck at the first stage i.e. generating SSL SSL Certificate.
Here is what I have done and please let me know on how to proceed...
- Installed SAP Cryptographic libraries, all the necessary Profile parameters and activated HTTPS...
- STRUSTSSO2 --> Created SSL Server PSE
- Generated the Certificate Requests for the SSL Server PSE
- Copied the Certificate Request.
- Opened the https://service.sap.com/tcs site
- Requested for SSL Test Server Certificate by pasting the Copied the Certificate Request and generated the certificate response in a "PKCS # 7 Certificate Chain" format.
- Copied the Generated Imported Certficate from SAP Trust center Site, and Imported the Certificate response for SSL Server using STRUSTSSO2.
What else I am missing here?????????
How to generate the Import Certifcate in a crt file format for SSL client (Anonymous or Standard) PSE's?????????
Kindly help me with these issue ASAP.
Thank you,
Nikee

Users are prompted to accept the certificate from the WLC because the clients do not have a trusted root certificate for the certificate that is installed on the WLC. The SSL certificate on the WLC is not in the list of certificates that the client system trusts. There are two ways to stop the generation of this web-browser security alert popup window:
a) Use the self-signed SSL certificate on the WLC and configure the client stations to accept the certificate
b) Generate a CSR and install a certificate that is signed by a source (a third-party CA) for which the clients already have the trusted root certificates installed. For more information on this read http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00806e367a.shtml

Microsoft certificate for SSL

Similar Messages

Maybe you are looking for