Retrieving ssl certificates from a server

Hello there,
i am currently trying to learn some things about SSL, i've never had to work with ssl servers until now, and i've got a couple of questions here;
first off, my client program needs to connect to an IMAP server, in order to retrieve the number of new messages in the inbox. Now, the certificate doesnt seem to be standard, because i get an sun.security.validator.ValidatorException: No trusted certificate found.
I have already learned how to make my own keystore file and add in custom certificates, but i do not know how to retrieve these certificates from the servers I am connecting to.
So, how can i get this information from an IMAP server? :)
many thanks in advance!
With kind regards,
Steven

Ok well I found a way on the net to use an "all-trusting" trust manager, so now the handshake works and i can work within the imap server..
but, what's the use of this certificate then, if i can simply avoid using a real one? I hope someone could answer this :)

Similar Messages

Copying SSL Certificates from one server to another.

I have a question that hopefully someone might have the answer for... I have a IPlanet 6.0 SP4 server that has an SSL certificate I'm trying to move to a new server that's on SunOne 6.1. I was under the impression that I could easily copy the <Iplanet_Root>/alias/https-<ServerInstance>-<server>-<key3/cert7>.db files to the new server from that server's alias directory. However before I copied the files, I immediately noticed the new server's cert file is called cert8 instead of cert7 and is 64K as opposed to the 6.0 server's 16K.
I stopped the web instance and renamed the current db files and copied in the new and changed the cert7 to cert8. When I restarted the server, it stayed up and didn't report any problems. However, when I go the security tab and click on any of the links on the left column, an internal server error (http500) page is displayed. No additional errors show up in the errors log.
Unfortunately, we don't have the original certificate request. I'm sure when it was applied for; it was cut and pasted into the install certificate page. Otherwise, I'd simply do the install on the other server. Is there a simply means to copy an already installed cert from one sever to another?
Any assistance would be greatly appreciated.

Migration from 6.0 to 6.1 should take care of this. You don't have to rename the files to cert7.db after the migration, just leave them with their new names and size as is. The new file created in 6.1(after migration is complete) will be called cert8 and this is fine because 6.1 uses newer version of security libs. Doc links:
http://docs.sun.com/source/817-1830-10/migrate2.html
http://docs.sun.com/source/817-1831-10/agcert.html#wp1017112
Thanks,
Manish

Install GoDaddy SSL Certificate to Windows Server 2012 - Access Anywhere

I would like to activate Access Anywhere on my windows server 2012 essentials. I went through the guided steps and purchased a SSL certificate from Godaddy. Godaddy doesn't offer support regarding the correct installation process of their certificates
using iis 8 (server 2012 essentials). I noticed that Access Anywhere requires a PFX certificate and Godaddy only provided a PKCS #7 and a cer. file. Please let me know if Godaddy's certificates are compatible with windows server 2012 essentials. Without Access
Anywhere functioning on my server, the usefulness of the server greatly decreases. Your assistance is greatly appreciated. Thanks.

All you need is the standard, lowest level, single domain, no email, no bells, no whistles, no UCC. Just a simple SSL cert. Even SBS standard which adds email to the RWA feature, only requires that, thanks to the magic of the dev. team.
Larry Struckmeyer[SBS-MVP] If your question is answered, please mark the response as the answer so that others can benefit.

SHA-2 SSL certificates supported on Server v10.5?

Am upgrading Mac OS Server 10.4.11 on a PowerPC Mac Mini (1.42GHz) to Server 10.5 and currently have SHA-1 SSL certificate from GoDaddy.
They want everyone to upgrade to a SHA-2 (SHA256) SSL certificate for Google's Chrome browser which will soon start showing SSL errors for SHA-1 certificates.
Is Mac OS Server 10.5 capable of serving up a SHA-2 SSL certificate? (I originally renewed last Feb. to a SHA-2 certificate, but many browsers didn't recognize it, so I re-keyed to a SHA-1 certificate that is good to 12/31/15.
Mac mini, Mac OS X Server (10.4.11, upgrading to 10.5.x), Power PC 1.42GHz

Hi, I do not know, but I doubt it.
Here's the 10.4 Server forum if you want to ask over there...
Mac OS X Server v10.4 and earlier

Unable to Retrieve Contact Info from synch server - Gator wrote to try renaming file but I can't manage to find the pathway on my Win 7 computer for that file! got as far as my name under user but can't get to application data. Can someone help?

Hi, going crazy. Can't get this fixed. Unable to retrieve contact info from synch server. I did re-do synch using one time only replace I-phone info from "contacts" on computer and tried synching after that - no use same error!
I saw someone by name of Gator wrote pathways to follow in windows but got only as far as user (yes, selected my name as user as opposed to public) then clicked it open but lost after that - can't get to appdata for the next step.... any help or ideas would be soooooo appreciated. I'm so tired of this issue. thanks!
Pinina in Phoenix, Az

Hi, going crazy. Can't get this fixed. Unable to retrieve contact info from synch server. I did re-do synch using one time only replace I-phone info from "contacts" on computer and tried synching after that - no use same error!
I saw someone by name of Gator wrote pathways to follow in windows but got only as far as user (yes, selected my name as user as opposed to public) then clicked it open but lost after that - can't get to appdata for the next step.... any help or ideas would be soooooo appreciated. I'm so tired of this issue. thanks!
Pinina in Phoenix, Az

Provide steps to send Root CA certificate to the Lync client, getting error" There was a problem verifying certificate from the server"

Hi,
I Build an Lync 2013 set up with FEpool, Director pool and Exchange server is integrated. I have windows 8 client machine, with Lync client installed. When I try to login to the lync client, I am getting error like"There was a problem verifying
certificate from the server".
When I installed ROOT CA cert manually on client machine I am able to login to the lync client. similarly if I add my client machine in my domain, I am able to login to the Lync client.
Now is there any other way to send the certificate automatically to the client machine (Which are NOT part of the DOMAIN) from the server, instead of manual installation process.
Please help me troubleshoot this problem

Agree with S Guna, there is no easy way to push a certificate automatically to a client that you don't control other than building an installer package and asking them to run it. In this situation, if there are a lot of non-domain joined machines
a third party certificate is the way you need to go.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications

Lync 2010 Certificate Issue - "There was a problem verifying your certificate from the server"

Greetings.
My Issue:
Lync 2010 client does not connect to server;error displayed "Cannot sign into Lync. There was a problem verifying the certificate from the server."
Description:
The client is running on my Windows 7 box, and my CA server is a Windows Server 2003 box. I have installed the hotfix on the Server 2003 box to update the Web Enrollment portion of CA to allow for newer clients (Vista and 7) to receive certificates from
this server.
Lync server is running on Server 2008 R2 STD, installation was a success.
The Windows 7 box is a part of the domain.
I have manually exported the Root CA from my Enterprise CA server from
Trusted Root Certification Authorities -> Certificates and imported into the same location on my Windows 7 box.
If I look at the certification path on the Root CA, on my Windows 7 box, it says "The certificate is OK." The same goes for the servers involved.
Still nothing.
I have read the other forum posts on here about people having success once they manually import the Root CA from the Enterprise CA server, but this is not my case here.
All certificates are successfully assigned on the Lync server box; however, I did have to manually import the Root CA into Lync server's
Trusted Root Certification Authorities -> Certificates before I could successfully assign them. Had to do this on another deployment I completed, so I didn't think anything of it.
To recap: it seems that even with my Root CA imported into my Windows 7 box I can still not connect to my Lync server with the client, and I get the error message "There was a problem verifying the certificate from the server."

Solved
Solution : Export certificate from Lync Server Start > Administrative Tools > IIS > Server Certificate > Export > abc.pfx save it, Copy and place the certificate where Ms Lync 2010 client is installed or getting certificate
error. Follow these steps on client machine to install certificate
Run > mmc > add or remove snap in > certificates > computer account > local computer >finish > ok > expand Certificate > Trusted Root Certification Authorities > Certificate > All task > Import > copy abc.pfx certificate
and delete unnecessary certificate from there.
Restart Client machine and open microsoft Lync client 2010 and open option menu > Personal > Advanced > choose Auto Configuration > save ok

CA issue - Workstation signin "There was a problem verifying the certificate from the server"

Hi,
We have issues with all workstations on our domain. I just recently setup Lync 2013 server on a windows 2012 OS. When I went to test sign-in, I received a message "There was
a problem verifying the certificate from the server". To fix this issue, I had to download the cert and import it into Trust Root Certification Authorities on the local workstation. This will be impossible if I have to do this for multiple machines.
Is there a way around this? Why is it asking to do this?
Thanks guys, much appreciated.
MM

You can follow the instructions here to use Group Policy to install your root certificate to all your workstations.
Or you could re-deploy your CA as an Enterprise CA.
Hi Georg,
Thank you for your reply.
I did deploy my CA as an Enterprise CA..... Not sure why its still asking me to install on workstations?
How can I confirm its an Enterprise CA?
Thanks,
MM

The SSL certificate of the server is expired

Today, I accessed Beehive Online via Oracle Beehive Extentions for Explorer.
I cannot use Beehive Online with error message "The SSL certificate of the server is expired".
How should I do?

We're looking into it, meanwhile you can use a Webdav connection.
Thanks,
Jereen

EVDRE encountered error retrieving the data from web Server

Hi,
I know this is the common/generic error message, following is our scenario:
We installed BPC NW 7.5 on our production box and configured F5 load balancing for two .NET servers.
We are getting the error "EVDRE encountered error retrieving the data from web Server"when we run the report EVDRE on APSHELL (original Appset). This is the fresh installation:
The workaround "Clear Local application information". Even this works only sometimes.
Is there anything else we should have configured on using two .NET servers?
Please suggest.
Thanks

hi Nagesh sorry for the delayed reply..
We changed some of the parameters at F5 switch like sticky time, timeout..
And the MDXPARSER connection to one of out application server was failling, thats why we did not had this issue consistently.
When ever the request goes to that app server fails. It took a lot effort to notice this since we were assuming the F5 switch was only causing the issue.
Thanks

There was a problem verifying the certificate from the server

i can not sign in to my lync server in client user and the error message is "There was a problem verifying the certificate from the server".
i can sign in in my lync server by any account but i can not sign in in other pc clients.

Hi,there,
Just some additional info...
Please go through the following old threads with the same error message
http://social.technet.microsoft.com/Forums/en-US/ocscertificates/thread/19d74620-9ea8-4f19-bc01-25387e4ee380/
http://social.technet.microsoft.com/Forums/en-US/ocscertificates/thread/7a973094-6cd1-4f3f-9af0-6d330a9b8428
http://social.technet.microsoft.com/Forums/en-US/ocscertificates/thread/4034e791-6c3c-4c35-b936-bca734204fd4/
Hope these helpful!
B/R
Sharon
Sharon Shen
TechNet Community Support
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question.

Lync 2013 mobile client. Can't verify the certificate from the server. Please contact your support team

We upgraded Lync Server 2010 to Lync 2013.
Users are able to login on desktop clients but unable to connect on mobile client. We get following error message:
Can't verify the certificate from the server.
Please contact your support team

Please check the Root CA is installed on your mobile device.
Can you sign in externally?
Please check you have updated the DNS records for Lync mobile autodiscover service.
Lisa Zheng
TechNet Community Support

SA540 and SSL certificate from DigiCert

Has anyone succeeded in installing a SSL certificate from DigiCert on a SA540 router?
The SSL certifcate is a wildcard variant (*.example.com).

Hello Mr. ivar,
In order to get a new SSL certificate please follow the next instructions:
STEP 1 : Click Administration > Authentication.
The Authentication (Certificates) window opens.
STEP 2 For each type of certificate, perform the following actions, as needed:
• To add a certificate, click Upload. You can upload the certificate from the PC or the USB device. Click Browse, find and select the certificate, and then
click Upload.
• To delete a certificate, check the box to select the certificate, and then click
Delete.
• To download the router’s certificate (.pem file), click the Download button under the Download Settings area.
STEP 3 To request a certificate from the CA, click Generate CSR.
The Generate Certification Signing Request window opens.
a. Enter the distinguished name information in the Generate Self Certificate
Request fields.
• Name: Unique name used to identify a certificate.
• Subject: Name of the certificate holder (owner). The subject field populates the CN (Common Name) entry of the generated certificate and can contain these fields:
- CN=Common Name
- O=Organization
- OU=Organizational unit
- L= Locality
- ST= State
- C=Country
For example: CN=router1, OU=my_dept, O=my_company, L=SFO, C=US
Whatever name you choose will appear in the subject line of the generated CSR. To include more than one subject field, enter each subject separated by a comma. For example: CN=hostname.domain.com, ST=CA, C=USA
• Hash Algorithm: Algorithm used by the certificate. Choose between MD5 and SHA-1
•Signature Algorithm: Algorithm (RSA) used to sign the certificate.
• Signature Key Length: Length of the signature, either 512 or 1024.
• (Optional) IP Address, Domain Name, and Email Address
b. Click Generate.
A new certificate request is created and added to the Certification Signing Request (CSR) table. To view the request, click the View button next to the certificate you just created.
Or you could check it on the next link. please check page 191
http://www.cisco.com/en/US/docs/security/multi_function_security/multi_function_security_appliance/sa_500/administration/guide/SA500_AG_OL1911404.pdf
If this answer was satisfactory for you, please mark the question as Answered.
Diego Rodriguez
Cisco network engineer
Thank you

Is it possible to use single ssl certificate for multiple server farm with different FQDN?

Hi
We generated the CSR request for versign secure site pro certificate
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
SSL Certificate for cn=abc.com considering abc.com as our major domain. now we have servers in this domain like www.abc.com, a.abc.com , b.abc.com etc. we installed the verisign certificate and configured ACE-20 accordingly for ssl-proxy and we will use same certificate gerated for abc.com for all servers like www.abc.com , a.abc.com , b.abc.com etc. Now when we are trying to access https//www..abc.com or https://a.abc.com through mozilla , we are able to access the service but we are getting this message in certfucate status " you are connected to abc.com which is run by unknown "
And the same message when trying to access https://www.abc.com from Google Chrome.
"This is probably not the site you are looking for! You attempted to reach www.abc.com, but instead you actually reached a server identifying itself as abc.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of adgate.kfu.edu.sa. You should not proceed"
so i know as this certficate is for cn=abc.com that is why we are getting such errors/status in ssl certficate.
Now my question is
1. Is is possible to remove above errors doing some ssl configuration on ACE?
2. OR we have to go for VerisgnWildcard Secure Site Pro Certificate for CSR generated uisng cn =abc.com to be installed on ACE and will be used for all servers like www.abc.com , a.abc.com etc..
Thanks
Waliullah

If you want to use the same VIP and port number for multiple FQDNs, then you will need to get a wildcard certificate. Currently, if you enter www.abc.com in your browser, that is what the browser expects to see in the certificate. And right now it won't beause your certificate is for abc.com. You need a wildcard cert that will be for something like *.abc.com.
Hope this helps,
Sean

Unable to make SSL connection from Proxy Server to Directory Server

I have recently installed Directory Proxy Server 5.2 Patch 3 on Solaris 9 server. Backend directories are Sun Directory Server 5.2sp3 using Thawte signed certificates.
I can't get the Proxy Server to make a successful SSL connection to the Directory Servers. The proxy server can make the non-ssl connection without problem. When the Proxy Server attempts the SSL connection it gives SEC_ERROR_UNTRUSTED_ISSUER error. The SSL certificates on the Directory Servers are signed by Thawte and have just recently been updated. The certificate for the Proxy Server is also signed by Thawte. The CA certificate is loaded in both the Proxy Server and the Directory Server.
I also have an iPlanet Directory Access Router (iDAR) 5.0 Server that is our current production server that serves these same directories and I haven't had a problem with SSL connection with it. So, the certificates are good.
I've encluded an exerpt from the Proxy Server log below for one of SSL connection attempts.
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [STAT/CONN]    [   560
307] Connection from secured listen port. New connection is on socket 37.
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [STAT/CONN]    [   560
305] Number of open connections is 1.
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [STAT/CONN]    [   171
211] [client(         152.3.100.30, 37)] Accepting connection via dukenet-group
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   302
023] Failure with CERT_VerifyCertNow (checking signature, usage: "certUsageSSLSe
rver").
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   302
023] SEC_ERROR_BASE + 20, NSPR error: -8172 (0xffffe014). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
729] Rejected certificate on socket 38
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
729] SEC_ERROR_BASE + 20, NSPR error: -8172 (0xffffe014). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
728] Certificate rejected on socket 38
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
728] SEC_ERROR_BASE + 20, NSPR error: -8172 (0xffffe014). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
721] Read on socket 38 failed.
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
721] SEC_ERROR_BASE + 20, NSPR error: -8172 (0xffffe014). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [EXCEPTION]    [   301
006] Unexpected error on socket 38. (Error: -8172).
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   171
002] [client(         152.3.100.30, 37)] [server( 152.3.101.110+ 636, 38)] L
ost connection to server, trying to failover to another
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   302
023] Failure with CERT_VerifyCertNow (checking signature, usage: "certUsageSSLSe
rver").
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   302
023] SEC_ERROR_BASE + 20, NSPR error: -8172 (0xffffe014). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
729] Rejected certificate on socket 38
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
729] SEC_ERROR_BASE + 20, NSPR error: -8172 (0xffffe014). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
728] Certificate rejected on socket 38
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
728] SEC_ERROR_BASE + 20, NSPR error: -8172 (0xffffe014). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [EXCEPTION]    [   385
717] ber_flush unexpected error on socket 38
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [EXCEPTION]    [   385
717] SEC_ERROR_BASE + 20, NSPR error: -8172 (0xffffe014). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [EXCEPTION]    [   385
717] ber_flush unexpected error on socket 38
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [EXCEPTION]    [   385
717] NSPR error: -5938 (0xffffe8ce). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
721] Read on socket 38 failed.
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   385
721] NSPR error: -5938 (0xffffe8ce). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [EXCEPTION]    [   301
006] Unexpected error on socket 38. (Error: -5938).
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [NOTICE]       [   171
002] [client(         152.3.100.30, 37)] [server(    152.3.232.3+ 636, 38)] L
ost connection to server, trying to failover to another
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [EXCEPTION]    [   385
717] ber_flush unexpected error on socket 38
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [EXCEPTION]    [   385
717] NSPR error: -5938 (0xffffe8ce). Native errno is: 11
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [EXCEPTION]    [   190
102] [client(         152.3.100.30, 37)] Rejecting request The server is tempor
arily busy
Aug 30 2005 16:12:12 king.oit.duke.edu SunONEDPS[ 17471]: [OP/CONN]      [   170
904] [client(         152.3.100.30, 37)] [server( 152.3.101.110+ 636, 38)] C
onnection unbound by client

No, that was on 5.1. For 6.0, my classpath has just:
%JAVA_HOME%\lib\tools.jar;%WL_HOME%\lib\weblogic_sp.jar;%WL_HOME%\lib\weblogic.jar;
%CLASSPATH%
This works fine.

Retrieving ssl certificates from a server

Similar Messages

Maybe you are looking for