OIF 11.1.1.4.0 Signing Certificate Question

How does the old/new model for Wallets (Security and Trust) used for Signature and Encryption works?
We are trying to roll out two signing certificates at the same time. This will allow our customer to update their IdPs (the ones that decided to verify our signature) at their own pace.
When I install two certs (PKCS wallet) I can retrieve them with /fed/sp/cert?type=new and /fed/sp/cert?type=old . But how does the SP knows which cert needs to sign with? At this point it seems that all request to the ACS (fed/sp/samlv11sso) are being answered with the old certificate.
I have been looking all over for documentation on this process and still can't find anything relevant.
*PS we use SAML 1.1 Artifact profile.
Thanks!
-Noel

I found the answer and I guess is not what I was thinking it was.
8.3 Managing Signing and Encryption Wallets
Oracle Identity Federation provides a way to update signing and/or encryption wallets smoothly, without interrupting service.
When you need to replace a signing or encryption wallet and a new one is uploaded, Oracle Identity Federation saves the old wallet. The server then continues to use the old wallet in all transactions until it is removed. However, generated metadata will contain the new wallet information as well as the old information. This allows time to notify remote providers about the change.
Once new metadata has been created and distributed to all remote providers, the old wallet can be deleted and Oracle Identity Federation will use the newly uploaded wallet for all subsequent transactions.

Similar Messages

  • A PKI Code Signing Certificate question.

    Hello,
    Can someone please help me with the following question.
    I have created and used a code Signing certificate from our Microsoft Enterprise CA before which works OK, but I am not sure I did it correctly, and have a few related questions please.
    what I did.
    1: Logged on the CA directly, went to the CertSvc web site, requested a code signing cert, issued it and exported it along with the private key.
    2: Imported the above certificate into CurrentUser/My store on PC and used it to sign code
    3: Took the came certificate (along with the private key, and this is where perhaps I made at least one mistake) and imported it into the 'Trusted Publishers' store the PC that will be running the signed code. This step was done so the user does not receive
    a message asking if they want to run the code signed by "AAnotherUser" as it were, as although the code is signed by a trusted CA, the user still gets this warning message as the 'Publisher' is not in the 'Trusted Publishers' list. Therefore the
    way I sorted this at the time was to take the whole certificate as above and import to this store.
    The first mistake I made (as far as I can see as I am new to this area) I think I should have not imported the certificate 'along with its private key' into the trusted publishers store? in other words should I have imported the certificate 'minus its
    private key' into the trusted publishers store?
    Also, I understand you have to have the certificate along with is private key to sign code. I am 'assuming' a Hash of the code is taken and this is signed (encrypted) with the private key (in the same way a CA signs a CSR for a WEBServer cert for example),
    is that correct i.e. is that what it mean to sign code?
    if the above is correct then I assume you only need the 'public' key of the code signed cert in the 'Trusted Publishers Store' to verify the code was signed by a trusted CA and it has not been altered e.g. the Hash code still computes to the same value.
    Is this correct?
    My next question is regarding the private key. As I need to 'Login' to AD in order to request a code signing cert, can the 'private key' not be stored securely in AD along with my AD User account?
    if the above is possible (which would make good sense to me I think) then I do not have to worry about looking after the safety of the private key as the system 'AD' can do this for me. It would also mean which every computer I logon to in the domain I would
    have access to the private key (but no other user) and therefore be able to sign code I assume. Does this last paragraph make sense can this be done/is this done?
    Basically I need to understand the above, in order to understand more about Crypto.
    I also need create a code signing cert for a 'department' of about 10 people. Therefore I was thinking about creating and AD account called 'XYZCorpCodeSigning' or what ever, and issuing a code singing cert to this entity. If the private key could be stored
    in AD then accessed used once signed in as this account (these 10 people would need to know the password for the account) this would make life easier/more secure, I think.
    I know there are several question above, but it would be great it they would be answered as I would help me understand more about how it all works and to solve a problem too
    Thanks very much
    AAnotherUser__
    AAnotherUser__

    > The first mistake I made (as far as I can see as I am new to this area) I think I should have not imported the certificate 'along with its private key' into the trusted publishers store
    yes, it is not correct. Only public part should be imported to a Trusted Publishers container.
    >  is that correct i.e. is that what it mean to sign code
    exactly. Encryption with private key and decrypting with public key is called "digital signature".
    > if the above is correct then I assume you only need the 'public' key of the code signed cert in the 'Trusted Publishers Store' to verify the code was signed by a trusted CA and it has not been altered e.g. the Hash code still computes to the same
    value. Is this correct?
    yes. Client uses only public part of the certificate to validate the signature.
    > As I need to 'Login' to AD in order to request a code signing cert, can the 'private key' not be stored securely in AD along with my AD User account?
    normally code signing certificates are not stored in Active Directory and should not be there, because signing certificate is included in the signature field.
    > I do not have to worry about looking after the safety of the private key as the system 'AD' can do this for me.
    this is wrong assumption. A user is responsible to protect signing private key from unauthorized use.
    > If the private key could be stored in AD then accessed used once signed in as this account (these 10 people would need to know the password for the account) this would make life easier/more secure
    wouldn't, because if something happens -- you will never know who compromised the key.
    as a general practice, we recommend to purchase at least few smart cards to store signing keys. Depending on a particular code development practice, there might be a dedicated employee (for example, manager of devs) who the only has access to a smart card
    (and PIN) and signs the code upon dev request. Or issue a dedicated smart card with unique signing certificate to each developer. However this will add a complexity in signing certificate trust management.
    My weblog: en-us.sysadmins.lv
    PowerShell PKI Module: pspki.codeplex.com
    PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
    Check out new: SSL Certificate Verifier
    Check out new:
    PowerShell FCIV tool.

  • Step by Step Instructions for Installing Self Signed Certificate using Certificate Modification Tool

    I am looking for some step by step instructions for installing the self signed certificate from my Microsoft SBS 2003 server on a Treo 755p and 750p.  In particular I need some help with the form of the actual certificate and how to use the Certificate Modification tool. 
    Some questions I have are as follows:
    1. When I install the certificate on a Windows Mobile device I used an exported version of the certificate.  This export is done using the DER x.509 format.  Is that the same form I’ll need for the Palm?  Do I need some other form? Can/should I just use sbscert.cer file that is generated when SBS is configured?
    2. Does the self signed cert need to be installed on the computer being used to update the Palm or do we just need to be able to access the appropriate .CER file?
    3. There are three things included in the PalmCertificatesTool.zip file:
                                    Trusted CAs (folder)
                                    Cert2pdb.exe
                                    PalmCertificates.exe
       How do I use these tools?
    4. It looks like the PalmCertificates.exe file opens an interface that will allow me to browse to the desired .CER file.  Then I suppose I use the < Generate PDB > to create something that needs to then be uploaded to the Palm device?  Not having any real experience with a Palm device how do I upload and install this file? 
    5. Once uploaded do I do something on the device to install it?
    If there is some white paper that provides step by step instructions on doing this that would be great.
    Thanks,
    Walt Bell
    Post relates to: Treo 755p (Verizon)
    Post relates to: Treo 755p (Verizon)

    Thanks for that.
    I have one question after reading the article 43375:
    The article has you "Turn of AutoSync" and then "Reset the device".  It then indicates the device should be left idle. 
    The next step relates to running the PalmCertificates.exe, navigate to the certificate file and add it and then run the < Generate PDB > button.  Should the device be connected to the computer during this process? If so, at what point after the reset do you connect it to the computer?
    Thanks!
    Post relates to: Treo 755p (Verizon)

  • ADFS with SharePoint 2013 RP: What to do when Token Signing Certificate is about to expire?

    Hello,
    I have an ADFS with a SharePoint 2013 Relying Party.
    I’ve assigned a primary token signing certificate to the ADFS environment. I had to run this command to be able to add the token signing certificate and “Set as Primary”:
    Set-ADFSProperties -AutoCertificateRollover $false
    The certificate is valid until one more year and I am concern what happens after the certificate expires. I assume I need to update SharePoint’s SPTrustedIdentityTokenIssuer.
    Is there any guideline explains how to update the Token Signing Certificate after it expires?
    Thank you,

    Hi Allan,
    If certificate is due to expire, you could choose to renew the certificate by importing certificate. However, ADFS could generate certificate itself. if you use ADFS to generate the new token signing certificate, you could use the Set-ADFSProperties cmdlet
    to modify the CertificateDuration property to increase the validity period.
    For more information:
    http://www.benjaminathawes.com/2013/07/31/how-to-renew-your-adfs-2-0-token-signing-certificate-in-sharepoint/
    Regards,
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected] .
    Rebecca Tu
    TechNet Community Support

  • ACS 5.3 / Self Signed / Certificate base auth

    Hello,
    Our ACS (5.3) has self signed certificate, we have exported it and declared it in Certificate Authorities.
    We have exported it to have a Trusted Certificate for client machine.
    This certificat has been installed on a laptop.
    The wlc is successfully setup for eap (peap & eap-fast has been tested > ok)
    I have this error in the log:
    12514 EAP-TLS failed SSL/TLS handshake because of an unknown CA in  the client certificates chain
    I think the Access Policies (identity & authorization) are misconfigured:
    > I allowed Host Lookup, PAP/ASCII, MSCHAPV2, EAP-MD5, EAP-TLS, PEAP, EAP-FAST
    > Identity: System:EAPauthentication match EAP-TLS
    id Source: AD in which AD, Internal Users, Password based, certificate based CN Username are enabled
    > authorization: System:WasMachineAuthenticated=True
    Thanks for your help,
    regards,

    Hello,
    I found the answer here:
    https://supportforums.cisco.com/message/1298039#1298039
    ACS self-signed certificate is not compatible with EAP-TLS
    Thanks,

  • How to register iOS device when using self signed certificate with apple Server?

    Hi,
    I have installed the server.app by Apple and used a slef signed certificate for my server. Now I want to register my different devices (iMac, iPhone etc.). I could register the iMac without problesm (I just had to add my self signed certificate to the trusted certificates)
    Sadly, with the iPhone it is not that easy. I can install the "trust profile", but still after that I can not register my device. It seems like it does not accept my self signed certificate for device registration. When adding a registration profile, I get the error "www._mydomain_.tld/devicemanagement/api/device/auto_join_ota_service" is not valid.
    Nethertheless, I can install a profile with setting, e.g. my imap settings, via the profile management without problems.
    Does anyone have an idea how to get around the problem with the self signed certificate?
    Best regards

    Try deleting the Server.app and download it again from the App Store, restart.
    My Server is also using self signed certificates and is working with iOS device (Trust Profile needed first).

  • How to use Java code signing certificate in oracle 11i

    Hello,
    I am try to configure java code signing certificate in 11.5.10.2 application. we got java sign certificate from verisgin. SA's imported the certificate and created alias XXX_XXX with password and passphrase.
    I am able to see the my certificate. keytool -list -v -keystore xxx_xxxx.jks -storepass Password.
    how do I use it. I am using Enhance Jar Signing for EBS DOC ID 1591073.1.
    could you please give me some advice on it?
    Thanks
    Prince

    Hussien,
    I find out apps keystore keypassword and storepassword, I imported the java code sign certificate. I generated Jar files through adadmin, but I am getting  warning error
    adogif() unable to generate Jar Filers under JAVA_TOP.
    executing /usr/jdk/jdk1.6.0_45/bin/java sun.security.tools.JarSigner keysotre **** -sigfile CUST Signer /apps/......
    Error JarSigner subcommand Exited With status 1.
    No standard output from jarsigner JarSigner error output: Exception in thread "main" java.lang.NoClassDefFoundError: sun/security/tools/JarSigner Caused by: java.lang.ClassNotFoundException: sun.security.tools.JarSigner         at java.net.URLClassLoader$1.run(URLClassLoader.java:202)         at java.security.AccessController.doPrivileged(Native Method)         at java.net.URLClassLoader.findClass(URLClassLoader.java:190)         at java.lang.ClassLoader.loadClass(ClassLoader.java:306)         at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301)         at java.lang.ClassLoader.loadClass(ClassLoader.java:247) Could not find the main class: sun.security.tools.JarSigner.  Program will exit. WARNING: The following path(s), defined in /apps2/property/product/tst/appl/cz/11.5.0/java/make/czjar.dep as elements of the output:   oracle/apps/cz/runtime/tag WARNING: Copying cztag.lst from the old fndlist.jar ...   About to Analyze flmkbn.jar : Fri Nov 22 2013 10:45:51
    Please let me know if you have any idea. Thanks Prince

  • Does anyone know how to use a self signed certificate with apple mail??

    Ive read about it in mail's help and tried to set it up according to it. Ive created a self-signed certificate but have no idea how to set it up as it would work with Mail so that i would be able to send signed messages. could anyone help me??

    Hello rado:
    Welcome to Apple discussions.
    I am assuming this is what you read:
    http://docs.info.apple.com/article.html?path=Mac/10.5/en/8916.html
    If you follow the instructions when you set up the certificate, you should be fine.
    Incidentally, most +"ordinary users"+ (like me) do not use this function. I am curious as to why you want to jump through hoops in your Mail application.
    Barry

  • Possible to select self-signed certificate for client validation when connecting to VPN with EAP-TLS

    In windows 8.2, I have a VPN connection configured with PPTP as the outer protocol and EAP : "Smart card or other certificate ..." as the inner protocol. Under properties, in the "When connecting" section I've selected "Use a certificate
    on this computer" and un-checked "Use simple certificate selection".
    My preference would be to use separate self-signed certificates for all clients rather than having a common root certificate that signed all of the individual client certificates. I've tried creating the self-signed certificate both with and without the
    client authentication EKU specified, and I've added the certificate to the trusted root certificate authority store on the client. But when I attempt to connect to the VPN I can not get the self signed certificate to appear on the "Choose a certificate"
    drop down.
    Are self signed certificates supported for this use in EAP-TLS? If it makes a difference, I'm working with makecert (not working with a certificate server).
    TIA,
    -Rick

    Hi Rick,
    Thank you for your patience.
    According to your description, would you please let me know what command you were using to make a self-signed certificate by tool makecert? I would like to try to reproduce this issue. Also based on my experience, please let me
    know if the certificate has private key associated and be present in the local machine store. Hence, please move the certificate from the trusted root certificate authority store to personal store.
    Best regards,
    Steven Song
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • Failed to create machine self-signed certificate for site role [SMS_SQL_SERVER]

    SCCM 2012 has been successfully installed on the server:
    SRVSCCM.
    The database is on SQL Server 2008 R2 SP1 CU6 Failover Cluster (CLS-SQL4\MSSQLSERVER04)
    Cluster nodes: SQL01 and SQL01. On all nodes made necessary the Security Setup of SCCM. No errors and warning on SCCM Monitoring.
    The cluster service is running on the account: sqlclusteruser
    The account has the appropriate SPN are registered:
    setspn -L domain\sqlclusteruser
    Registered ServicePrincipalNames for CN=SQL Cluster,OU=SQL,OU=Users special,OU=MAIN,DC=domain,DC=local:
    MSSQLSvc/CLS-SQL4
    MSSQLSvc/CLS-SQL4.domain.local
    MSSQLSvc/CLS-SQL4:11434
    MSSQLSvc/CLS-SQL4.domain.local:11434
    After some time on the cluster hosts every day started appearing new folders with files inside:
    srvboot.exe
    srvboot.ini
    srvboot.log
    srvboot.log contains the following information:
    SMS_SERVER_BOOTSTRAP_SRVSCCM.domain.local_SMS_SQL_SERVER started.
    Microsoft System Center 2012 Configuration Manager v5.00 (Build 7711)
    Copyright (C) 2011 Microsoft Corp.
    Command line: "SMS_SERVER_BOOTSTRAP_SRVSCCM.domain.local_SMS_SQL_SERVER CAS K:\SMS_SRVSCCM.domain.local_SMS_SQL_SERVER8 /importcertificate SOFTWARE\MicrosoftCertBootStrap\ SMS_SQL_SERVER".
    Set current directory to K:\SMS_SRVSCCM.domain.local_SMS_SQL_SERVER8.
    Site server: SRVSCCM.domain.local_SMS_SQL_SERVER.
    Importing machine self-signed certificate for site role [SMS_SQL_SERVER] on Server [SQL01]...
    Failed to retrieve SQL Server service account.
    Bootstrap operation failed: Failed to create machine self-signed certificate for site role [SMS_SQL_SERVER].
    Disconnecting from Site Server.
    SMS_SERVER_BOOTSTRAP_SRVSCCM.domain.local_SMS_SQL_SERVER stopped.

    The site server is trying to install the sms_backup agent on the SQL Server Cluster nodes.
    Without successfull bootstrap the siteserver backup is not able to run successfully.
    Try grant everyone the read permisson on
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS on the SQL server nodes.
    This worked for me.
    After that a Folder named "SMS_<SITESERVER-FQDN>" appeared on C: on the SQL Cluster nodes, and a "SMS_SITE_SQL_BACKUP_FQDN" Service should be installed.
    After the new Folder is created and the new Service is installed, you can safely remove the bootstrap Service by opening a command prompt and enter:
    sc delete "SMS_SERVER_BOOTSTRAP_FQDN-of-SiteServer_SMS_SQL_SERVER"

  • How to replace an expiring self-signed certificate?

    Well, I've successfully (I THINK) replaced two of the three certificates that are expiring.
    First off - 90% of what's in the Security manual concerning certificates is useless to this issue. I don't want to know how the watch is made - I just want to tell time! In fact there is a GLARING typo on Page 167 of the Snow Leopard Server Security Configuration Manual showing a screenshot of the Certificate Assistant in Server Admin that is just plain wrong!
    It's clear there is no way to RENEW the certificate. You have to delete the old one and replace it with a new certificate.
    The issue I have is that with all the services using the certificate, I don't know what the impact to the end-users is going to be when I delete that expiring certificate.
    It appears that a certificate is created automatically when the OS is installed, although I installed the OS Server on a virtual machine and I didn't see where it got created, nor was I given any input during the creation (like extending the expiration date).
    I don't know whether those certificates are critical to the running of the OS or not, but I went through the process of creating a new certificate in Server Admin. I deleted the expiring certificate. Because the two servers on which the expiring certificate was deleted does not have any services running that require a certificate (such as SSL on my mail server), nothing bad seems to have happened or been impacted negatively.
    I did, however, name the new certificate the exact same thing as the old certificate and tried to make sure that the parameters of the new certificate were at least as extensive as the old certificate. You can look at the details of the old certficate to see what they were.
    Here's the "critical" area of the certificate that was "auto-created" on my virtual server. (It's the same as the one on my "real" server.
    http://screencast.com/t/zlVyR2Hsc
    Note the "Public Key Info" for "Key Usage": Encrypt, Verify, Derive. Note the "Key Usage" Extension is marked CRITICAL and it's usage is "Digital Signature, Data Encipherment, Key Cert Sign". Extended Key Usage is also critical and it's purpose is Server Authentication.
    Here's a screenshot of the default certificate that's created if you create a new self-signed certificate in Server Admin:
    http://screencast.com/t/54c2BUJuXO2
    Note the differences between the two certificates. It LOOKS to me like the second certificate would be more expansive than the default issued at OS Install? Although I don't really care about Apple iChat Encryption.
    Be aware that creating certificates starts to populate your server Keychain.
    http://screencast.com/t/JjLb4YkAM
    It appears that when you start to delete certificates, it leaves behind private keys.
    http://screencast.com/t/XD9zO3n16z
    If you delete these keys you get a message warning you about the end of the world if you delete private keys. I'm sorry if your world melts around you, but I'm going to delete them from my Keychain.
    OK, now I'm going to try to create a certificate that is similar to the one that is created at start-up.
    In Server Admin, highlight your server on the sidebar and click the "Certificates" tab in the icon bar.
    Click the "+" button under your existing certificate and select "Create a Certificate Identity". (This is how I created the default certificate we just got through looking at except I clicked through all the defaults.)
    Bypass "Introduction".
    In the "Create Your Certificate" window I set the "Name" as exactly the same as the name of the expiring certificate. I'm HOPING when I do this for my email server, I won't have to go into the services using the certificate and select the new one. On the other hand, naming it the same as the old one could screw things up - I guess I'll know when I do it later this week.
    The "Certificate Type" defaults to "SSL Server" and I think this is OK since that's what I'll be using this certificate for.
    You HAVE to check the "Let me override defaults" if you want to, for example, extend the expiry period. So that's what I want to do, so I checked it.
    In the next window you set the Serial Number and Validity Period. Don't try typing "9999" (for an infinite certificate) in the "Validity Period" field. Won't work - but you CAN type in 1826 (5 years) - that works - Go Figure!??? You can type in a bigger number than that but I thought 5 years was good for me.
    The next part (Key Usage Extension) is where it gets sticky. OF COURSE there is NO DOCUMENTATION on what these parameters mean of how to select what to choose.
    (OK here's what one of the "explanations" says: "Select this when the certificate's public key is used for encrypting a key for any purpose. Key encipherment is used for key transport and key wrapping (or key management), blah, blah, blah, blah, blah blah!") I'm sure that's a clear as day to you rocket scientists out there, but for idiot teachers like me - it's meaningless.
    Pant, pant...
    The next window asks for an email address and location information - this appears to be optional.
    Key Pair Information window is OK w/ 2048 bits and RSA Algorithm - that appears to be the same as the original certificate.
    Key Usage Extension window
    Here's where it gets interesting...
    I brought up the screenshot of the OS Install created certificate to guide me through these next couple of windows.
    Since the expiring cert had "Digital Signature, Data Encipherment, Key Cert Sign" I selected "Signature, Data Encipherment and Certificate Signing".
    Extended Key Usage Extension...
    Hoo Boy...Well, this is critical. But under "Capabilities" it lists ANY then more stuff. Wouldn't you THINK that "ANY" would include the other stuff? Apparently not..."Learn More"?
    Sorry, folks, I just HAVE to show you the help for this window...
    +*The Extended Key Usage Extension (EKU) is much like the Key Usage Extension (KUE), except that EKU values are defined in terms of "purpose" (for example, signing OCSP responses, identifying an SSL client, and so on.), and are easily extensible.  EKU is defined with object identifiers called OIDs.  If the EKU extension is omitted, all operations are potentially valid.*+
    KILL ME NOW!!!
    OK (holding my nose) here I go...Well, I need SSL Server Authentication (I THINK), I guess the other stuff that's checked is OK. So...click "Continue".
    Basic Constraints Extension...
    Well, there is no mention of that on the original certificate, so leave it unchecked.
    Subject Alternate Name Extension...
    Nothing about that in the original certificate, so I'm going to UNCHECK that box (is your world melting yet?)
    DONE!!!! Let's see what the heck we got!
    http://screencast.com/t/QgU86suCiQH
    Well, I don't know about you but that looks pretty close for Jazz?
    I got some extra crap in there but the stuff from the original cert is all there.
    Think we're OK??
    Out with the old certificate (delete).
    Oh oh - extra private key - but which is the extra one? Well, I guess I'll just keep it.
    http://screencast.com/t/bydMfhXcBFDH
    Oh yeah...one more thing in KeyChain Access...
    See the red "X" on the certificate? You can get rid of that by double clicking on the certificate and expanding the "Trust" link.
    http://screencast.com/t/GdZfxBkHrea
    Select "Always Trust".
    I don't know if that does anything other than get rid of the Red "X", but it looks nice. There seem to be plenty of certificates in the Keychain which aren't trusted so maybe it's unnecessary.
    I've done this on both my file server and my "test" server. So far...no problems. Thursday I'll go through this for my Mail server which uses SSL. I'm thinking I should keep the name the same and not replace the certificates in the iCal and Mail service which use it and see what happens. If worse comes to worse, I may need to recreate the certificate with a different name and select the new certificate in the two services that use it.
    Look...I don't know if this helps anyone, but at least I'm trying to figure this idiocy out. At least if I screw up you can see where it was and, hopefully, avoid it yourself.
    If you want to see my rant on Apple's worthless documentation, it's here.
    http://discussions.apple.com/thread.jspa?threadID=2613095&tstart=0

    to add to countryschool and john orban's experiences:
    using the + Create a Certificate Identity button in Server Admin is the same thing as running KeyChain Access and selecting Certificate Assistant from the app menu, and choosing Create a Certificate. Note that you don't need to create a Certificate Authority first.
    in the second "extended key usage extension" dialog box, i UN-checked Any, PKINIT Server Authentication, and iChat Encryption. this produced the closest match to the server's default self-installed certificate.
    when updating trust settings in Keychain Access, the best match to the original cert are custom settings - set Always Trust for only SSL and X.509 Basic Policy.
    supposedly you can use Replace With Signed or Renewed certificate button from Server Admin and avoid needing to re-assign to services. however i was unable to get this to work because my new cert didn't match the private key of the old. for those interested in going further, i did figure out the following which might be helpful:
    you can't drag and drop a cert from Keychain Access or Cert Manager. you need the actual PEM file. supposedly you can hold down the option button while dragging, but this didn't work for me. however you can view the certificates directly in etc/certificates. but that folder is hidden by default. a useful shortcut is to use Finder / Go To Folder, and type in "/private/etc/certificates"
    now, on my system the modification date was the same for old and new certificates. why? because it seems to be set by when you last viewed them. so how do you know which is which? answer: compare file name to SHA1 Fingerprint at bottom of certificate details.
    after you delete the old certificate, it will disappear in Keychain Access from "System" keychains. however in "login" keychains the old one will still be there but the new one won't. it seems to make sense to delete the old one from here and add the new one. somebody tell me if this is a bad idea. the + button does not work easily for this, you need to drag and drop from the etc/certificates folder.
    lastly, the "common name" field is the server/host name the client will try to match to. you can use wildcard for this, e.g. *.example.com. if you need to, you can use the Subject Alternate Name to provide an alternative name to match to, in which case the common name field will be ignored, which is why by default the dNSName alternate field defaults to the common name. more info here: http://www.digicert.com/subject-alternative-name-compatibility.htm.
    maybe that's hopeful to somebody. but i stopped there since things seem to be working.
    last note, which you probably know already - if you don't want to bother installing the certificate in your client computers and phones, you can select Details when the first trust warning pops up and select Always Trust.
    now, we'll see how everything works once people start really using it...

  • How do I prevent Mail from using a particular signing certificate?

    I use Apple Mail for my emails, on a MacBook Pro running Lion 10.7.5.
    In my Mail client, I have two email accounts configured. One (we'll call this the Signed Account) has a signing certificate purchased from Verisign; the other (the Unsigned Account) does not. I would like to be able to sign — and, where appropriate, encrypt — emails I send from the former account, but not the latter, by default.
    Which would be the normal behaviour for Mail, I'm given to understand. Except that I have a second signing certificate on my computer. (I have several, in fact, but only the two I mention are important.) This second certificate was obtained from an academic grid signing authority for the purposes of connecting as an administrator to particular web databases. It's not intended to be used for email.
    But Mail tries to use it nonetheless. Specifically, because the certificate uses the email address of the Unsigned Account (for contact details?), the Mail program thinks it's good for signing emails sent from that account.
    The only way I've been able to disable that function (and, thus, avoid the big, ugly banner that says, "Unable to verify message signature.") is by turning off signing altogether (checking the seal button in the Compose window). This affects the other account — the Signed Account — as well.
    I tried to set the "Secure Mail (S/MIME)" setting to Never Trust in the Keychain settings for that particular certificate, but it doesn't seem to have changed anything in this regard.
    Is there a way of "permanently" disabling signing (but only if using the Unsigned Account), while keeping signing in place for the Signed Account? This could be in Mail itself, in Keychain Access, or in some other place.
    Thanks!

    Hmm.. probably not.
    You want to open Mail. Then go into Preferences > General and you will see something similar to this:
    In the area marked Default Mail reader click on the pull down and at the bottom of the list it will say Other. You can see if you can select Safari here and if that will open up Safari.
    Good luck.

  • Mail App Not Working with Self-Signed Certificates

    First and foremost, I apologise for starting another thread that is 90% similar to others but I wanted to avoid falling into an existing context.  Like may others, I am having issues with the Mail App in Mavericks but I have an email account other than G-Mail.
    That being said, here is the issue I am having.  Until recently I never had an issue sending and receiving email from various accounted.  My Internet provider, an Exchange account, even a G-Mail account.
    Yesterday, my Web hosting provider issued a new (self-signed) certificate as the old one had expired (which was also a self-signed certificate).  While I am able to still receive messages, I am no longer able to send any.
    I have tried numberous possible solutions to no avail.  I have removed and readded my email account, I have refreshed my SMTP settings, I have removed all semblence of the account from my Key Chain, added the Certificate manually with full trust, and I have even flushed the caches from my ~/Library/ folder.  The last one perked up the Mail App but did not restore my ability to send messages from my Web provider's SMTP server.
    I suspect this is a bug in the Mail App but I'm hoping I can find a few last solutions before I file a bug report.
    In the meantime, I am using another outgoing server from my Internet provider.  It will do but for consistency I'd much rather use the outgoing server that came with the email account in question.
    I am all but convinced it is the Mail App as Thunderbird is able to use the SMTP server just fine and I am still able to send messages using the exact same settings on my iPhone and iPad.
    In case it helps, I am using a Early 2011 MacBook Pro with the latest Mavericks update (which ironically was meant to solve some issues other users had with the Mail App).
    On a related note, I wish I had stayed on Snow Leopard.  I did not have a single issue with that OS.  Now I feel like I am working on Windows Vista again and I am waiting for the Apple version of Windows 7 to set things right.

    MrsCDS wrote:
    I am using an iPhone 6 plus on iOS 8.1 and suddenly my Yahoo email account will not populate to my Mail app. I have deleted and re-added the account and also re-booted the phone with no luck. I get the spinning wheel up by my Wi-Fi signal that suggests it's attempting to do something, but the bottom of the Inbox only says "Updated Yesterday." Has anyone else experienced this or can someone, especially an Apple employee, tell me how to fix this?
    There is no Apple in this user to user technical forum, if you want an Apple employee you would need to take your phone to the Apple store.
    What happens when you switch to using cellular data?  Does your email update?
    FYI - Yahoo email account is notoriously bad, you can try their app.

  • Steps to create your own self signed certificate with java plugin working

    You need two tools that comes with your jdk which are keytool and jarsigner.
    Steps explain below in detail. Don't use netscape signtool, it will NEVER work!
    * keytool -genkey -keyalg rsa -alias tstkey -keypass 2br2h2m -dname "cn=Test Object Signing Certificate, o=AI Khalil, ou=Java Products, c=AU"
    cn = Certificate name
    o = organistation
    ou = organistation unit
    c = country (first two letters)
    If don't put the -dname, you can fill it line by line.
    The -keypass has to be verify at the end, and you have to wait for it to create the rsa signing keys.
    On NT by default it will put the alias information at D:\WINNT\Profiles\Administrator (if log in as administrator) with the default file called ".keystore". Windows 98 etc, don't know, search for .keystore
    file. When you update it, check for the timestamp change and you know if you at the right spot.
    You can store your alias information via the -storepass option to your current directory you work on, if you don't want to update the default .keystore file?
    The .keystore contains a list of alias so you don't have to do this process again and again.
    Another tip if you want your certificate encryption validity to be more than the default one month is simply
    add the -validity <valDays>, after the -genkey option, to make your certificate usage for encryption to last much longer.
    Note: You MUST use the -keyalg rsa because for starters the rsa encyption alogorthim is supported on ALL browsers instead of the default DSA and the other one SHA. Java plugins must work with the RSA algorthim when signing applets, else you will get all sorts of weird errors :)
    Do not use signtool because thats a browser dependant solution!! Java plugin is supposed to work via running it owns jre instead of the browser JVM. So if you going to use netscape signtool, it starts to become a mess! ie certificate will install, but applet won't start and give you funny security exception errors :)
    * keytool -export -alias tstkey -file MyTestCert.crt
    It will read the alias information in the .keystore information picking up the rsa private/public keys info and
    create your self sign certificate. You can double click this certificate to install it? But don't think this step is needed but maybe for IE? Someone else can check that part.
    If you make a mistake with the alias, simply keytool -delete -v -alias <your alias key>
    If not in default .keystore file, then simply keytool -delete -v -alias <your alias key> -keystore <your keystore filename>
    * Put your classes in your jar file, my example is tst.jar.
    * jarsigner tst.jar tstkey
    Sign your testing jar file with your alias key that supports the RSA encryption alogorthim.
    * jarsigner -verify -verbose -certs tst.jar
    Check that its been verified.
    The last step is the most tricky one. Its to do with having your own CA (Certified Authority) so you don't
    have to fork out money straight away to buy a Verisign or Twarte certificate. The CA listing as you see in
    netscape browsers under security/signers, is NOT where the plugin looks at. The plugin looks at a file called
    CACERTS. Another confusion is that the cacerts file is stored in your jre/lib/security AND also at your
    JavaSoft/Jre/<Java version>/lib/security. When you install the Java plugin for the first time in uses your
    JavaSoft folder and its the cacerts file that has to be updated you add your own CA, because thats where
    the plugin look at, NOT THE BROWSER. Everything about plugin is never to do with the browser!! :)
    * keytool -import -file MyTestCert.crt -alias tstkey -keystore "D:\Program Files\JavaSoft\JRE\1.3.1\lib\security/cacerts"
    Off course point to your own cacerts file destination.
    Password to change it, is "changeit"
    Before you do this step make a copy of it in its own directory in case you do something silly.
    This example will add a CA with alias of my key called "tstkey" and store to my example destination.
    * keytool -list -v -keystore "E:/jdk/jdk1.3/jre/lib/security/cacerts"
    List to see if another CA is added with your alias key.
    Your html, using Netscape embed and Internet explorer object tags to point to the java plugin,
    your own self sign applet certificate should work
    Cheers
    Abraham Khalil

    I follow Signed Applet in Plugin, and it's working on
    my computer. Thanks
    But When I open my applet from another computer on
    network, why it does not work ..?
    How to make this applet working at another computer
    without change the policy file ..?
    thanks in advance,
    AnomYou must install the certificate on that computers plugin. Can this be done from the web? can anyone suggest a batch file or otherwise that could do this for end users?
    I want a way for end users to accept my cert as Root or at least trust my cert so I dont have to buy one. I am not worried about my users refusing to accept my cert. just how do I make it easy for them? IE you can just click the cert from a link, but that installs for IE, and not the plugin where it needs to be.

  • Adobe AIR 3 Performance Issues and Code Signing Certificate Problem

    I recently updated to Adobe AIR 3.0 SDK (and runtime) doing HTML/Javascript development using Dreamweaver CS5.5 in a Windows 7 Home Premium (64 bit).
    The AIR app I'm developing runs well from within Dreamweaver. But when I create/package the AIR app and install it on my machine:
    1. The app literally CRAWLS running it in my Windows 7 12G RAM machine (especially when I use the mouse to mouse over a 19-by-21 set of hyperlinks on a grid) --- IT IS THAT SLOOOOWWWW...
    2. The app runs fine in my Mac OS X 10.6.8 with 4G RAM, also using the Adobe AIR 3 runtime.
    About the Code Signing Certificate problem:
    When I try to package the AIR app with ADT using AIR's temporary certificate feature, I get the error message "Could not generate timestamp: handshake alert: unrecognized_name".
    I found some discussions on this problem in an Adobe AIR Google Groups forum, but no one has yet offered any resolution to the issue. Someone said Adobe is using the Geotrust timestamping service --- located at https://timestamp.geotrust.com/tsa --- but going to this page produces a "404 --- Page not found" error.
    The Google Groups Adobe AIR page is here:
    http://groups.google.com/group/air-tight/browse_thread/thread/17cd38d71a385587
    Any ideas about these issues?
    Thanks!
    Oscar

    I recently updated to Adobe AIR 3.0 SDK (and runtime) doing HTML/Javascript development using Dreamweaver CS5.5 in a Windows 7 Home Premium (64 bit).
    The AIR app I'm developing runs well from within Dreamweaver. But when I create/package the AIR app and install it on my machine:
    1. The app literally CRAWLS running it in my Windows 7 12G RAM machine (especially when I use the mouse to mouse over a 19-by-21 set of hyperlinks on a grid) --- IT IS THAT SLOOOOWWWW...
    2. The app runs fine in my Mac OS X 10.6.8 with 4G RAM, also using the Adobe AIR 3 runtime.
    About the Code Signing Certificate problem:
    When I try to package the AIR app with ADT using AIR's temporary certificate feature, I get the error message "Could not generate timestamp: handshake alert: unrecognized_name".
    I found some discussions on this problem in an Adobe AIR Google Groups forum, but no one has yet offered any resolution to the issue. Someone said Adobe is using the Geotrust timestamping service --- located at https://timestamp.geotrust.com/tsa --- but going to this page produces a "404 --- Page not found" error.
    The Google Groups Adobe AIR page is here:
    http://groups.google.com/group/air-tight/browse_thread/thread/17cd38d71a385587
    Any ideas about these issues?
    Thanks!
    Oscar

Maybe you are looking for