Self Signed Certificates vs. GnuPG key and Web of Trust

I'm not totally sure where to ask this question, though this is the best place I can think of.
Wanting to be able to digitally sign my emails, and I can use a self signed certificate, or get one from CAcert.org (which, as far as I can tell, is also a self signature)...
Whereas with GnuPG, the keys are certified based on the web of trust.
Is there any kind of web of trust for the certificates?
Russell

Your private key is stored in the keystore (.pfx or .p12)
file that adt created for you when you created your self-sign
certificate. The file itself is protected by the password you
entered. Don't ever give this file to anyone, and under no
circumstances should you give the password to anyone.
The public key is also stored in the same file. You can
export the public key, embedded in a certificate, from the keystore
file, although you likely won't have any need to do that.
If the resulting .air file is ever modified then the
application won't install. There's no need for users to check the
hash or anything like that to validate the file; it's all done
automatically as part of the installation process.
Hope that helps,
Oliver Goldman | Adobe AIR Engineering

Similar Messages

  • Why does my MAC keep asking me to trust a self signed certificate that I indicated it should always trust?

    My company uses a Cisco Wireless Lan Controler solution.  The cert is self signed and every time i go to connect i prompts me VerifyCertificate.  When i show the certificate, the check box for for "Always Trust" is checked.  Also, all when i expand the Trust arrow, all the  options there say "Always Trust".  I then MUST click continue and put in my credentials (Active Directory) .  Then everhthing works, but I don't want to be prompted everytime i connect to wireless.
    Any thoughts?

    I never said I was happy with my defective product. I'll get it fixed, just as you said. But I'm far from an apple store at the moment, so his workaround works great for the moment. anth2013's answer told me that there is an issue with the newer macbook airs. That's all I needed to know: whether there was a problem with my router or with my dad's mac. And now I know that my dad's mac is defective. What, do you want me to mark your answer as the right one? If you're really desperate for the "reputation" then FINE, I'll mark your answer as "this solved my question". Just let me know. In fact I don't think I can change it now. His/her "answer" came first and broadly answered my question. I would me more than happy to say that you "helped me".
    As for you useless rage, I understand that you're angry with apple, but please direct it elsewhere, because you have no further help to contribute to this post. If you really think that your rage can help people, start your own thread, and stop bothering this thread. There is truly nothing left to contribute to this thread.

  • Xcode continuous integration, Subversion and self-signed certificate won't work altogether.

    Hi!
    I've installed on MacMini Maverick OS with OSX Server.
    Then I've configured the Xcode continuous integration with Subversion (using self-signed certificate), also created bots and etc.
    But It won't work.
    Attached is the log:
    Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Debug>: [XCSCheckoutOperation.m:717 7c087310 +0ms] revision: (null) Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Debug>: [XCSCheckoutOperation.m:718 7c087310 +0ms] log: (null) Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Debug>: [XCSCheckoutOperation.m:719 7c087310 +0ms] checkoutError: Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk." UserInfo=0x7fb388c4b4e0 {NSURLErrorFailingURLPeerTrustErrorKey=<SecTrust 0x7fb388c18ff0 [0x7fff7baddf00]>, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, NSUnderlyingError=0x7fb389904370 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk.", NSErrorPeerCertificateChainKey=( "<SecCertificate 0x7fb388c6f490 [0x7fff7baddf00]>" ), NSLocalizedDescription=The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk., NSErrorFailingURLKey=https://svn.myheritage.co.il:8443/svn/mobile/MyHeritageMobileiPhone/branches/Mob ile_with_albums_and_inapp, NSErrorFailingURLStringKey=https://svn.myheritage.co.il:8443/svn/mobile/MyHeritageMobileiPhone/branches/Mob ile_with_albums_and_inapp, NSErrorClientCertificateStateKey=0} Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Error>: [XCSCheckoutOperation.m:732 7c087310 +0ms] Error in SVN checkout Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk." UserInfo=0x7fb388c4b4e0 {NSURLErrorFailingURLPeerTrustErrorKey=<SecTrust 0x7fb388c18ff0 [0x7fff7baddf00]>, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, NSUnderlyingError=0x7fb389904370 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk.", NSErrorPeerCertificateChainKey=( "<SecCertificate 0x7fb388c6f490 [0x7fff7baddf00]>" ), NSLocalizedDescription=The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk., NSErrorFailingURLKey=https://svn.myheritage.co.il:8443/svn/mobile/MyHeritageMobileiPhone/branches/Mob ile_with_albums_and_inapp, NSErrorFailingURLStringKey=https://svn.myheritage.co.il:8443/svn/mobile/MyHeritageMobileiPhone/branches/Mob ile_with_albums_and_inapp, NSErrorClientCertificateStateKey=0} <stderr>= (null) Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Error>: [XCSOperation.m:33 7c087310 +0ms] Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk." UserInfo=0x7fb388c4b4e0 {NSURLErrorFailingURLPeerTrustErrorKey=<SecTrust 0x7fb388c18ff0 [0x7fff7baddf00]>, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, NSUnderlyingError=0x7fb389904370 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk.", NSErrorPeerCertificateChainKey=( "<SecCertificate 0x7fb388c6f490 [0x7fff7baddf00]>" ), NSLocalizedDescription=The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk., NSErrorFailingURLKey=https://svn.myheritage.co.il:8443/svn/mobile/MyHeritageMobileiPhone/branches/Mob ile_with_albums_and_inapp, NSErrorFailingURLStringKey=https://svn.myheritage.co.il:8443/svn/mobile/MyHeritageMobileiPhone/branches/Mob ile_with_albums_and_inapp, NSErrorClientCertificateStateKey=0} Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Debug>: [XCSOperation.m:28 7c087310 +0ms] Cancelling operation: XCSCheckoutOperation Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Error>: [XCSBuildBundle.m:790 7c087310 +0ms] Got an error from the checkout operation: Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk." UserInfo=0x7fb388c4b4e0 {NSURLErrorFailingURLPeerTrustErrorKey=<SecTrust 0x7fb388c18ff0 [0x7fff7baddf00]>, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, NSUnderlyingError=0x7fb389904370 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk.", NSErrorPeerCertificateChainKey=( "<SecCertificate 0x7fb388c6f490 [0x7fff7baddf00]>" ), NSLocalizedDescription=The certificate for this server is invalid. You might be connecting to a server that is pretending to be “svn.myheritage.co.il” which could put your confidential information at risk., NSErrorFailingURLKey=https://svn.myheritage.co.il:8443/svn/mobile/MyHeritageMobileiPhone/branches/Mob ile_with_albums_and_inapp, NSErrorFailingURLStringKey=https://svn.myheritage.co.il:8443/svn/mobile/MyHeritageMobileiPhone/branches/Mob ile_with_albums_and_inapp, NSErrorClientCertificateStateKey=0} Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Debug>: [XCSBuildBundle.m:850 7c087310 +0ms] Starting upload files operation Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Debug>: [XCSBuildBundle.m:1018 7c087310 +0ms] Updating bot run status to running, substatus to uploading Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Info>: [CSRemoteServiceClient.m:151 7c087310 +0ms] Connecting to https://localhost:4443/svc to execute [https]Request{AuthService.enterMagicalAuthRealm()} Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Debug>: [XCSBuildHelper.m:97 7c087310 +38ms] Updating bot run with GUID cccf1c74-6c5a-4fff-a57f-5e5bead09457 Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Debug>: [XCSBuildHelper.m:102 7c087310 +0ms] Updating bot run (cccf1c74-6c5a-4fff-a57f-5e5bead09457): { guid = "cccf1c74-6c5a-4fff-a57f-5e5bead09457"; status = running; subStatus = uploading; } Aug 24 14:03:27 osxserver.iloffice.myhrtg.net xcsbuildd[82719] <Info>: [CSRemoteServiceClient.m:151 7c087310 +0ms] Connecting to https://localhost:4443/svc to execute [https]Request{XCBotService.updateBotRun:({ guid = "cccf1c74-6c5a-4fff-a57f-5e5bead09457"; status = running; subStatus = uploading; })}
    Hope you'll be able to assist me find what I'm doing wrong.
    Thanks in advance.

    Did anyone find a way around this? I have the exact same error and tried the exact same solution.
    The Xcode 5 release notes described a problem that sounds similar.
    Communicating with a remote SVN repository over HTTPS can fail with an error similar to “Error validating server certificate for server name.” Edit the file /Library/Server/Xcode/Config/xcsbuildd.plist and change the TrustSelfSignedSSLCertificates key from false to true. Then, from a Terminal window, run: sudo killall xcsbuildd. 14639890
    https://developer.apple.com/library/ios/releasenotes/DeveloperTools/RN-Xcode/Cha pters/xc5_release_notes.html
    I haven't found a similar fix for Xcode 6 though.

  • Self signed certificate, key of 2048 bits, CUOM 8.7

    Hello:
    What is the correct way to create a self signed certificate with a key of 2048 bits in Cisco Unified Operations Manager 8.7?
    I edited the file
    "NMSROOT\MDC\Apache\conf\ssl\openssl.conf",
    changing
    default_bits from 1024 to 2048 and
    prompt from no to yes and then executed
    "NMSROOT\MDC\Apache\gencert.bat"
    and now the files
    "NMSROOT\MDC\Apache\conf\ssl\server.crt" and
    "NMSROOT\MDC\Apache\conf\ssl\chain.cer"
    show public keys RSA of 2048 Bits.
    Is this the right procedure to increase the lenght of the key?
    Regards,
    Marco Antonio.

    Sure, the secure-server is the quickest and easiest method but you can create the new key, define the trustpoint manually and enroll the certificate that way.
    Below are the commands. (You can of course call the key, trustpoint, O and CN values whatever locally significant names make sense for you.)
    router(config)#crypto key generate rsa label router-rsa modulus 2048
    The name for the keys will be: router-rsa
    % The key modulus size is 2048 bits
    % Generating 2048 bit RSA keys, keys will be non-exportable...
    [OK] (elapsed time was 10 seconds)
    router(config)#
    router(config)#crypto pki trustpoint router-ca
    router(ca-trustpoint)#enrollment selfsigned
    router(ca-trustpoint)#subject-name O=Test,CN=www.router.com
    router(ca-trustpoint)#rsakeypair router-rsa
    router(config)#crypto pki enroll router-ca
    % Include the router serial number in the subject name? [yes/no]: no
    % Include an IP address in the subject name? [no]: no
    Generate Self Signed Router Certificate? [yes/no]: yes
    Router Self Signed Certificate successfully created
    router(config)#

  • Safari on Windows could not accept self-signed certificate

    Hi, i am using Safari 5.0.4 on Windows 7 and I am trying to access an https site with a self-signed certificate (internal developing site).
    after i install the certificate to the Windows certificate store (i try both Personal store and Trusted Root Certification), when i try to browse the site, Safari asks me to choose a certificate, after i choose it, after a long hang time, Safari displays "Safari can't open the page".
    My questions are:
    1. Any one has configured safari on windows to accept self-signed certificate successfully?
    2. i see some other posts saying "Safari on Windows has bug to use the self-signed certificate", any official document or link saying this if this is true?

    Microsoft Windows web browser support questions?   Try one or more of these resources:
    http://technet.microsoft.com/en-us/library/cc747495(WS.10).aspx
    http://www.leonmeijer.nl/archive/2008/08/01/123.aspx
    http://stackoverflow.com/questions/681695/what-do-i-need-to-do-to-get-ie8-to-acc ept-a-self-signed-certificate
    That was from tossing the /internet explorer import self-signed certificate/ query at Google, and some poking around.  StackOverflow and Microsoft Technet and the Microsoft KBs have more details on Microsoft platforms and products and permutations, too.
    The usual best fix with this stuff is to create your own certificate authority (CA) root certificate and to configure that within your chosen platforms and browsers, but I do not know (off-hand) how to do that on Microsoft Windows boxes.  Google or some KB probably has details of loading your own root cert.  This approach means loading one cert, and the rest of what you create that's signed from that cert will now automatically be trusted.  Basically you become your own CA provider, load your root cert into each of your clients, and then issue your own certs chained from your own root cert, and Bob's Your Uncle.

  • Cannot upload self signed certificate on EZ Media

    The problem I have is on my Lenovo Iomega EZ Media & Backup Center 3TB, version 4.1.108.32627
    Using openssl I created the following self signed certificates in both .pem and .der format:
    -CA.cert.pem( this is the CA that I used to sign the server certificate that I intend to upload to the Iomega EZ; I installed this in my browser, works ok )
    -server.cert.pem ( this is the certificate that I want to install on server )
    -server.key.pem ( this is the key that I used to make the certificate signing request that I used to generate server.cert.pem ).
    From the security menu ( https://<personal_cloud_url>/manage/security.html ) I try to install server.cert.pem ( and also in .der format ).
    The problem is that I receive this error:
    "Failed to validate the uploaded certificate"
    Same error is seen when I try to upload CA.cert.pem/.crt.
    I red the help file for this particular security page, but I could not find anything about the required format of the certificate.
    Does anyone have any idea how to install a self signed certificate?
    Thank you.
    Solved!
    Go to Solution.

    Hello zupermann
    Iomega/LenovoEMC Lifeline devices only support x.509 certificates with one private key and pem extension.  
    This should be the format used to create an open ssl cert for use with a lifeline device 
    " # openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout newCertificate.pem -out newCertificate.pem "
    Hope that helps!
    LenovoEMC Contact Information is region specific. Please select the correct link then access the Contact Us at the top right:
    US and Canada: https://lenovo-na-en.custhelp.com/
    Latin America and Mexico: https://lenovo-la-es.custhelp.com/
    EU: https://lenovo-eu-en.custhelp.com/
    India/Asia Pacific: https://lenovo-ap-en.custhelp.com/
    http://support.lenovoemc.com/

  • Renewing Self Signed Certificate on IPN Nodes 1.2

    Dear Team
    I have just upgraded the ISE infrastructure to 1.2, IPN nodes have also been upgraded, a default self signed certificate is generated, which is for a validity of 90 days.
    on my ISE main units, i have self signed certificates with 2048 Modulas and SHA1-256 hash, validity = 12 years.
    1:  I want to generate self signed certificate on IPN with the same specifications.
    how it can be achieved, is it through "pep certificate server add" ?
    IPN2/admin# pep certificate server add
    Server Certificate change will result in application restart. Proceed? (y/n): y
    Bind the certificate to private key made by last certificate signing request? (y/n):
    but as such i am not generating any CSR, because we do not have any CA in our deployment.
    Thanks
    Ahad Samir

    Above requirement is necessary because we don't have an Enterprise CA in our Deployment. We have to rely on self Signed certificates.
    Further Self Signed certificates should be valid for a long period so that no communication issue happens, 

  • Web Server 7 Admin Server and Self-Signed certificate

    Is it possible to create and install a self-signed certificate for the administration server in Sun Web Server 7. The default installation comes with a self-signed certificate but we would like to install our own certificate and not the certificate issued by "admin-ca-cert"
    Message was edited by:
    aar

    As far as I know its not a problem. You can install your own certificate. Make sure that the certificate nick name is changed accordingly in "server-cert-nickname" in server.xml section as shown below :
    <http-listener>
    <name>admin-ssl-port</name>
    <port>2224</port>
    <server-name>alamanac.india.sun.com</server-name>
    <default-virtual-server-name>admin-server</default-virtual-server-name>
    <ssl>
    <server-cert-nickname>Admin-Server-Cert</server-cert-nickname>
    </ssl>
    </http-listener>

  • Statement on Firefox 33 and self-signed certificates

    Dear Mozilla,
    Your decision to drop support for self-signed certificates is causing problems all around in LANs, VPNs, and domain networks both home and corporate which employ SSL but use self-signed certs. Despite it being understanding that it is generally ill-advised to access sites with such problems, further deciding that this minority of exceptions should be abandoned altogether in a world web full of so many shades of grey and complex setups is not a responsible decision.
    Please implement methods for us to be able to coexist with these updates, as suddenly dropping support for the plenthora of routers, domains, websites and other sources using such a setup, many of which cannot be quickly updated or even at all, is a big problem.
    The internet engineering taskforce has not issued any such directives, nor have broader plans to drop support for self-signed certificates been announced. In the lack of a transitioning climate away from this setup or any plans to do so, Mozilla has unilaterally decided to remove support.
    Please remember that you have a large userbase and thus a responsibility to keep available means of access that are in common use by the world. Self-signed certificates still very much play a role in the ecosystem, and they will continue to exist for as long as there is a need for encryption on intranets.
    Thank you!

    it seems the problem is not self-signed certificate itself, but too short (from current point of view) RSA-keys.
    Please see
    https://support.mozilla.org/en-US/questions/1045971
    moreover, SSLv3 is now insecure, and is soon going to be disabled by default.
    https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/

  • Self- Signed Certificate - Change RSA Public Key & Signature Algorithim

    Hi
    My 1801 router (IOS 15x) is using the original self signed certificate (1024) with an signature algorithm MD5. I would like to change the cert to a 2048 key length , with a hash of SHA1 or better but I'm unsure how to do this.
    Should I just generate new keys or would I be better creating a new self-signed cert?  What is the procedure & explicit commands (CLI) to do this?
    Many thanks in advance.
    Regards
    Bob

    Sure, the secure-server is the quickest and easiest method but you can create the new key, define the trustpoint manually and enroll the certificate that way.
    Below are the commands. (You can of course call the key, trustpoint, O and CN values whatever locally significant names make sense for you.)
    router(config)#crypto key generate rsa label router-rsa modulus 2048
    The name for the keys will be: router-rsa
    % The key modulus size is 2048 bits
    % Generating 2048 bit RSA keys, keys will be non-exportable...
    [OK] (elapsed time was 10 seconds)
    router(config)#
    router(config)#crypto pki trustpoint router-ca
    router(ca-trustpoint)#enrollment selfsigned
    router(ca-trustpoint)#subject-name O=Test,CN=www.router.com
    router(ca-trustpoint)#rsakeypair router-rsa
    router(config)#crypto pki enroll router-ca
    % Include the router serial number in the subject name? [yes/no]: no
    % Include an IP address in the subject name? [no]: no
    Generate Self Signed Router Certificate? [yes/no]: yes
    Router Self Signed Certificate successfully created
    router(config)#

  • Self Signed Certificate for Web Proxy 4.0.2

    Does anyone have instructions on how to create and install self signed Certificate for Web Proxy Server 4.0.2? My OS is RHEL 4.
    Shed.

    Unfortunately you will not be able to do that from the GUI.
    You will have to use certutil frin proxy-install/bin/proxy/admin/bin/certutil
    Make sure that your LD_LIBRARY_PATH includes proxy-install/bin/proxy/lib
    (start -shell will give you a shell with all necessary paths set.)
    create a file called password-file which contains your password to your cert database
    your cert database resides in the alias directory of proxy installation.
    certutil -S -s "CN=My Issuer" -n myissuer -x -t "C,C,C" -1 -2 -5 -m 1234
    -f password-file -d certdir

  • Self signed certificate for web service security !!

    i've created self-signed certificate using keytool for web serivce security. But i'm unable to implement from the client side. When i'm giving "dn=localhost" it's working fine. But when i'm giving other than that it's throwing me error as :
    java.io.IOException: HTTPS hostname wrong: should be <192.168.2.36>
    I don't know what's the problem. Could any tell me where i'm wrong. In the CN i've given my ip address. Please help me out.
    Do i need to do something else?

    thanks for your kind help.
    But i follwed the same which are given. Do i need to set something in netbeans? i'm usign netbeans 5.5,tomcat 5.5 and jdk5. Still i'm getting the same error as "https hostname is wrong: it should be <192.168.2.278>", which my ip address. I've created my self signed certificate and given the path to it by mentioning in System.setProperty("javax.net.ssl.trustStore","d:/keystore/auth.keystore"); and for password to. Do i need to do something else?
    Please help me out in this reagard. I'm startup of this technology.
    in advance thanks.

  • Issue with Self Signed Certificate Web Sites

    I tried searching, but wasn't really getting the answer or help I needed so I figured I would just start a new topic. At my work we have a test server that we use for development and we have a couple of Web Services on there that use Self Signed Certificates. At work, I have a PC (Windows 7) and a Mac Mini (OS X) both of which can connect to the Web Services just fine. But at home, I can't access any of the Web Services at all, my browsers and Xcode keep timing out. I know the Web Service is public, I've accessed it before from other machines outside of work it's just at home I can't. I have an iMac at home, with a linksys router and I don't know if it's a setting on my home computer or network that could be causing it but I don't even get the message in Safari, Chrome or Firefox that the site has a self signed or bad certificate so I know something isn't letting me communicate. Any help would be great (all of the answers I have found suggested to purchase a certificate, which in this case isn't appropriate since they are used for Development until we feel they are ready for production in which case we purchase the certificate). Thanks.

    new information:
    I tried an other lumia800, the https page worked.
    The difference of the two phone was only the language
    My phone language was english (US), the other was hungarian.
    After that, I switched my phone language settings to hungarian, and tada... the self signed https page worked.
    I switched back to english(US) and stopped working.
    than I tried english(GB) and worked again.
    I did not try other languages, but it looks, if I use english-US language, I cannot see any invalid certificated page
    In other language settings, there is no problem.

  • How pass client credentials to ws client and accept self signed certificate

    How do you connect to a web service over ssl and accept self-signed certificates. I generated the client using JAX-WS but i ran into two problems. First of all, how do you pass the client credentials? And second, how can you accept a self-signed certificate?

    Thanks for your comments Jason.
    I'm not quite sure why the certificate has client auth. It does seem to be a misconfiguration, but I do see both 7.3.1 & 7.3.2 on the cert. That seems like a possible fix, but in a backwards way.  I can get those certificates reissued, but I'm confused
    as to why config manager itself is not installing per the site settings.
    My default install is via a vbs script you wrote (1.6.5).  The other methods I've tried in this particular instance are by browsing to the server and running ccmsetup.exe from explorer out of my sms_<site> directory, and by using command line
    specifying the /mp:mp.mysite.com
    I looked for command line switches to use, but there's no /NoUsePKI switch or /UseSelfSigned...
    any suggestions for a better installation method?

  • DS6.3 replication and sun self signed certificate

    1. I am creating a replication agreement using the dscc and am prompted to choose:
    Authenticate using simple authentication and use a non-secure connection
    Authenticate using simple authentication and use a secure connection
    Authenticate using a certificate and use a secure connection
    I would like to choose the second option "Authenticate using simple authentication and use a secure connection" since I am replicating to another company division on another subnet in another building.
    Does this option take into account the installed certificates? Can I do this with a sun self signed certificate that I got by default at install? And if so can I renew it if it is expired?
    In my deployments I have used my own self signed certs and store bought certs. Since I know the other server has the sun cert, I was thinking I could just use that, and not do any root cert exchanges.

    Yes, you can. By default the certs that come when instance is created expire in 90 days and you can renew the cert easily using certutil. But you have to change the cert's trust properties so it can be used as a client as well.
    It's best you use CA signed certificates that last for longer, that way you can use it with normal apps as well. If this does not help, please post again.
    http://docs.sun.com/app/docs/doc/820-2763/bcarh

Maybe you are looking for