SSL Certificate Authority TÜRKTRUST

I see listed under preferences - advanced - certificates:
TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı
Begins On 13/05/2005
Expires On 22/03/2015
What is this SSL Certificate Authority?
What does it do?

Hi ,
1)     Login to the visual administrator using admin userid and pwd
2)     Goto server >services>keystore
3)     Select the service_ssl and create new entry with name ssl_credentials
Click on create button and generated one new entry with name:  ssl_credentilas
4)     After generating  new entry ssl_credentials(private key) and ssl_credentials.cert (ecertificate) will be created.
now select the new entry and click on generate CSR request button and send the c
ertificate to verisgn. they will send u response to ur CSR request.Now save this in .crt ext and goto VA and sekect the new entry again and click on import CSR .
5)     Select the Trusted CAs and click on import from other button
6)     Select the service_ssl from the Select view option and select the ssl_credentials (privatekey) which is created in step 3. and click on Ok
7)     ssl-credentials will be added into the Trusted CAs
8)Goto SSL provider and  select the  dispatcher
9)Select the new sockets radio button and select server identity tab and click on Add button.
10)     Select the (new entry created just now)  ssl-credential and click on ok.
11)     Add the same for Active sockets and reboot the sun 128 displatcher.
Result:  Https is working for sun 128 server .

Similar Messages

  • SSL certificates and/ or Oracle Certificate Authority

    Our Oracle infrastructure is as follows:
    1.Database server
    (a)Oracle 9i R2 database
    (b) Oracle ApEx 2.2
    2. Infrastructure server
    (a) Oracle 10g (9.0.4.x.x) Infrastructure
    (b) OID - configured as external authentication to Microsoft 2003 Active Directory LDAP version 3
    (c) SSO - configured as Windows Native authentication
    3. Application server
    (a)Oracle 10g (9.0.4.x.x) Forms and reports server
    Network traffic currently is not encrypted. All we need is to ensure that network traffic is encrypted between the the end-user PC and all servers (database or app server)
    I was reading through Oracle Certificate Authority and Secure Sockets Layer.
    1. Is there a difference between the two products?
    2. Which product would be best to ensure the encryption (authentication is provided through MS LDAP)
    Thanks,
    Mayura

    Certificate authority and SSL are two completely different concepts. They can be related but are by no means similar.
    SSL is a service or a feature, not a product. SSL is used to encrypt the traffic. Part of SSL is the use of certificates for authentication. A server or user would pass a certificate as part of an SSL transmission.
    The certificates used for enrypted transmission(SSL), can be obtained from the Oracle Certificate Authority(OCA), or by a third party certificate authority. OCA is not required to use SSL.
    To achieve a fully encrypted envrinment, you would need to use SSL at several layers. This would be done with or without the use of the Oracle certificate authority.
    1. From the web browser to the middle tier
    2. End user to database
    3. from the middle tier to OID
    4. from the middle tier to the database
    5. From OID to active directory

  • Firefox does not recognize SSL Certificate issuer Entrust Certification Authority – L1K, but Entrust Certification Authority – L1C is ok?

    We have a new Entrust SSL Certificate with issuer Entrust Certification Authority – L1K which Firefox does not recognize. Internet Explorer and Chrome are ok.
    On a different system we have an Entrust SSL Certificate with issuer Entrust Certification Authority – L1C which is ok with Firefox.

    Did you verify that all intermediate certificates are installed on the server?
    You can inspect the certificate chain via a site like this:
    *http://www.networking4all.com/en/support/tools/site+check/
    *https://www.ssllabs.com/ssltest/

  • Generate SSL cert with stronger signature algorithm such as RSA-SHA 1 or SHA 2 from Certificate Authority Version: 5.2.3790.3959

    We have a Certificate Authority (Version: 5.2.3790.3959) configured on  Windows 2003 R2 server in our environment. How do i generated SSL cert with stronger signature algorithm such as with SHA1 or SHA2
    Currently i am only able to generate SSL cert with md5RSA.

    Hi,
    Since you are using Windows Server 2003 R2 as CA, the hash algorithm cannot be changed, while in Windows 2008 and 2008 R2, changing the hash algorithm is possible.
    Therefore, you need to build a new CA to use a new algorithm.
    More information for you:
    Is it possible to change the hash algorithm when I renew the Root CA
    http://social.technet.microsoft.com/Forums/windowsserver/en-US/91572fee-b455-4495-a298-43f30792357e/is-it-possible-to-change-the-hash-algorithm-when-i-renew-the-root-ca?forum=winserversecurity
    Changing public key algorithm of a CA certificate
    http://social.technet.microsoft.com/Forums/windowsserver/en-US/0fd19577-4b21-4bda-8f56-935e4d360171/changing-public-key-algorithm-of-a-ca-certificate?forum=winserversecurity
    modify CA configuration after Migration
    http://social.technet.microsoft.com/Forums/windowsserver/en-US/0d5bcb76-3a04-4bcf-b317-cc65516e984c/modify-ca-configuration-after-migration?forum=winserversecurity
    Best Regards,
    Amy Wang

  • Oracle Certificate Authority OCA and SSL Immlementation

    Hi
    Is anybody can clear that:
    1) Does OCA only work on intranet or it does work internet also.
    2) What is the difference between OCA and Verisign or any other third party CA
    3) What are the benifits for OCA
    4) What are the advantages and disadvantages for both of them
    5) what are the main steps invloved to implement OCA and SSL
    I'll be very appraciated, if anybody give me the answers as soon as possible. Please gIve me the answers whichever you knows very well.
    Thanks in Advance
    Munir Muhammad

    Certificate authority and SSL are two completely different concepts. They can be related but are by no means similar.
    SSL is a service or a feature, not a product. SSL is used to encrypt the traffic. Part of SSL is the use of certificates for authentication. A server or user would pass a certificate as part of an SSL transmission.
    The certificates used for enrypted transmission(SSL), can be obtained from the Oracle Certificate Authority(OCA), or by a third party certificate authority. OCA is not required to use SSL.
    To achieve a fully encrypted envrinment, you would need to use SSL at several layers. This would be done with or without the use of the Oracle certificate authority.
    1. From the web browser to the middle tier
    2. End user to database
    3. from the middle tier to OID
    4. from the middle tier to the database
    5. From OID to active directory

  • How do I set up my own certificate authority

    I tried google on the above question, and the most recent thing I found was 7 years old. replacing the phrase used generates a lot of hits with a very poor signal to noise ratio.
    I have OpenSSL (in the cygwin distribution), which is quite recent, but frankly its documentation leaves just about everything to be desired. I found pyca, but it has no documentation at all (and it is a couple years old).
    I tried the steps appended below, but invariably the attempt to sign the certificates fails with an obscure error message about OpenSSL not finding one thing or another.
    At this stage, I just don't care whether I do this using something in the J2SDK such as keytool or OpenSSL, as long as I can get it done. Or if there is some other opensource software tool I can use, terrific. This is primarily for the purpose of securing communications within an Intranet, and secondarily for signing applets and applications distributed through WebStart. If I am not mistaken, I'll need a certificate for each of my servers. Right?
    If you know of an URL where this is well explained and illustrated, great. Give that to me.
    Otherwise, a simple illustration (or a correction of what I've appended below) would be appreciated. I believe I understand what ought to be happening. It ought to be rather simple to do, but there are these irritating and frustrating minor details getting in the way. For example, the steps I show below seem simple, but everything appears to get messed up by some of the contents of openssl.cnf in 'usr/ssl', in the cygwin directory, and there is no explanation of how to set things up for the first time you use OpenSSL within Cygwin (or on unix for that matter).
    Any assistance would be appreciated.
    Thanks,
    Ted
    ========failed attempt=====================
    # Generation of Certificate Authority(CA)
    openssl req -new -x509 -keyout cakey.pem -out cacert.pem -config /usr/ssl/openssl.cnf
    # Create server request and key
    openssl req -new -keyout server-key.pem -out server-req.pem -days 36502 -config /usr/ssl/openssl.cnf
    # Remove the passphrase from the key
    openssl rsa -in server-key.pem -out server-key.pem
    # Sign server cert
    openssl ca -policy policy_anything -out server-cert.pem -infiles server-req.pem -config /usr/ssl/openssl.cnf
    # Create client request and key
    openssl req -new -keyout client-key.pem -out client-req.pem -days 36502 -config /usr/ssl/openssl.cnf
    # Remove a passphrase from the key
    openssl rsa -in client-key.pem -out client-key.pem
    # Sign client cert
    openssl ca -policy policy_anything -out client-cert.pem -infiles client-req.pem -config /usr/ssl/openssl.cnf

    The following works for me:
    NB: Some of the output has been removed in the interests of privacy (this will not affect the outcome)
    1. Create CA key and certificate
    1.1 Create a new file called "serial" containing the value "01".
    1.2 Create an empty file "index.txt"
    1.3 Create a subdirectory "newcerts"
    1.4 Execute.... create a key for your CA
    [ben@localhost ca]$ openssl genrsa -out ca.key 2048
    Generating RSA private key, 2048 bit long modulus
    .....................................+++
    ..........................................................+++
    e is 65537 (0x10001)
    1.5 Execute... create a certificate for your own CA
    [ben@localhost ca]$ openssl req -config ./openssl.cnf -new -x509 -key ca.key -out cacert.pem -days 365
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    Country Name (2 letter code) [GB]:
    County or State (full name) []:
    City or town (eg, Hitchin) []:
    Organization Name (eg, company) []:
    Organizational Unit Name (eg, section) []:
    Common Name (eg, your name or your server's hostname) []:
    Email Address []:
    2. Create PK key and .csr
    2.1 Execute...
    [ben@localhost ca]$ keytool -genkey -alias PK
    Enter keystore password: password
    What is your first and last name?
    [Unknown]:
    What is the name of your organizational unit?
    [Unknown]:
    What is the name of your organization?
    [Unknown]:
    What is the name of your City or Locality?
    [Unknown]:
    What is the name of your State or Province?
    [Unknown]:
    What is the two-letter country code for this unit?
    [Unknown]:
    Is CN=, OU=, O=, L=, ST=, C=GB correct?
    [no]: yes
    Enter key password for <PK>
    (RETURN if same as keystore password):
    2.2 Create .csr
    [ben@localhost ca]$ keytool -certreq -alias PK -file PK.csr
    Enter keystore password: password
    3. Sign PK with CA cert
    [ben@localhost ca]$ openssl ca -config ./openssl.cnf -in PK.csr -out PK.pem -keyfile ca.key -days 365
    Using configuration from ./openssl.cnf
    Check that the request matches the signature
    Signature ok
    Certificate Details:
    Serial Number: 0 (0x0)
    Validity
    Not Before: Jan 5 19:48:33 2006 GMT
    Not After : Jan 5 19:48:33 2007 GMT
    Subject:
    countryName = GB
    stateOrProvinceName =
    organizationName =
    organizationalUnitName =
    commonName =
    X509v3 extensions:
    X509v3 Basic Constraints:
    CA:FALSE
    Netscape Comment:
    OpenSSL Generated Certificate
    X509v3 Subject Key Identifier:
    D6:2D:7E:71:77:9E:1A:BB:54:69:98:63:6A:6A:E2:BA:12:C4:D7:DD
    X509v3 Authority Key Identifier:
    keyid:92:7C:33:7C:EC:1D:76:C5:B8:F0:30:6D:10:12:40:E5:E7:EA:24:31
    DirName:/C=GB/ST=/L=/O=/OU=/CN=/emailAddress=
    serial:F0:D1:38:36:65:6D:71:D5
    Certificate is to be certified until Jan 5 19:48:33 2007 GMT (365 days)
    Sign the certificate? [y/n]:y
    1 out of 1 certificate requests certified, commit? [y/n]y
    Write out database with 1 new entries
    Data Base Updated
    4. Convert PK certificate into DER format
    [ben@localhost ca]$ openssl x509 -in PK.pem -out PK.der -outform DER
    5. Import CA certificate into keystores
    [ben@localhost ca]$ keytool -import -alias ca -file cacert.pem
    Enter keystore password: password
    Owner: EMAILADDRESS=, CN=, OU=, O=, L=, ST=, C=GB
    Issuer: EMAILADDRESS=, CN=, OU=, O=, L=, ST=, C=GB
    Serial number: f0d13836656d71d5
    Valid from: Thu Jan 05 19:41:09 GMT 2006 until: Fri Jan 05 19:41:09 GMT 2007
    Certificate fingerprints:
    MD5: AF:3D:8E:25:12:24:04:1F:40:70:BC:A0:9E:0E:44:84
    SHA1: B8:E8:0B:A5:86:33:21:0C:B5:3C:6E:F2:DE:7B:31:0F:59:AE:21:E4
    Trust this certificate? [no]: yes
    Certificate was added to keystore
    6. Import signed PK into keystore
    [ben@localhost ca]$ keytool -import -alias pk -file PK.der
    Enter keystore password: password
    Certificate reply was installed in keystore
    REF:
    http://www.yorku.ca/dkha/docs/jsse_cert/jsse_cert.htm
    http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#ownca
    http://www.openssl.org/docs/apps/ca.html#
    openssl.cnf:#
    # OpenSSL example configuration file.
    # This is mostly being used for generation of certificate requests.
    # This definition stops the following lines choking if HOME isn't
    # defined.
    HOME               = .
    RANDFILE          = $ENV::HOME/.rnd
    # Extra OBJECT IDENTIFIER info:
    #oid_file          = $ENV::HOME/.oid
    oid_section          = new_oids
    # To use this configuration file with the "-extfile" option of the
    # "openssl x509" utility, name here the section containing the
    # X.509v3 extensions to use:
    # extensions          =
    # (Alternatively, use a configuration file that has only
    # X.509v3 extensions in its main [= default] section.)
    [ new_oids ]
    # We can add new OIDs in here for use by 'ca' and 'req'.
    # Add a simple OID like this:
    # testoid1=1.2.3.4
    # Or use config file substitution like this:
    # testoid2=${testoid1}.5.6
    [ ca ]
    default_ca     = CA_default          # The default ca section
    [ CA_default ]
    dir          = .               # Where everything is kept
    certs          = $dir/certs          # Where the issued certs are kept
    crl_dir          = $dir/crl          # Where the issued crl are kept
    database     = $dir/index.txt     # database index file.
    #unique_subject     = no               # Set to 'no' to allow creation of
                             # several ctificates with same subject.
    new_certs_dir     = $dir/newcerts          # default place for new certs.
    certificate     = $dir/cacert.pem      # The CA certificate
    serial          = $dir/serial           # The current serial number
    #crlnumber     = $dir/crlnumber     # the current crl number must be
                             # commented out to leave a V1 CRL
    crl          = $dir/crl.pem           # The current CRL
    private_key     = $dir/private/cakey.pem# The private key
    RANDFILE     = $dir/private/.rand     # private random number file
    x509_extensions     = usr_cert          # The extentions to add to the cert
    # Comment out the following two lines for the "traditional"
    # (and highly broken) format.
    name_opt      = ca_default          # Subject Name options
    cert_opt      = ca_default          # Certificate field options
    # Extension copying option: use with caution.
    # copy_extensions = copy
    # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
    # so this is commented out by default to leave a V1 CRL.
    # crlnumber must also be commented out to leave a V1 CRL.
    # crl_extensions     = crl_ext
    default_days     = 365               # how long to certify for
    default_crl_days= 30               # how long before next CRL
    default_md     = md5               # which md to use.
    preserve     = no               # keep passed DN ordering
    # A few difference way of specifying how similar the request should look
    # For type CA, the listed attributes must be the same, and the optional
    # and supplied fields are just that :-)
    policy          = policy_match
    # For the CA policy
    [ policy_match ]
    countryName          = match
    stateOrProvinceName     = match
    organizationName     = match
    organizationalUnitName     = optional
    commonName          = supplied
    emailAddress          = optional
    # For the 'anything' policy
    # At this point in time, you must list all acceptable 'object'
    # types.
    [ policy_anything ]
    countryName          = optional
    stateOrProvinceName     = optional
    localityName          = optional
    organizationName     = optional
    organizationalUnitName     = optional
    commonName          = supplied
    emailAddress          = optional
    [ req ]
    default_bits          = 1024
    default_keyfile      = privkey.pem
    distinguished_name     = req_distinguished_name
    attributes          = req_attributes
    x509_extensions     = v3_ca     # The extentions to add to the self signed cert
    # Passwords for private keys if not present they will be prompted for
    # input_password = secret
    # output_password = secret
    # This sets a mask for permitted string types. There are several options.
    # default: PrintableString, T61String, BMPString.
    # pkix      : PrintableString, BMPString.
    # utf8only: only UTF8Strings.
    # nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
    # MASK:XXXX a literal mask value.
    # WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
    # so use this option with caution!
    # we use PrintableString+UTF8String mask so if pure ASCII texts are used
    # the resulting certificates are compatible with Netscape
    string_mask = MASK:0x2002
    # req_extensions = v3_req # The extensions to add to a certificate request
    [ req_distinguished_name ]
    countryName               = Country Name (2 letter code)
    countryName_default          = GB
    countryName_min               = 2
    countryName_max               = 2
    stateOrProvinceName          = County or State (full name)
    stateOrProvinceName_default     =
    localityName               = City or town (eg, Hitchin)
    localityName_default          =
    0.organizationName          = Organization Name (eg, company)
    0.organizationName_default     =
    # we can do this but it is not needed normally :-)
    #1.organizationName          = Second Organization Name (eg, company)
    #1.organizationName_default     = World Wide Web Pty Ltd
    organizationalUnitName          = Organizational Unit Name (eg, section)
    organizationalUnitName_default     =
    commonName               = Common Name (eg, your name or your server\'s hostname)
    commonName_max               = 64
    emailAddress               = Email Address
    emailAddress_max          = 64
    # SET-ex3               = SET extension number 3
    [ req_attributes ]
    challengePassword          = A challenge password
    challengePassword_min          = 4
    challengePassword_max          = 20
    unstructuredName          = An optional company name
    [ usr_cert ]
    # These extensions are added when 'ca' signs a request.
    # This goes against PKIX guidelines but some CAs do it and some software
    # requires this to avoid interpreting an end user certificate as a CA.
    basicConstraints=CA:FALSE
    # Here are some examples of the usage of nsCertType. If it is omitted
    # the certificate can be used for anything *except* object signing.
    # This is OK for an SSL server.
    # nsCertType               = server
    # For an object signing certificate this would be used.
    # nsCertType = objsign
    # For normal client use this is typical
    # nsCertType = client, email
    # and for everything including object signing:
    # nsCertType = client, email, objsign
    # This is typical in keyUsage for a client certificate.
    # keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    # This will be displayed in Netscape's comment listbox.
    nsComment               = "OpenSSL Generated Certificate"
    # PKIX recommendations harmless if included in all certificates.
    subjectKeyIdentifier=hash
    authorityKeyIdentifier=keyid,issuer:always
    # This stuff is for subjectAltName and issuerAltname.
    # Import the email address.
    # subjectAltName=email:copy
    # An alternative to produce certificates that aren't
    # deprecated according to PKIX.
    # subjectAltName=email:move
    # Copy subject details
    # issuerAltName=issuer:copy
    #nsCaRevocationUrl          = http://www.domain.dom/ca-crl.pem
    #nsBaseUrl
    #nsRevocationUrl
    #nsRenewalUrl
    #nsCaPolicyUrl
    #nsSslServerName
    [ v3_req ]
    # Extensions to add to a certificate request
    basicConstraints = CA:FALSE
    keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    [ v3_ca ]
    # Extensions for a typical CA
    # PKIX recommendation.
    subjectKeyIdentifier=hash
    authorityKeyIdentifier=keyid:always,issuer:always
    # This is what PKIX recommends but some broken software chokes on critical
    # extensions.
    #basicConstraints = critical,CA:true
    # So we do this instead.
    basicConstraints = CA:true
    # Key usage: this is typical for a CA certificate. However since it will
    # prevent it being used as an test self-signed certificate it is best
    # left out by default.
    # keyUsage = cRLSign, keyCertSign
    # Some might want this also
    # nsCertType = sslCA, emailCA
    # Include email address in subject alt name: another PKIX recommendation
    # subjectAltName=email:copy
    # Copy issuer details
    # issuerAltName=issuer:copy
    # DER hex encoding of an extension: beware experts only!
    # obj=DER:02:03
    # Where 'obj' is a standard or added object
    # You can even override a supported extension:
    # basicConstraints= critical, DER:30:03:01:01:FF
    [ crl_ext ]
    # CRL extensions.
    # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
    # issuerAltName=issuer:copy
    authorityKeyIdentifier=keyid:always,issuer:always

  • How do I install this self-signed SSL certificate?

    I haven't been able to connect to the jabber server I've been using (phcn.de) for quite some time now, so I filed a bug report with mcabber. The friendly people there told me to install phcn.de's self-signed certificate, but I can't figure out for the life of me how to do that.
    I know I can download something resembling a certificate using
    $ gnutls-cli --print-cert -p 5223 phcn.de
    Which does give me something to work with:
    Resolving 'phcn.de'...
    Connecting to '88.198.14.54:5223'...
    - Ephemeral Diffie-Hellman parameters
    - Using prime: 768 bits
    - Secret key: 767 bits
    - Peer's public key: 767 bits
    - PKCS#3 format:
    -----BEGIN DH PARAMETERS-----
    MIHFAmEA6eZCWZ01XzfJf/01ZxILjiXJzUPpJ7OpZw++xdiQFBki0sOzrSSACTeZ
    hp0ehGqrSfqwrSbSzmoiIZ1HC859d31KIfvpwnC1f2BwAvPO+Dk2lM9F7jaIwRqM
    VqsSej2vAmAwRwrVoAX7FM4tnc2H44vH0bHF+suuy+lfGQqnox0jxNu8vgYXRURA
    GlssAgll2MK9IXHTZoRFdx90ughNICnYPBwVhUfzqfGicVviPVGuTT5aH2pwZPMW
    kzo0bT9SklI=
    -----END DH PARAMETERS-----
    - Certificate type: X.509
    - Got a certificate list of 1 certificates.
    - Certificate[0] info:
    - subject `CN=phcn.de', issuer `CN=phcn.de', RSA key 1024 bits, signed using RSA-SHA, activated `2009-05-04 08:26:21 UTC', expires `2014-04-08 08:26:21 UTC', SHA-1 fingerprint `d01bf1980777823ee7db14f8eac1c353dedb8fb7'
    -----BEGIN CERTIFICATE-----
    MIIBxzCCATCgAwIBAgIINN98WCZuMLswDQYJKoZIhvcNAQEFBQAwEjEQMA4GA1UE
    AwwHcGhjbi5kZTAeFw0wOTA1MDQwODI2MjFaFw0xNDA0MDgwODI2MjFaMBIxEDAO
    BgNVBAMMB3BoY24uZGUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALqS+tnB
    tNruBGdcjw0o+BWSdfkKH4T3VpS7bkrsS0q7RD5iUIao7jH2lJqTk1TrLbQe28+R
    H0X9Ya+w22iYFea2l3wkrTnBfgdSZbRhpSxgVvC2QEBMoSrEQoRpo5lzXadRlob/
    RQ+rhu/cWCNeiRJzfkmNirPVEciGKQHrwKxxAgMBAAGjJjAkMCIGA1UdEQQbMBmg
    FwYIKwYBBQUHCAWgCwwJKi5waGNuLmRlMA0GCSqGSIb3DQEBBQUAA4GBALFBalfI
    oESZY+UyVwOilQIF8mmYhGSFtreEcUsIQvG1+cgD16glKehx+OcWvJNwf8P6cFvH
    7yiq/fhMVsjnxrfW5Hwagth04/IsuOtIQQZ1B2hnzNezlnntyvaXBMecTIkU7hgl
    zYK97m28p07SrLX5r2A2ODfmYGbp4RD0XkAC
    -----END CERTIFICATE-----
    - The hostname in the certificate matches 'phcn.de'.
    - Peer's certificate issuer is unknown
    - Peer's certificate is NOT trusted
    - Version: TLS1.0
    - Key Exchange: DHE-RSA
    - Cipher: AES-128-CBC
    - MAC: SHA1
    - Compression: NULL
    - Handshake was completed
    - Simple Client Mode:
    Unfortunately, the above command spits out more than a certificate. Do I need the additional information? If so, what do I need it for? Where do I need to put the certificate file?

    Hi,
    I recently found out a way how to install test or self-signed certificates and use it with S1SE.
    See:
    http://www.gtlib.cc.gatech.edu/pub/linux/docs/HOWTO/other-formats/html_single/SSL-Certificates-HOWTO.html
    Follow the instructions there
    1. Create CA
    2. Create root ca certificate
    Now install the root-ca-certificate in S1SE -> Security>Certificate Management and Install a "Trusted Certificate Authority".
    Paste the contents of the file: cacert.pem into the message-text box.
    Then restart the server. Now your CA-Cert should be visible in the Manage Certificates menu.
    The next step is to send a certificate-request from S1SE to your e-mail-address.
    The contents of the e-mail the server sends to you (certificate request) must be pasted into the file: newreq.pem.
    Now just sign the Request:
    CA.pl -sign
    The last step is that you have to paste the contents of the file newcert.pem into the message-box of the Security>Certificate Management - now under the option Certificate for "This Server".
    Then you have to reboot the server/instance again and it should work with your certificate.
    Regards,
    Dominic

  • Untrusted server cert chain & does not recognize the certificate authority

    I have java code that makes an ssl connection to an HTTPS server.
    The code workes fine when I connect to a server that has a
    certificate that was issued by a recognizable authority.
    But when I try to connect to our test HTTPS server which has a
    certificate that was created by ourselves for debug, I get this
    java exception: "untrusted server cert chain".
    When I connect to our test HTTPS server with a browser, I get
    this message from the browser in a popup window:
    "www.xyz.com is a web site that uses a security certifcate to
    identify itself. However netscape 6 does not recognize the
    certificate authority that issued this certificate."
    At this point I am able to accept the certificate in the popup
    window and continue.
    Question: In my java code how can I accept a certificate
    that was signed by an unrecognizable authority just like the
    browser can. Or during debug, how can I set an override
    to accept ALL certs no matter what.
    Thanks.....Paul

    You will have to import your server test certificate into your client machine keystore. By default the keystore will be the 'cacerts' file in JAVA_HOME/jre/lib/security, get your server certificate in .pem format and use keytool to import it to the client.
    keytool -import -alias <anything> -file <full path of .pem file> -keystore <full path of cacerts file>
    The keystore password is 'changeit' by default, keytool comes with the JDK.
    The reasoning behind this is to prevent the misuse of test certificates, the client has to consciously import an untrusted certificate. When you install a real certificate on your server the client will be automatically validated if bought from a trusted CA (Thawte, Verisign).
    Take a look at the java.security.KeyStore class, you can use it to view your certificate chain.
    Ronny.

  • How to filter certificate templates in Certificate Authority snap-in with the correct values

    How to filter certificate templates in Certificate Authority snap-in with the correct values
    I have a 2012 R2 server running Microsoft Certificate Authority snap-in.
    I want to do a filter on a specific Certificate Template which i know exists in the 'Issued Certificates' folder.
    All the documentation i can find seems to suggest i copy the certificate name and use this in the View Filter.
    1). I add the 'Certificate Template' option into the Field drop-down.
    2). I leave the Operation as the '=' symbol
    3). I paste in just the name of the template in question. for example: 'my computers'
    The search results always come back blank 'There are no items to show in this view.' even when i know there are many instances of this template. I've tried on a win 2008 server and same issue.
    Is there a correct value to enter for the Certificate Template name?
    Can this be done easier using certutil commands?
    When i run the certutil tool i can confirm i have several issued templates. Certutil -catemplates -v > c:\mytemplate_log.csv
    Anybody know what i'm doing wrong?
    I seem to be getting nowhere with this one.

    > But its important you are using the template name, not the display name
    this is incorrect. OIDs are mapped to *display name*, not common name (it is true for all templates except Machine template). That is, in order to translate template name to a corresponding OID, you need to use certificate template's display name. And, IIRC,
    template name in the filter can be used only for V1 templates. For V2 and higher, OID must be used.
    My weblog: en-us.sysadmins.lv
    PowerShell PKI Module: pspki.codeplex.com
    PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
    Check out new: SSL Certificate Verifier
    Check out new:
    PowerShell FCIV tool.

  • Can I reference 2 different SSL certificates in the same weblogic.properties

    Hello,
    Can I reference 2 different SSL certificates in the same
    weblogic.properties
    file?
    Reason is we have 2 groups of users for a web application: one will use
    a
    French-language DNS to access
    the application, and the other will use English DNS. Both DNS will point
    to
    the same application on the same
    server.
    Example of what we require:
    weblogic.security.certificate.server=mycert1.pem
    weblogic.security.key.server=mykey1.der
    weblogic.security.certificate.authority=rootCertificate1.pem
    ----and---
    weblogic.security.certificate.server=mycert2.der
    weblogic.security.key.server=mykey2.der
    weblogic.security.certificate.authority=rootCertificate2.pem
    mycert1 will correspond to DNS1, and mcert2 will correspond to DNS2, and
    both
    DNS1 and DNS2 point to the same application on the same box.
    Thanks,
    Ragu

    I think that you can only have one server certificate per server currently
    since the certificate establishes the server's identity and there isn't
    support for a server to have two identities at the same time.
    "RAGUTAM BOMMAREDDY" <[email protected]> wrote in message
    news:[email protected]..
    Hello,
    Can I reference 2 different SSL certificates in the same
    weblogic.properties
    file?
    Reason is we have 2 groups of users for a web application: one will use
    a
    French-language DNS to access
    the application, and the other will use English DNS. Both DNS will point
    to
    the same application on the same
    server.
    Example of what we require:
    weblogic.security.certificate.server=mycert1.pem
    weblogic.security.key.server=mykey1.der
    weblogic.security.certificate.authority=rootCertificate1.pem
    ----and---
    weblogic.security.certificate.server=mycert2.der
    weblogic.security.key.server=mykey2.der
    weblogic.security.certificate.authority=rootCertificate2.pem
    mycert1 will correspond to DNS1, and mcert2 will correspond to DNS2, and
    both
    DNS1 and DNS2 point to the same application on the same box.
    Thanks,
    Ragu

  • Windows Root Certificate authority questions.

    hello,
    I have 2 questions with regards to Offline ROOT CA in a 2 TIER Hierarchy :
    (1) Is it necessary to to ” map the Namespace of Active Directory to an Offline CA’s Registry Configuration” ? I didn’t do this step in my lab env and find this in some but
    but not all the online posts as well. what happens if we don't run this command on offline CA ?
    For instance:  certutil.exe –setreg ca\DSConfigDN CN=Configuration,DC=lab,DC=com 
    (2) What happens if i do not publish the ROOT CA certificate via "certutil -dspublish -f xxx.cer ROOTCA " command but instead just  push the root certificate  using Default Domain Group Policy Object to "Trusted Root Auth" store
    on all the domain machines ?  What are the pros/cons of using the certutil method vs the GPO method ?  
    Thanks
    Neeraj

    > Is it necessary to to ” map the Namespace of Active Directory to an Offline CA’s Registry Configuration” ?
    it is necessary only if you configure LDAP URLs for CRL Dsitribution Points and Authority Information Access extensions on Root CA (not recommended).
    > What are the pros/cons of using the certutil method vs the GPO method ?  
    different scopes. When publishing in Active Directory, it is downloaded to all
    *forest* members, while GPO covers only limited scope (domain, site or OU).
    Vadims Podāns, aka PowerShell CryptoGuy
    My weblog: en-us.sysadmins.lv
    PowerShell PKI Module: pspki.codeplex.com
    PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
    Check out new: SSL Certificate Verifier
    Check out new:
    PowerShell File Checksum Integrity Verifier tool.

  • SQL Server SSL Certificate

    Hi All,
    I am slowly getting to the bottom of applying SSL throughout my project but am stuck in the current situation and I need help please..
    Project is a Java servlet running on Windows. Java 1.6 and Tomcat 7 but connects to a SQL Server database and an Oracle database (running on unix). We have a keystore set up successfully on the servlets' server with root, intermediate certificates etc
    that successfully encrypts the connection to Oracle. The server team maintaining the server hosting the SQL Server database have supplied me with an SSL certificate, I am told is for accessing the SQL Server database. I am assuming it is a public key certificate.
    I am trying to apply this certificate to encrypt the network traffic to the SQL Server database. I have attempted to import the certificate into the keystore mentioned above using the Java keytool but this does not work so I deleted the certificate from
    the keystore again. I found the URL below which I have followed to install the certificate through MMC but cannot find how to now force Tomcat to encrypt the network traffic.
    http://support.microsoft.com/kb/316898
    Can someone please tell me what I am missing here please? There is loads of guidance on setting up keystores with root and intermediate certificates etc, but I cannot find any guidance on what to do in Tomcat to use a single provided SSL certificate. Do
    I use the Java cacerts file and import the certificate in there?
    Thanks in advance
    Regards
    AJF

    Hi SQL Team - MSFT
    Thank you for your response.
    I have been looking at this further.  I have only been given one SSL certificate which I am assuming because it has a file format of ".cer" it is the public key for the certificate on the server hosting the SQL server database.  For this to work
    they way we want, the "clients" will not have SQL Server Configuration Manager installed, but instead will have the SSL certificate mention above stored in a Keystore set up with the "Keytool" in the Java JRE.
    I am unsure how the guys who manage the server hosting the SQL server database have set up the SSL certificate, i.e. if they have set up a root and intermediate certificate etc.  I am currently trying to get information out of them (They are not
    located immdiately near my location).  I have a funny feeling they have not set up the SSL at their end correctly, and I am wondering if they have just imported into the servers browser, the same public key certificate they forwarded to me.  When
    you say "you have to first export the Trusted Root Certificate Authority from the server and import this to the client", what part of the SSL certificate(s) do you mean?
    Do you mean the Certificate Authority root certificate and I have to import that into the client as well as the public key certificate?
    I look forward to you next feedback.
    Regards
    Alanjo

  • ISE Certificate Authority Certificate

    I'm confussed about the certificates:
    Some weeks ago a certificate was installed in the ISE to avoid the browser certificate error when the customer access the sponsor portal ...
    Now, the customer is requesting to authenticate the sponsor users through LDAPS ... I understand Active Directory or LDAP as External Identity Sources are not secure. So, in order to enable LDAPS we must check the Secure Atuthentication box in the LDAP configuration, but a ROOT CA must be chooseen also.
    I understand the ISE should validate the customer PKI in order to validate the user certificate ... Am I right?
    Do I need request the customer to provide me the "Certificate Authority Certificate" from its PKI ??
    Is it a file completely different to the certificate already loaded in the ISE ??
    With this certificate, would the ISE validate the user's computer certificate additional to user and password ??
    Would the user must use a computer with certificate in order to access the sponsor portal ??
    Thanks in advance.
    Regards
    Daniel Escalante.

    Please follow the "secure authentication tab" in the below table( highlighted)
    go to >LDAP Connection Settings
    Table lists the fields in the LDAP connection tab and their descriptions.
    Table :     LDAP Connection Tab 
    Option Description
    Enable Secondary Server
    Check this option to enable the secondary LDAP server to be used as a  backup in the event that the primary LDAP server fails. If you check  this check box, you must enter configuration parameters for the  secondary LDAP server.
    Primary and Secondary Servers
    Hostname/IP
    (Required) Enter the IP address or DNS name of the machine that is  running the LDAP software. The hostname can contain from 1 to 256  characters or a valid IP address expressed as a string. The only valid  characters for hostnames are alphanumeric characters (a to z, A to Z, 0  to 9), the dot (.), and the hyphen (-).
    Port
    (Required) Enter the TCP/IP port number on which the LDAP server is  listening. Valid values are from 1 to 65,535. The default is 389, as  stated in the LDAP specification. If you do not know the port number,  you can find this information from the LDAP server administrator.
    Access
    (Required) Anonymous Access—Click to ensure that searches on the LDAP  directory occur anonymously. The server does not distinguish who the  client is and will allow the client read access to any data that is  configured as accessible to any unauthenticated client. In the absence  of a specific policy permitting authentication information to be sent to  a server, a client should use an anonymous connection.
    Authenticated Access—Click to ensure that searches on the LDAP directory  occur with administrative credentials. If so, enter information for the  Admin DN and Password fields.
    Admin DN
    Enter the DN of the administrator. The Admin DN is the LDAP account that  permits searching of all required users under the User Directory  Subtree and permits searching groups. If the administrator specified  does not have permission to see the group name attribute in searches,  group mapping fails for users who are authenticated by that LDAP.
    Password
    Enter the LDAP administrator account password.
    Secure Authentication
    Click to use SSL to encrypt communication between Cisco ISE and the  primary LDAP server. Verify that the Port field contains the port number  used for SSL on the LDAP server. If you enable this option, you must  choose a root CA.
    Root CA
    Choose a trusted root certificate authority from the drop-down list box  to enable secure authentication with a certificate.
    See the "Certificate Authority  Certificates" section on page 12-17 and "Adding a Certificate  Authority Certificate" section on page 12-19 for information  on CA certificates.
    Server Timeout
    Enter the number of seconds that Cisco ISE waits for a response from the  primary LDAP server before determining that the connection or  authentication with that server has failed. Valid values are 1 to 300.  The default is 10.
    Max. Admin Connections
    Enter the maximum number of concurrent connections (greater than 0) with  LDAP administrator account permissions that can run for a specific LDAP  configuration. These connections are used to search the directory for  users and groups under the User Directory Subtree and the Group  Directory Subtree. Valid values are 1 to 99. The default is 20.
    Test Bind to Server
    Click to test and ensure that the LDAP server details and credentials  can successfully bind. If the test fails, edit your LDAP server details  and retest.

  • How to import a Root Certificate Authority for signing

    How can I import a Root Certificate Authority in order to use it with Certificate Assistant as a CA to sign other certs?
    I have the CA cert imported in keychain along with it's associated private key (from a .p12), it's got the gold icon and is recognized as a Root certificate authority, yet Certificate Assistant will not list it as an available Root CA in the "Set Default CA" action dialog, the "Add..." dialog seems only interested in a ".certAuthorityConfig" plist file.
    Do I have to generate a certAuthorityConfig for the CA? I can't seem to find a way to do that. No clues from certtool & security CLI utils even.
    Any info/leads on how to get this to work would be much appreciated.
    Regards,
    -david

    Hi Alex,
    From ACE perspective, it doesn't make differences if you are using certificates issued by your local or a "well known" CA. Moreover, if not mistaken, you have to configure authentication group whatever you are doing client or server authentication.
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA4_1_0/configuration/ssl/guide/certkeys.html#wp1043643
    Thanks,
    Olivier

  • SSL Certificate Error in AIX server~~~SCOM 2012 R2

    Hi Everyone,
    While installing SCOM client i am getting below error. Plz suggest.
    Agent verification failed. Error detail: The server certificate on the destination computer (FQDN(Server Name):1270) has the following errors: 
    The SSL certificate could not be checked for revocation. The server used to check for revocation might be unreachable.    
    The SSL certificate is signed by an unknown certificate authority.      
    It is possible that:
       1. The destination certificate is signed by another certificate authority not trusted by the management server. 
       2. The destination has an invalid certificate, e.g., its common name (CN) does not match the fully qualified domain name (FQDN) used for the connection.  The FQDN used for the connection is: FQDN serve 
       3. The servers in the resource pool have not been configured to trust certificates signed by other servers in the pool.
    The server certificate on the destination computer (FQDN(Server Name:1270) has the following errors: 
    The SSL certificate could not be checked for revocation. The server used to check for revocation might be unreachable.    
    The SSL certificate is signed by an unknown certificate authority.      
    It is possible that:
       1. The destination certificate is signed by another certificate authority not trusted by the management server. 
       2. The destination has an invalid certificate, e.g., its common name (CN) does not match the fully qualified domain name (FQDN) used for the connection.  The FQDN used for the connection is: FQDN serve.
       3. The servers in the resource pool have not been configured to trust certificates signed by other servers in the pool. 

    Hi Pawan
    Have you exported/imported scx certificates?
    Check out Kevin Holmans blog on installation of UNIX/Linux agents:
    http://blogs.technet.com/b/kevinholman/archive/2012/03/18/deploying-unix-linux-agents-using-opsmgr-2012.aspx
    www.coretech.dk - blog.coretech.dk

Maybe you are looking for