Problem Installing Entrust SSL Certificate

Hello:
We are using BEA Weblogic 6.1 SP1. This year when we renew SSL certificate, we changed vendor from Verisign to Entrust. I just got the certificate from Entrust. Here's what happended:
1. In the Entrust certificate email, it says "Entrust would like to inform you that as of January 1, 2004, the current GTE Corporation chain certificate that is distributed with all Entrust SSL certificates, will no longer be distributed with certificates that have an expiry date greater than January 1, 2006". However, I can't get Weblogic started on SSL without a valid ServerCertificateChainFileName. So I got the ServerChainFile from http://www.entrust.net/tech/weblogic6/removechain.cfm and saved the certificate into entrust-cert.pem file.
2. It works on the server with BEA development license. However, when I move it to test web server with "SSL/Export" license, it gives this error "<License allows low strength (export) SSL.>" and Weblogic won't even start on both HTTP and SSL port.
3. After trying all sorts of things and nothing helped, I'm wondering whether it's OK to use the same CSR request I generated using Weblogic certificate servlet last year, since no information has been changed since then?
Does anybody have similar experience and can you shed some light on how to solve this issue. Should I contact Entrust to get a low strength SSL?
Thanks in advance!
Jenny

It looks like you have the correct certificate but perhaps didn't import it the correct way. Did you create the Certificate Request on the same machine as you imported it? Otherwise you don't have the private key. If not them import the certificate on the
same where you created the CR and then export the certificatye and make sure you select to export the private key as well and then import it on the RDS. If you followed the import steps correctly I suggest you contact GoDaddy to make sure the delivered
a valid certificate.
Kind regards,
Freek Berson
http://microsoftplatform.blogspot.com/

Similar Messages

Problem Installing a SSL Certificate on a RD Server

I'm trying to install a 3rd party SSL Certificate (GoDaddy) on my RD Session Host server (2008 R2). I generated the request through IIS, received the cert from GoDaddy and imported it into [Certificates(Local Computer)\Personal\Certificates].
I then went to RD Session Host Configuration, and RDP-Tcp, and chose to select certificate.... however, I'm not given a choice...instead I receive a dialogue box saying "There are no certificates installed on this Remote Desktop Session Host server".
Any ideas why I cannot choose the cert? Do I request the cert improperly ? I'm stuck here... thanks in advance for any tips!
Scott

It looks like you have the correct certificate but perhaps didn't import it the correct way. Did you create the Certificate Request on the same machine as you imported it? Otherwise you don't have the private key. If not them import the certificate on the
same where you created the CR and then export the certificatye and make sure you select to export the private key as well and then import it on the RDS. If you followed the import steps correctly I suggest you contact GoDaddy to make sure the delivered
a valid certificate.
Kind regards,
Freek Berson
http://microsoftplatform.blogspot.com/

Trouble installing Verisign SSL certificate

I'm using WebLogic 7.0 and need to figure out how to install the SSL certificate.
I've followed the instruction from both Verisign and BEA to install the certificate.
But I could not get pass this error:
####<Oct 24, 2002 3:16:18 PM EDT> <Warning> <Security> <prodmvision02> <myserver>
<main> <kernel identity> <> <090088> <SSL did not find the private key alias on
server myserver for realm myrealm even though this server is configured as a 7.0
server. This data was required by SSL to load the server private key.>
####<Oct 24, 2002 3:16:19 PM EDT> <Alert> <WebLogicServer> <prodmvision02> <myserver>
<main> <kernel identity> <> <000297> <Inconsistent security configuration, java.security.KeyManagementException:
ASN.1: Lengths longer than 32 bits are not supported>
####<Oct 24, 2002 3:16:19 PM EDT> <Emergency> <Security> <prodmvision02> <myserver>
<main> <kernel identity> <> <090034> <Not listening for SSL, java.io.IOException:
Inconsistent security configuration, java.security.KeyManagementException: ASN.1:
Lengths longer than 32 bits are not supported.>
Curently I'm clueless on what has happened. This is the third time I tried to
follow the instruction. Please help.

Hello Patrick,
Thanks for the information:
you created a keypair for SSL in the Key Store service interface in the Visual Administrator, generated a CSR response and sent it to Verisign. Now you have the CSR response from Verisign - is my understanding of the situation correct?
Absolutely right
You can import this into the Key Store service, by highlighting the private key of the keypair and choosing 'Import CSR Response'. Now your key pair is signed.
Successfully done.
After this i can see that PRIVATE KEY (IssueDN has been changed to Verisign)
But CERTIFICATE ISSUER DN is not changed.
Now if i try to access the site with https, able to do properly and if click on the Lock icon on the browser, i can see certificate is 3 Chained
Verisign Trial Secure Server Root CA - G2
----> Verisign Trial Secure Server CA - G2
----> -> Training.pearson.com (this is my Common Name)
So it looks to be working fine.
However there is no chain formed. You need to now follow the aforementioned note and export the private key and public key certificate separately by higlighting the private key and choosing 'Export'. Export with the 'Files of type' drop down box set to (*p8), and after exporting the private key you will be able to export the public key cert. This is step 6 and 7 of the note. Now follow steps 8-12 to form the chain
No Chains has been made in Visual Admin, and i tried these on another server - it works as you are saying.
But is there any benefit of importing Intermediate, Root Certificates - as mentioned in SAP note steps 8 to 12.
If yes, then is it mandatory to make the chain till 3rd level (means Root Certificate also).
Once the chain is loaded into the Key Store, you need to ensure that the Java dispatcher is configured to send the signed server certificate for the relevant SSL ports - see here http://help.sap.com/saphelp_nw04/helpdata/en/5c/15f73dd0408e5be10000000a114084/content.htm
Edited by: Julius Bussche on Aug 10, 2009 3:44 PM
code --> quote

Installing Verisign SSL Certificate on NW 700 Java system

Hello Experts,
For our NW700 Java system, we have got Verisign SSL Certificate. Installation instructions from Verisign says - we need to install Intermediate Certificate also along with SSL certificate for our Common Name.
Can you please let me know how we install Verisign SSL Certificate on NW700 JAVA system using Visual Admin.
Instructions from Verisgn says:
Install Intermediate Certificate on server.
Install SSL certificate.
Thanks
Davinder

Hello Patrick,
Thanks for the information:
you created a keypair for SSL in the Key Store service interface in the Visual Administrator, generated a CSR response and sent it to Verisign. Now you have the CSR response from Verisign - is my understanding of the situation correct?
Absolutely right
You can import this into the Key Store service, by highlighting the private key of the keypair and choosing 'Import CSR Response'. Now your key pair is signed.
Successfully done.
After this i can see that PRIVATE KEY (IssueDN has been changed to Verisign)
But CERTIFICATE ISSUER DN is not changed.
Now if i try to access the site with https, able to do properly and if click on the Lock icon on the browser, i can see certificate is 3 Chained
Verisign Trial Secure Server Root CA - G2
----> Verisign Trial Secure Server CA - G2
----> -> Training.pearson.com (this is my Common Name)
So it looks to be working fine.
However there is no chain formed. You need to now follow the aforementioned note and export the private key and public key certificate separately by higlighting the private key and choosing 'Export'. Export with the 'Files of type' drop down box set to (*p8), and after exporting the private key you will be able to export the public key cert. This is step 6 and 7 of the note. Now follow steps 8-12 to form the chain
No Chains has been made in Visual Admin, and i tried these on another server - it works as you are saying.
But is there any benefit of importing Intermediate, Root Certificates - as mentioned in SAP note steps 8 to 12.
If yes, then is it mandatory to make the chain till 3rd level (means Root Certificate also).
Once the chain is loaded into the Key Store, you need to ensure that the Java dispatcher is configured to send the signed server certificate for the relevant SSL ports - see here http://help.sap.com/saphelp_nw04/helpdata/en/5c/15f73dd0408e5be10000000a114084/content.htm
Edited by: Julius Bussche on Aug 10, 2009 3:44 PM
code --> quote

Installing an SSL certificate for a CSS 11503

I'm having the hardest time searching for clear instructions on how to request and install an SSL certificate for a CSS 11503 Content Switch. Can anyone help or point me in the right direction?
I'm also looking for instructions on how to replace an SSL certificate once it's been installed. Thanks!

Allen,
The portion of the configuration guide related to SSL certificates and keys can be found here:
http://cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a00801eea82.html#1422544
To replace an SSL certificate, you'll need to remove the current certificate and re-import/create the new one.
~Zach

ACS Not installing renewed SSL Certificate for PEAP/EAP-TLS?

We recently renewed our SSL certificate through RapidSSL. While attempting to install the new certificate into ACS, I was given the prompt to showing the updated dates, confirmed and installed the new certificate, deleting the old. I restarted ACS, as required, but when trying to enable PEAP or EAP-TLS, I am getting the error "Failed to initialize PEAP or EAP-TLS authentication protocol because ACS certificate is not installed."
The worst part, is that I when I tried to reinstall the old certificate, I am now getting the same problem.
Any suggestions?

Matt,
How did you perform the CSR.... did you use ACS or OpenSSL? Also, did you verify that the certificate is in the trusted personal folder on the server?
Scott

Installing single SSL certificate on primary/secondary ACS boxes

I am trying to install the same SSL certificate I have installed on my primary ACS on my secondary ACS. I have replication configured and working between the two. The primary is the ACS appliance. The secondary is windows v3.3. The problem is the secondary ACS does not know about the private key file created during the CSR so I get an error when I try to install the certificate. So, what do I have to do to get around this? Obviously the certificate information is not copied over during replication. Is there a way to import it over manually?
Can I install the same certificate or do I need to do a separate CSR and install a separate certificate?

Yes you can use same cert for both the acs. On appliance download the cert and pvk file on your FTP root.
Move both files to acs windows and upload the certs and pvk file. Retype the private key (you need to remember it )
On windows acs--->install new cert---->use Read certificate from file--->put the location of cert like D:\Jar.cer
Give the location of Private key file---->D:\prv.pvk-----> Type the pvt key --->submit.
Regards,
~JG
Do rate helpful posts

How to install a SSL certificate on Azure?

Hi,
I am trying to install an SSL cert on my Azure instance. I followed this tutorial: http://www.windowsazure.com/en-us/documentation/articles/cloud-services-configure-ssl-certificate/
However, when I deploy the package on to the staging instance it does not start up. And we can't retrieve detailed bug, and can't connect remotely to that instance.
I am not sure what else can be done? Please help?

hi,
Did you upload cert into staging environment? How did you set the Https endpoint on your service definition file ?Did you try to change http to https to access cloud service? I suggest you could try to use https to visit your cloudservice firstly. If it
doesn't work, please check your endpoints setting in your project.
>>And we can't retrieve detailed bug, and can't connect remotely to that instance.
Did you enable the Remote desktop? You could enable the remote desktop on your deployment (http://msdn.microsoft.com/en-us/library/windowsazure/gg443832.aspx ). Any latest info,
please let me know.
Hope this helps.
Will
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Error installing standard SSL certificate

- Using Sun Java System Web Server 7.0 U4. Fresh install on clean server. Created an instance for SSL. However, when installing the standard SSL certificate on the instance configuration, I get the following error:
ADMIN4078: Unable to retrieve output from command: /Sun/WebServer7/lib/CertificateMgrUtil.exe
I'm new to Sun 7 (we've been using 6.1) and I'm not familar with this CertificateMgrUtil.exe. Can anyone shed some light on what this is and what steps I would need to take for this utility?
Thanks

Please do the following:
- Try running administration server with the log-level 'finest'.
- Then do the same action that gave raise to the error that you are facing.
- After that look in to .../admin-server/logs/errors to see the error.
- Copy paste that error here.
BTW, have you enabled Dr.Watson? Check in Event viewer to see if the process crashed. Dr.Watson output would be useful too.

Installing new SSL certificate on CUCM 7.1 (Verisign or Geotrust)

Hello,
I am trying to search CCO for a guide for installing a trusted certificate on a CUCM server to eliminate the SSL browser warnings. Could anyone point me to such a guide?
Thanks!

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/7_1_2/cucos/iptpch6.html#wp1046223
Michael
http://htluo.blogspot.com

Install GoDaddy SSL Certificate to Windows Server 2012 - Access Anywhere

I would like to activate Access Anywhere on my windows server 2012 essentials. I went through the guided steps and purchased a SSL certificate from Godaddy. Godaddy doesn't offer support regarding the correct installation process of their certificates
using iis 8 (server 2012 essentials). I noticed that Access Anywhere requires a PFX certificate and Godaddy only provided a PKCS #7 and a cer. file. Please let me know if Godaddy's certificates are compatible with windows server 2012 essentials. Without Access
Anywhere functioning on my server, the usefulness of the server greatly decreases. Your assistance is greatly appreciated. Thanks.

All you need is the standard, lowest level, single domain, no email, no bells, no whistles, no UCC. Just a simple SSL cert. Even SBS standard which adds email to the RWA feature, only requires that, thanks to the magic of the dev. team.
Larry Struckmeyer[SBS-MVP] If your question is answered, please mark the response as the answer so that others can benefit.

Installing 2 ssl certificate on one machine with two virtual hosts

Hi,
If you have a managed server in a cluster that has two virtual hosts running
on it how can you intsall the ssl certificates for both virtual hosts, in
the admin console.
any help would be great!

OK....I figured it out.
I was able to set the IPV4 properties on the ones needing filtering to use the IP or OpenDNS as the primary DNS and my server address as the secondary and that works.
I removed OpenDNS forwarder from the server, flushed dns on all machines and so far it's working perfectly. The machines that are not going to be filtered just go through the server for DNS.
Hopefully, after a while it doesn't break down!

Installing Valid SSL Certificate for Agent Reskilling Tool

Has anyone done this? I'm looking for documentation and can't find anything. There's documentation for UCM/CUIC, but nothing for agent reskilling. The Cisco Security Best Practices seems to just gloss over this subject and not really provide any good data.
david

Hi David, I recently tried to do this and I think I figured out a solution. This is on ICM 8.5(4). Let me know if this works for you.
Open SSL Encryption Utility. Select All Instances. Click Certificate Administration tab. Click Uninstall. Close SSL Encryption Utility.
Create Certificate request in IIS Manager.
Complete Certificate request in IIS Manager.
Export Certificate in IIS to c:\icm\ssl\[yourfile.pfx]. Remember password you use.
Open command prompt
Cd c:\icm\ssl\bin
Openssl.exe
pkcs12 -in c:\icm\ssl\[yourfile.pfx] -nocerts -out keyfile-encrypted.key
pkcs12 -in c:\icm\ssl\[yourfile.pfx] -clcerts -nokeys -out [host.crt]
Exit
Copy c:\icm\ssl\bin\host.crt to c:\icm\ssl (overwrite if necessary)
Copy c:\icm\ssl\bin\keyfile-encrypted.key to c:\icm\ssl (overwrite if necessary)
Open SSL Encryption Utility. Select All Instances. Click Certificate Administration tab. Click Install. Click no when it asks to create a new certificate. Close SSL Encryption Utility. I got one error but certificate imported successfully.
Verify by going to https:///reskill
Openssl commands taken from http://www.markbrilman.nl/2011/08/howto-convert-a-pfx-to-a-seperate-key-crt-file/

Installing a SSL certificate for WebVPN

We purchased a SSL certficate from network solutions to interface with our webvpn connections. This is what they sent us:
AddTrustExternalCARoot.crt
NetworkSolutions_CA.crt
UTNAddTrustServer_CA.crt
WEBVPN.MYSITE.COM.crt (name changed to protect privacy)
I've had absolutely no luck getting the identity certificate installed, and I have no idea what the other certs are really used for.
Try #1:
I figured that using the ASDM was easier to deal with certs so I navigated to the identity certificates section. I tried to import an identity certificate from a file by browsing to the identity certificate and click add certificate. But it stops me and says "Passphrase cannot be empty." I talked to network solutions and they don't have a passphrase for me. So then I just make up anything and click Add Certificate but I get stopped with this error: ERROR: Import PKCS12 operation failed.
Try #2:
At the identity certificates page in ASDM I clicked Add and then tried to add a new identity certificate by filling out all the parameters. This prompts me to save a CSR file to my computer. Ok done. But the certificate is not 'installed'.
     Try #2.1
     To get the certificate installed I tried clicking 'install' and browsing to WEBVPN.MYSITE.COM.crt. Upon hitting OK I get stopped with the following error: Cannot import certificate - Certificate does not contain device's General Purpose public key for trust point ASDM_TrustPoint1. ERROR: Failed to parse or verify imported certificate.
     Try #2.2
     I thought the CSR file is something important so I sent the CSR file to network solutions and they sent back a 'validation.xps' file. I tried to use this to 'install' into the identity certificate I just added. Unfortunately I get the following error when doing so: ERROR: Failed to parse or verify imported certificate.
I called network solutions and tried to explain to them and they of course had no idea what I'm talking about.
Is anyone familiar with this process that can point me in the right direction to install the cert?Thanks

I know this is a really old question and our solution was pretty silly, but this is still one of the top results for "Passphrase cannot be empty."
In our case, the cert we had purchased was not in PKCS12 format, but the regular PEM format. You need to convert it using openssl:
openssl pkcs12 -export -in prod_cert.pem -out prod_cert.pkcs12 -name "New Cert"
It will ask you for a password, which you supply, then use that cert and password with the Cisco Cert import.
They're one of the few appliances I have seen that don't accept unencrypted PEM files.
Hope this is of use to someone else.

Installing Intermediate SSL Certificates on ISA550?

Been trying to figure this out for days with no luck. Godaddy issued me two certificates. One is the FQDN.crt for my domain and the other is the intermediate certificate that is responsible for completing the chain of trust. However, I haven't been successful with installing the intermediate .crt onto my ISA550. I was able to install the FQDN.crt using the guide here: http://www.cisco.com/en/US/docs/security/small_business_security/isa500/technical_reference/certificates/isa500_installing_certs_appnote.pdf but that doesn't talk about installing chained certificates at all.
I have seen some guides talking about how to do this with ASA devices but it seems those don't apply to the ISA. This is mostly because there is no CLI with the ISA (as there is with the ASA) and also I don't see way to import/export private SSL keys from/to the ISA.
Ideas?

Hi Rodman, thank you for using our forum, my name is Johnnatan I am part of the Small business Support community. I apologize for this inconvenience, but in this case can you please reach out to our Small Business Support Center and open a Service Request to address this issue? One of our Engineers may be able to work with you and diagnose the root cause. You can find the appropriate contact information for SBSC in the below link.
http://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html
I hope you find this answer useful,
“Please rate useful posts so other users can benefit from it”
Greetings,
Johnnatan Rodriguez Miranda.
Cisco Network Support Engineer.

Problem Installing Entrust SSL Certificate

Similar Messages

Maybe you are looking for