Verisign Certificate Renewal - Help!!!

Hi Guys,
     I am a beginner in Adobe Flex.
     The digital certificate from verisign got expired which I used in my flex builder 3, packaging it while exporting an AIR application.
     My organisation renewed it and gave me a certificate .p12 file stating that it is a renewed one.
     I used that renewed file in place of the old .p12 file in the application package and exported it to an AIR application.
     But, I was not able to install that application anymore as it results in "The installation of this application is damaged. Try re-installing the application or contact the publisher for assistance." error.
     Later, I double clicked that .p12 file and registered it with trusted enterprise certificates. Now the application installed fine. But it did not work in another PC. Later It worked when I did the same process in that PC also(i.e. I double clicked that .p12 file and registered it with trusted enterprise certificates in that PC).
     In that process I found that the previous certificate was "VeriSign Class 3 Code Signing 2009-2 CA" and the renewed one is "VeriSign Class 3 Code Signing 2010 G5". Is this the reason???
     Or am I doing something wrong while exporting the release build???? Somebody please help me ASAP.
     FYI - I am using this verion SDK "<application xmlns="http://ns.adobe.com/air/application/1.5">" in my app.xml file.
Thanks & Regards,
Raj
Message was edited by: TomCruise06

What do you mean by "Call" a certificate? A certificate is not "called". It is a container for an asymmetric cryptographic key. What you normally do with the certificate is "extract" the key so that you can use it
for a cryptographic operation. In .Net, you typically use the classes in System.Security.Cryptography to do this. See example here:
http://www.ultradevelopers.net/Blog/21

Similar Messages

Verisign Certificates renewal Issue

Hi
We are running Sun Java Web Server 7.0 update 5 and wanted to renew verisign certificates for 2 more years.
What i did:
1. Got the certificates from Verisign with last year CSR (i'm not sure if previous CSR can be used or not)
2. Using admin console (browser based) , i went to "server certificates" ->"install" and could successfully installed them (but there was a warning that duplicate nick name) and i selected ls2 (listener-2 for https)
3. admin console shows renewal successful and expiry year is 2011.
4. I also restarted both admin and web services
But the problem that when i access the application from browser, it still says the expiry year as 2009.
Please advise.
Prvn

Well ... I don't know WHICH three *db files you copied, or from where you copied them in the admin-serv directory.
If the admin server appears to be working as expected, and the instance appears to be working as expected, then just make sure the admin server isn't telling you that changes have been made on the instance (if it is then tell it to copy the changes and make them the new current version).
Depending on which files you copied from where you may end up with the admin server having the wrong certificates. This could cause a problem for any nodes that are registered with it. I think you'd already see a problem if this were going to break things though.
In a perfect world everything is just working as expected now, and you're done. If you want to be extra cautious, though, you should restore the admin server's key3 and cert8 databases from a backup (these databases contain the self-signed certificate and its associated keys that were created when you installed Web Server).

J2EE Certificate Renewal in PI 7.0

Hi
We are executing a project to renew the certificates installed in our XI server. The certificate which is currently installed in our XI severer is signed by Verisign. All partners communicating to the XI server use the certificate to digitally sign the message. In XI server we have configured communication channels to receive process the signed message and also to deliver digitally signed message to partners. The validity of the current certificate installed in our system is going to end by the end of Feb. We are looking at renewing the certificate before the expiry date so that there will not be any interruption in partner communication. In this regard, please provide your inputs to the following items
1. Should the existing CSR be sent to the CA for validity extension or a new CSR to be generated
2. During certificate renewal, can the existing private/public key be retained for the renewed certificate
3. Can we have the old certificate installed in the XI server along with the newly renewed certificate, so that the partners can be gradually migrated
4. Is XI server restart required after certificate installation/upgrade
We have referred the SAP Note 694290 for Verisign certificate renewal
Thanks
Srinivas

No cross posting
Read the "Rules of Engagement"
Regards
Juan

How do I renew my Verisign certificate

Our Verisign certificate is about to expire and we need to replace it. Verisign can generate a new certificate based on our original request. Does this mean that all I should really have to do is to open Oracle Wallet, delete the old user certificate and add the new user certificate? Are there other steps?

I create a new request and a new wallet. Now I'm having trouble installing it on the app server. See Re: Install renew-ed user certificate in Wallet manager

Can not import Verisign certificate

Dear all,
I am trying to import a Verisign certificate in my ABAP BW 3.5
Production system.This is a certificate renewal as I had a certificate there for a year that is to expire on the 12th of June. However, because of the fact that we had to change the SSL
PSE so that it contains field SP, it is more like installing a new
certificate.
What I did: I deleted the old PSE that didn't have any information about the "State" field and created a new one.
I then created the CSR request to Verisign. I received
the response from Verisign, which I pasted in a text file together with the Verisign Intermediate and Verisign Root certificate which I used last year as well when I installed a Verisign certificate in this server for the first time.
When I apply the response, by pasting the contents of the text
file created above, I get the message:
"CA Certificate missing in database"
I have already looked at notes 508307, 518185, 510007, 1074447, 511919
I am sure that the Verisign root and Intermediate certificates are ok because I have used them successfully in the past in the same server and recently to create the certificate chain for other system certificates of my EP 6.0 landscape.
I am also sure that the Verisign CA root certificate exists in the
database, I checked table STRUSTCERT and it is there. Also, if it didn't exist, I wouldn't have been able to import the Verisign certificate last year
I haven't restarted ICM so the previous certificate still works. After the 12th of June though it will expire and all funtionality based on HTTPS in BW will not work.
Many thanks in advance for your help
Regards
Andreas

Just created a new SSL PSE and imported the certificate chain again and this time it worked...

Signing in mail with a verisign certificate

I have 2 certificates bought from Verisign that I used previously under 10.6.
I made a clean install of 10.6 and then updated to 10.7, but even if I managed to import the certificates in the keychain access, the buttons in mail proposing the signature and encryption of emails doesn't appear.
Thank you in advance for your help

I haven't been able to resolve this issue using Mail and a Verisign certificate. So instead I tried Comodo and my Mail system now works perfectly with both signature and encryption. So perhaps the problem lies with Verisign rather than Apple......
And Comodo is free, see http://www.instantssl.com/ssl-certificate-products/free-email-certificate.html

How can I get an up to date Verisign certificate??

For an app I need the Verisign certificate. I downloaded one from a link provided in this forum but once installed I see it valid until "15-07-2009" -- no good for me, I'm in August.
Trawling the Verisign site didn't help ease the frustration.
Any pointers?
It's a VeriSign Class 3 Code Signing Certificate. I've already updated the Nokia firmware to the latest version.

I can't seem to find any other place to put this but here.
I have the same exact issue as the person who started this thread.
I have a valid VeriSign Class 3 code signing certificate and when trying to do a OTA for a E63 phone the message shows "certificate not recognizable".
VeriSign blames Nokia.
What can I do for this?

Customizing Certificate Renewal

We are developing system that makes use of Certificate Server. But, only our system is visible form the Internet,
CS is hidden behind the firewall.
We've developed a solution, that makes it possible to request for certificate from our system, then forwards the request to CS, and vice versa, we fetch the page which installs the certificate and forwards it to end-user.
But, when talking about renewal, we have a problem.
CS interface for certificate renewal expects, that user legitimates with its expiring (or expired) certificate and then
CS regenerates new certificate (with validity customized via console) and installs it on client browser.
We expected similar functionality as with requesting for certificate. User fills out the request, sends it to CS, and admin after checking issues the certificate. More, the admin is responsible for renewing the certificate, not the user, as in previous scenario.
Also, authenticating with client certificate makes it impossible to forward the request and response by us (we cannot fetch the certificate from the user browser to use it for communication with CS)...
Maybe some of You have solution that satisfies our needs?
Maybe CS has another interface, which we didn't explore, allowing certificate renewal without presenting user certificate.
Or you developed your own, custom solution, that can be suitable for us...
Thanks for help!
Michal Szklanowski
Java Architecte
empolis Poland

You have to create certificate request(CSR) from the same instance on which you are trying to install the certificate.
You need to copy the production server's *.dbs in <ws-install-dir>/https-<instance>/config and run a pull-config --force command to pull the changes into Admin Server.
If you use WS7.0 Admin Server for certificate renewal, AFAIK a new set of private and public key is generated.

Regarding Certificate Renewal

Hi all,
i am using sun java communication suite 5 + portal server 7.1.
My Webmail and Application Server is using the same certificate which will expire soon. If I can get any information about the certificate renewal.
regards
Adeel

Hi,
Try it with the new license page:
<a href="http://service.sap.com/sap/bc/bsp/spn/minisap/minisap.htm">http://service.sap.com/sap/bc/bsp/spn/minisap/minisap.htm</a>
For the old-style license key (license string) choose <b>NSP - SAP NetWeaver 04</b>.
For the new license key (license file) choose <b>NSP - SAP NetWeaver 2004s</b>
Hope this helps.
Kind regards,
Klaus

Importing Verisign Certificate on PIX7.1

Hi there,
After having importet Verisign Intermediate CA onto my PIX, I've send the CSR request to Verisign and gotten a Certificate back. Now when I try to import the returned certificate on the PIX, I get an error :
Failed to parse or verify imported certificate
Now, I've tried clearing all certs, reauthenticate the CA etc.
Any ideas?
Is it a problem that the CA is Intermediate? Can the CSR attributes contain spaces?
Pix is running latest version 7
Kind regards
Kelvin Dam

Hi koksm,
Yeah - I got it to work. I dont know how many of these steps you have done, but heres how I did it :
RSA-keys are probably already generated (also needed for ssh-access), but if you ever need to reissue the cert, regenerate the rsa keys, otherwise the CSR will be exactly the same and not accepted by the 3rd party CA:
crypto key generate rsa
Then define the trustpoint:
crypto ca trustpoint Verisign
crl optional
enrollment terminal
subject-name CN=host.domain.com,OU=Unit,O=Organisation,C=NL,St=xxx,L=xxx,[email protected]
Import root CA cert (make sure you have the correct one, preferably without intermediate CA (RA)):
crypto ca authenticate Verisign
---BEGIN--- or ---END--- lines do not matter>
quit
INFO: Certificate has the following attributes:
Fingerprint: 069f6979 16669002 1b8c8ca2 c3076f3a
Do you accept this certificate? [yes/no]: yes
Trustpoint CA certificate accepted.
Generate the CSR:
crypto ca enroll Verisign
% Start certificate enrollment ..
% The subject name in the certificate will be: xxxx
% The fully-qualified domain name in the certificate will be: hostname.domain.com
% Include the device serial number in the subject name? [yes/no]: no
Display Certificate Request to terminal? [yes/no]: yes
Certificate Request follows:
MIICNjCCAZ8CAQAwgbwxJTAjBgkqhkiG9w0BCQEWFnNlcnZpY2VkZXNrQGR5bm9t
aWMubmwxEjAQBgNVBAcTCUJpbHRob3ZlbjEQMA4GA1UECBMHVXRyZWNodDELMAkG
---End - This line not part of the certificate request---
Redisplay enrollment request? [yes/no]: no
Notice this is generate without ---BEGIN--- and ---END--- lines which you do need to add when submitting the form to the 3rd party CA.
After succesful verification by the CA you'll be returned a certificate which you can import with or without the ---BEGIN--- and ---END---- lines, so you might as well just copy the complete text:
crypto ca import Verisign certificate
% The fully-qualified domain name in the certificate will be: xxx.domain.com
Enter the base 64 encoded certificate.
End with the word "quit" on a line by itself
-----BEGIN CERTIFICATE-----
MIIDcTCCAtqgAwIBAgIQIHOwJ7acK6Fmibyhf67HlDANBgkqhkiG9w0BAQUFADC
MXN/DqZw504SdlIkm3K4Dt7kSa5NILlncBiPhJJPJRjcOk6wRB6vuGG85uz6twR
nq4BqbMitzpgxvK12hgS9ZDy62kC
-----END CERTIFICATE-----
quit
INFO: Certificate successfully imported
Make sure you activitate the trustpoint either as for use on all interfaces or on a specific interface using:
ssl trust-point thawte.com [interface]
One more thing - the verisign root cert, I did NOT get from their webpage, but I took the one that accompanies the Internet Explorer.
Hope it helps
Kdam

Difference b/w OCA certifciate and verisign certificate

What is the difference b/w OCA certifciate and verisign certificate
Do we need to buy the OCA certificate as well as I understand that we need to buy verisign certificate?
Thanks

A certificate is not a single entity. It helps if you know how to administer certificates using the openssl commandline tool. A certificate is a signed public key.
This is how it works in using the oracle tools:
First, a wallet is created using the wallet manager (owm) or orapki. A wallet at that point consists of some trusted CA (Certificate Authority) certificates, and probably already the (non visible) private key.
Next, a CSR (Certificate Signing Request) is made using the wallet manager or orapki. This is a non-signed version of the certificate.
This is where the OCA comes into play. The OCA is the oracle version of a Certificate Authority. Using the CA, you can sign your certificate yourself. The signer certificate (the certificate of the OCA) is not officially listed as trusted certificate.
If you send your CSR to verisign, verisign signs it for you. The advantage verisign has, is it's certificate (the signer certificate) is officially listed as trusted certificate. That's the reason people use verisign for their certificates.

Cisco ISE Admin and EAP certificate renewal

Hi board,
maybe I'm asking a rather dumb question here, but anyway :)
I'm currently thinking about how to renew an admin/EAP certificate on an ISE node and the effect on the endpoint authentication.
Here's the thing I do, when I initially install an ISE node
1.) CSR creation on ISE (PAN) - CN=$FQDN$ and SAN="fqdn as well"
2.) Sign CSR and bind certificate on ISE node - done
Now after 10 month or so (if the certificate is valid for one year) I want to renew the ISE admin/EAP certificate.
CSR creation: I cannot use the $FQDN$ as the CN, because there is still the current certificate (CN must be unique in the store, right?)
So what to do now? Do I really need to create a temporary SSC and make it the admin/EAP certificate, delete the current certificate and then create a new CSR? There must be a better and more important non-disruptive way of doing this.
How do you guys do this in your deployments?
Thanks in advance and sorry again if this is a silly question.
Johannes

you can install a new certificate on the ISE before it is active, Cisco recommends that you install the new certificate before the old certificate expires. This overlap period between the old certificate expiration date and the new certificate start date gives you time to renew certificates and plan their installation with little or no downtime. Once the new certificate enters its valid date range, enable the EAP and/or HTTPS protocol. Remember, if you enable HTTPS, there will be a service restart
Certificate Renewal on Cisco Identity Services Engine Configuration Guide
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116977-technote-ise-cert-00.html

Exchange 2007 Webmail certificate Renewal

Hi,
If any one knows more details about how to renew the webmail certificate in Exchange 2007, Webmail certificate is ging to expire soon ...EventID 12018

You can use powershell cmdlet Import-ExchangeCertificate to renew the certificate.
To enable the certificate, execute Enable-ExchangeCertificate -Services IMAP,POP,IIS,SMTP -Thumbprint <cert-thumbprint-here>
For more info, visit
https://www.digicert.com/ssl-certificate-renewal-exchange-2007.htm

Installing verisign certificates

Hi
I have two load-balanced portal gateways , and I need to install a Verisign certificate on them.
The question is: Do i have to create a csr request for each server and ask for separate certificates (obviously registering the same fqdn host name)??
thanks a lot

If your gateways have different hostnames, you have to get a separate certificate for each host. Otherwise, you will get a certificate mismatch error. If your gateways share the same hostname in a load balancing environment, one certificate can serve both servers. There may be licensing issues with this depending on your Certificate provider.
To accomplish this task, create your CSR on gateway1, get it signed and install it. After gateway1 is complete, copy all the files in /etc/opt/SUNWps/cert/<profilename> from gateway1 to gateway2. Don�t forget the .files.
Steve

Cacerts verisign certificate expires Jan 08 2004

Two Verisign Certificates in the jdk 1.4 keystore 'jdk1.41/jre/lib/security/cacerts' expire on Thu Jan 08 2004.
They are stored with alias 'verisignclass2ca' and 'verisignclass3ca'.
A Weblogic Server Message looks like this:
<Dec 16, 2003 5:39:13 PM CET> <Notice> <WebLogicServer> <BEA-000298> <Certificate expires in 22 days: [
Version: V1
Subject: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
Signature Algorithm: MD2withRSA, OID = 1.2.840.113549.1.1.2
Key: com.sun.net.ssl.internal.ssl.JSA_RSAPublicKey@3e
Validity: [From: Mon Jan 29 01:00:00 CET 1996,
To: Thu Jan 08 00:59:59 CET 2004]
Issuer: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
SerialNumber: [ e49efdf3 3ae80ecf a5113e19 a4240232]
Algorithm: [MD2withRSA]
Signature:
0000: 61 70 EC 2F 3F 9E FD 2B E6 68 54 21 B0 67 79 08 ap./?..+.hT!.gy.
0010: 0C 20 96 31 8A 0D 7A BE B6 26 DF 79 2C 22 69 49 . .1..z..&.y,"iI
0020: 36 E3 97 77 62 61 A2 32 D7 7A 54 21 36 BA 02 C9 6..wba.2.zT!6...
0030: 34 E7 25 DA 44 35 B0 D2 5C 80 5D B3 94 F8 F9 AC 4.%.D5..\.].....
0040: EE A4 60 75 2A 1F 95 49 23 B1 4A 7C F4 B3 47 72 ..`u*..I#.J...Gr
0050: 21 5B 7E 97 AB 54 AC 62 E7 5D EC AE 9B D2 C9 B2 ![...T.b.]......
0060: 24 FB 82 AD E9 67 15 4B BA AA A6 F0 97 A0 F6 B0 $....g.K........
0070: 97 57 00 C8 0C 3C 09 A0 82 04 BA 41 DA F7 99 A4 .W...<.....A....
]>
Does anybody know,
what that means for ssl ?
Is there a Patch or a new cacerts file for download ?
Thanks a lot.
Ede

I would assume that there are not that many certificates still
being used that use those CA certs for their CA.
As you probably noticed, there are a bunch of newer Verisign
CA certs in that trust store (cacerts). The newer CA certs are
probably the ones being used by certificates that are currently
in use.
I suppose you have to ship the older CA certs until they become
invalid. I doubt that Verisign issued any certificates with those
old CA anytime recently.
-Steve

Verisign Certificate Renewal - Help!!!

Similar Messages

Maybe you are looking for