Requesting certificate from certificate authority

I am in the last step of migrating from a personal account to a business account. I need to remove my old certificate, request a new one from the Certificate Authority in my keychain access. I attempt to get the new certificate, but it says the Certificate Authority email address is required. Does anybody know it or know how to bypass this step? Thanks

I am actually working on getting this setup for user Certs. and I am having some trouble. Can you tell me how you got this working?

Similar Messages

Request Smartcard Logon certificates for more than 2 years from Certificate Authority

Dear all,
I have setup a Certificate Services in a Windows Server 2008 R2 domain and I request certificates via the CA webpage
http://ipofdomainserver/certsrv using the SmartCard logon custom template.
The problem is that my certificates are only valid for 2 years even though when I created my custom Smartcard logon I selected for validity period 5 years.
I read in documentation that issued certificates cannot have a greater validity than the root that signed them.
What and where I should modify to be able to request certificates from the template for more years than standard 2 ?
Ps: WINSC-CA is valid for 5 years. Should I generate a new WINSC-CA ? How ?

I was successfully able to create a root CA for 20 years, issued a certificate and login using smartcard using the following procedure:
1. I increased the CA lifetime to 20 years by using this link http://www.expta.com/2010/08/how-to-create-certificates-with-longer.html
Created the file CAPolicy.inf in %SYSTEMROOT% with following content
[Version]
Signature=”$Windows NT$”
[certsrv_server]
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=20
2. Renew CA root using this guide https://technet.microsoft.com/en-us/library/cc780374(v=ws.10).aspx
Console Root -> Certification Authority -> select domain -> Right click -> All Tasks ->
Renew CA certificate
3. Delete from Console Root -> Certificates (local computer) -> Trusted Root Certification
Authority -> Certificates the *WINSC-CA that has the previous lower validity, and from
Certificates (local computer) -> Personal, the *WINSC-CA that was lower validity
4. I performed a reboot here
5. Change in Console Root -> Certificate Templates -> Smartcard Logon Custom Template (my custom duplicate template) -> Properties -> Validity 10 years
6. Change in registry HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CertSvc\Configuration\<CAName>\ValidityPeriod
to value 10 for 10 years.
7. Request a new certificate from CA webpage http://ipofdomain/certsrv and let the webpage write it to
smartcard (I was making sure there is no other certificate on the smartcard)
8. Try to log in. At this point it should throw an erorr that smartcard logon is not supported for this
account type. This is becuase we need to enroll it again for domain authentication
9. Console Root -> Certificates (local Computer) -> Personal -> Right click -> All Tasks ->
Request new Certificate -> Next -> Active Directory Enrollment -> Next -> Select Domain Controller Authentication -> Enroll -> Finish.
Now you should be able to login using your smartcard and 10 years generated certificate.
Though I have a problem at step 3, after CA server reboots the *WINSC-CA certificate with lower
validity is restored automatically, but the certificates are generated for 10 years.
What am I doing wrong ? How can I delete the lower validity root CA ?

Request a digital certificate from a certification authority

How do I request a digital certificate from a certification authority?

You will generate and submit a certificate-signing request to a vendor. Here's the general sequence for obtaining a certificate for OS X Server 10.8.

HTTPS request signed by client certificate from PL/SQL procedure

Hi All, please help.
The PL/SQL procedure connects to different web services, using both HTTP/HTTPS, for HTTPS sever certificates were used. Everything was OK.
The next service requires client to sign requests with client certificate. I made the client certificate, sign it by CA, store it in Wallet Manager.
Is here the possibility to send signed HTTPS request from PL/SQL?
If not, how to do it using Java and encapsulate for PL/SQL?
Please answer ASAP!!!

It is pretty straight-forward to make HTTPS requests with UTL_HTTP.
To do so, you first need to create an Oracle wallet on the database server host with Oracle Wallet Manager. If your database resides on Windows, I believe a short-cut has been created in the Windows menu. On Linux, it can be invoked from $ORACLE_HOME/bin/owm.
Once the wallet is created, you need to make an additional call to utl_http.set_wallet(<wallet-directory>, <wallet-password>) before any utl_http.request or utl_http.begin_request calls. The <wallet-directory> is the wallet directory where you will find the cwallet.sso and/or ewallet.p12 files, using the format "file:/<wallet-directory>". For example:
utl_http.set_wallet('file:/home/oracle/wallets/my_wallet/', '123456');
When an Oracle wallet is created, it is pre-populated with common certificate authorities' certificates (e.g. Verisign). In the event that the server certificate of the HTTPS host is not signed by one of those common certificate authorities, you need to import the additional certificate authority's certificate in your wallet using Oracle Wallet Manager.

How to request certificate from a non-domain computer

We using a Windows Server 2008 R2 Enterprise CA to issuing webserver-certificates (SSL). The CA-Server is a member of a AD-Domain and online. Now we want to request certificates from computers like Windows Server 2008 R2 or Linux Server which aren't member
of the domain.
How we can request certificates automatically with a script remote from these Windows Servers, for example ? Is it possible to use the "Certificate Enrollment Web Service" without the "Certificate Enrollment Policy Web Service" ?
Is it possible to use certreq in this scenario ?
Thanks for your help.

Now I have found a solution. Shortly I want describe the way:
Prerequirements:
1. ADCS Enterprise Certification Authority is installed
2. ADCS Certificate Enrollment Web Service is installed on a server
3. ADCS Certificate Enrollment Policy Web Service is installed on an other server
Steps to do:
1. Prepare a request-file for a certificate
2. On a computer which is not a member of the Domain/Forest of the CA-Service: submit the request to the CA and receive the issued certificate. The following command have to written in one line without line breaks.
certreq -submit
    -Username {domain}\{username}
    -p {password}
    -PolicyServer "https://{FQDN CertificateEnrollmentPolicyWebService-Server/-Alias}/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP"
    -config "https://{FQDN CertificateEnrollentWebService-Server/-Alias}/{CAName}_CES_UsernamePassword/service.svc/CES"
    -attrib "CertificateTemplate:{TemplateName}"
    {Enter Path and Name of the Request-File}
    {Choose Path and Filename for certificate}
   Sample:
   certreq -submit
        -Username contoso\Serviceaccount
        -p P@ssw0rd
        -PolicyServer "https://CAPolicyEnroll.contoso.com/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP"
        -config "https://CAWebEnroll.contoso.com/IssuingCA1_CES_UsernamePassword/service.svc/CES"
        -attrib "CertificateTemplate:MyOwnSSLTemplate"
        request.req
        sslcert.cer
3. Now you can find a file with your requested certificate locally in path you have choosen for the certificate-file.
I hope this will be helpful for other people enrolling certificates on non-domain member computers.

Installing a certificate from a Certificate Authority

I don't understand the process of a installing a certificate.
I have got to the step where I have a sign request.
Now I want to import the certificate. I am using tomcat.
The instruction that I have say that I need to import a certificate from a signing authority. It give me the following command.
keytool -import -alias root -keystore <your_keystore_filename> \
-trustcacerts - file <filename_of_the_chain_certificate>
I found link to verisign for installing the intermediate CA certificate that says you need to copy and past some text that basically says "begin certificate" block of text , "end of certificate".
Where do I copy this block of text? Do I save it to a text file and them use it in the "filename_of_the_chain_certificate" example mentioned above. I don't see any examples that show all the details of the steps.
Thanks.

Hi Simon,
It looks like you're trying to do PEAP authentication on a specific SSID, is that correct?
Once you have the certificate generated, you'll upload it at the following location:
Topline Menu -> Commands
Then you'll choose "download file" and choose the certificate type to install it.
PEAP usually calls for a server side certificate (on your authentication server) to be installed on that server. Then you have to configure the controller for 802.1x authentication on the SSID itself. Pointing to one of the authentication servers listed on the "WLAN" Menu under security "AAA Servers". The servers themselves are entered in the "Security" Menu under either RADIUS or TACACS+ tab.
I can point you in the proper direction if you need more assistance, as I've done this many times. I just need more clarification on what you're trying to accomplish.
Regards,
Jerry

Problem in requesting certificate from enterprice CA

I have an enterprice CA and I created a new certificate template for SCOM authentication, and when I submit a certificate from web enrollment I got this error massege:
Certificate Request Denied
Your certificate request was denied.
Your Request Id is 63. The disposition message is "Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Active Directory Certificate Services policy: SCOM Template.
Contact your administrator for further information.
I checked the authentication and make it: everyone full control. when I request a certificate from the same CA with another template it works well without any errors !!
please feed me back with any suggestions
Hossam Wael Elmosallamy IT Support Engineer ECC Solutions MCSE - CCNA [email protected] Mobile: +2(014)-9464671 Work: +202-3828-4576 www.eccsolutions.net "Experience Reliability"

At the end of the day your CA adminstrator has to allow you to make a request via that template and have it auto-approved. By default, you cannot just define a new template, import it into CA server and expect it to bypass explicit policy. Depending
on whether your CA is domain joined or not, you may also be dealing with global corporate policy (and defaults) that prevent someone from hacking a new CA server into the companys network, adding a new template and executing it with a request for automatic
approval.
These are the keys to the kingdom you are messing with ... you have to go to the king.
Microsoft Corporation

Computer certificates expiring within 6 weeks disappearing from machines when computer certificates from two certificate authorities are present

2008 R2 single tier enterprise certificate authority with root certificate expiring within 6 weeks, also domain controller
2012 R2 single tier enterprise certificate authority with root certificate valid for more than the next year, also domain controller
Both servers are approved as certificate authorities for the domain and can issue computer certificates using the computer certificate template. There is a group policy object applied to all workstations that contains an automatic computer certificate request,
but the actual "certificate services client auto-enrollment" element is "not configured". This process seems to work like a round robin in that computers with no certificate can wind up with a certificate from either certificate
authority. I need all PCs to have both certs for a DirectAccess migration. I have successfully used SCCM to ensure all PCs have both certificates using compliance rules and a script using certreq.exe.
A machine will keep both certs until the older computer certificate moves into the 6 week window of expiration, then it gets purged. I have observed this behavior for over a month, even when the CA root certificate wasn't so close to expiring. I
can't figure out what setting is triggering the purge, but need to stop it. Maybe it's coming from default settings in local machine policy for an element that should be disabled in the group policy object supplying the automatic certificate request?
The worst part of this issue is that I can't recreate the purging behavior with gpupdates or restarts on my test machines.

You should not be using Automatic Certificate Request Service (ACRS) for this - it was designed for Windows 2000 and is generally deprecated. Secondly, the reason it is acting like a round-robin as you describe it, is that templates are generally configured
to attempt to renew within 6 weeks of their expiration. Since the 2008 R2 CA is expiring within 6 weeks, it cant issue anything longer than its own remaining lifetime. It is a well known issue that issuing a certificate within the renewal period will cause
problems.
What you should do it use AutoEnrollment and issue a certificate with a very small renewal period (1 week perhaps) by creating a custom V2 template and issuing that from your 2008 R2 CA. Then on the 2012 R2 CA you will need ANOTHER template, as the computer
will only enroll for a certificate from each template. This one can be configured with a normal lifetime and renewal period.
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years. Connect with Mark at http://www.pkisolutions.com

RPC Server is unavailable when trying to renew or request a new certificate with new key

Hi
I have a couple of wireless access points (AP's) that are unable to use our RADIUS server to authenticate.
This started happening after a power outage, and I did a gracefull shutdown of the RADIUS server. When the server was booted up the AP's appear to have lost the ability to authenticate users of both PC's and mobile devices.
I looked through the Network Policy server MMC and didn't find anything there.
Next I looked at the certificates and found 2 in the Personal>Certificates folder, that I think are related to this configuration. The odd thing is they expired the exact same day as the power outage.
So I tried to Renew and then Recreate the certificate's key. That's when I received the RPC server unavailable. I also tried creating a new key from scratch, same problem.
I did a lot of searching on the web so I have seen this thread and I have checked all the things recommended, none of the suggestions helped:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/2b93bfa8-c162-4fc8-9cf3-a8f8f8c8ff29/rpc-server-is-unavailable-requesting-a-new-certificate?forum=winservergen
I must admit I am at a loss as to where to look next.
Help is very much appreciated.

Are you also the admin of the certificate authority?
=====I am the admin, but my knowledge of this topic is low.
If the CA is operational, the next steps are:
- Any firewalls between your client and this CA? Did somebody change the desktop firewalls settings at the CA?
===== There are no firewalls between the client and CA nor have the desktop firewall rules changed.
- Can sombody (the PKI admin?) confirm that the CA works fine and other clients can enroll? What's the difference between those clients and yours?
===== I will see about trying this out and report back.
- Is the CA probably in a different domain and does Kerberos authentication work fine between domains? I had sometimes seen things like: CA is in a root domain but clients cannot talk to Root DCs as per firewall settings - thus clients cannot get Kerberos tickets
from the domain hosting the CA. (Certificate enrollment is sometimes the first application that really requires Kerberos and cannot fall back to NTLM). A network trace would help here.
=====
The CA is in the same domain.
- Did somebody tweak with DCOM permissions or lock down flags at the CA (unlikely)
===== The DCOM settings haven't been touched by anyone.
Thanks

Issue generating a subordinate certificate - The certification authority's certificate contains invalid data

Other recipients:
Hi Guys, I have a root CA and a sub CA. I want to generate another Sub CA certificate from my current sub CA however when I try to do so either via web or csr file I get the below error: The certification authority's certificate contains
invalid da
<input role="presentation" style="width:1px;height:1px;opacity:0;" tabindex="-1" type="text" />
Hi Guys,
I have a root CA and a sub CA both windows 2008 R2 ent. I want to generate another Sub CA certificate from my current sub CA however when I try to do so either via web or csr file I get the below error:
The certification authority's certificate contains invalid data. 0x80094005 (-2146877435). Denied by policy module.
I have confirmed that the basic constraint attribute for my current subca is none so I should be able to generate a certificate for a new subca.
Any assistance is greatly appreciated.
Thanks.

Hi,
According to your description, you want to build a new CA which is under an existing sub CA (one of your two working sub CAs) to issue certificates to other devices, am I right?
Based on my research, to achieve this, we need to install another
Subordinate Certification Authority. During the installation process, this new sub CA will generate a certificate request to its parent CA.
“The subordinate CA cannot be used until it has been issued a root CA certificate and this certificate has been used to complete the installation of the subordinate CA”, I quoted this
sentence from the article I posted in my last reply.
Therefore, in your case, the process flow should be like:
Install a new sub CA.
Generate a certificate request to its parent CA during installation.
The parent CA approves this request.
Installation of the subordinate CA has completed.
The new sub CA issues new certificates to other devices.
Please feel free to let me know if this method is not working.
Best Regards,
Amy Wang

Asking specific client certificate (not certificates trusted by authority)

As I understand from what I read so far, during the handshake negotiation for two way ssl, the server sends the client a list of trusted certificate authorities and say to the client: "hey, those are the authorities I trust. send me a certificate that can be verified by one of them".
I also read how you can customize SSLSocketFactory to, on the client side, look for a specific certificate alias (http://www.ibm.com/developerworks/java/library/j-customssl/). I would like to move this idea further and ask for specific certificates depending on what resources the user is trying to access.
For example:
Let's suppose I have two resources on my server called "bobPrivateStuff" and "alicePrivateStuff". I also have a certificate authority who can validate both Bob and Alice certificates on a custom trust keystore. In a regular scenario, the server will ask for a client certificate and will accept either Alice or Bob certificate, as both can be verified by the custom trust.
But what if Alice can't access "bobPrivateStuff"? What if when trying to open a connection, to say http://myserver.com/services/bobPrivateStuff, the server asks specifically for Bob's certificate? Can I setup the handshake in a way it will actually ask for Bob's certificate instead of only just "any certificated trusted by this CA"?
And what piece of information could be used to distinguish one certificate from another? Is the serial number unique between multiple certificates? Is this pushing the envelop too much and trying to use SSL for more than what it is intended for?

I agree 100%. It's just that we want to use certificates to validate the client's identity (instead of relying on username/password).Fine, that's exactly what SSL & PKI will do for you.
It might not be elegantBut it is!
See my point?Of course I see your point. SSL already does that. I said that. You agreed. I agree. What it doesn't do is the authorization part. Because it can't. It isn't meant to. You are supposed to do that.
Instead of the server asking for a specific certificate, it justs checks if the certificate sent by the client has access to the resource.Not quite. It should check if the identity represented by the client certificate (Certificate.getSubjectX500Principal(), or SSLSocket.getSession().getPeerPrincipal()) has access to the resource.
This way, we can leave the server untouchedNo you can't. The server has to get hold of the client principal after the handshake and authorize it against the resource.
if Bob wants to access some resources, Bob has to prove he is who he says he is.You're still confused. That's authentication, and SSL already does that for you. SSLSocket.getSession().getPeerPrincipal() returns you the authenticated identity of the peer. The server then has to check that that identity can access that resource. This is 'authorization'. You can't automate it via keystores and truststores. That's not what they do and it's not what they're for.
So I think it is perfectly plausible to do this kind of verification on the server side (i.e. "hijack" a certificate sent to validate the ssl handshake to also verify if the user has the correct privileges).There's no 'hijacking' about it, but you're concentrating on the certificate instead of the identity it represents. A client could have a large number of certificates that all authenticate the same identity. You need to think in terms of authorizing Principals to access resources.

While logon to lync it gives error " there was a problem verifying the certificate from the server "

i already go through all threads related to my question. but not even one thread is satisfying my question ok my problem is again the same it gives me error as i mentioned in title. client OS is XP. actually can somebody tell me which certificate
i should import in which name of certificate group.
N ya why error has occur. help me
thanks in advance
jayesh rohit

You'll want the CS root certificate in the trusted root certificate authorities area of the machine store (vs the user store). If there are any subordinate CAs with intermediate certificates, put them in the intermediate certification authorities area.
Verify that the certificate has the correct SANs for you server. Did you generate the certificate from the deployment wizard, did you check the box for the sip domains as you went through the wizard? Is the certificate internally signed by your
certificate authority? Are you attempting to connect internally or externally when you see the issue?
Can you confirm that your SRV records for _sipinternaltls._tcp.domain.com have the correct port and hostname and that the hostname is also resolvable? Can you do the same for _sip._tls.domain.com?
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications

Weblogic Start script fails while Loading trusted certificates from jks

Hi,
I have a Weblogic Portal 10.3.2 installation on a Solaris Unix box. There is one Admin server and two Managed servers. I am trying to deploy an EJB based application on one of the Managed servers. Note that this application has been working fine in the Weblogic 9.2 environment.
When the Managed Server is started, I get the below messages in the Weblogic console log. We have an internal SSO authentication system, which is integrated with this application. When this integration is removed, we are able to login to the application without any issues. When it is turned on, the redirection from SSO to the application fails - most likely because of the below SSL related errors.
I have accessed the below link and accordingly set the property -Dweblogic.ssl.JSSEEnabled=true. But it didn't help.
http://justasg.blogspot.com/2012/04/tlsssl-certificate-errors-and-warnings.html
Please let me know if you have any suggestions.
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090169> <Loading trusted certificates from the jks keystore file /data/applications/norkom/BEA103/wlserver_10.3/server/lib/DemoTrust.jks.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090169> <Loading trusted certificates from the jks keystore file /opt/jdk1.6.0_32/jre/lib/security/cacerts.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=Entrust Root Certification Authority - G2,OU=(c) 2009 Entrust\, Inc. - for authorized use only,OU=See www.entrust.net/legal-terms,O=Entrust\, Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=thawte Primary Root CA - G3,OU=(c) 2008 thawte\, Inc. - For authorized use only,OU=Certification Services Division,O=thawte\, Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "OU=Security Communication RootCA2,O=SECOM Trust Systems CO.\,LTD.,C=JP". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=VeriSign Universal Root Certification Authority,OU=(c) 2008 VeriSign\, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=KEYNECTIS ROOT CA,OU=ROOT,O=KEYNECTIS,C=FR". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=GeoTrust Primary Certification Authority - G3,OU=(c) 2008 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<Jun 4, 2012 4:51:59 PM MEST> <Error> <Server> <BEA-002606> <Unable to create a server socket for listening on channel "DefaultSecure[1]". The address 127.0.0.1 might be incorrect or another process is using port 7022: java.net.BindException: Address already in use.>
<Jun 4, 2012 4:51:59 PM MEST> <Error> <Server> <BEA-002606> <Unable to create a server socket for listening on channel "DefaultSecure". The address 10.228.12.24 might be incorrect or another process is using port 7022: java.net.BindException: Address already in use.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Server> <BEA-002613> <Channel "Default" is now listening on 10.228.12.24:7020 for protocols iiop, t3, ldap, snmp, http.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Server> <BEA-002613> <Channel "Default[1]" is now listening on 127.0.0.1:7020 for protocols iiop, t3, ldap, snmp, http.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <WebLogicServer> <BEA-000332> <Started WebLogic Managed Server "NCA_Server" for domain "norkom" running in Development Mode>
<Jun 4, 2012 4:52:01 PM MEST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to RUNNING>
<Jun 4, 2012 4:52:01 PM MEST> <Notice> <WebLogicServer> <BEA-000360> <Server started in RUNNING mode>
<WSEE:27>Warning: JMS queue 'weblogic.wsee.DefaultQueue' is not found, as a result, Web Service async responses via jms transport is not supported. If the target service uses JMS transport, the responses will not be able to come back.<JmsQueueListener.connect:287>
<WSEE:27>Warning: JMS queue 'weblogic.wsee.DefaultQueue' is not found, as a result, Web Service async responses via jms transport is not supported. If the target service uses JMS transport, the responses will not be able to come back.<JmsQueueListener.connect:287>
<WSEE:27>Warning: JMS queue 'weblogic.wsee.DefaultQueue' is not found, as a result, Web Service async responses via jms transport is not supported. If the target service uses JMS transport, the responses will not be able to come back.<JmsQueueListener.connect:287>
<WSEE:27>Warning: JMS queue 'weblogic.wsee.DefaultQueue' is not found, as a result, Web Service async responses via jms transport is not supported. If the target service uses JMS transport, the responses will not be able to come back.<JmsQueueListener.connect:287>
<WSEE:27>Warning: JMS queue 'weblogic.wsee.DefaultQueue' is not found, as a result, Web Service async responses via jms transport is not supported. If the target service uses JMS transport, the responses will not be able to come back.<JmsQueueListener.connect:287>
<WSEE:27>Warning: JMS queue 'weblogic.wsee.DefaultQueue' is not found, as a result, Web Service async responses via jms transport is not supported. If the target service uses JMS transport, the responses will not be able to come back.<JmsQueueListener.connect:287>
Note: We have another Solaris Unix box, with the same installation of Weblogic with the same SSO redirection, but another EJB application is deployed. Also, there is no Managed and the application is deployed on the Admin server itself. But when the server is started, I don't see any attempts to load any certificates and also there are no issues.
So either please suggest how this certificate loading can be rectified or suggest a way to disable the certificate loading (if at all its an option).
Please let me know if you need any further details.

Firstly,
938767 wrote:
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090169> <Loading trusted certificates from the jks keystore file /opt/jdk1.6.0_32/jre/lib/security/cacerts.>
<Jun 4, 2012 4:51:59 PM MEST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=Entrust Root Certification Authority - G2,OU=(c) 2009 Entrust\, Inc. - for authorized use only,OU=See www.entrust.net/legal-terms,O=Entrust\, Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>I don't think that this will be your problem... Unless you are actually using some of those certificates you can ignore those messages.
But the following looks suspicious, I guess 7022 is your SSL port...
<Jun 4, 2012 4:51:59 PM MEST> <Error> <Server> <BEA-002606> <Unable to create a server socket for listening on channel "DefaultSecure[1]". The address 127.0.0.1 might be incorrect or another process is using port 7022: java.net.BindException: Address already in use.>
<Jun 4, 2012 4:51:59 PM MEST> <Error> <Server> <BEA-002606> <Unable to create a server socket for listening on channel "DefaultSecure". The address 10.228.12.24 might be incorrect or another process is using port 7022: java.net.BindException: Address already in use.>Hope that helps.
Cheers,
Vlad
Give points - it is good etiquette to reward an answerer points (5 - helpful; 10 - correct) for their post if they answer your question. If you think this answer is helpful, please consider giving points.

Import and trust a self-signed CA certificate from the Terminal

Hello there,
i have a problem: I would like to import and trust a self-signed CA(root) certificate from the Terminal to the System.keychain.
My request is to create a installation script to install the Cisco AnyConnect VPN Client and the needed certificates.
For the import i have used the following command:
    sudo security import certificate.cer -k "/Library/Keychain/System.keychain" -A
    The Option "-A" says:
Allow any application to access the imported key without warning (insecure, not recommended!) <- From the Mac Developer Library
The command reportet: 1 certificate is importet ... but ... the certificate is not trusted.
What do i need to do to set this certificate as trustworthy at the terminal?
Thanks for your help and best regards
Benjamin
P.S. The command: sudo security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “/private/tmp/certs/certname.cer” doen't run, i get an error message. Found on http://derflounder.wordpress.com/2011/03/13/adding-new-trusted-root-certificates -to-system-keychain/

Hello Linc Davis,
thanks for your answer and sorry for my mistake, because i had already changed the last argument but for this discussion i had only copy this example.
But your answer show me the right way, big thanks.
I had entred the following command (see the last argument):
     sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "~/Downloads/mycert.cer"
... and i get the following message:
    ***Error reading file ~/Downloads/mycert.cer
     Error reading file ~/Downloads/mycert.cer
Today i changed the last argument to:
   /Users/User/Downloads/mycert.cer
and its run.
Many thanks!
Benjamin

ACS 5.2 / WLC - EAP-TLS Certificate from 2 CA

Hello,
I'm Newbie with ACS equipment, i'm trying to implement it to secure our WIFI environment.
One wifi SSID is broadcasted on a site, I would like to authenticate WIFI client through machine certificate.
The big deal is that some client computer belong to an AD (AD1) and having its own CA1. Other client computer belong to another AD (AD2) also having its own CA (CA2). (With no relation or between the 2 CA)
So computer1 having machine certificate from CA1 and computer2 having machine certificate from CA2
I have imported the root certificate from the both CA into the "certificate authorities" store of the ACS.
I have generated certificate signing request, one for each CA. Then I have binding the CA signed certificate.
After configuring... the access services (identity, authorization...) and so on I have the following issue:
- Computer with certificate from the CA1 can connect without any problem.
- Computer with certificate from the CA2 can NOT connect:
     - After investigation: the client computer do not trust the server ACS and reject the connection
     - Error return :
RADIUS Status:Authentication failed 11514 Unexpectedly received empty TLS message; treating as a rejection by the client
     - (If i get ridd of the option "verify server identity" on wifi optionof the client, the computer can conect: but this option is not acceptable)
     - It seems that the ACS sends only its certificate signed by the CA1
The questions are:
1- How can I configure the ACS to send the right certificate signed by the right CA corresponding to the computer that is intenting to authenticate
2- I could see in documentation:
    "For TLS related EAP protocols, a single local certificate is used to authenticate the server for all the TLS related protocol"
     --> Does it mean that we can only configure one local certificate to allow the ACS to authenticate to client for all the EAP-TLS protocol used ?
     --> How can I choose it ?
     --> For the current configuration, I have only the certificate signed by the CA which is configure "EAP: Used for EAP protocols that use SSL/TLS tunneling" (i don't know if this option has an impact with the certificate presented by the ACS when it authenticate itself to the client")
Thanks for your helk and your information.
Guillaume

Hi Bastien,
it is actually what i did.
The point here i have 2 CA involved, with no relation between them.
So I did the operation twice for each CA :
-> making a certificate signing request, sent it to the CA, signed to by the CA and then imported/binded into the ACS
-> I have added the root CA of each CA into the ACS as well.
The point is when a computer, try to connect, it try to verify ACS server identity. And the ACS server only seems to present the certificate signed from CA1.
So when a computer with certificate machine CA2, try to connect, it doesn't trust the ACS server has the ACS sent its certificate signed by CA1.
I don't know how to allow the ACS to present the right signed certificated depending on the cleint that try to connect.
Then another conf I do not understand is the option:
EAP: Used for EAP protocols that use SSL/TLS tunneling --> in local cetificate, when you add a local certificate to the ACS
I do not undestand what does this option stand for ?
Then I culd see into Cisco do :
    "For TLS related EAP protocols, a single local certificate is used to authenticate the server for all the TLS related protocol"
Doest it means that the ACS can use only one single certificate for All the TLS protocol configured in the ACS, to authenticate itself to the client?
Or does the ACS can use a diferent local certificate from each dedicated eap-tls protocol?
thx

Requesting certificate from certificate authority

Similar Messages

Maybe you are looking for