Some clients migrated from 2007 is presented with the self signed certificate in 2013

I have migrated from 2007 to 2013. I did a couple of test migrations and on the ones with domain member computers Outlook is giving a certificate warning. The certificate they are presented with is the default self signed certificate on the 2013 server.
Even though I have added a trusted public certificate to Exchange and checked of to use With IIS.
I see that the default certificate is also checked of to use With IIS and it cant be removed in ECS. Shouldnt this be removed from IIS all together when adding a New certificate? And why does some Clients gets presented With the self signed and some With
the Public? For instance owa is presented With the Public cert. Also and Outlook I tested from outside the domain.
Regards

Only the UCC certificate should be bound to IIS.
Are any clients using POP or IMAP, which also use SMTP? In this case clients can be presented with the "wrong" certificate as well.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Similar Messages

Problem with placing self-signed certificate in trust store on WLS 10.3

I have had some problems setting up two-way SSL on WLS 10.3.2.
1. I have not been able to use the java properties listed on
http://weblogic-wonders.com/weblogic/2010/11/09/enforce-weblogic-to-use-sun-ssl-implementation-rather-than-certicom/
to use the native Java SSL implementation rather than the certicom. Has anyone else had success using these?
-Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol
-Dssl.SocketFactory.provider=com.sun.net.ssl.internal.SSLSocketFactoryImpl
-DUseSunHttpHandler=true
-Dweblogic.wsee.client.ssl.usejdk=true (for webservice clients)
2. When I use the ValidateCertChain to validate my keystore with the self-signed certificate I get the message
CA cert not marked with critical BasicConstraint indicating it is a CA
Certificate chain is invalid
which I read was a problem with certificates generated by keytool, yet I find I was not able to circumvent this
by setting the property weblogic.security.SSL.enforceConstraints to off in the WLS server environment.
Has anyone else noticed this?
3. The error I get is
####<Feb 15, 2011 1:12:21 PM EST> <Debug> <SecuritySSL> <hostname> <server
<[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1297793541204> <BEA-000000> <Exception during hands
hake, stack trace follows
java.lang.NullPointerException
at com.certicom.security.cert.internal.x509.X509V3CertImpl.checkValidity(Unknown Source)
at com.certicom.security.cert.internal.x509.X509V3CertImpl.checkValidity(Unknown Source)
at com.certicom.tls.interfaceimpl.CertificateSupport.findInTrusted_Validity(Unknown Source)
####<Feb 15, 2011 1:12:21 PM EST> <Debug> <SecuritySSL> <hostname> <server> <[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tunin
g)'> <<WLS Kernel>> <> <> <1297793541207> <BEA-000000> <NEW ALERT with Severity: FATAL, Type: 40
java.lang.Exception: New alert stack
at com.certicom.tls.record.alert.Alert.<init>(Unknown Source)
at com.certicom.tls.record.handshake.HandshakeHandler.fireAlert(Unknown Source)
Are there other conditions besides the issue about the missing Basic Constraint field that can raise an
alert with type 40?
4. Steps I used to generate jks keystore for inclusion in trust keystore (actual values substituted):
** keytool -genkey -alias mykey -keystore mykeystore -validity 35600 \
-dname "cn=Common Name, ou=Common Name, o=Org, l=location, s=state, c=US" \
-storepass mypass -keypass mypass
** exported a DER format head certificate of mykey into mykey.cer.der
** keytool -import -trustcacerts -keystore DemoTrust.jks -alias mykey -file mykey.cer.der
Any comments appreciated and thanks for this forum.

Faisal,
Certicom has an internal restriction that a Date must be notBefore 1970 and notAfter 2105 inclusive.The Java-generated key is valid until Wed Mar 14 11:03:59 EDT 2108. Your knowledge of this area is
quite impressive, thank you so much for this!

SCCM 2007 - task sequence - prestaged media - self-signed certificates - error message 'Certificate has expired for this media'

Hi there
Quick scenario.
We have created a task sequence prestaged media .wim file (SCCM 2007, client OS is Windows XP).
Recently some of these swap-out machinses, on delivery and start up, have started showing this message:
'Certificate has expired for this media'.
This is because the self-signed certificate created during the prestaged media creation process has expired.
My question is: is it possible to mount the image using dism or imagex and then inject an updated sertificate?
Best regards
John

the disk that has the prestaged media applied must be the boot partition.
create a task sequence to stage the prestaged media. In this task run a format and partition step which configures both the system disk and the os disk, though make the os disk the active boot partition. Then apply the prestage wim.
On your deploy task, somewhere after the OS has applied create a group that runs only if the media is OEM (from memory _SMSTSMedia =
OEMMedia)
in this group run the command bcdboot C:\Windows /s F: /f ALL where f: is the drive letter assigned to the system disk, then run another step that removes the drive letter and reboots. The deploy task will now continue and you will be booting to the system
partition.
So I wanted to get back to working on this issue. I noticed that when I said it Worked that it was actually still booting from C drive instead of the reserved partition. For the past few days I have been trying to get the prestaged to work like
a network deploy but fail every time. I cannot get the prestaged to boot from any other partition other then the partition where windows was imaged too.
So where I am at today. When I do as suggest above the D drive (The reserved Boot volume) return on reboot. it will not stay hidden. also the OS is till booting from C and does not change to the D drive or no drive letter drive with the above
commands. I think there is some other command missing that tells it to boot from a new location that is not bcdboot.
Has anyone seen any guides for how to use prestaged and bitlocker enabled task sequence? I think that would help me figure out my current issues as with bitlocker you must have this other partition.

Mail.app with a self-signed certificate in postfix/dovecot

I thought I'd post this tidbit about getting Mail.app to work correctly with a self-signed certificate in a postfix/dovecot Linux installation; in my case under Debian Lenny. After setting this up, my Mail.app refused to connect to the outgoing server to deliver mail. In the postfix logs, I would see "SSL_accept error from ...: -1". The problem ended up being that postfix uses the default "snakeoil" self-signed certificate, while dovecot creates its own. If the IMAP and SMTP hosts are the same as they were in my case, when you accept the dovecot certificate upon the first IMAP connection, the SMTP connection with a different certificate will fail. This is because after the accept there is now a known certificate for that host, and the new certificate presented by postfix will not match. To fix this, either use different hosts for IMAP and SMTP, or use the same (perhaps the "snakeoil") certificate in both the postfix and dovecot configuration.

Exactly the same problem, except I'm using FF v6 for Windows, not FF v4 as for the lead post. This is for a self-cert which IS trusted, although the error message says it isn't.

How to access Flash Apps over https with a self signed certificate?

I have a Flex app that needs to access data from a SOAP web service over https with a self signed certificate. The app needs to ignore the https warnings, just as a browser would warn & allow the user to proceed. Buying a valid signed certificate is not an option for us.
It works fine over http.
How can I achieve this?
I read that URLRequest has a property: authenticate, that I can set to false. However, this property is available only for Adobe AIR applications from what I can see. This doesn't seem available for Flex apps.
I have tried this in both Flex 3 & the latest Flash Builder 4. Have the same issue in both cases.
Help appreciated.
Thanks

You'd really need to ask in the Flex or Flash Builder forums as this is a front end code modification and Flash Player can't do any of that.

I have a macbook 2.1 with osx10.6.8 and want to wipe it clean and migrate from my macbook pro with the same osx..is it possible to do?

I have an older macbook 2.1 intel OSX 10.6.8 that I want to wipe clean and then migrate from my macbbok pro with OSX10.6.8 to the older macbook, is it possible ,how would I do it..especially how do I wipe clean the older macbook?

Connecting to a TV is no different than connecting to any other external display. It's possible that there's a problem with the mini dvi port on the macbook r that you have bad adapters. You might try resetting the SMC Intel-based Macs: Resetting the System Management Controller (SMC) - Apple Support
Does the Macbook recognize that there's an external display connected when you look at the Display preference pane?

Avoid an alert with using self-signed certificate

Hi
I want to publish a free product and I would like to use a free self-signed certificate
But during installing, the Adobe Exstension Manager shows an alert
Where is a way how to avoid this alert with using a self-signed certificate (I generated certificate with help of Adobe Exchange Packager) or I should only use a paid code-signed certificate?
Best regards
Maxim

As I understund, "Show warning when instaling..." this option available only for end user in Exstantion manager, right? It means there is no way how to switch off this warning if I use ucf.jar tool for packing ZPX and an user uses default setting on this end. When, only one way is left - to buy a payed certificate, even for free product. Correct?

SCCM - Client migration from 2007 to 2012

Hi All,
Can someone share the information what will be the impact in case , if we install CM2012 R2 client on the exisiting 2007 R2 client machine
Regards,

Hi,
In addition, information from the source hierarchy about any advertisements or deployments that have not yet run, Compliance data and inventory are not retained.
For more information, please check the article below.
Planning a Client Migration Strategy in System Center 2012 Configuration Manager
http://technet.microsoft.com/en-us/library/gg712283.aspx
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Does Firefox Home work with custom servers with a self signed certificate?

I've setup my own custom Firefox Sync server which has a self signed SSL certificate.
When I try to connect to it using Firefox Home I get the error:
Cannot Sync - Failed To Communicate With Server (1)
Firefox on my Mac and Windows laptop Sync fine with my custom firefox sync server providing I create an exception first. But no such luck with my iPhone.

Access your server with ssl using https://<servername> . Firefox will warn you about untrusted certificate, and suggest you to add an exception. This exception will work for firefox sync too.

With the new Firefox 10.0 cannot connect to my office https portal (with a self-signed certificate)

The connexion is not possible from any computer (tested on different Windows Platform) . Firefox try to connect without apparent error. Same problem with firefox 10.0.1 . No problem with Firefox 9 (or previous version).
But I've used the debugger Fiddler Tool, I get this warning:
Session #4: The remote server (###.###.###.###) presented a certificate that did not validate, due to RemoteCertificateNameMismatch, RemoteCertificateChainErrors.
SUBJECT: CN=F1000C000920300401, OU=F1000-C, O=NETASQ - Secure Internet Connectivity, L=Villeneuve d'Ascq, S=Nord, C=FR
ISSUER: OU=NETASQ Firewall Certification Authority, O=NETASQ - Secure Internet Connectivity, L=Villeneuve d'Ascq, S=Nord, C=FR
EXPIRES: 29/10/2013 12:41:15
If I acknowledge theses warnings, it seems the connexion is possible.
Any ideas?

I'm searching the reason o f this problem. And I'v read that Firefox could have stop to support MD5-Based Certificate. And the algorithm is in this case.
May be is this the explanation?

In Firefox 4.0 with a Server with a self signed certificate using IPv6 I can not add a "Security Exception" for this certificate.

In Firefox 4.0 I have a server ... it contains a self signed certificate. Using IPv6 I can not add a "Security Exception" for this certificate.
1. I log onto the server (using IPv6). I get the "Untrusted connection page" saying "This connection is Untrusted"
2. I click on "Add Exception.." under the "I understand the Risks" section.
3. The "Add Security Exception" dialog comes up. soon after the dialog comes up I get an additional "Alert" dialog saying
An exception occured during connection to xxxxxxxxx.
Peer's certificate issuer has been marked as not trusted by the User.
(Error code sec_error_untrusted_issuer).
Please note that this works in Firefox 3.6.16 (in IPv4 and IPv6). It also works in Firefox 4.0 in IPv4 only IPv6 has an issue. What's wrong?

Exactly the same problem, except I'm using FF v6 for Windows, not FF v4 as for the lead post. This is for a self-cert which IS trusted, although the error message says it isn't.

How to register iOS device when using self signed certificate with apple Server?

Hi,
I have installed the server.app by Apple and used a slef signed certificate for my server. Now I want to register my different devices (iMac, iPhone etc.). I could register the iMac without problesm (I just had to add my self signed certificate to the trusted certificates)
Sadly, with the iPhone it is not that easy. I can install the "trust profile", but still after that I can not register my device. It seems like it does not accept my self signed certificate for device registration. When adding a registration profile, I get the error "www._mydomain_.tld/devicemanagement/api/device/auto_join_ota_service" is not valid.
Nethertheless, I can install a profile with setting, e.g. my imap settings, via the profile management without problems.
Does anyone have an idea how to get around the problem with the self signed certificate?
Best regards

Try deleting the Server.app and download it again from the App Store, restart.
My Server is also using self signed certificates and is working with iOS device (Trust Profile needed first).

Driver and Driver Package migration from 2007 to 2012 R2 query

Dear Team,
I am in the process of migrating the drivers and DriverPackage from SCCM2007 to CM2012 . I am following the below steps and also i am getting below warning message while doing Driver migration.
1) Copied all the driver source path from SCCM2007 to 2012 folders and shared the same.
2) By using migration Utility , i have migrated all the drivers from 2007 to 2012 .
3) After the migration i have changed the dirver source path at CM2012 side pointing to new CM12 driver source path.
4) I have started the DriverPackage migration.
5) After the DriverPackage migration , i have changed to DriverPackage Source path at CM12 side pointing to new CM12 dirverpackage source.
Please help me my steps and procedure and suggest if anything i need to do extra .....
My question and observation :
1) During the driver migration , i got a warning message like . Some drivers not able to migrate due to unsupported by CM2012 .
    a) Is there any way i can find unsupported model drivers before or after the migration
    b) Is there any other process to migrate Unsupported drivers from 2007 to 2012 other than manual import or script basis
2) After the DriverPackage migration and after the change in the DriverPackage source path. I am not seeing any folder creating in DriverPackage new source path (I understood the reason).
   a) Is there any way i can recreate those folders in new source path after the DriverPackage Migration ?
   b) What is the best process for the DriverPacakge migration from 2007 to 2012 regarding the SourcePath.
Thanks in advance....
Raja

A good article written by Johan Arwidmark
http://www.deploymentresearch.com/Research/tabid/62/EntryId/71/Migrating-unsupported-driver-packages-from-ConfigMgr-2007-to-supported-packages-in-ConfigMgr-2012.aspx
Benoit Lecours | Blog: System Center Dudes

Possible to select self-signed certificate for client validation when connecting to VPN with EAP-TLS

In windows 8.2, I have a VPN connection configured with PPTP as the outer protocol and EAP : "Smart card or other certificate ..." as the inner protocol. Under properties, in the "When connecting" section I've selected "Use a certificate
on this computer" and un-checked "Use simple certificate selection".
My preference would be to use separate self-signed certificates for all clients rather than having a common root certificate that signed all of the individual client certificates. I've tried creating the self-signed certificate both with and without the
client authentication EKU specified, and I've added the certificate to the trusted root certificate authority store on the client. But when I attempt to connect to the VPN I can not get the self signed certificate to appear on the "Choose a certificate"
drop down.
Are self signed certificates supported for this use in EAP-TLS? If it makes a difference, I'm working with makecert (not working with a certificate server).
TIA,
-Rick

Hi Rick,
Thank you for your patience.
According to your description, would you please let me know what command you were using to make a self-signed certificate by tool makecert? I would like to try to reproduce this issue. Also based on my experience, please let me
know if the certificate has private key associated and be present in the local machine store. Hence, please move the certificate from the trusted root certificate authority store to personal store.
Best regards,
Steven Song
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

How to use Self Signed certificate with SSLServerSocket?

Hello to all.
I'm trying to build a simple client/server system wich uses SSLSocket to exchange data. (JavaSE 6)
The server must have it's own certificate, clients don't need one.
I started with this
http://java.sun.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore
To generate key for the server and a self signed certificate.
To sum it up:
     Create a new keystore and self-signed certificate with corresponding public/private keys.
keytool -genkeypair -alias mytest -keyalg RSA -validity 7 -keystore /scratch/stores/server.jks
     Export and examine the self-signed certificate.
keytool -export -alias mytest -keystore /scratch/stores/server.jks -rfc -file server.cer
     Import the certificate into a new truststore.
keytool -import -alias mytest -file server.cer -keystore /scratch/stores/client.jksThen in my server code I do
System.setProperty("javax.net.ssl.keyStore", "/scratch/stores/server.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "123456");
SSLServerSocketFactory sf = sslContext.getServerSocketFactory();
SSLServerSocket sslServerSocket = (SSLServerSocket)sf.createServerSocket( port );
Socket s = sslServerSocket.accept();I am basically missing some point because I get a "javax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled." when I try to run the server.
Can it be a problem with the certificate? When using -validity <days> in keytool the certificate gets self-signed, so it should work if I'm not wrong.
I have also tried this solution
serverKeyStore = KeyStore.getInstance( "JKS" );
serverKeyStore.load( new FileInputStream("/scratch/stores/server.jks" ),
     "123456".toCharArray() );
tmf = TrustManagerFactory.getInstance( "SunX509" );
tmf.init( serverKeyStore );
sslContext = SSLContext.getInstance( "TLS" );
sslContext.init( null, tmf.getTrustManagers(),secureRandom );
SSLServerSocketFactory sf = sslContext.getServerSocketFactory();
SSLServerSocket ss = (SSLServerSocket)sf.createServerSocket( port );and still it doesn't work.
So what am I missing?

You were right. I corrected the mistakes in the server code, now it's
     private SSLServerSocket setupSSLServerSocket(){
          try {
               SSLContext sslContext = SSLContext.getInstance( "TLS" );
               KeyManagerFactory km = KeyManagerFactory.getInstance("SunX509");
               KeyStore ks = KeyStore.getInstance("JKS");
               ks.load(new FileInputStream(_KEYSTORE), _KEYSTORE_PASSWORD.toCharArray());
               km.init(ks, _KEYSTORE_PASSWORD.toCharArray());
                * Da usare con un truststore se serve autenticazione dei client
                * TrustManagerFactory tm = TrustManagerFactory.getInstance("SunX509");
               tm.init(ks);*/
               sslContext.init(km.getKeyManagers(), null, null);
               SSLServerSocketFactory f = sslContext.getServerSocketFactory();
               SSLServerSocket ss = (SSLServerSocket) f.createServerSocket(_PORT);
               return ss;
          } catch (UnrecoverableKeyException e) {
               e.printStackTrace();
          } catch (KeyManagementException e) {
               e.printStackTrace();
          } catch (NoSuchAlgorithmException e) {
               e.printStackTrace();
          } catch (KeyStoreException e) {
               e.printStackTrace();
          } catch (CertificateException e) {
               e.printStackTrace();
          } catch (FileNotFoundException e) {
               e.printStackTrace();
          } catch (IOException e) {
               e.printStackTrace();
          return null;
     }and on the client code
private SSLSocket setupSSLClientSocket(){
     try {
          SSLContext sslContext = SSLContext.getInstance( "TLS" );
          /* SERVER
          KeyManagerFactory km = KeyManagerFactory.getInstance("SunX509");
          km.init(ks, _KEYSTORE_PASSWORD.toCharArray());
          KeyStore clientks = KeyStore.getInstance("JKS");
          clientks.load(new FileInputStream(_TRUSTSTORE), _TRUSTSTORE_PASS.toCharArray());
          TrustManagerFactory tm = TrustManagerFactory.getInstance("SunX509");
          tm.init(clientks);
          sslContext.init(null, tm.getTrustManagers(), null);
          SSLSocketFactory f = sslContext.getSocketFactory();
          SSLSocket sslSocket = (SSLSocket) f.createSocket("localhost", _PORT);
          return sslSocket;
     } catch (KeyManagementException e) {
          e.printStackTrace();
     } catch (NoSuchAlgorithmException e) {
          e.printStackTrace();
     } catch (KeyStoreException e) {
          e.printStackTrace();
     } catch (CertificateException e) {
          e.printStackTrace();
     } catch (FileNotFoundException e) {
          e.printStackTrace();
     } catch (IOException e) {
          e.printStackTrace();
     return null;
}and added a System.out.println(sslSocket); after every incoming message (server side) and SSL is now fully working!
So my mistakes were:
[] Incorrect setup done by code
[] Incorrect and insufficient println() of socket status
Now that everything works, I've deleted all this manual setup and just use the system properties. (They MUST be set before getting the Factory)
SERVER SIDE:
System.setProperty("javax.net.ssl.keyStore", _KEYSTORE);
System.setProperty("javax.net.ssl.keyStorePassword", KEYSTOREPASSWORD);
SSLServerSocketFactory f = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket sslServerSocket = (SSLServerSocket) f.createServerSocket(_PORT);
CLIENT SIDE:
System.setProperty("javax.net.ssl.trustStore", "/scratch/stores/client.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "client");
SSLSocketFactory f = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket sslSocket = (SSLSocket) f.createSocket(_HOST, _PORT);
And everything is working as expected. Thank you!
I hope my code will help someone else in the future.

Some clients migrated from 2007 is presented with the self signed certificate in 2013

Similar Messages

Maybe you are looking for