The correct use of certificates

I need some guidance please. My company as an exchange server, a time-card server and a web server. Each site has a thawte certificate specifying the full fqdn and directory path.
We've chosen to now implement a CSS11501 (with ssl) and terminate the SSL at the CSS, make a routing decision based on URL, and pass the traffic on in the clear to the specific server. In the future, we will consider backend-ssl.
Here is my question. What is the correct, and ethical way to employ the certificates. Do I take the existing certificates that were generated for each site, and import them into the CSS? In this manner, the CSS answers the certificate check. Will the servers/applications work correctly if the traffic arrives in the clear?
If I do backend-ssl, does the placement of certificates change?
For either scenario, would it be better to get a cert specifically for the CSS?
Thanks for your help.

Ok, the more I dig, the more I find. So basically, if I only have one IP, and one port (external customers behind fw's that only use well-known ports(well-known to them!)) I will need a more generic cert. I can't list multiple servers in the proxy list with the same port, so the rsacert/key that matches the inbound port/content rule - must be usable by all the servers, right?
Or is there another way to have all URLs
https://www.acme.com/timesheet
https://www.acme.com/mail
https://www.acme.com/pinkslips
all come in on port 443 and still have three unique certs?

Similar Messages

  • Understanding the correct use of FromOrderComponets and ToOrderComponents

    Hi all
    Someone could help me understand the difference, and in what case I must use fromOrderComponets and in what case i must use toOrderComponents.
    In the Decomposition Rules.
    I've done multiple orchestrations to own cartridges, by multiple products, and I've never needed to use the expression toOrderComponents, because we've always used FromOrdercomponents.
    any explanation is helpful,
    Best Regards
    David A Leon H

    Hi Leon,
    In the Design Studio Help, please refer to "Working with Decomposition Rules" inorder to understand Decomposition Rules.
    Property Correlation is used while setting a dependency in the Product Specification. This is where FromOrderComponent & ToOrderComponent both are extensively used. For more information, please refer help section for the following.
    1)About Order Item Dependencies
    2)Orchestration Dependency Editor Order Item Dependencies Tab
    Thanks,
    Naveen Jabade

  • The correct use of iMovie to edit  AVCHD footage and the output to disc

    Can anyone help me by setting out the simple steps I must take to take footage from my Panasonic SD9-HDC camcorder (recording on SDHC card), edit it into moves in iMovie, and then burn it to DVD quality disk to watch on an stanfard def TV through a DVD player AND to also burn to Blueray to watch on a high def TV through a blue ray player, keepin the best quality possible for the output.
    The camera can record in 1080i 25 and has a 24p option too....
    Finally what is the best output option to watch my created movies on a MAC and on a PC at the highest possible quality on a full screen 22" widescreen monitor?
    Many thanks

    Ok, the more I dig, the more I find. So basically, if I only have one IP, and one port (external customers behind fw's that only use well-known ports(well-known to them!)) I will need a more generic cert. I can't list multiple servers in the proxy list with the same port, so the rsacert/key that matches the inbound port/content rule - must be usable by all the servers, right?
    Or is there another way to have all URLs
    https://www.acme.com/timesheet
    https://www.acme.com/mail
    https://www.acme.com/pinkslips
    all come in on port 443 and still have three unique certs?

  • Use User-certificates to authenticate a user?

    Hi,
    I have hit a big road block and so decided to reach for some help and information.
    I figured out later that blazeds forum can be the best place to get some channelset authentication questions answered
    I am using blazeds & Spring security on the server. As of now my application using channelset.login(username,password) to authenticate the user.
    A new requirement has been introduced to authenticate the user using  user-certificates derived from a smart card.
    I can use spring-security filters to pass the certificate to the server and the validate it. But I have open questions about channelset authentication.
    1. Is it required to call the channelset.login method inorder to use AMF Channels & StreamingAMFChannels?
    2. Can I pass user-certificate instead of password in a login call and still authenticate the channelset?
    3. I have to use the channelsets , so is there way to bypass username , Password based authentication?
    Thanks,

    Hi,
    I have hit a big road block and so decided to reach for some help and information.
    I figured out later that blazeds forum can be the best place to get some channelset authentication questions answered
    I am using blazeds & Spring security on the server. As of now my application using channelset.login(username,password) to authenticate the user.
    A new requirement has been introduced to authenticate the user using  user-certificates derived from a smart card.
    I can use spring-security filters to pass the certificate to the server and the validate it. But I have open questions about channelset authentication.
    1. Is it required to call the channelset.login method inorder to use AMF Channels & StreamingAMFChannels?
    2. Can I pass user-certificate instead of password in a login call and still authenticate the channelset?
    3. I have to use the channelsets , so is there way to bypass username , Password based authentication?
    Thanks,

  • How to get the correct client certificate used in the two way ssl

    how to export the certificate in browser to the correct client certificate format needed by the WLSSSLAdaptor?
    I can export the certificate in browser to p12 or pfx format, but how to retrieve the private key from it and convert to PKCS#8?
    anyone did this before?
    Thanks

    Hi,
    Use the event after_user_command.When the user clicks any other buttons in the toolbar,this event will be triggered after the processing and you can handle the sub-total for % columns here.
    Regards,
    Archna Raja

  • Certificate does not contain the correct site name

    Hello,
    I have to make a midlet that connect to a tomcat 5.5.9 server with ssl.
    I import the certificate whit tomcat alias in the wireless toolkit but when i run the midlet this error appear: Certificate does not contain the correct site name
    import java.io.*;
    import javax.microedition.midlet.*;
    import javax.microedition.io.*;
    import javax.microedition.lcdui.*;
    public class HelloNet extends MIDlet implements CommandListener , Runnable{
    // User interface command to exit the current
    // application.
    private Command exitCommand = new Command("Exit",
    Command.EXIT, 2);
    // User interface command to issue an HTTP GET
    // request.
    private Command getCommand = new Command("Get",
    Command.SCREEN, 1);
    /// The current display object.
    private Display display;
    // The url to GET from the 'net.
    private String url;
    * Initialize the MIDlet with a handle to the
    * current display.
    public HelloNet() {
    url = "https://127.0.0.1:8443/Hello.txt";
         display = Display.getDisplay(this);
    * This lifecycle method should return immediately
    * to keep the dispatcher
    * from hanging.
    public void startApp() {
         showPrompt();
    * Display the main screen.
    void showPrompt() {
    String s = "Press Get to fetch " + url;
    TextBox t = new TextBox("Http Result", s,
    s.length(), 0);
    t.addCommand(exitCommand);
    t.addCommand(getCommand);
    t.setCommandListener(this);
         display.setCurrent(t);
    * pauseApp signals the thread to stop by clearing
    * the thread field.
    * If stopped incorrectly, it will be restarted from
    * scratch later.
    public void pauseApp() {
    * destroyApp must cleanup everything. The thread
    * is signaled
    * to stop and no result is produced.
    * @param unconditional is a flag to indicate that
    * forced shutdown
    * is requested
    public void destroyApp(boolean unconditional) {
    * commandAction responds to commands
    * @param c command to perform
    * @param s Screen displayable object
    public void commandAction(Command c, Displayable s) {
         if (c == exitCommand) {
         destroyApp(false);
         notifyDestroyed();
         } else if (c == getCommand) {
              Thread th= new Thread (this);
              th.start();
    * Read the content of the page.
    public void run() {
    TextBox t = null;
    StringBuffer b = new StringBuffer();
    HttpsConnection c = null;
    InputStream is = null;
         try {
         int len = 0;
         int ch = 0;
         System.out.println("Cerco di leggere");
    c = (HttpsConnection)Connector.open(url);
    c.setRequestMethod(HttpsConnection.GET);
         is = c.openInputStream();
    // length of content to be read.
    len = (int) c.getLength();
    if (len != -1) {
    // Read exactly Content-Length bytes
    for(int i=0; i<len; i++) {
    if((ch = is.read()) != -1) {
    b.append((char) ch);
    } else {
    // Read until connection is closed.
    while((ch = is.read()) != -1) {
    len = is.available();
    b.append((char) ch);
    t = new TextBox("Https Result", b.toString(),
    b.length(), 0);
         } catch (Exception e) {
    e.printStackTrace();
    String s = e.toString();
    if(s != null) {
    t = new TextBox("Https Error", s, s.length(),
    0);
    } finally {
    if (is != null) {
         try {
              is.close();
         } catch (Exception ce) { }
    if (c != null) {
         try {
              c.close();
         } catch (Exception ce) { }
    display.setCurrent(t);
    }

    re: code tags, please see http://forum.java.sun.com/help.jspa?sec=formatting.
    As for the rest:
    See, we now know that you used keytool to generate you certificate. You need a new certificate. This time, when keytool asks you for a first and last name, type 127.0.0.1.

  • How to filter certificate templates in Certificate Authority snap-in with the correct values

    How to filter certificate templates in Certificate Authority snap-in with the correct values
    I have a 2012 R2 server running Microsoft Certificate Authority snap-in.
    I want to do a filter on a specific Certificate Template which i know exists in the 'Issued Certificates' folder.
    All the documentation i can find seems to suggest i copy the certificate name and use this in the View Filter.
    1). I add the 'Certificate Template' option into the Field drop-down.
    2). I leave the Operation as the '=' symbol
    3). I paste in just the name of the template in question. for example: 'my computers'
    The search results always come back blank 'There are no items to show in this view.' even when i know there are many instances of this template. I've tried on a win 2008 server and same issue.
    Is there a correct value to enter for the Certificate Template name?
    Can this be done easier using certutil commands?
    When i run the certutil tool i can confirm i have several issued templates. Certutil -catemplates -v > c:\mytemplate_log.csv
    Anybody know what i'm doing wrong?
    I seem to be getting nowhere with this one.

    > But its important you are using the template name, not the display name
    this is incorrect. OIDs are mapped to *display name*, not common name (it is true for all templates except Machine template). That is, in order to translate template name to a corresponding OID, you need to use certificate template's display name. And, IIRC,
    template name in the filter can be used only for V1 templates. For V2 and higher, OID must be used.
    My weblog: en-us.sysadmins.lv
    PowerShell PKI Module: pspki.codeplex.com
    PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
    Check out new: SSL Certificate Verifier
    Check out new:
    PowerShell FCIV tool.

  • Air iOS - To use TestFlight Beta Testing, build 1.0.0 must contain the correct beta entitlement.

    Hi,
    I published my iOS app and uploaded it to iTunes Connect to run an external beta test through Apple TestFlight but I got this error:
    To use TestFlight Beta Testing, build 1.0.0 must contain the correct beta entitlement.
    I created my certificate 3 days ago and it contains the beta entitlement.
    I published the iOS app with the latest Flash CC 2014 version on a Mac with Air 15.
    How to fix that error?
    Thanks

    I'm using flasProfesionnalcc 2014, using Air SDK 16... I have the same problem. 
    >In summary... I am using Air SDK 16.0 and added the following to my app xml file:
    <Entitlements>
    <![CDATA[ <key>get-task-allow</key>
    <false/>
    <key>beta-reports-active</key>
    <true/> ]]>
    </Entitlements>
    But when I try to insert the <Entilements> code into de xml file   I receive a error when a try to complile:
    Error application.Entilemens is a unexpected element/atribute
    How to fix that error?
    Thanks

  • MacBookpro Receiving pop up warnings: Error: Unable to establish a secure connection to pop.mail....etc. because the correct root certificate is not installed. Help needed please.

    My Entourage is very slow and 2 Error pop ups (above) are showing. Additionaly, a warning about the start up disc being full. I decided to back up to an external HD.When backing up I was surprised to see 9.4GB in the catagory named 'Other'. Ive probably got too much junk stored here (unless it could be imovie files?). If I could see what was in 'Other', and delete what I dont need, this may be the answer to freeing up more space. The next big file I have is under 'Pictures' which is 1.7GB. I have never downloaded any video or Youtube stuff.
    This is my first experience on this forum.

    Apple in their glorious wisdom did not update the root certificates for users of 10.5, only for 10.6 and later.
    You'll need to make some changes, open your Keychain Access in your Applicaitons or Utilitties folder.
    Delete the compromised DigiNotar root certificates, also change the KeyChain Access preferences > Certificates to
    Best Attempt
    Best Attempt
    Require Both
    Because the Certificate Autorities themselves are being attacked, you need the most recent and varied source of valid certificates so your comptuer does the best it can to verify the site your visiting is legitiment.
    Also make sure the time and date on your computer is accurate and updated with Apple's time severs, allow any such time requests out your outgoing firewall (aka LittleSnitch)
    You might decide to upgrade to 10.6, it's the best OS version for users of Intel Mac's, strips out the PowerPC code your not using and improved video drivers for better graphics performance. It should run most of your 10.5 software with just minor updates at most.
    Please backup your data off the machine (not TimeMachine) before doing anything as you might need to wipe the drive if the upgrade doesn't go correctly.
    http://store.apple.com/us/product/MC573Z/A
    However OS X Lion 10.7 is a radical change, won't run your older software or drivers and likely be slow on most older hardware. I'd advise against installing it, buy it with a new machine instead.

  • Transport certificate does not have the correct issuer or is expired

    Hi all,
    I hope this is not a duplicate question.
    We are assisting a partner company set up the Flash Access ecosystem.  They have asked us to help packaged some content for them using certificates issued to them.  I've been trying to package content that works fine when using our certificates but I keep getting this error : Transport certificate does not have the correct issuer or is expire when I try to package with their certificates.
    The certificate has not expired.  That was the first thing I checked.
    Has anyone run into this error?  I am using the reference implementation for packaging if that helps.
    Thanks.
    Pedro.

    Hi Katherine,
    Thanks for responding. 
    Indeed I do have the adobe-flashaccess-certs.jar in my path.  I was able to package with a certificate issued to our own company.  Our Certificates were Trial Certificates.  The ones I am having problems with are test PKI certificates that our partner sent to us so that we can help them out. 
    Please let me know if you need any more info.  I am definitely down with helping someone trying to help me!
    Thanks.
    Pedro.

  • I used the wrong password for my belkin wifi. Now that I know the correct password I can not get pass the unable to connect or join message. I have turned off all the options such as wifi and join and also put my touch to sleep.. but nothing seems to work

    I used the wrong password to join my new belkin wifi. Now that I have the correct password, I can not get the to the join screen with the space to type in the password. I continue to get the unable to join message.  I have put the touch to sleep and I have turned on and off the wifi and join options on the Network screen page.  Does anyone know how to get pass this block of the wrong password to a new page that will allow me to type in the correct password.  I see there is a option that asks if I want to reset the network settings.. is that what I should do? and what does it erase when I do that?  Thanks for any input anyone has.

    Yes.  Reset network settings. Head to Settings -> General -> Reset and tap Reset Network Settings.
    B-rock

  • I changed a password to a frequesntly used site. Firefox has not asked me if I want to save this new password and I have to keep changing the saved one to the correct one. How do I get it to save the new password?

    I have websites I use for my employer that require a password. The employer requires these be changed periodically. Always before, if I changed the password, about the second or third time I tried to log in and changed the saved password to the correct one, Firefox would ask if I wanted to save the new password. It is not doing this now. How can I get it to save a new password? It keeps putting in the old one.

    Make sure that you do not run Firefox in permanent Private Browsing mode.
    *https://support.mozilla.com/kb/Private+Browsing
    *You enter Private Browsing mode if you select: Tools > Options > Privacy > History: Firefox will: "Never Remember History"
    *To see all History and Cookie settings, choose: Tools > Options > Privacy, choose the setting <b>Firefox will: Use custom settings for history</b>
    * Deselect: [ ] "Permanent Private Browsing mode"
    The website may be using autocomplete=off to prevent Firefox from saving the name and password.
    *http://kb.mozillazine.org/User_name_and_password_not_remembered

  • I can't activate my iPad and I'm sure i am using the correct apple id and password but when i press net it says it cannot be used to unlock this iPad

    i can't activate my iPad and I'm sure i am using the correct apple id and password but when i press net it says it cannot be used to unlock this

    You can try to figure out which Apple ID/email address and/or password you used to activate it by going to http://iforgot.apple.com
    If you can't, you'll need to contact Apple Account Security with your proof of purchase. 

  • I am using an Mac PPC version 10.5.8 and I am trying to download the correct version of Flash Player.  I did once but I had to install a "Clean Install" of my computer and when finished I had put back the new Flash Player I just installed well every time

    I am using an Mac PPC version 10.5.8 and I am trying to download the correct version of Flash Player.  I did once but I had to install a "Clean Install" of my computer and when finished I had put back the new Flash Player I just installed well every time I try install the new player it is place in my Trash Folder and I can not get Player to work.  I did everything I was to install it correctly but it still does not install it correctly.  Can some help me.  Bob

    Some MacBook Pro versions cannot be upgraded past 10.6.8; others are maxed out at 10.7.5. newer models can go all the way to 10.10. So it is important to know exactly what version you have--there may be close to 40 variants produced since the MB made its debut in 2006.
    You can safely give us a snapshot of your model and its current config that will allow us to deternmmine your model and its upgrade potential, plus show it you have any software that may impede any upgrades. Please download and install this free utility:
    http://www.etresoft.com/etrecheck
    It is secure and written by one of our most valued members to allow users to show details of their computer's configuration in Apple Support Communities without revealing any sensitive personal data.
    Run the program and click the "Copy report to clipboard" button when it displays the results. Then return here and paste the report into a response to your initial post. It can often show if any harmful files/programs are dragging down your performance.
    Remember that, on leaving OS10.6.8, you lose the ability to run older softare written for older PowerPC Macs (yours in Intel-based). Programs such as Office 2004 will no longer work (min of Office 2008 needed to work on newer OS versions), and AppleWorks will stop working completely

  • When I try to purchase an app using my iphone it asks me for a password for the wrong email address. How do I reset my iphone to show the correct email address/apple ID

    when I try to purchase an app using my iphone it asks me for a password for the wrong email address. How do I reset my iphone to show the correct email address/apple ID

    Thanks for your reply. Having read through relevant topics it suggests that if I sync my iphone with the correct account on my pc it should use that one thereafter. i will try both.

Maybe you are looking for