Unrecognized update of expired ssl certificate

hi there
i installed open ssl to serve pages through apache using https by following this support page
http://developer.apple.com/internet/serverside/modssl.html
after a successful year, my server certificate expired. my users now get the following error message...
"xxx is a site that uses a security certificate to encrypt data during transmission, but its certificate expired.
you should check to make sure that your computer's time (currently set to xxx) is correct."
i followed the same steps again to renew the certificate, but it still produces the same error message eve after the update. i've even tried deleting any references to the old certificates from the keychain, in case there was some old pointer, but that hasn't seemed to work either.
the situation is causing my users some consternation and is cause for mistrust. how can i get the update to be recognized?

To confirm, I was able to connect to https://rumi.smarthome.cs.cmu.edu/ and saw the valid certificate.
I'm not an expert on SSL by any means, but I do believe your certificate should match the host name of the server. And as for virtual hosts, see Apache's documentation on using SSL:
http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#vhosts
Summary: you cannot use name-based virtual hosting to host multiple SSL sites on one server. You can use different IP addresses or different ports.
Matt

Similar Messages

Expired SSL certificate errors in browser after installing a new Certificat

I recently install a new SSL certificate from Thawte following the same process as the last time in installed. The install seemed to work for a couple days and then i stared getting calls reporting an expired SSL Certificate. I verified that the proper cert was still installed and it was. what actually got the ball rolling again was disabling the listener associated with my secure site and re enabled it. that workd for 2 days and now the website is reporting an expired SSL cert. any clue what is going on?

Here is the output but i noticed that there are three of the same key(sitecert)
wadm> certutil -L -d .
sitecert                                                     u,u,u
sitecert                                                     u,u,u
Thawte SGC CA - VeriSign, Inc.                               CT,,
sitecert                                                     u,u,ui guess now the question is how to get ride of the 2 offending certs in the database.

Any adverse effect of an expired SSL certificate

I wanted to understand if there are any adverse effects if the SSL certificate has expired. Going logically, the communication channel between server and client browser would not be secure. I would give an example to this, if the site is say https://www.xyz.com
1) Would the site be accessible if the SSL certificate has expired, I guess yes?
2) Any other adverse effects?
I hope, I have been able to explain the question clearly.
Requesting a reply to my query.
Regards

Thanks for your update. It is connecting using https. The SSL certificate is not generated at OS (RHEL) level but is done most probably at Tomcat server level which I am trying to check from the developers.
Regards

UNIFIED MANAGER ALERT : on EXPIRING SSL certificates in clustered Data ONTAP systems

The default ssl certificates on clustered Data ONTAP systems are valid for 1 year.
Since we have cDOT clusters monitored via Oncommand Unified Manager 6.2, we would like Unified Manager to alert on expiring Certificates.
Is this possible in OCUM 6.2?
Thanks

Thanks Saravanan, Initially i had it on RHEL 6.6, and i see some of the existing packages were of a older version and created some issues while rrdtool and sql installation. but i managed to do the installation and faced the same issue. I Didnt know that this is a user account issue not a package dependency issue.and thats the reason i got my server upgraded to RHEL 7.1 and the installation went fine but the same issue. But its working for now, thanks again :-)

Expired SSL Certificate

hi,
I have imported an expired certificate into XI using STRUST for a site https://test.com
When i try to test the connection to the above site, throws up an error ICM_HTTP_SSL_ERROR.
I could see the trace file in SMICM and it explains the error saying that certificate error.
I don't think XI would send any messages to the external system if the certificate has expired? Am i right?
Is there any other option to send messages through HTTPS?
Thanks,
Tirumal

>>I don't think XI would send any messages to the external system if the certificate has expired? Am i right?
yes.
>>Is there any other option to send messages through HTTPS?
for this i need some more information like , What is your Scenario? what is the adapter you configured in the receiver side?..
regards,
Jeyakumar

What's the process to replace an SSL certificate

I have to replace an expiring SSL certificate in this server and can't recall the procedure. I have the new cert, and intermediate CA, but can't remember what utilities to use to replace the old with the new.

The image replace works perfectly with a masked image intact, only if the two images dimensions are the same.
However, doing the following gets you 95% of the way with just a final tweak of the mask:
select the image on the slide
Format > Copy Animation
then replace image
Format > Paste Animation
Format > Image > Edit Mask

How to ignore SSL certificate warning only for a specific internal subnet?

I understand my issue may be a little unique, but I am sure some people have come across it. I am working with some test gears that have either self-signed certificates or flat out invalid/expired SSL certificates. Since this is a lab/test environment I don't want to have to go through the trouble of generating my own certificates and load them on each test device, since they come and go quite a bit.
Is there a way to tell Firefox to ignore SSL warning, but only for a given subnet? For example, if the SSL certificate is presented by anyone in 10.11.12.0/24, accept it without question, but if it's coming from anywhere else, check its validity.
I doubt this will ever be a main feature for Firefox, but perhaps someone has come across an add-on that does this?

I suggest you to ignore self signed certificates. You should get some low priced SSL certificates to prevent your website from warnings.
I preferred to buy ssl certificates from reseller, as its low pricing.
Some good resellers are:
[http://servertastic.com servertastic.com]
[https://www.sslrenewals.com SSLRenewals.com]
and you can google it for more reseller list.

After updating SSL Certificate, iCal is saying the certificate has expired.

Having a problam with iCal after updating our SSL certificate. The certificate expired recently so we renewed it with godaddy and followed the steps on their site to update it on our server. Everything seemed to have gone fine, under server admin in the certificates section it shows the certificate is valid through 2015 and I have Mail and iCal both set to use that certificate (it is the only one you can select.). E-mail works fine but when you connect with iCal it says there is a problem with the certificate. When I click details it shows the certificate has expired and shows the esperation date of the old certificate. I have tried to delete and import the new certificate again but still have the same issue. It seems that some how iCal is still holding the old certificate. Does anyone know what is going on? Did I make a mistake somewhere?

Hi,
According to your post, I understand that client face an problem “The linked image cannot be displayed. The file may have been moved, renamed, or deleted. Verify that the link points to the correct file and location” after change SSL certificate.
If I misunderstand your concern, please do not hesitate to let me know.
Do you see the "page cannot be displayed" error only from your DC server or also from a Windows 7 client machine? What browser do you use and what version?
Please run “certutil –store” command from a command to verify that the certificate is correctly installed in the certificate store. Also run “certutil -store my” to check the certificate from CA.
If the certificate is already installed, please refer to below link to check the value of Cache in registry:
https://support.microsoft.com/en-us/kb/2753594
Thanks
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Allen Wang
TechNet Community Support

SSL Certificates Update Error in ACE 4710

Hi,
I am facing a problem while updating the SSL certificates in ACE 4710. Our certificate is expired and we have purchased a new certificate from CA. Moreover the common name of the certificate is also changed.
I tried importing the certificate to the repository and change the SSL proxy likewise to use the new certificate. but still the new certificate with new CN is not recognised by the clients. they can see the old certificate only. I even tried deleting and creating a new ssl proxy service with the new cert and attaching it to policy map.
but still the new certificate is not used even after a reboot,
Attaching screenshots and running config. Any help will be appreciated.
BR//Rajiv

Ravi,
Here are the procedures for updating your certificate on the ACE.
1) Create New RSA Key
2) Create CSR
3) Send CSR to CA authority for a new certificate
4) Import Certificate into the ACE
5) Change the ssl-proxy to use the new Certificate and Key
6) Remove the SSL-Proxy from the policy map and reapply
Now if you created the CSR on a different box, you will need to import both the RSA key are the certificate. Another thing you should be aware of is a possible change in the Root and intermediate certicates that are used by the CA. In your configuration, you have
crypto chaingroup iotms-chain-gr-1
cert inter-root-new
Is the the correct certificates for your cert? If so, it seems odd that there is only on certificate in the Chaingroup. Most CAs use an intermediate and and a root certificate.
Verify that you have the correct chaingroup (with the correct root and intermediate certificates).

SSL Certificate expired

Hello
I've updated our internal application SSL certificates on our core WAEs group, for some reason it didn't push the updated ones down to the branch WAEs. The users are getting the expired cert error. The work around for now was to disable the SSL cert. Is there a procedure on how to update the SSL certs on your core WAEs? How can I check the branch WAE where the expired cert if being stored, it's not showing up when you issue a show
crypto certificates. I went and updated the existing ones with the new ones and the date had changed correctly.
WAEs - 4.2.1
CM - 4.4.1

Hi John,
I believe Ahmad is talking about this link, here is the corrected one:
http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v431/configuration/guide/policy.html#wp1138543
As per the document, the certificates should be propogated to WAE and replace the expired one. Why it did not happen in your case, I believe requires some investigation. It may be that the CM-WAE connectivity is/was broken or may be the WAE is managed by CM but is configured in such a way that CM can not update config on WAE. This could happen if you are using Device Groups and if WAE is not part of that group.
Hope this helps.
Regards.
PS: If this answers your question, please mark this as Answered.

SSL certificate expired for Google Mail

Hi there everyone, I am new here so please be gentle with me! I have had a Palm Pre on the 02 network since October and have been able to use my email fine. I use Googlemail and 02 using IMAP and today it keeps giving me error messages saying the SSL certificate has expired. I have tried turning SSL on and off, and have downloaded the software update for Palm OS but it's still not working. Is there an easy fix for this? If I change to POP will that work and how do I do that? Many thanks. Hellywobs.
This question was solved.
View Solution.

Just to say that I have solved this from another source - the date was wrong on my phone. No idea why, but now I've set the date to today, it's working again. I went to the Date and Time App and made the change. Just thought I would post here in case anyone else has the same trouble - it is an easy solution.

Cannot display images after updating SSL certificate

Hello All,
With the changes in SSL certificates (no support for .local domains in public certificates), I had to update the SSL certificate used for our Exchange 2010 Server. We are a small organization with a single server running Exchange Server 2010.
There were some articles about how to change the URL's within Exchange to use the public (not .local) domain names. We followed these instructions and now, when a user using Outlook sends an e-mail with an image embedded to other users in the domain,
they see a placeholder for the graphic with the text "The linked image cannot be displayed. The file may have been moved, renamed, or deleted. Verify that the link points to the correct file and location." . This is causing a great
deal of concern to the users and I cannot find anything on how to fix or even troubleshoot this issue. Any assistance will be greatly appreciated.
Thanks in advance,
Allen
Long time IT professional always learning the new stuff! Thank you for your assistance.

Hi,
According to your post, I understand that client face an problem “The linked image cannot be displayed. The file may have been moved, renamed, or deleted. Verify that the link points to the correct file and location” after change SSL certificate.
If I misunderstand your concern, please do not hesitate to let me know.
Do you see the "page cannot be displayed" error only from your DC server or also from a Windows 7 client machine? What browser do you use and what version?
Please run “certutil –store” command from a command to verify that the certificate is correctly installed in the certificate store. Also run “certutil -store my” to check the certificate from CA.
If the certificate is already installed, please refer to below link to check the value of Cache in registry:
https://support.microsoft.com/en-us/kb/2753594
Thanks
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Allen Wang
TechNet Community Support

Error after SSL Certificat update

I updated the SSL certificate on a Win2003 SP2 server with IIS6.0
The initial certificat was a single URL certificate and is replaced by a wildcard one.
After installing the certificate (and it's CA chain) using the mmc I changed the certificate in IIS and configured the SSLBinding using "cscript.exe
adsutil.vbs".
The result is an SSL ERROR.
The CA chain and the certificate are two CRT files.
Here is the result of the "certutil.exe -store my"
command :
C:\Documents and Settings\Administrateur.W2K79>certutil -store my
================ Certificat 0 ================
Numéro de série : 4899717f3b1ba89dedb7c472d575cb01
Émetteur: CN=Thawte SSL CA, O=Thawte, Inc., C=US
Objet: CN=*.bourgenbresse.fr, OU=Collectivite, O=COMMUNE DE BOURG EN BRESSE, L=B
OURG EN BRESSE, S=Ain, C=FR
Il ne s'agit pas d'un certificat racine
Hach. cert. (sha1): eb 03 df 43 a8 03 e5 5f b1 52 fc e7 5b a9 0b 0c 19 2a 15 8a
Aucune information sur le fournisseur de clé
Pas de propriétés pour le jeu de clé dans le magasin
================ Certificat 1 ================
Numéro de série : 023fcc
Émetteur: CN=GeoTrust DV SSL CA, OU=Domain Validated SSL, O=GeoTrust Inc., C=US
Objet: CN=www.portailenfance.bourgenbresse.fr, OU=Domain Control Validated - Qui
ckSSL(R) Premium, OU=See www.geotrust.com/resources/cps (c)11, OU=GT68088061, O=
www.portailenfance.bourgenbresse.fr, C=FR, SERIALNUMBER=R2RJ3sRPOrW0Q3XZYvvpcP05
TqodNAru
Il ne s'agit pas d'un certificat racine
Hach. cert. (sha1): 12 49 a6 95 9a 67 05 86 d9 a3 64 cb a7 a7 78 ee 6c eb 94 52
Conteneur de clé = cecd6bee4621365b6e763b9bfcd773cf_b3f7eefb-5c14-4333-a5bb-29
d40b271698
Fournisseur = Microsoft RSA SChannel Cryptographic Provider
Succès du test de cryptage
CertUtil: -store La commande s'est terminée correctement.
Please help !

It seems that the key for the wild card certificate has not been found. The output shows a valid key for the other cert. ("1") but no key information for the wild card cert ("0"). I assume, that when you double-click the certificate in
the computer's Personal store you don't see the message You have a Private Key...
(on the bottom of the General tab), right?
Windows 2003 sometimes needed some extra effort to "connect" key and certificate, in addition to just importing it (I am assuming that you imported it to the machine where you had created the key).
Check if the command line tool certutil is available. If not, install the W2K3 admin pack (download e.g.
here).
Double-click the new server certificate, go to Details...
Scroll down the list of attributes and locate the Serial Number. Copy the serial number value.
At the command shell run as a local admin:
certutil -repairstore my "<Serial Number>"
If this has been successful you should now see the message You have a Private Key... when double-clicking the certificate.
Elke

The SSL certificate of the server is expired

Today, I accessed Beehive Online via Oracle Beehive Extentions for Explorer.
I cannot use Beehive Online with error message "The SSL certificate of the server is expired".
How should I do?

We're looking into it, meanwhile you can use a Webdav connection.
Thanks,
Jereen

Message: Your Server's SSL certificate has expired. - Can no more login

Hi,
Since yesterday I can no more login into beehiveOnline via OBEE. Every time I try it the extension goes offline and tells me in a window that "Your Server's SSL certificate has expired.". If I try to relogin it takes some seconds but the window and message comes up again and again.
It was working perfectly during the previous weeks, no issues at all. What do I have to do to get it solved?
Thanks
Volker

Hello,
I've set up OBEE for BeehiveOnLine usage today, without any issue (Monday 28 of June)
May you retry please?
Yesterday - Sunday - the system might be under maintenance.
Thanks
Fred

Unrecognized update of expired ssl certificate

Similar Messages

Maybe you are looking for