Move wildcard SSL cert from 10.7 to 10.6 server

I purchased and configured a wildcard cert (*.example.com) on my 10.7 server. I now want to import this cert onto my 10.6 servers (all using the same domain) and I can't seem to get it to work.
I exported both the cert and the private key file from the 10.7 server, however when trying to import the private key into the system keychain on the 10.6 server, I get this error: An error has occurred. Unable to import an item. The contents of this item cannot be retrieved.
Any ideas?

Check permissions on the crt and key you are trying to import, maybe change to 777
How specifically did you export the cert/key from 10.7 ?
I always copy them from /etc/certificates, change permissions, then I like to remove the passphrase (more on that if needed).. then I end up with a cert/key with read permissions and no pass... makes import simple to any service (OS X or other)

Similar Messages

  • Use Wildcard SSL Cert to Monitor Non-Domain COmputers

    Hello,
      I was wondering if a Wildcard SSL Cert from GoDaddy or another Provider can be used to monitor Non-Domain Computer on SCOM 2012R2?
    TIA,
    Jim

    Hi,
    The Operations Manager agents support two types of authentication method, Kerberos or certificate based authentication. In order to monitor servers and clients located outside the Operations Manager’s native Active Directory domain, you will need to configure
    certificate authentication using either an internal Certificate Authority or through a 3rd party Certificate Authority.
    Regards,
    Yan Li
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Wildcard SSL Cert on ASA 5500

    What do I need to do on the ASA 5520 to be able to use a wildcard SSL cert?  I'm running 8.2.5 code.

    Make sure you get the cert in pkcs12 format and no fqdn. Other than that, just follow the config guide.
    Sent from Cisco Technical Support Android App

  • Wildcard SSL cert on ASA

    Is it possible to use a wildcard SSL cert on an ASA? That is, instead of getting a specific cert with the FQDN of the ASA, we would use the wildcard cert issued?

    Absolutely, it's especially needed in ASA vpn load balancing environments. When you connect to a FQDN that translates to a load balancing IP, one of the ASAs will do an http redirect to its individual hostname, your browser (or AnyConnect) will attempt that connection and ASA needs to have a certificate for that specific hostname. Having a wildcard cert on all ASAs resolves this. I've got this running on several customers.
    If you need help with configuration, let me know.
    You can either generate private keys on the ASA (and later export it to another ASA or other non-cisco devices), or you could import an existing wildcard certificate with the private keys (in PKCS12-BASE64 format)
    Regards,
    Roman

  • Wildcard SSL Cert

    Is it possible to install a wildcard SSL cert in Messaging Server? I attempted to install the cert that I have and I am giving an error saying "cert was not generated for this server".
    Thanks,
    Pete

    I have managed to use pk12util to import the wildcard cert into the trust store. I have used configutil to set the appropriate parameters to enable SSL and POP over SSL. However, when I start the server I get the following error in the imta log file: General Error: SSL initialization error: ASockSSL_Init: PK11 auth failed to *.unca.edu (-8177).

  • Move SSL Cert from one device to another on Cisco ASA

    Hello Everyone,
    Is it possible to move SSL certificate + Key from one cisco asa to another ? I hope its possible and if someone can guide me towards correct documentation that would be perfect.
    thank you
    Manish

    We have an ASA5550 running 8.2(5) that we're using as a VPN terminator; it died yesterday when we had a power glitch in the data center, and we're temporarily installing a spare 5510 (we don't have a spare 5550) until it's replaced.  But the RSA keys on the spare don't match the ones on the old firewall, so when we try to install the old cert it fails:
    ERROR: Keypair cannot be found for trustpoint UMVPN3-INCOMMON-MAY2020.
    The old ASA is dead, so we can't do a straight export/import - all we have to work with is what's in yesterday's config backup...
    I gather there's no way to extract the original keys from this; is there any way to recover in this case?  Or must we export the certs from the ASAs with a "crypto ca export" and save copies of these in a secure location?

  • Install GoDaddy Wildcard SSL cert on GW WebAccess - ver.8

    I have followed all of the documentation regarding generating a CSR, creating the new eDirectory object from which that CSR is generated, then subsequently downloading and doing the "read from file" SSL cert installation, and it won't validate.
    I have a NetWare 6.5, SP8 server running Apache/Tomcat and it's our GroupWise WebAccess server (version 8).
    I want to encrypt the sessions as well as the authentication from the GW WebAccess login screen (right now, it's just http://).
    Our institution purchased a wildcard, unlimited subdomain, SSL certificate from GoDaddy to use for this, and other, SSL cert. needs.
    No matter what I do, it won't work.
    I am using ConsoleOne to create the new eDirectory object according to the documentation, generate the CSR, and install the certificate, but to no avail.
    Can anyone help?

    Originally Posted by AndersG
    Fmcunningham,
    > > I am looking at installing a cert as well. I have NOWS SBE 2.0
    > > upgrading to SBE 2.5 this weekend and would like to add a CA Cert. Do I
    > > need a Wild card cert to be able to accomplish this?
    >
    Only difference between a wildcard and a regular (apart from price) is that
    a wildcard covers all hosts in a domain,. Ie *.acme.com, whereas a regular
    cert only covers a named host, homer.acme.com
    - Anders Gustafsson (Sysop)
    The Aaland Islands (N60 E20)
    Novell has a new enhancement request system,
    or what is now known as the requirement portal.
    If customers would like to give input in the upcoming
    releases of Novell products then they should go to
    http://www.novell.com/rms
    I am running SBE 2.0 upgrading soon to SBE 2.5. I am not using sub domains, so I think I should be fine with just a normal cert. The real reason I want to go with a cert from a CA instead of a self signed is for webaccess.

  • CSS11506 + wildcard ssl cert ?

    We have a need to terminate multiple SSL websites on our CSS. So name1.test.com
    name2.test.com, name3.test.com etc. The problem I have found is that I need to burn 1 public VIP per SSL connection b/c they all need to use tcp 443 inbound and point to their respective cert on the CSS. Is there anyway to possibly generate a wildcard cert that matched only the last part of our domain name ( events.test.com = *.test.com ) and then get away with using only 1 VIP for the multiple sub domains ??
    Thanks for your help.
    Cheers
    Dave

    Yes this is possible. We are currently using the same design.
    http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a0080579f6b.html
    Please rate.

  • Use of Wildcard SSL cert with DRM

    DRM needs a URL to be embedded in the protected PDF document(e.g., mysite.mycompany.com).  The SSL certificate for the URL must be from a trusted provider (e.g., Verisign).  My question is will Adobe Reader accept for DRM a wild card SSL certificate (e.g., *.mycompany.com) from a trusted provider?

    Hi,
    The Operations Manager agents support two types of authentication method, Kerberos or certificate based authentication. In order to monitor servers and clients located outside the Operations Manager’s native Active Directory domain, you will need to configure
    certificate authentication using either an internal Certificate Authority or through a 3rd party Certificate Authority.
    Regards,
    Yan Li
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • CertPrincipalName forced to wrong setting on server with wildcard SSL cert

    Dears
    After testing Exchange 2013 for a couple of weeks with a limited amount of IT personnel, we have migrated the first batch of users from 2010 to 2013.
    That was the biggest mistake we've done this.. week..
    The error is identified as an autodiscover/ssl problem. No matter what I specify in CertPrincipalName on CAS, Outlook resets itself to msstd:server.domain.com
    I have tried with "none" and "msstd:*.domain.com" but it always resets to msstd:server.domain.com
    Outlook Autoconfigure test returns the correct value. Any ideas?
    All our clients are not domain members, so setting this with GPO is not an option.

    I have compared how autodiscover works for clients on 2013 and on 2010. It is definitely server related. Clients still on a 2010 mb server get's the correct value msstd:*.domain.com. 
    The only difference I see in the autodiscover xml is that on 2013 there is two extra blocks of data for protocol "EXHTTP". One of these blocks does not contain the CertPrincipalName value.
    <Protocol>
            <Type>EXHTTP</Type>
            <Server>mailbox.domain.com</Server>
            <SSL>On</SSL>
            <AuthPackage>Basic</AuthPackage>
            <ASUrl>https://ex02.domain.com/EWS/Exchange.asmx</ASUrl>
            <EwsUrl>https://ex02.domain.com/EWS/Exchange.asmx</EwsUrl>
            <EmwsUrl>https://ex02.domain.com/EWS/Exchange.asmx</EmwsUrl>
            <EcpUrl>https://ex02.domain.com/ecp/</EcpUrl>
            <EcpUrl-um>?rfr=olk&amp;p=customize/voicemail.aspx&amp;exsvurl=1&amp;realm=domain.com</EcpUrl-um>
            <EcpUrl-aggr>?rfr=olk&amp;p=personalsettings/EmailSubscriptions.slab&amp;exsvurl=1&amp;realm=domain.com</EcpUrl-aggr>
            <EcpUrl-mt>PersonalSettings/DeliveryReport.aspx?rfr=olk&amp;exsvurl=1&amp;IsOWA=&lt;IsOWA&gt;&amp;MsgID=&lt;MsgID&gt;&amp;Mbx=&lt;Mbx&gt;&amp;realm=domain.com</EcpUrl-mt>
            <EcpUrl-ret>?rfr=olk&amp;p=organize/retentionpolicytags.slab&amp;exsvurl=1&amp;realm=domain.com</EcpUrl-ret>
            <EcpUrl-sms>?rfr=olk&amp;p=sms/textmessaging.slab&amp;exsvurl=1&amp;realm=domain.com</EcpUrl-sms>
            <EcpUrl-photo>PersonalSettings/EditAccount.aspx?rfr=olk&amp;chgPhoto=1&amp;exsvurl=1&amp;realm=domain.com</EcpUrl-photo>
            <EcpUrl-tm>?rfr=olk&amp;ftr=TeamMailbox&amp;exsvurl=1&amp;realm=domain.com</EcpUrl-tm>
            <EcpUrl-tmCreating>?rfr=olk&amp;ftr=TeamMailboxCreating&amp;SPUrl=&lt;SPUrl&gt;&amp;Title=&lt;Title&gt;&amp;SPTMAppUrl=&lt;SPTMAppUrl&gt;&amp;exsvurl=1&amp;realm=domain.com</EcpUrl-tmCreating>
            <EcpUrl-tmEditing>?rfr=olk&amp;ftr=TeamMailboxEditing&amp;Id=&lt;Id&gt;&amp;exsvurl=1&amp;realm=domain.com</EcpUrl-tmEditing>
            <EcpUrl-extinstall>Extension/InstalledExtensions.slab?rfr=olk&amp;exsvurl=1&amp;realm=domain.com</EcpUrl-extinstall>
            <OOFUrl>https://ex02.domain.com/EWS/Exchange.asmx</OOFUrl>
            <UMUrl>https://ex02.domain.com/EWS/UM2007Legacy.asmx</UMUrl>
            <OABUrl>https://mailbox.domain.com/OAB/3abb5758-f1c7-4246-9f9f-bbf390f5febb/</OABUrl>
            <ServerExclusiveConnect>On</ServerExclusiveConnect>
          </Protocol>

  • SSL cert on ASA 5512 from Thwate or Digitcert

    I ran into the issue when I install SSL123 cert from Thwate . I did not have issue with SSL cert from DIgitcert- their process and steps are simple and using better encryoption - SHA256. Compare to Thwate - their support did not let me use SHA2 and I had to use SHA1 - according to some organisation SHA1 will be retired soon 
    Let me explain how to install SSL123 from Thwate into ASA 5510- you can follow their instruction - but generate CSR with 2048 - with 4096 did not work .Once you apply into their portal use SHA1 ( SHA2 did not work ) . Before you get email with their CA -  install Root and Secondary intermidiate certificate - located in their website . After you get email with the new cert - you can install under Idendity certificates where still says pending .Note - there are CSR checker tools - before you apply it into CA _ google CSR checker - make sure your CSR does not have any errors
    Note - When you install each certificate - trustpoint association could be in different order - example - ASDM_trustpoint0 , ASDM_trustpoint1 , ASDM_trustpoint2   etc . If you use the same ASDM_trustpoint0 for all certs- root , intermidiate and signed certificate - Did not work and you are getting ERROR - :Failed to parse or verify imported certificate
    here is the link you can follow - https://search.thawte.com/support/ssl-digital-certificates/index?page=content&id=SO16141&actp=search&viewlocale=en_US&searchid=1429125296765
    Finally you can check your SSL cert - google SSL checker to see if your chain as good all the way and what need to be fixed 

    First of all, you don't need the server names in the cert if your Exchange urls are configured to a load balanced url. Going forward, you will not be able to get a certificate from 3rd party with internal urls (server fqdn) in it.
    When you export the certificate from CAS1, make sure that you include the private key as well (there will be a check box to tick) and import it back on CAS2.
    If not, you can just import the certificate into CAS2 by selecting Import Exchange certificate in EMC and select the 3rd party cert (just like you imported on CAS1).
    Yes, you need the certificate on both servers, otherwise you will get certificate errors on clients (assuming that there is some form of load balancing in place - NLB or hardware).

  • Remote Desktop Services Single SSL Cert with multiple hosts

    I am trying to use a single SSL Cert from a third party issuer.  I have 3 servers in my deployement all are 2012R2.  One contains the RD Web Access role, RD Gateway role, RD Licensing role, and RD Connection Broker role.  The other 2 are
    RD Session Hosts.  I have the SSL cert for the server that has the Gateway and other roles.  My deployement is primarily focused on deploying RemoteApp to Windows 8 Thin clients with GPO through the default URL.  It works currently with the
    exception that the user gets a certificate mismatch error because it is seeing the cert for the gateway server but is connecting to the host servers so the names don't match.  Is anyone else using a similar setup and had success with it?  I am trying
    to avoid buying an expensive wildcard cert to cover all of them.

    Hi,
    Please verify that the .rdp file embedded in the RDWeb IE page matches the same one from RADC.  To do this, log on to RD Web Access using IE, right-click and choose View Source.  Find the goRDP function for the icon you want to examine and copy
    the text between the ' marks.  Next paste this into the escape text box the below page:
    http://www.web-code.org/coding-tools/javascript-escape-unescape-converter-tool.html
    Click complete unescape to get the plain text version.  After that you can select all of the text in the clear text box, paste it into a blank Notepad window, then save as a .rdp file.  Once you have the .rdp file created you can compare
    it to the other ones and see if any of the names are different, see if it gets the certificate error as well when you double-click it, etc.
    Do you have any proxy or other non-default network configuration on your Windows 8 embedded clients?
    Thanks.
    -TP

  • SSL Cert Renewal w/Org Name Change

    Hello,
    We get our SSL certs from a central agency that deals with Verisign. The central agency changed their name, which changes the Organization Name on the cert. That prevents the cert from being imported by the server. On the advice of a Windows admin, I tried to fake it by creating a new site on that server, importing the new cert (all good), but then the new server won't start.
    Is there a better way to get the new-org-named cert accepted by the original site?
    Steve Kayner

    Are you talking about changing your SMTP domain name? Or you want to change AD DS domain name? If you want to change/add SMTP domain that you Exchange is using, just add accepted domain that you wish to use.
    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Damir

  • Wildcard SSL Server 3.2.1

    I purchased a wildcard SSL certificate from Go Daddy. My public website is hosted by go daddy (www.example.com). I have a server (OS X 10.9.5, Server 3.2.1) in the office to handle printer, file sharing, profile manager, etc. (server.example.com) I want to assign an SSL for the server, and the public website on go daddy. I cannot however enter *.example.com in the host name field on the Get a Trusted Certificate dialog. If I allow it to use server.example as the host name, when I paste the CSR into Go Daddy's site, it of course gives me the error that the CSR is only for a sub domain, not a wildcard.
    Can anyone help me? I want to use the Wildcard to secure example.com as well as server.example.com and any other subdomain...

    You can't do that through the Server app.
    Generating a Certificate Signing Request (CSR) - Apache 2.x | GoDaddy Help

  • Wildcard * SSL Certificates for TTA??

    Is there any way I can use a wildcard SSL certificate like:
    *.mycompany.com
    in my TTA server?
    I was able to run all the cert commands successfully using the
    *.mycompany.com cert:
    Generated the CSR (tarantella security certrequest)
    Installed the Cert File (tarantella security certuse)
    Installed the Chained CA cert (tarantella security customca)
    Review/validate certinfo (tarantella security certinfo)
    The TTA-installed Apache webserver was fine with the wildcard certificate
    since I was able to goto:
    https://subdomain.mycompany.com (FYI, the subdomain is NOT "www")
    But after I went to:
    https://subdomain.mycompany.com/tarantella/
    I got the following errors in my Java Console:
    Secure Global Desktop 4.10.903: Connecting to Secure Global Desktop
    server...
    Secure Global Desktop 4.10.903: Using secure connection to
    Secure Global Desktop server subdomain.mycompany.com:443
    Secure Global Desktop 4.10.903: Certificate (*.mycompany.com) not accepted
    for this Secure Global Desktop server (subdomain.mycompany.com) due to name
    mismatch.
    Secure Global Desktop 4.10.903: Client dropping connection.
    Secure Global Desktop 4.10.903: Unable to connect: Certificate
    (*.mycompany.com) not accepted for this Secure Global Desktop server
    (subdomain.mycompany.com) due to name mismatch.
    Secure Global Desktop 4.10.903: Missing negotiation feature cgi script
    Is there a way that I can get the applet to do a regex-ish match on the name
    for wildcard certs?
    Cyrus

    Hi Cyrus
    I was loosely referring to PKI rules e.g.
    http://www.ietf.org/proceedings/98mar/98mar-edited-110.htm
    http://www.iihe.ac.be/internal-report/1997/stc-97-19.html
    Wildcarding isn't supported. I understand what you are trying to do now
    but it won't work because the software is looking for a certificate
    matching a single server.
    The certrequest command is just a wrapper script for openssl so it won't
    stop you doing anything the openssl command believes may be valid. You don't
    actually need to use this command it's just there for convenience, you
    could do everything just using openssl.
    The current documentation doesn't explictly state that you can't use
    wildcards in certificates but it does say you need a certificate for a
    SGD server. My understanding of the wildcard issue is that it is up to
    a particular application to decide what is appropriate.
    http://www.tarantella.com/support/documentation/sgd/ee/4.1/help/en-us/tsp/gettingstarted/whatare_certs.html
    Regards
    Barrie
    On 2005-08-15, Cyrus Mehta <[email protected]> wrote:
    May I inquire as to where these rules are listed regarding SSL Certs, I
    didn't see anything to the effect in the documentation. Also why weren't
    the rules enforced at certificate generation time. Even the validation
    command (tarantella security certinfo) had no problems.
    The CSR generation/signing went through flawlessly and created a wildcard
    cert that Apache could use. It's one thing if the whole cert process
    couldn't handle a wildcard, but it seems like everything would have worked
    if only the applet accepted a wildcard regex match.
    Regards,
    Cyrus
    barrie wrote:
    Hi Cyrus
    No, sorry. The rules say you can't do that. You are required to have a
    certificate for a node not a network.
    Regards
    Barrie
    On 2005-08-05, CM <[email protected]> wrote:
    Is there any way I can use a wildcard SSL certificate like:
    *.mycompany.com
    in my TTA server?
    I was able to run all the cert commands successfully using the
    *.mycompany.com cert:
    Generated the CSR (tarantella security certrequest)
    Installed the Cert File (tarantella security certuse)
    Installed the Chained CA cert (tarantella security customca)
    Review/validate certinfo (tarantella security certinfo)
    The TTA-installed Apache webserver was fine with the wildcard certificate
    since I was able to goto:
    https://subdomain.mycompany.com (FYI, the subdomain is NOT "www")
    But after I went to:
    https://subdomain.mycompany.com/tarantella/
    I got the following errors in my Java Console:
    Secure Global Desktop 4.10.903: Connecting to Secure Global Desktop
    server...
    Secure Global Desktop 4.10.903: Using secure connection to
    Secure Global Desktop server subdomain.mycompany.com:443
    Secure Global Desktop 4.10.903: Certificate (*.mycompany.com) not accepted
    for this Secure Global Desktop server (subdomain.mycompany.com) due to
    name
    mismatch.
    Secure Global Desktop 4.10.903: Client dropping connection.
    Secure Global Desktop 4.10.903: Unable to connect: Certificate
    (*.mycompany.com) not accepted for this Secure Global Desktop server
    (subdomain.mycompany.com) due to name mismatch.
    Secure Global Desktop 4.10.903: Missing negotiation feature cgi script
    Is there a way that I can get the applet to do a regex-ish match on thename
    for wildcard certs?
    Cyrus

Maybe you are looking for