Server certificate migration.
Hi,
We are using Sun[tm] Crypto Accelerator I Board along with iPlanet 6.0 on a Netra T1 Solaris machine, for our web server.
How can we export the SSL server certifcate and its associated private key from this server and install it into another server having another Sun[tm] Crypto Accelerator I Board along with iPlanet 6.0, but running on a Ultra-10 machine ?
Your help is highly appreciated.
Thank You.
Sanjay.
http://technet.microsoft.com/en-us/library/ee126170(v=ws.10).aspx
however, I would suggest to keep infrastructure services (like ADCS) in the root domain. Also you need to understand, that you cannot decommission a w2000 domain after moving everything to CHD domain. You will have to maintain it.
I would go into this way: upgrade w2000 domain to a modern functional level, keep at least 2 domain controllers with regular backups and leave there only infrastructure services. Cleanup it from unnecessary resources. Accounts and resources
would move to CHD domain.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new:
SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.
Similar Messages
-
Migrating a server certificate
Hi,
I have a server instance running on a Sun ONE Web Server 6.1 installation. I would like to move this site, which includes a VeriSign server certificate, from my WS6.1 installation to my AS7 installation. It appears as though the trust database for WS6.1 is in a cert8.db file, whereas the trust database for AS7 is a cert7.db file.
Is there an easy way to export this certificate from the cert8.db and import it into the cert7.db?
Thanks,
BillIn case anyone else needs to do this, I've figured it out.
1. On the old server, put the appropriate certificate utilities in your PATH:
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/sunone61/bin/https/lib
PATH=$PATH:/opt/sunone61/bin/https/admin/bin2. Export the certificate in pcks#12 format:
pk12util -d /opt/sunone61/alias -o mydomain.p12 \
-n 'Server-Cert' -P https-www.mydomain.com-xxx-This will save your certificate in a file named mydomain.p12. Note that the "xxx" will reflect the name of your admin server.
3. On the new server, change into the new server instance's config directory. Copy the .p12 file created in the previous step into this directory, then run the following command to import it into the CA500 slot:
pk12util -i mydomain.p12 -d . -h 'nobody@mydomain'This assumes that you have already created the "mydomain" realm in the CA500.
Good luck!
Bill -
SSL certificate migration.
Hi all,
I had to upgrade my production server from 4.1 to 6.0sp4. The server was also different as we can't afford any big down-time. I couldn't find any iWS related proper documentation for SSL certificate migration between different servers, so I did a hack and copied the cert7.db and key3 db manually and renamed it as expected...
I was never sure if I was doing right.... BUT IT WORKED :-)
Now after setting up live server for a months, I am getting complains about certificate errors and/or warnings from various customers. In all cases there is a problem coz of 'ancient' browsers (like lesser than IE5 or NS4.7). Any mordern browser is working perfectly (including my favorite Opera). And customers are happy again coz site is working fine after browser upgrade. But my concern is:
HAVE I DONE ANYTHING WRONG IN SSL MIGRATION OR ITZ JUST iWS 6.0's PROBLEM?
Any info / suggestion will be highly appreciated.
Thanx.There isn't enough information for me to be certain, but I suspect the errors are unrelated to anything on the server side. The most likely explanation is that the ancient browsers have an expired root CA cert for the CA that signed your certificate. Upgrading either the browser or the browser's root CA certs would address the problem.
Copying the trust database files from iWS 4.1 to iWS 6.0 is safe. -
Server Certificate on Weblogic 8.1
Hi. I know it is really dumb to ask these questions but I urgently need to know these as I am on a very tight project schedule. So can someone please enlighten me.
1. If I use SSL protocol and configure to use server certificate, may I know when someone enter my URL, will internet explorer prompt my client for certificate?
2. Do I really need SSL for configuring Certificate? If I do not use, can I still configure and use Server Certificate?
3. Can I reuse the server certificate on my Weblogic 5.1 to Weblogic 8.1 since I am migrating from WL5.1 to WL8.1?
My certificates files in WL 5.1 are in the form of *.pem
CheersIf you get (for example) a 128-bit SSL certificate from Verisign you need to specify a Certificate Signing Request (CSR). This is unique for each server. If you have upgraded your server and the CSR generated from the weblogic CSR generator servlet is the same as it was in the previous version, then I guess you can use the same certificate. If the CSR has changed then I think you will need to replace the certificate, this costs $100. If it's been less than 30 days since your certificate was issued, it's free.
-
SSL VPN Failed to validate server certificate (cannot access https)
Hi all,
I have the next problem.
I've configured in an UC520 a SSL VPN.
I can access properly and I can see the labels, but I only can access urls which are http, not https:
I can access the default ip of the uc520 (192.168.1.10) but
When I try to get access to a secure url I get the msg: Failed to validate server certificate
I'm trying to access a Cisco Digital Media Manager, whose url is https://pc.sumkio.local:8080
Does the certificate of both hardware has to be the same?
How can I add a https?
Here is the config of the router:
webvpn gateway SDM_WEBVPN_GATEWAY_1
ip address 192.168.1.254 port 443
ssl trustpoint TP-self-signed-2977472073
inservice
webvpn context SDM_WEBVPN_CONTEXT_1
secondary-color white
title-color #CCCC66
text-color black
ssl authenticate verify all
url-list "Intranet"
heading "Corporate Intranet"
url-text "DMM Sumkio" url-value "http://pc.sumkio.local:8080"
url-text "Impresora" url-value "http://192.168.10.100"
url-text "DMM" url-value "https://pc.sumkio.local:8443"
url-text "DMM 1" url-value "http://192.168.10.10:8080"
url-text "UC520" url-value "http://192.168.10.1"
policy group SDM_WEBVPN_POLICY_1
url-list "Intranet"
mask-urls
svc dns-server primary 192.168.10.250
svc dns-server secondary 8.8.8.8
default-group-policy SDM_WEBVPN_POLICY_1
aaa authentication list sdm_vpn_xauth_ml_1
gateway SDM_WEBVPN_GATEWAY_1
max-users 10
inservice
Any help would be apreciatted.
Thank youHi, thanks for your advise.
I'm trying to copy the certificate via cut and paste, but I'm getting a
% Error in saving certificate: status = FAIL
I dont know if I'm doing this right.
I open the https page from the DMM with Mozilla Firefox, and in options I export the certificate in PEM format.
I get a file which if I open with notepad is like
-----BEGIN CERTIFICATE-----
MIICOzCCAaSgAwIBAgIET7EwyzANBgkqhkiG9w0BAQUFADBhMQswCQYDVQQGEwJV
KoZIhvcNAQEFBQADgYEAdk7n+tJi0igrTD2o7RD9ty8MLTyHN4uk8km+7DbpEy0g
mxLY0UZswYvbj15kPdd8QbeGEdDR6SXOYePsfIRJzL0mqMON4oiUhsqAK5y2yC6R
nqy4wWQ2fGVEYAeLpb1jGKdZWpuag/CO90NMHcMiobfBh+4eTqm7kRPTEyma6V0=
-----END CERTIFICATE-----
If I try to authenticate the trustpoint, I get that error.
how can I export the certificate from the DMM?
I think that this file is not the right file.
and then, do I have to make some changes in
webvpn gateway SDM_WEBVPN_GATEWAY_1?
Should I choose the new trustpoint?
I understand that the old trustpoint is for the outside connection, no for the LAN connection.
Dont worry about me, answer when you can but I really need to fix this.
Thank you so much -
AnyConnect 3.1 - removing Security Warning: Untrusted VPN Server Certificate!
Hi guys,
Is there a way to disable the warning generated from using self signed certs?
I would like to make the process as seamless as possible.
AnyConnect 3.1
ASA 8.4(2)
Thanks.Hi,
We had problem with the above error message with our certificate when we moved to AnyConnect 3.1
We were instructed to request a new one
Also here is the link to Cisco site we were provided that explains the changes in 3.1
IPSec and SSL connections require server certificates to contain Key Usage attributes of Digital Signature and Key Encipherment, as well as an Enhanced Key Usage attribute of Server Authentication or IKE Intermediate. Note that IPSec server certificates not containing a Key Usage are considered invalid for all Key Usages, and similarly an IPSec server certificate not containing an Enhanced Key Usage is considered invalid for all Enhanced Key Usages.
Link to document
http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/release/notes/anyconnect31rn.html#wp1049936
Sadly I dont dable with certificates myself so I'm not really familiar with this.
- Jouni -
How to add a certificate to IIS global "Server Certificates" list using PowerShell?
Hi, been surfing the web for an example on how to add a certificate to the "global" IIS "Server Certificates" list using PowerShell but to no luck. I already have code in place on how to tie / associate a specific website with a specific cert but not how
to add the new .cer file using the "Complete Certificate Request..." wizard using PowerShell.... I dont expect the final code to become published but if someone had an idea on howto integrate / get an entry point on where to interact between the "Server Certificate"
list in IIS and POSH I would be super happy! :|
I am runnign IIS on a Windows 2008R2 x64 Standard Edition if that helps..... of course, I would saddle for an CLI if there is no other way, but POSH is of course the way to go! :)
Thanks for the help in advance guys, take care!
br4tt3Hi and thanks for the suggestions!
Although it comes close, the suggested code example points on howto import / incorporate .pfx files - I am getting fed by .cer files which I need to add into the IIS console using POSH.
I tried explore the IIS.CertObj object but was not able to work out if this one could be used for importing / adding .cer files into IIS! However, launching the following command from a POSH console with Import-Module Webadministration already
loaded into that shell;
$certMgr = New-Object -ComObject IIS.CertObj returns the following error message:
New-Object : Cannot load COM type IIS.CertObj
From an IIS perspective I have the following components installed;
[X] Web Server (IIS) Web-Server
[X] Web Server Web-WebServer
[ ] Common HTTP Features Web-Common-Http
[ ] Static Content Web-Static-Content
[ ] Default Document Web-Default-Doc
[ ] Directory Browsing Web-Dir-Browsing
[ ] HTTP Errors Web-Http-Errors
[ ] HTTP Redirection Web-Http-Redirect
[ ] WebDAV Publishing Web-DAV-Publishing
[X] Application Development Web-App-Dev
[ ] ASP.NET
Web-Asp-Net
[X] .NET Extensibility Web-Net-Ext
[ ] ASP
Web-ASP
[ ] CGI
Web-CGI
[ ] ISAPI Extensions Web-ISAPI-Ext
[ ] ISAPI Filters Web-ISAPI-Filter
[ ] Server Side Includes Web-Includes
[ ] Health and Diagnostics Web-Health
[ ] HTTP Logging Web-Http-Logging
[ ] Logging Tools Web-Log-Libraries
[ ] Request Monitor Web-Request-Monitor
[ ] Tracing
Web-Http-Tracing
[ ] Custom Logging Web-Custom-Logging
[ ] ODBC Logging Web-ODBC-Logging
[X] Security
Web-Security
[ ] Basic Authentication Web-Basic-Auth
[ ] Windows Authentication Web-Windows-Auth
[ ] Digest Authentication Web-Digest-Auth
[ ] Client Certificate Mapping Authentic... Web-Client-Auth
[ ] IIS Client Certificate Mapping Authe... Web-Cert-Auth
[ ] URL Authorization Web-Url-Auth
[X] Request Filtering Web-Filtering
[ ] IP and Domain Restrictions Web-IP-Security
[ ] Performance Web-Performance
[ ] Static Content Compression Web-Stat-Compression
[ ] Dynamic Content Compression Web-Dyn-Compression
[X] Management Tools Web-Mgmt-Tools
[X] IIS Management Console Web-Mgmt-Console
[X] IIS Management Scripts and Tools Web-Scripting-Tools
[ ] Management Service Web-Mgmt-Service
[ ] IIS 6 Management Compatibility Web-Mgmt-Compat
[ ] IIS 6 Metabase Compatibility Web-Metabase
[ ] IIS 6 WMI Compatibility Web-WMI
[ ] IIS 6 Scripting Tools Web-Lgcy-Scripting
[ ] IIS 6 Management Console Web-Lgcy-Mgmt-Console
[X] FTP Server Web-Ftp-Server
[X] FTP Service Web-Ftp-Service
[X] FTP Extensibility Web-Ftp-Ext
[ ] IIS Hostable Web Core Web-WHC
More or less the one thing that I am trying to get up and running is an automated FTPS solution - I just use the IIS console to be able to troubleshoot / compare how things scripted from POSH interacts in the MMC representation. The error I am getting
might be that I am lacking some IIS components to be in place to be able to automate some parts of the IIS - as suggested by the IIS.CertObj object listed in the example..... I will get back if I can track down which component needs to be added to be
able to reference the IIS.CertObj object.
Br4tt3 signing out...
br4tt3 -
How can I make Firefox trust a Server Certificate by Default?
I'm trying to distribute Firefox via Empirum. All settings are made using the CCK-Wizard Addon.
When I import our Certificates in CCK-Wizard, I can make trust-settings for CA's, but not for Server Certificates, and so the SC isn't trusted by default.
Is there any way to make the trust Settings for SC's in the install package, maybe through an option in about:config (didn't find any, but maybe somebody knows more than google :P )?
I tried to do it like PRF_1 suggested here https://support.mozilla.org/de/questions/687296#answer-112220 but in the last step I got an Error 1: C compiler cannot create executables.
Regards,
BowserHello,
'''Try Firefox Safe Mode''' to see if the problem goes away. Safe Mode is a troubleshooting mode, which disables most add-ons.
''(If you're not using it, switch to the Default theme.)''
* On Windows you can open Firefox 4.0+ in Safe Mode by holding the '''Shift''' key when you open the Firefox desktop or Start menu shortcut.
* On Mac you can open Firefox 4.0+ in Safe Mode by holding the '''option''' key while starting Firefox.
* On Linux you can open Firefox 4.0+ in Safe Mode by quitting Firefox and then going to your Terminal and running: firefox -safe-mode (you may need to specify the Firefox installation path e.g. /usr/lib/firefox)
* Or open the Help menu and click on the '''Restart with Add-ons Disabled...''' menu item while Firefox is running.
[[Image:FirefoxSafeMode|width=520]]
''Once you get the pop-up, just select "'Start in Safe Mode"''
[[Image:Safe Mode Fx 15 - Win]]
'''''If the issue is not present in Firefox Safe Mode''''', your problem is probably caused by an extension, and you need to figure out which one. Please follow the [[Troubleshooting extensions and themes]] article for that.
''To exit the Firefox Safe Mode, just close Firefox and wait a few seconds before opening Firefox for normal use again.''
''When you figure out what's causing your issues, please let us know. It might help other users who have the same problem.''
Thank you. -
Error: Untrusted Server Certificate
When i click on Query Interfaces (IPS Manager: Configuration > Settings > Interfaces) i get the following error:
An error occurred trying to get the interface information. An error occurred while trying to determine the sensor version. Detail = Error occurred while communicating with 172.17.xx.xx: java.security.cert.CertificateException: Untrusted Server Certificate Chain
Any suggestion?
Thank you,That is a pretty strange message. Have you had a chance to reach out to Windows Live?
TamaraH_VZW
Follow us on Twitter @VZWSupport -
Untrusted Server Certificate Chain error
I am trying to use a certificate (digital signature) on the client, when accessing a Webservice. This fails with the following error :
javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Untrusted Server Certificate Chain
My code is :
KeyStore ks = null;
String strURL = "https://myserver.com/myurl/lookup.asmx";
SSLSocketFactory sslSocketFactory = null;
System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
// Load certificate dynamically
SSLContext sslContext = SSLContext.getInstance("SSLv3");
TrustManagerFactory trustMgtFactory = TrustManagerFactory.getInstance("SunX509");
CertificateFactory cert = CertificateFactory.getInstance("X.509");
FileInputStream lo_fileinputstream = null;
lo_fileinputstream = new FileInputStream("c:\\temp\\digital.cer");
X509Certificate servercacert = (X509Certificate)cert.generateCertificate(lo_fileinputstream);
lo_fileinputstream.close();
String s1 = servercacert.getSerialNumber().toString();
if(ks == null)
ks = KeyStore.getInstance("JKS");
ks.load(null, null);
ks.setCertificateEntry(s1, servercacert);
trustMgtFactory.init(ks);
sslContext.init(null, trustMgtFactory.getTrustManagers(), null);
sslSocketFactory = sslContext.getSocketFactory();
HttpsURLConnection.setDefaultSSLSocketFactory(sslSocketFactory);
// Call webservice
URL cascadeURL = new URL(strURL);
HttpsURLConnection conn = (HttpsURLConnection) cascadeURL.openConnection();
String inputline=null;
if (conn instanceof HttpsURLConnection) {
conn.connect();
BufferedReader in = new BufferedReader(
new InputStreamReader(
conn.getInputStream()));
while ((inputline = in.readLine()) != null) {
System.out.println(inputline);
in.close();
Please help - I am on a very tight deadline (as usual).Found the problem. I simply needed to add another certificate.
-
Untrusted VPN Server Certificate
We just upgraded our AnyConnect to Ver 3.1.01065 and we are using a self signed cert with it. We haven't had any issues with the before but now when ever a customer logs on to the VPN using AnyConnect we get " Security warning: Untrusted VPN Server Certificate!" and it says that AnyConnect cannot verify the VPN server.
Then i can connect anyways or cancel.
Because this is my server and i trust the cert i am fine just clicking Connect anyways. My customers freak out a bit when they see this, I know this has to be a simple fix but i can't figure out how to get my local boxes to trust the cert. Has anyone run in to this with Ver 3.1.01065 and how did you fix it?
Thanks,
JeremyCisco is really trying to make people stop using self-signed certificates with AC 3.1. You have to either use a trusted root CA (either private or public) or turn off the certificate checking altogether.
-
Security warning for any connect VPN " Untrusted VPN server Certificate"
Is there any way to disable this security warning ( " Untrusted VPN server Certificate") with self sign certificate on the ASA
Hi Anton,
Please have a look at the link below:
http://docs.acl.com/ex/300/index.jsp?topic=%2Fcom.acl.ax.exception.installguide%2Fexception%2Finstallation%2Ft_installing_the_self-signed_certificate.html
This is for IE. You should get steps for FF and CHROME out there easily as well.
Regards,
Kanwal
Note: Please mark answers if they are helpful. -
How to get the Server Certificate Chain File?
Hi all,
I config the SSL for weblogic 6.0 on a Win2k Machine .I followed WebLogic
documentation:
Generate a private key file, then submit to Verisign, get the certificate
file.
Because I have only one WebLogic server. I clear the "Server Certificate
Chain File" field.
But I get error message after reboot WebLogic. Following is the error
message:
<2001-1-21 04:57:56 pm> <Alert> <WebLogicServer> <Inconsistent security con
figuration, java.lang.Exception: Required file server-certchain.pem which is
spe
cified by ServerCertificateChainFileName, was not found>
java.lang.Exception: Required file server-certchain.pem which is specified
by Se
rverCertificateChainFileName, was not found
at
weblogic.t3.srvr.SSLListenThread.resolvePropertyFromLocalFile(SSLList
enThread.java:152)
at
weblogic.t3.srvr.SSLListenThread.resolvePropertyFromAdminServer(SSLLi
stenThread.java:180)
at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:425)
at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:297)
at weblogic.t3.srvr.T3Srvr.initializeListenThreads(T3Srvr.java:939)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:403)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:169)
at weblogic.Server.main(Server.java:35)
My question is: Should I input the rootCA certificate into the Server
Certificate Chain File field? If yes, where can I get the rootCA certificate
file?
Thanks[sorry, deleted irrelevant wrong answer]
-
Step by Step : How to Create an SSL Server Certificate (Part 3)
How to Create an SSL Server Certificate (Part 3)
In the previous part you have completed step 10, now you are almost there.
Step 11:
This is another very important step.
Leave the settings as is or tick more options if you know what you do.
Step 12:
Again leave as it is.
Step 13:
Another important step !
In the DNS Name field enter the host name(s) separated by spaces (or commas), e.g.
myserver.name.private myserver.dyndns.org
You can enter your local IP if you wish.
Step 14:
Certificate Assistant now procedes to create your certificate. Within a few seconds you should see the new certificate in your Keychain.
Switch to Server App (if at this stage Server App has crashed, don't worry , re-open Server App and proceed.
Repeat step 2 described in Part 1 and select the new certificate from the drop-down menu of available certificates.
You may want to use this certificate for all services (iChat, iCal, Mail, Web) or create different ones.
If you use the same certificate for all services the name of the certificate is diplayed next to "SSL Certificate", if you don't you will see "Custom" instead.
Addendum:
1. Do not forget to open port 443 in your router to enable https connections.
2. Enable SSL in your iCal account settings if you wish.
Enjoy your server !Hi,
Are you talking about the Mercedes leaderboard ad? Because that look a lot more complicated than "fade in - fade out" images?
Anyway... I am looking at the easiest way to create a banner ad with fade in - fade out images that I have created in illustrator.
This tutorial helped me alot.
http://www.youtube.com/watch?v=gFw-1D8yaMs&NR=1
cheers -
Validate Server Certificate Problem
Hi all.
We have this problem with EAP-TLS with WPA and certificate authentication.
With a third part client (odissey) all work well, with integrated microsoft client all work if we deselect "Validate Server Certificate" into configuration.
In trusted server list there is our CA server.
But when we select this option (or if we try to connect to wifi network for the first time), authentication fail.
It's an annoying problem, because Windows XP default this option, so for an end user it's difficult to connect (he need to enter in network configuration.... we want a simple connection...).
Thank a lot
DanieleTry this link
http://cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a0080545a29
Maybe you are looking for
-
How do I update OfficeJet Pro 8500A eAiO
How do I update OfficeJet Pro 8500A eAiO to AirPrint from the iPhone4S?
-
DataSource Connection Pooling in 903?
We are having difficulty getting 9iAS DataSource Pooling to work. We are using 9iAS 9.0.3 (without Infrastructure) and, as per the J2EE Services Guide, have : 1) Added... Context ic = new InitialContext(); DataSource ds (DataSource) ic.lookup("jdbc/O
-
How to deactivate a message or message class
Dear Gurus, Can any body tell me is there any way to deactivate a message class/mesage? Thanks Praveen
-
1603 error when installing inDesign...help
1603 error: Fatal error during installation. I installed InDesign CS4 on my new computer. Tuned off firewall and antivirus. Restarted computer. All programs closed. Tried several times and still get the error. I can run the program but some features
-
How use raw device in linux?
Hi all. scene: oracle 8.1.6.1 Linux red hat 6.1 I'm trying to create a database with raw device. In HPux the raw device is /dev/rdsk but I found no documentation for linux raw device. thanks for any help. null