Tomcat standalone & instant ssl-certificate

hi folks
i have a tomact-standalone server. last year as i installed the whole thing everything worked fine
as i followd the instructions on this site.
http://www.comu.de/docs/tomcat_ssl.htm
Now i have to replace the certificate and i followed the instructions on this site.
http://www.instantssl.com/ssl-certificate-support/cert_installation/ssl-certificate-java.html?currency=EUR&region=Europe&country=DE
allthoug tomcat starts mozilla gives the following exception.
Mozilla and mydomain.de cannot communicate because they have no common
encryption algorithms.
Has anybody got tomcat standalon run with an instantssl certificate and has some detailled instructions.
regards
gencaslan

could it be possible that the certificat was generated wrongly? without a certification path?

Similar Messages

Web server type of standalone oc4j needed for SSL Certificate

Hi,
We have a standalone oc4j 10.1.3 that hosts an application whose many of its pages use https and so we need to buy SSL certificate from any of CAs like Verisign, GeoTrust, etc.. All of these CAs are asking us about the web server type that the standalone OC4J uses. I read the following statement from this url:
http://download.oracle.com/docs/cd/B32110_01/web.1013/b28950/intro.htm#JICON100
"communications in a standalone environment is provided through the built-in *_OC4J Web server_*, which supports HTTP and HTTPS communications natively without the use of the Oracle HTTP Server"
On all of the SSL certificate systems of above CAs websites, they ask us to choose the web server type from a list of server types but I don't see OC4J web server listed and I am told that it is very important to make sure the web server type is correct otherwise the SSL Certificate that we buy may not be compatible with our web server type.
So, I like to know the exact built in web server type name that goes with Standalone OC4J or one that is closest and for which SSL Certificate is compatible.
Shown below is a list of web server types that I am asked to choose from on Verisign website.The closest to standalone oc4j according to below list is Oracle Wallet Manager but isn't this meant for Oracle Application Server (OAS) and not the standalone OC4J? we are using the java keytool to generate the CSR that we look to sign it via the verisign but again we are not sure about the web server type in the case of standalone OC4J that is not listed below. Please advice and thanks in advance to any of your responses in helping out.
Webstar 4.x
ApacheSSL mod_ssl
WebLogic 6.0
WebLogic 8.1
Cisco
ACS 3.2
Covalent
Apache ERS 2.4
Apache ERS 3.0
F5
BIG-IP
IBM
Websphere MQ
HTTP Server
Lotus
Domino 5.0
Domino 6.0
Domino 7.0
Domino 8.0
Windows NT - IIS 4.0
Windows 2000 - IIS 5.0
Windows 2003 - IIS 6.0
Windows 2008 - IIS 7.0
Exchange 2007
iPlanet 4.x
iPlanet 6.x
ScreenOS
SSL Accelerator
Oracle Wallet Manager_
Secure Web Server
SSL Offloaders
Stronghold
Java Web Server 6.x
Sun ONE
AS Server w/IIS 4
AS Server w/IIS 5
EA Server
Tomcat
Zeus

Hi Zeus,
Type of certificate depends the method you will use to deploy the certificate on your application server.
Please refer the links,
http://download.oracle.com/docs/cd/B31017_01/web.1013/b28957/configssl.htm
http://download.oracle.com/docs/cd/B14099_19/core.1012/b13995/wallets.htm#ASADM400
http://download.oracle.com/docs/cd/B14099_19/web.1012/b14013/configssl.htm
Regards,
mYth

Configuring SSL certificates on ALBPM Studio

Hi,
I am invoking a web service which is deployed on a web logic server which is a secure server and needs SSL certificates to communicate. I have the certificates but don’t know how to configure it to my ALBPM Studio.
Can I configure those to studio or do I need to deploy my code on the Enterprise edition installed on application server having these SSL certificates? But in that case I would land up investing so much time in deploying the code on server after even a small change. Since I don’t have those certificates configured to my studio it is not allowing me to catalog the service in my project and throwing Introspection error. The details of the error are mentioned below:
+[Error] Web Service WSDL parse exception: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target..+
+[Error] Instrospection exception: Web Service WSDL parse exception: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target...+
Can anyone throw any pointers on this type of error
Thanks,
Akshay

In order to communicate with SSL secured webservices (those with WSDL end point starting as https:// you need to have certificates from these servers.
For BPM Standalone these are the steps
1. Download the .cer file from server. (One way is you can use IE browser to get that file and export it from browser to a local directory)
2. Put this file in %JAVA_HOME%\jre\lib\security. You can put it anywhere you want.
3. Run the following command at a command prompt:
C:\Program Files\Java\jre1.6.0_02\bin>keytool -import -trustcacerts -alias <CERT ALIAS NAME> -keystore ..\lib\security\cacerts -file ..\lib\security\gd_<cert file name>.cer
4. You will be prompted for a password. If you have not changed the password, it will be "changeit".
5. You will then get the following message if all is successful - "Certificate was added to keystore".
6. Restart Tomcat (inbuilt server in BPM Studio).
This should solve your problem.
Pls note that if you have not configured your keyStore then first do so. you will find this document handy to do so.
http://tomcat.apache.org/tomcat-5.5-doc/ssl-howto.html#Edit%20the%20Tomcat%20Configuration%20File
Arvind
Visit my blog at http://soa-bam-bi.blogspot.com/ for more tips on BPM & SOA

Is there a way to change the CSR for install SSL Certificate for CCMADMIN

HI there,
Our customer want a solution for the https failure on CCMAdmin and CCMUser sites.
For that, I have exported a csr to buy a ssl certificate from verisign.
The problem is the csr includes fqdn an not just the servername
But the users just have to type in the servername to reach the server.
Is there a way to export a csr which include as common name only the server name without changing the domain settings in the cucm?
thanks
Marco

Hi
You can go to the server via SSH, and enter the 'set web-security' command with the alternate-host-name parameter:
Command Syntax
set web-security orgunit orgname locality state country alternate-host-name
Parameters
• orgunit represents the organizational unit.
• orgname represents the organizational name.
• locality represents the organization location.
• state represents the organization state.
• country represents the organization country.
• alternate-host-name (optional) specifies an alternate name for the host when you generate a
web-server (Tomcat) certificate.
Note When you set an alternate-host-name parameter with the set web-security command,
self-signed certificates for tomcat will contain the Subject Alternate Name extension with
the alternate-host-name specified. CSR for Cisco Unified Communications Manager will
contain Subject Alternate Name Extension with the alternate host name included in the CSR.
Typically you would still use an FQDN, but a less specific one (e.g. ccm.company.com)...
Regards
Aaron
Please rate helpful posts...

How Do You Generate a 2048bit CSR for a Third Party SSL Certificate for LMS 4.0.1?

Our site requires Third Party SSL certificates to be installed on our servers. We have an agreement with inCommon. I have to supply a CSR in order to obtain the SSL certificate.
My installation is on a Windows 2008 server and I had the self-signed CSR already but it is only 1024 bits. Is there someplace in the GUI or OS where I can change the encryption?

This is a shot in the dark, but since CiscoWorks is using (I believe) Tomcat as the web server, could you run keytool to generate the CSR?
http://help.godaddy.com/article/5276
You could also use an online CSR gererator such as:
http://www.gogetssl.com/eng/support/online_csr_generator/
The key (pun intended) is having the private key on your server so that when you get the signed certificate and install it (using sslutil) it will be usable.
Hope this helps.

Prob in config tomcat to use SSL

Hello,
I have configured tomcat to use SSL exactly defined in how-to doc of apache tomcat.
but when i give URL https://localhost:8443 its simple says page cannot b displayed....and when clientAuth is set to true...
In case if i set clientAuth as false then it says There is problem with website security certificate...
Below is the connector tag tht i have..
<Connector className="org.apache.coyote.tomcat4.CoyoteConnector"
port="8443" minProcessors="5" maxProcessors="75"
enableLookups="true"
acceptCount="100" debug="0" scheme="https" secure="true"
useURIValidationHack="false" disableUploadTimeout="true">
<Factory className="org.apache.coyote.tomcat4.CoyoteServerSocketFactory"
clientAuth="true" protocol="TLS" />
</Connector>
Can any1 plzzzz help me????
Thanks in Advance.

Where is your keystore specification?
What is the output of logs/catalina.out and .err?
In this doc :
http://tomcat.apache.org/tomcat-5.5-doc/ssl-howto.html
There is the very important sentence :
"There are addional option used to configure the SSL protocol. You may need to add or change the following attribute values, depending on how you configured your keystore earlier:"

SQL Server SSL Certificate

Hi All,
I am slowly getting to the bottom of applying SSL throughout my project but am stuck in the current situation and I need help please..
Project is a Java servlet running on Windows. Java 1.6 and Tomcat 7 but connects to a SQL Server database and an Oracle database (running on unix). We have a keystore set up successfully on the servlets' server with root, intermediate certificates etc
that successfully encrypts the connection to Oracle. The server team maintaining the server hosting the SQL Server database have supplied me with an SSL certificate, I am told is for accessing the SQL Server database. I am assuming it is a public key certificate.
I am trying to apply this certificate to encrypt the network traffic to the SQL Server database. I have attempted to import the certificate into the keystore mentioned above using the Java keytool but this does not work so I deleted the certificate from
the keystore again. I found the URL below which I have followed to install the certificate through MMC but cannot find how to now force Tomcat to encrypt the network traffic.
http://support.microsoft.com/kb/316898
Can someone please tell me what I am missing here please? There is loads of guidance on setting up keystores with root and intermediate certificates etc, but I cannot find any guidance on what to do in Tomcat to use a single provided SSL certificate. Do
I use the Java cacerts file and import the certificate in there?
Thanks in advance
Regards
AJF

Hi SQL Team - MSFT
Thank you for your response.
I have been looking at this further. I have only been given one SSL certificate which I am assuming because it has a file format of ".cer" it is the public key for the certificate on the server hosting the SQL server database. For this to work
they way we want, the "clients" will not have SQL Server Configuration Manager installed, but instead will have the SSL certificate mention above stored in a Keystore set up with the "Keytool" in the Java JRE.
I am unsure how the guys who manage the server hosting the SQL server database have set up the SSL certificate, i.e. if they have set up a root and intermediate certificate etc. I am currently trying to get information out of them (They are not
located immdiately near my location). I have a funny feeling they have not set up the SSL at their end correctly, and I am wondering if they have just imported into the servers browser, the same public key certificate they forwarded to me. When
you say "you have to first export the Trusted Root Certificate Authority from the server and import this to the client", what part of the SSL certificate(s) do you mean?
Do you mean the Certificate Authority root certificate and I have to import that into the client as well as the public key certificate?
I look forward to you next feedback.
Regards
Alanjo

Problem in installation of free SSL certificate on Weblogic using keytool

We tried to install SSL certificate on weblogic certificate using Keystore ..but it is giving error in console at startup and server shutdowns automatically...
Steps followed:-
1) To generate keystore and private key and digital cerficate:-
keytool -genkey -alias mykey2 -keyalg RSA -keystore webconkeystore.jks -storepass webconkeystorepassword
2) To generate CSR
keytool -certreq -alias mykey2 -file webconcsr1.csr -keyalg RSA -storetype jks -keystore webconkeystore.jks -storepass webconkeystorepassword
3) CSR is uploaded on verisign site to generate free ssl certificate.All certificate text received is paste into file (cacert.pem)
4) Same certificate is put into same keystore using following command
keytool -import -alias mykey2 -keystore webconkeystore.jks -trustcacerts -file cacert.pem
5) Before step 4), we have also installed root /intermediate certificate to include chain using following command.
(intermediateCa.cer file is downloaded from verisign site)
keytool -import -alias intermediateca -keystore webconkeystore.jks -trustcacerts -file intermediateCa.cer
6) After this configuration we used weblogic admin module to configure Keystore and SSL.
7) For KeyStore tab in weblogic admin module, we have select option Custom Identity And Custom Trust provided following details under Identity and Trust columns:-
Private key alias: mykey2
PassKeyphrase: webconkeystorepassword
Location of keystore: location of webconkeystore.jks file on server
8) For SSL tab in weblogic admin module, we have select option KeyStores for Identity and Trust locations.
Error on console:
<Nov 3, 2009 3:00:17 PM IST> <Emergency> <Security> <BEA-090034> <Not listening for SSL, java.io.IOException: Failed to retrieve identity key/certificate from keystore /home/cedera/bea9.0/weblogic90/server/lib/webconkeystore.jks under alias mykey2 on server AdminServer.>
<Nov 3, 2009 3:00:17 PM IST> <Emergency> <Security> <BEA-090087> <Server failed to bind to the configured Admin port. The port may already be used by another process.>
<Nov 3, 2009 3:00:17 PM IST> <Critical> <WebLogicServer> <BEA-000362> <Server failed. Reason: Server failed to bind to any usable port. See preceeding log message for details.>
<Nov 3, 2009 3:00:17 PM IST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FAILED>
<Nov 3, 2009 3:00:17 PM IST> <Error> <WebLogicServer> <BEA-000383> <A critical service failed. The server will shut itself down>
<Nov 3, 2009 3:00:17 PM IST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FORCE_SHUTTING_DOWN>
If anyone knows the solution ,please help us out.Thanx in advance.
I was really happy to get reply yesterday from "mv".I was not expecting such instant response.

Thanx all guys for your interest and support.
I have solved this issue.
We have weblogic 9 on unix env.
Following steps which I followed:
#generate private key
keytool -genkey -v -alias uinbrdcsap01_apac_nsroot_net -keyalg RSA -keysize 1024 -dname "CN=linuxbox042, OU=ASIA, O=Citigroup, L=CALC, S=MH, C=IN" -validity 1068 -keypass "webconkeystorepassword" -keystore "cwebconkeystore"
#generate csr
keytool -certreq -v -alias uinbrdcsap01_apac_nsroot_net -file linuxbox042.csr -keypass "webconkeystorepassword" -keystore "cwebconkeystore" -storepass webconkeystorepassword
Then we uploaded this csr on verisigns free ssl certificate to generate and receive certificate text.
We copied that text file in "ert4nov2009.crt" rt file used below.
Apart from that , mail which we received from verisign also contains links to download root ca certificate and intermediate ca certificate.We downloaded them.
roo ca in "root4nov2009.cer" file.
intermediate ca in "intermediateca4nov2009.cer"
both these files used in
#import root certificate
keytool -import -alias rootca -keystore "cwebconkeystore" -storepass "webconkeystorepassword" -trustcacerts -file "root4nov2009.cer"
#import intermediate ca certificate
keytool -import -alias intermediateca -keystore "cwebconkeystore" -storepass "webconkeystorepassword" -trustcacerts -file "intermediateca4nov2009.cer"
#install free ssl certifiate
keytool -import -alias uinbrdcsap01_apac_nsroot_net -file "cert4nov2009.crt" -trustcacerts -keypass "webconkeystorepassword" -keystore "cwebconkeystore" -storepass "webconkeystorepassword"
#after this admin configuration
In weblogic admin console module, we did following settings:-
1. under Configuration tab
a. Under KeyStore tab
For keystore , we selected "Custom identity and Custom Trust"
Under Identity,
Custom Identity Keystore:location of keystore "webconkeystore" on weblogic server
Custom Identity Keystore Type: JKS
Custom Identity Keystore Passphrase:password for keystore mentioend above.In our case, webconkeystorepassword
Same we copied Under "Trust", as we have not created separate keystore for trust.
Save setting.
b. Under SSL tab
Identity and Trust Locations: select "Keystores"
Private Key Alias: alias used while creating private keyi.e. in our case "uinbrdcsap01_apac_nsroot_net"
Save setting.
c. Under General tab
Check checkbox "SSL Listen Port Enabled"
and mention ssl port "SSL Listen Port"
Save setting.
After this activate changes.You might see error on admin module.
Using command prompt, stop the server and again restart and then try to access using https and port ...
you will definately get output...
in our case issue might be due to key size..we used 1024 key size ..it solve problem.
for your further reference plz find link below..it is also helpful.
http://download.oracle.com/docs/cd/E13222_01/wls/docs81/plugins/nsapi.html#112674

SSL Certificate on Oracle EPM 11.1.1.3

Hi All,
I configured ssl for epm products.
the environement is of two server:
application_server with shared services and hfm backend,
web_server with workspace, hfm web and Financial Reporting),
Initially I used a self-signed certificate for sharedservices on application_server (tomcat),
a self-signed certificate for workspace and financial reporting (tomcat)
and a trusted certificate for IIS
I follow the manual instruction and everything gone fine.
Now we decide to use a trusetd certificte for tomcat in Shared Services too.
I created a keystore and a CSR from tomcat,
sent the csr to CA,
recived the signed certificate and imported it in the keystore,
stopped all the services
changed %HYPERION_HOME%\deployments\Tomcat5\SharedServices9\conf\server.xml to point the new keystore.
started all the services
Shared Services works fine,
but in the workspace the 'Application' menù is missing..
I tried to reconfigure HFM (all steps - resuming the db tables) and reconfigure Workspace (all steps - resuming the db tables), but without success.
If I edit again the ..\Tomcat5\SharedServices9\conf\server.xml to point the old keystore,
I can again see the 'Application' menù.
I'm doing something wrong?
thanks
gianluca

Why would you want to know the minimum requirements, surely it would be best to have optimal server specs, the nearest you are going to get is contained in the standard deployment guide - About Standard Deployment
Saying that it is not possibly to provide stats based on nothing, you would really need to undertake a technical design review/workshop as there many topics to cover before coming up with server information.
Cheers
John

What kind of SSL Certificate to use on Profile Manager?

I would like to get my SSL CSR signed to use it with Profile Manager, but on the CA's website it asks me what kind of SSL Certificate I need giving me these options:
<option value=1>AOL</option>
                      <option value=2>Apache-ModSSL</option>
                      <option value=3>Apache-SSL (Ben-SSL, not Stronghold)</option>
                      <option value=4>C2Net Stronghold</option>
                      <option value=33>Cisco 3000 Series VPN Concentrator</option>
                      <option value=34>Citrix</option>
                      <option value=5>Cobalt Raq</option>
                      <option value=6>Covalent Server Software</option>
                      <option value=29>Ensim</option>
                      <option value=32>HSphere</option>
                      <option value=7>IBM HTTP Server</option>
                      <option value=8>IBM Internet Connection Server</option>
                      <option value=9>iPlanet</option>
                      <option value=10>Java Web Server (Javasoft / Sun)</option>
                      <option value=11>Lotus Domino</option>
                      <option value=12>Lotus Domino Go!</option>
                      <option value=13>Microsoft IIS 1.x to 4.x</option>
                      <option value=14>Microsoft IIS 5.x to 6.x</option>
                      <option value=35>Microsoft IIS 7.x and later</option>
                      <option value=15>Netscape Enterprise Server</option>
                      <option value=16>Netscape FastTrack</option>
                      <option value=17>Novell Web Server</option>
                      <option value=18>Oracle</option>
                      <option value=30>Plesk</option>
                      <option value=19>Quid Pro Quo</option>
                      <option value=20>R3 SSL Server</option>
                      <option value=21>Raven SSL</option>
                      <option value=22>RedHat Linux</option>
                      <option value=23>SAP Web Application Server</option>
                      <option value=24>Tomcat</option>
                      <option value=25>Website Professional</option>
                      <option value=26>WebStar 4.x and later</option>
                      <option value=27>WebTen (from Tenon)</option>
                      <option value=31>WHM/CPanel</option>
                      <option value=28>Zeus Web Server</option>
                      <option value=-1>OTHER</option>
which one should I use?

If the Certificate is already on your Mac, you can examine it in the "Keychain Access" application. What they are asking you is who issued the Certificate. If you do not see the Issuer listed, try "Other".

Install SSL certificate for Oracle HTTP server

I received a PFX file that contains an SSL wildcard certificate for our company *.xyz.com.
I used this tool "xca" to extract two files: "server.crt" and "serverkey.pem".
I want to install this on the oracle 11g HTTP server (OHS) installed as standalone based on apache 2.2
With oracle, i have to create a wallet and point the SSL.CONF wallet directive to use that wallet.
I used Oracle Wallet Manager to create it and import the certificate but this is where i am having a problems.
First I could not restart the web server but the it worked but I got SSL handshake errors (Shown below).
According to oracle steps, I have to create a CSR and then import the certificate into the wallet
http://www.apache.com/resources/how-to-setup-an-ssl-certificate-on-apache/
However, when I tried to use Oracle Wallet Manager, there were two options: import server certificate and trusted certificate.
The import server certificate was greyed out. I had to create a CSR just to get it enabled but I did not use the CSR, i just imported the "server.crt" file.
I also tried to import the "serverkey.pem" into the trused certificate option but was rejected (invalid certificate).
Do you know how to create a successful wallet based on the files i have and not creating a CSR since i already have a certificate file?
2013-05-04T20:11:40.2718-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1253263680] [user: root] [VirtualHost: ptp.xyz.xom:443] nzos handshake error, nzos_Handshake returned 29040(server ptp.xyz.xom:443, client 10.60.117.121)
[2013-05-04T20:11:40.2719-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1253263680] [user: root] [VirtualHost: ptp.xyz.xom:443] NZ Library Error: Unknown error
[2013-05-04T20:11:40.4774-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1263753536] [user: root] [VirtualHost: ptp.xyz.xom:443] unusably short session_id provided (0 bytes)
[2013-05-04T20:11:40.4776-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1263753536] [user: root] [VirtualHost: ptp.xyz.xom:443] nzos handshake error, nzos_Handshake returned 29040(server ptp.xyz.xom:443, client 10.60.117.121)
[2013-05-04T20:11:40.4776-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1263753536] [user: root] [VirtualHost: ptp.xyz.xom:443] NZ Library Error: Unknown error
[2013-05-04T20:11:40.6814-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1274243392] [user: root] [VirtualHost: ptp.xyz.xom:443] unusably short session_id provided (0 bytes)
[2013-05-04T20:11:40.6816-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1274243392] [user: root] [VirtualHost: ptp.xyz.xom:443] nzos handshake error, nzos_Handshake returned 29040(server ptp.xyz.xom:443, client 10.60.117.121)
[2013-05-04T20:11:40.6816-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1274243392] [user: root] [VirtualHost: ptp.xyz.xom:443] NZ Library Error: Unknown error

I do not have weblogic installed. I only have standalone 11g HTTP server with mod_plsql.
If i can get OWM working to create a successful certificate them the problem would be resolved.
I am just not sure what is Root Certificate and Trustworthy Certificate and how to get that from the files i have.

Any adverse effect of an expired SSL certificate

I wanted to understand if there are any adverse effects if the SSL certificate has expired. Going logically, the communication channel between server and client browser would not be secure. I would give an example to this, if the site is say https://www.xyz.com
1) Would the site be accessible if the SSL certificate has expired, I guess yes?
2) Any other adverse effects?
I hope, I have been able to explain the question clearly.
Requesting a reply to my query.
Regards

Thanks for your update. It is connecting using https. The SSL certificate is not generated at OS (RHEL) level but is done most probably at Tomcat server level which I am trying to check from the developers.
Regards

Renew Verisign ssl certificate for webaccess

Hi, We have just had our current Verisign ssl certificate expire.
We are running Groupwise 7.03 - on our cluster agents and postoffices & gwia.
The webaccess application is running on a Netware 6.5 sp5 - which is running Apache ver 2.0.54 & Tomcat 4 and also has tomcat5 in the DMZ.
I have come across a number of support Tids about renewing ssl into edir, but i am looking for some steps to run through regarding WEBACCESS.
My web app team have just bought a new verisign ssl certicate.
What do i do from here to renew the webaccess application with the new Verisign ssl certificate.
Anything that can help with this regarding webaccess and verisign ssl renew certifcaite instruction steps would be helpful.
regards
Dennis

Dennis,
> My web app team have just bought a new verisign ssl certicate.
> What do i do from here to renew the webaccess application with the new
> Verisign ssl certificate.
>
> Anything that can help with this regarding webaccess and verisign ssl
> renew certifcaite instruction steps would be helpful.
If you still need to do this, drop me an email at hamish at haitch dot
net and I'll send you a doc I did documenting the process.
H.
Hamish
Run multi-processor NetWare VM's with vmBoost
http://www.haitch.net

Server 2008R2 - SSL Certificate Weak Public Key Strength

Hello -
I'm using a Windows 2008R2 server and am working on locking the system down. We use the BeyondTrust Retina Network Security Scanner, the scanner returns two results that I'm having trouble solving.
The first is finding is:
'SSL Certificate Weak Public Key Strength'
"Retina has detected that the certificate on the target supports a cryptographically weak public key strength. An attacker may be able to leverage weaknesses in the public key strength to gain access to sensitive information."
"Replace the current certificate with one using a high-grade public key strength of 2048 bits of higher"
**Does anyone have any ideas how to find all the certificates loaded on the machine that aren't at 2048 bits or higher, the system is a standalone machine without internet access**
The second finding is:
'SSL Certificate Self-Signed'
"Retina has detected that the certificate on target is self-signed. Self-signed certificates can provide underlying cryptographic functionality, but cannot guarantee the origin of the certificate is trusted."
"Verify the certificate is trusted to ensure the confidentiality and integrity of prior encrypted communications. Replace the current self-signed certificate with one signed by a trusted root certificate authority."
**Anyone have any ideas how to find 'self-signed' certificates? I've tried searching through the certificates store on the local computer, but I can't seem to find a self-issued certificate, but Retina sure found some.**
Any help would be greatly appreciated!!
Thanks,
Ryan

A self signed certificate is a certificate which Subject attribute equals Issuer attribute. You can use below script to find selfsigned certificates which is selfsigned and public key is less than 2048 bits.
Be aware that if you search in all possible certificate stores (including Trusted Root CA store) you will find a lot of self signed certificates. Please see my notes in powershell code.
#Find self-signed certificate which keysize less than 2048. Uncomment one of the lines below
#$myCerts = Get-Item Cert:\CurrentUser\My #search in Current User Store - Personal - this is the place to look in
#$myCerts = Get-Item Cert:\LocalMachine\My #search in Local Machine Store - Personal - this is the place to look in
#$myCerts = Get-Item Cert:\CurrentUser\* #search in Current User Store - this will bring a lot of cert list
#$myCerts = Get-Item Cert:\LocalMachine\* #search in Local Machine Store - this will bring a lot of cert list
$myCerts.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$myCertsList = Get-ChildItem $myCerts.PSPath
$myCertsList | where {$_.Subject -like $_.Issuer -and $_.PublicKey.Key.KeySize -lt 2048} | select * #self-signed and less then 2048
$myCerts.Close()
Did my post help you or make you laugh? Don't forget to click the Helpful vote :) If I answered your question please mark my post as an Answer.

SSL Certificates about to expire

Please forgive what is probably a "newbie" question
The first of my OES2 servers is about to have its SSL certificates expire.
I've done the following:
- issued new certs via iManager
- namconfig -k
- namconfig restart
Here's where I get stuck..... what else do I need to do to ensure that all services are using the new certificates eg Tomcat/Apache/etc - on NetWare I simply used tckeygen and restarted these services!
I've done a google on this topic and don't find to find any single conclusive document (perhaps I need new glasses). I would appreciate it very much if the community could point me in the right direction.
Thanks in advance

Laura,
here's an article on the topic:
http://wiki.novell.com/index.php/Rec...s_on_OES_Linux
Uwe
Novell Knowledge Partner (NKP)
Please don't send me support related e-mail unless I ask you to do so.

Tomcat standalone & instant ssl-certificate

Similar Messages

Maybe you are looking for