Self Signed in Certificates without CA server

Hi Team,
I am working to configure expressway for Cisco Jabber but i stuck now in certificate step, can i do self signed in certificate without CA server ? if yes what are the procedures to do that.
Thanks

It is better if you use a CA server.
Please follow the deployment guide http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-1/Mobile-Remote-Access-via-Expressway-Deployment-Guide-X8-1-1.pdf

Similar Messages

EDirectory install - failed to retrieve self-signed root certificate:142

Hi,
My istallation has 2 NICs, public & internal.
My tree name is IS.
I have succesfully installed and used RedCarpet. I additionally enabled
the Firewall and DHCP server to allow internet access to my users.
On running Yast install for eDirectory I am given the default IP address
of the server, this is the Public IP address - I decided that eDirectory
was for internal use so changed IP address to internal one.
At 50% of installation an error pops up :-
Error
The installation failed to retrieve the self-signed root certificate:142
I aborted the installation.
I retried the install using the public Ip address, it complains ports are
already in use, I chose ignore and go ahead. Same error occurs :142.
Your assistance and guidance would be appreciated.

> Hi Johan,
>
> Thanks for sticking with me... I appreciate your time and help (believe
> me, It's a great help..)
>
> I have cracked it...
>
> On a reboot, I chose to press F2 to get rid of the Suse Chameleon screen
> and watched the boot process progress. I then noticed that it was unable
> to contact my specified NTP source.
>
> I went into Yast Ntp client and changed my NTP source to other published
> secondary NTP servers and all failed. I then put in the ip address of one
> of the time servers and Bingo! ntp connected...I think I've seen this
> before with Netware...where name resolution of the ntp server name does
> not occur....most ntpserver administrators state they prefer you contact
> the server by name rather than address...hmmm.....
>
> I then retried Yast eDirectory install and it was a breeze, as was the
> iManager install....
>
> GroupWise here I come...
>
> Rgds.
>
> Stan Chelchowski
>
Hi, this is roy.
had the same issue. using a supermicro with a builtin dual nic.
disabled it and installed an old pci nic to test and it finally loaded the
edirectory without an error.
on another note, i am installing the NLSBS 9.0 and had to manually load
the disk drivers since i have an adaptec 2010s raid adapter. i had
installed suse 9.3 on the same machine earlier with absolutely no issues,
but NLSBS is a pain. if you run red carpet and update all, then the driver
issue returns.
how do you get and install the service pack 2?
thanks,
roy

Abandoning Self-Signed SSL Certificates?

Hello,
I'm working on remediation of some security flaws and have encountered a finding that calls out each of my domain-added workstations as having self signed SSL certificates. I'm not an expert on the subject, but I do know the following things:
1) An earlier finding lead to me disabling all forms of SSL on my servers and workstations
2) Workstations use certificates to identify themselves to other domain assets.
Now my servers all have their own certs signed by an outside authority. However, it would be a huge amount of work to go through the process for each and every workstation. So my questions are these:
1) Can I create a NON-SSL self signed cert for these machines to use?
2) How do I remove these current SSL certs without having to hover over each workstation?
Basically, what's the least effort to remove self-signed SSL certs and replace them with something more secure?
Thanks,
M.

What do you mean when you say that you've disabled all forms of SSL on your servers and workstations? SSL serves to provide secure communications for all of your domain operations, so disabling SSL, in general, would likely break your entire domain. If you're
using certificates on your workstations, then you're using certificate-based security (IPSec) in some manner.
Do you have AD CS or some other certificate signing authority/PKI in your environment? If not, you would have to pay a public provider (i.e. VeriSign) to provide certificates, and I can assure you that gets very expensive.
If you have Microsoft servers in your environment, you can install and use Certificate Services to provide an internal signing mechanism which can be managed through group policy. You can replace all of the workstation certificates with ones signed by your
internal certificate authority (CA,) and those will pass muster with any auditor provided the appropriate safeguards are put into place elsewhere in your environment.
Least effort for you would be to implement an internal CA, which admittedly isn't a low-effort endeavor, and have the CA assign individual certificates to all of your machines, users, and any other assets you need to protect. If your auditors are requiring
the removal of the self-signed certificates, you might find a way to script the removal of the certificates. In my experience, however, most auditors just want IPSec to be done with certificates that terminate somewhere other than the local workstation (i.e.
an internal CA).

E-Mail Setup fails with self-signed SSL certificat...

Hi, one of my e-mails is with a small provider who just moved the mail server to Imap and SSL. In Thunderbird, everything works fine, setup on my Nokia C-6-fails with an unspecific error message (and trows away the settings). I asked the provider, and it seems that the problem comes up because the Nokia e-mail application doesn't asked me if I want to accept the certificate but instead rejects it. Is there a workaround to this problem? Is there a way to setup the mail account without using the wizard? Or to take over the settings from Thunderbird? Or a way to put the certificate in the right place manually? In Opera mobile I have no trouble with self-signed SSL certificates. Thanks Cave

Any one around who can help? Self-Signed certificates are rather common, after all. I would be grateful cave

Mail.app: Self-Signed SSL Certificates

How can I make mail trust self signed mail certificates FOREVER? As it is now, I have to tell Mail.app to always trust the cert for each email account, every time I launch mail. Then it remembers to trust it until I quit mail, then I have to re-tell it all over again. This is bearable on my desktop but on my laptop, where I need SSL the most, I'm constantly logging in and out and rebooting, and it drives me crazy.
FYI it's my own server, running Mac OS X Server. And I'm not buying a certificate, it's the encryption I'm after

First, the certificate must match the name Incoming Mail Server that your clients are using. For example 'mail.acme.com'. So, when creating the self-signed certificate, the common name that you enter would be 'mail.acme.com'. If you don't do this, you will always be prompted about the certificate when you relaunch Apple mail.
Just for clarification, here is how you should trust the self-signed certificate on the Macs that are using Apple Mail:
1. When you get the prompt about the certificate, click the show certificate button.
2. Drag the icon of the Certificate on the left in the Show Certificate dialog box to the desktop. This will create a document on your desktop named 'mail.acme.com.cer'.
3. Double click the certificate on the desktop which will open an Add Certificate dialog box.
4. Depending on the version of Mac OS X that you are running, what you do next will vary a little.
Leopard
1. Click the drop down next to keychain and select System
2. Open Keychain Access (Applications/Utilities) if it is not already open
3. Click System on left hand side under Keychains
4. Locate the 'mail.acme.com' certificate on the right and double-click it to open it. (NOTE: I had to quit Keychain Access and reopen it before the certificate showed up under System for me for some odd reason)
5. Click the gray triangle next to Trust to expand the Trust section of the Certificate.
6. Select Always Trust from the drop down next to 'When using this certificate'
7. Close the certificate window and then quit out of Keychain Access
8. Click the continue button back in Apple Mail if the Certificate dialog is still present.
9. Quit out of Apple Mail and the relaunch it again. This time you should not see the certificate dialog alert.
Tiger
1. Click the drop down next to keychain and select X509Anchors
2. Open Keychain Access (Applications/Utilities) if it is not already open
3. Click System on left hand side under Keychains
4. Locate the 'mail.acme.com' certificate on the right and double-click it to open it.
5. Click the gray triangle next to Trust to expand the Trust section of the Certificate.
6. Select Always Trust Settings from the drop down next to 'When using this certificate'
7. Close the certificate window and then quit out of Keychain Access
8. Click the continue button back in Apple Mail if the Certificate dialog is still present.
9. Quit out of Apple Mail and the relaunch it again. This time you should not see the certificate dialog alert.
This worked for me. I hope this works for you too.

IPhone LDAP contacts and Self signed SSL certificates

Hi,
I am using OpenLDAP with self signed SSL certificate, and i am unable to get SSL work with LDAP contacts on the IPhone (4.x). I have tried to add a CA cert with a server certificate for the LDAP server and downloaded it to the IPhone by web, it adds the CA, but even with it, it does not want to connect to the LDAP server with SSL enabled.
Does LDAP contacts should work by adding new CA ? if yes, what is the exact procedure to do it ? (maybe I used a wrong CA export format, or wrong SSL certificate encryption format ...)
can someone tell me how to do it ?
This is really anoying, since we have multiple iphones on the company.
Thanks for the help.

Hello, found your post. I realize it's been 6 months since you posted, but I have a solution for you since I have struggled with the same problem since 2009.
I discovered that when the iPhone is using LDAPS, it tries to bind with LDAPv2. After it binds, it speaks LDAPv3 like it is supposed to. Apparently this is a somewhat common practice since OpenLDAP includes an option for it.
You'll want to set the following option in OpenLDAP:
dn: cn=config
olcAllows: bind_v2
Walla! LDAPS works! (assuming you've correctly done all the certificate stuff). Took some deep reading through the debug logs to figure out this problem. Figured I'd share my answer with others.

Is there a way to make a self-signed client certificate with keytool...

Is there a way to make a self-signed client certificate with keytool
that will install successfully into the personal store in IE?

hi,
It is possible to make a self-signed client certificate with keytool and i am successfully using in my dummy application.
The first thing you need to do is create a keystore and generate the key pair. You could use a command such as the following:
keytool -genkey -dname "cn=Mark Jones, ou=JavaSoft, o=Sun, c=US"
-alias business -keypass kpi135 -keystore C:\working\mykeystore
-storepass ab987c -validity 180
(Please note: This must be typed as a single line. Multiple lines are used in the examples just for legibility purposes.)
This command creates the keystore named "mykeystore" in the "working" directory on the C drive (assuming it doesn't already exist), and assigns it the password "ab987c". It generates a public/private key pair for the entity whose "distinguished name" has a common name of "Mark Jones", organizational unit of "JavaSoft", organization of "Sun" and two-letter country code of "US". It uses the default "DSA" key generation algorithm to create the keys, both 1024 bits long.
It creates a self-signed certificate (using the default "SHA1withDSA" signature algorithm) that includes the public key and the distinguished name information. This certificate will be valid for 180 days, and is associated with the private key in a keystore entry referred to by the alias "business". The private key is assigned the password "kpi135".
Also please go through the http://java.sun.com/j2se/1.3/docs/tooldocs/win32/keytool.html
This would help u better.
bye,
Arun

HT5012 How can you add a self signed CA Certificate to iOS 8?

How Can I add a self signed CA Certificate to an iPad with iOS 8.1?

I don’t think that I can help you but I am very interested in your question. Perhaps you have seen information about a related problem…
https://discussions.apple.com/thread/6590335
One way to install the self-signed CA certificate is to export it to a .CER file, email it to the iOS 8 device, open the attachment and process it. My guess is that the certificate will be installed (check the resulting profile) but due to an iOS 8 bug it will be ineffective.
Or, you could send a signed email from the email account for the CA. Open the email on the iOS 8 device and process it.
I assume your goal is for certificates issued by the CA to be automatically trusted on the iOS 8 device. Good luck with that.
The method I used was to send a .CER file. The CA certificate showed up as a profile. However, I do not get automatic trusting of certificates issued by the CA.

How to generate self-signed CA certificate, client certifacate in pkcs12

Based on the requirement, i need to generate self-signed CA certificate, client certificate, keystore type all in PKCS12 format.
Below is the successful process of generating them in DER format
1. openssl req -x509 -newkey rsa:1024 -keyout cakey.pem -out cacert.pem -days 2190 -config openssl.cnf
2. keytool -genkey -alias client -keyalg RSA -keystore client-keystore.jks
3. keytool -certreq -keystore client-keystore.jks -storepass clientkeystore -alias client -file client.cert.req
4. openssl ca -config openssl.cnf -out client.pem -days 2190 -infiles client.cert.req
5. openssl x509 -outform DER -in client.pem -out client.cert
openssl x509 -outform DER -in cacert.pem -out cacert.cert
6. keytool -import -file cacert.cert -keystore client-keystore.jks -storepass clientkeystore -alias ca
keytool -import -file client.cert -keystore client-keystore.jks -storepass clientkeystore -alias client
So, i try to create them in PKCS12 format
1. openssl req -x509 -newkey rsa:1024 -keyout cakey.pem -out cacert.pem -days 2190 -config openssl.cnf
2. keytool -genkey -alias client -keyalg RSA -keystore client-keystore.jks -storetype pkcs12
3. keytool -certreq -keystore client-keystore.jks -storetype pkcs12 -storepass clientkeystore -alias client -file client.cert.req
4. openssl ca -config openssl.cnf -out client.pem -days 2190 -infiles client.cert.req
5. openssl pkcs12 -export -out cacert.p12 -in cacert.pem -inkey cakey.pem -name "CA Certificate"
cacert.p12 successfully created. but,
openssl pkcs12 -export -out client.p12 -in client.pem -inkey cakey.pem -name "Client Certificate"
error message said "No certificate matches private key"
I have no idea that which step goes wrong....any advice or suggestion? importantly is to convert into pkcs12 format.
Thanks

Your last step should be to import the signed certificate back into your client PKCS#12 keystore, client-keystore.jks.
This file contains the private key used to create your signing requets originally, and must be matched when importing the signed certificate back in.
I think you will need to follow steps 5 & 6 in your DER example to complete the client PKCS12 keystore (including -storetype pkcs12 argument on the import statement).
Another way is to simply convert the keystore created in your DER example into a pkcs#12, by using JRE1.6 command:
keytool importkeystore -srckeystore [jks keystore] -srckeystoretype jks -destkeystore [pkcs12 keystore] -destkeystorestype pkcs12

IOS 6.1 upgrade, self signed root certificate not working

Hello,
We have been deploying our organizations self signed root CA to the iPhones with Apple Configurator and using that to confirm the identity of our local webservers.
Has anyone had problems with self signed root certificates after upgrading to 6.1 (same with 6.1.1)?
Safari complains that "Safari cannot verify the identity of "<servername>", Activesync also stopped working.
Any ideas to overcome the issue, other than buying a hundred certs from a trusted ca?

Same thing for me after updating to 6.1.2. Facebook, gmail, and many US govt sites certificates have been declared invalid by iOS/Safari. And there is no way to accept and continue, just click "ok" and you are forever prevented from those sites.

Need help with Apache self signed client certificates.

At work we use PHPmyadmin to administer our central MySQL database.
In order to access PHPmyadmin we use self signed ssl client certificates, for our developers, so that you can only access phpmyadmin if you have a valid client certificate installed in your browser.
The ssl certificate on the webserver hosting phpmyadmin has expired now and I would like to extend it, preferrably without having to re-genereate client certificates for all users.
I'm a bit confused to the approach. Most howtos I've found deal with extending a webserver certificate. but it really just looks like they generate a new one.
Can anyone help me out with how best to approach this.
Do I simply generate a new Apache Server certificate and then use this to re-sign the existing client certificates?

As the SOAP servlet says: "Sorry, I don't speak via HTTP GET- you have to use HTTP POST to talk to me.", you must use the HTTP POST method and not the GET method to use SOAP.
Use setRequestMethod("POST") of class HttpURLConnection to make your HTTP connection use the POST method.
(I didn't look at all your code).
Jesper

Problem with importing and creating self signed SSL certificate

Mac Pro, 10.7.2 Server. Attempting to import or create a self signed certificate for use as ichat.domain.com to encrypt iChat service. Server is acutally called server.domain.com but has an alias of ichat.domain.com. I understand that this is probably not best practice but I would like to keep things this way since we have one server, run multiple services on it, but want to continue to connect to each service at SERVICE.domain.com. We have been using this type of mismatched certificate with success since 10.4 or so.
I am working through setup of 10.7 Server to replace our 10.6 server.
Tried upgrade of 10.6 to 10.7 installation. The installation made a mess of some services and our Open Directory, but did move the certificate over and allowed iChat service to function properly.
Clean install and setup of 10.7 Server. Exported self signed certificate, private key, and encryption password from 10.6 Server and functioning 10.7 upgraded Server.
On import or manual creation of certificate get the following error:
Error
Check your server's logs for more information. The error (code 5001) was: Expected SecKeychainItemImport to return a SecIdentityRef, but it did not
Log shows:
Dec 29 17:56:55 server servermgrd[498]: -[CertsRequestHandler(HelperAdditions) importP12Data:passphrase:error:]: importedItems = (
"<SecCertificate 0x7fcf6ed43c00 [0x7fff78d96f40]>"
I have tried importing and manually creating other certificates with a variety of names with success. I assume that there is something buried somewhere that is causing this particular one to be a problem. Other than manually removing any remnants of the certificate from /etc/certficates I do not have any ideas what to try. I am essentially ready to move this server to 10.7 except for this problem and would like to avoid a reinstall.
Suggestions?
-Erich

Take a look here.
https://bbs.archlinux.org/viewtopic.php?id=146649
Maybe it's a problem with your network.

How do I install this self-signed SSL certificate?

I haven't been able to connect to the jabber server I've been using (phcn.de) for quite some time now, so I filed a bug report with mcabber. The friendly people there told me to install phcn.de's self-signed certificate, but I can't figure out for the life of me how to do that.
I know I can download something resembling a certificate using
$ gnutls-cli --print-cert -p 5223 phcn.de
Which does give me something to work with:
Resolving 'phcn.de'...
Connecting to '88.198.14.54:5223'...
- Ephemeral Diffie-Hellman parameters
- Using prime: 768 bits
- Secret key: 767 bits
- Peer's public key: 767 bits
- PKCS#3 format:
-----BEGIN DH PARAMETERS-----
MIHFAmEA6eZCWZ01XzfJf/01ZxILjiXJzUPpJ7OpZw++xdiQFBki0sOzrSSACTeZ
hp0ehGqrSfqwrSbSzmoiIZ1HC859d31KIfvpwnC1f2BwAvPO+Dk2lM9F7jaIwRqM
VqsSej2vAmAwRwrVoAX7FM4tnc2H44vH0bHF+suuy+lfGQqnox0jxNu8vgYXRURA
GlssAgll2MK9IXHTZoRFdx90ughNICnYPBwVhUfzqfGicVviPVGuTT5aH2pwZPMW
kzo0bT9SklI=
-----END DH PARAMETERS-----
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
- subject `CN=phcn.de', issuer `CN=phcn.de', RSA key 1024 bits, signed using RSA-SHA, activated `2009-05-04 08:26:21 UTC', expires `2014-04-08 08:26:21 UTC', SHA-1 fingerprint `d01bf1980777823ee7db14f8eac1c353dedb8fb7'
-----BEGIN CERTIFICATE-----
MIIBxzCCATCgAwIBAgIINN98WCZuMLswDQYJKoZIhvcNAQEFBQAwEjEQMA4GA1UE
AwwHcGhjbi5kZTAeFw0wOTA1MDQwODI2MjFaFw0xNDA0MDgwODI2MjFaMBIxEDAO
BgNVBAMMB3BoY24uZGUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALqS+tnB
tNruBGdcjw0o+BWSdfkKH4T3VpS7bkrsS0q7RD5iUIao7jH2lJqTk1TrLbQe28+R
H0X9Ya+w22iYFea2l3wkrTnBfgdSZbRhpSxgVvC2QEBMoSrEQoRpo5lzXadRlob/
RQ+rhu/cWCNeiRJzfkmNirPVEciGKQHrwKxxAgMBAAGjJjAkMCIGA1UdEQQbMBmg
FwYIKwYBBQUHCAWgCwwJKi5waGNuLmRlMA0GCSqGSIb3DQEBBQUAA4GBALFBalfI
oESZY+UyVwOilQIF8mmYhGSFtreEcUsIQvG1+cgD16glKehx+OcWvJNwf8P6cFvH
7yiq/fhMVsjnxrfW5Hwagth04/IsuOtIQQZ1B2hnzNezlnntyvaXBMecTIkU7hgl
zYK97m28p07SrLX5r2A2ODfmYGbp4RD0XkAC
-----END CERTIFICATE-----
- The hostname in the certificate matches 'phcn.de'.
- Peer's certificate issuer is unknown
- Peer's certificate is NOT trusted
- Version: TLS1.0
- Key Exchange: DHE-RSA
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed
- Simple Client Mode:
Unfortunately, the above command spits out more than a certificate. Do I need the additional information? If so, what do I need it for? Where do I need to put the certificate file?

Hi,
I recently found out a way how to install test or self-signed certificates and use it with S1SE.
See:
http://www.gtlib.cc.gatech.edu/pub/linux/docs/HOWTO/other-formats/html_single/SSL-Certificates-HOWTO.html
Follow the instructions there
1. Create CA
2. Create root ca certificate
Now install the root-ca-certificate in S1SE -> Security>Certificate Management and Install a "Trusted Certificate Authority".
Paste the contents of the file: cacert.pem into the message-text box.
Then restart the server. Now your CA-Cert should be visible in the Manage Certificates menu.
The next step is to send a certificate-request from S1SE to your e-mail-address.
The contents of the e-mail the server sends to you (certificate request) must be pasted into the file: newreq.pem.
Now just sign the Request:
CA.pl -sign
The last step is that you have to paste the contents of the file newcert.pem into the message-box of the Security>Certificate Management - now under the option Certificate for "This Server".
Then you have to reboot the server/instance again and it should work with your certificate.
Regards,
Dominic

Self signed SSL Certificates no longer work after upgrade to 37.0.1

I followed these two articles to create local self signed certificates and they have been working fine since February. Now with the update to 37.0.1 I get "Secure Connection Failed" while trying to access my local website through FireFox. IE and Google Chrome have no problem accessing the local site.
http://www.jayway.com/2014/09/03/creating-self-signed-certificates-with-makecert-exe-for-development/
http://www.jayway.com/2014/10/27/configure-iis-to-use-your-self-signed-certificates-with-your-application/
I have already deleted cert8.db, restarted FF, then re-imported the self signed certificates but get the same error. No other software has changed on this box except the automatic upgrade to FF 37.0.1.
The network setting is already set to use "No Proxy"
How do I fix this?
Windows 8.1 Pro
IIS 8

I have exactly the same problem. All servers and devices that use a self-signed certificate are not reachable anymore via FF37.0.1 after upgrade to FF 37.0.1.
Firefox prints:
"Secure Connection Failed
The connection to the server was reset while the page was loading.
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem."
I'm not getting the chance to add an exception hence no access to the server anymore.
This is a severe problem, because all internally used Glassfish servers in our test environments run with self-signed certificates. As Firefox blocks access to them I cannot maintain my servers anymore.
I have the same problem with Chrome but not with IE - IE is the offers to add an exception but suffers the blank page problem when accessing Glassfish.
I tried to adjust the following values in the FF config:
security.tls.version.min = 0 ;default
deleted cert8.db and restarted FF
I'm really lost, kindly advise.

Import and trust a self-signed CA certificate from the Terminal

Hello there,
i have a problem: I would like to import and trust a self-signed CA(root) certificate from the Terminal to the System.keychain.
My request is to create a installation script to install the Cisco AnyConnect VPN Client and the needed certificates.
For the import i have used the following command:
    sudo security import certificate.cer -k "/Library/Keychain/System.keychain" -A
    The Option "-A" says:
Allow any application to access the imported key without warning (insecure, not recommended!) <- From the Mac Developer Library
The command reportet: 1 certificate is importet ... but ... the certificate is not trusted.
What do i need to do to set this certificate as trustworthy at the terminal?
Thanks for your help and best regards
Benjamin
P.S. The command: sudo security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “/private/tmp/certs/certname.cer” doen't run, i get an error message. Found on http://derflounder.wordpress.com/2011/03/13/adding-new-trusted-root-certificates -to-system-keychain/

Hello Linc Davis,
thanks for your answer and sorry for my mistake, because i had already changed the last argument but for this discussion i had only copy this example.
But your answer show me the right way, big thanks.
I had entred the following command (see the last argument):
     sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "~/Downloads/mycert.cer"
... and i get the following message:
    ***Error reading file ~/Downloads/mycert.cer
     Error reading file ~/Downloads/mycert.cer
Today i changed the last argument to:
   /Users/User/Downloads/mycert.cer
and its run.
Many thanks!
Benjamin

Self Signed in Certificates without CA server

Similar Messages

Maybe you are looking for