iDRAC6 - self-signed ssl + intermediate

Similar Questions

• HPDM: HPDM replace self signed SSL certificates for server HDPM and master repository

  I am trying to replace the automatically generated self-signed certificates (issued to DM) issued by DM server HDPM and master repository.  I'm NOT arbitration FTPS, HTTPS embedded HPDM or CERT Thin Client Agent server.

  I already have CERT for the installation of our own internal domain CA for FTPS in IIS and the built-in Apache HTTPS server.  These work properly and pass tests of repository for both protocols.  I also have questions for Thin Clients of our internal CA very well.

  I am interested in the HPDM real server cert and cert master repository. These are generated automatically when the two services start.  They use a very weak MD5 hash and key RSA 1024.  I can't find any documentation around that, with the exception of troubleshooting, in which you can remove these certificates restart services and they will be regenerated.

  Here are the paths certs\key
  HPDM % install Path%\MasterRepositoryController\Controller.crt (Cert repository)

  HPDM % install Path%\MasterRepositoryController\Controller.key (repository key)

  HPDM % install Path%\MasterRepositoryController\Client.crt (HPDM Server Cert)

  HPDM % install Path%\Server\Bin\hpdmskey.keystore (Both HPDM server and repository Certs and keys) (not sure what format it is in.  It is not PEM and P12 ok I can say)

  There are also some HPDM % install Path%\Server\bin\hpdmcert.key.  Don't know what it is.  It's the key to the server HPDM but deleting it does nothing and it is never re auto generated in one of my tests.

  I am able to replace the Controller.crt and keys with my own files CA internal those emitted very well.  The service started and no errors occur.  However if I replace the Client.cert (HPDM Server Cert) with my own service will start but there are Socket SSL errors in repository logs and the HPDM server could not connect to the master repository. I have no idea where the key file is supposed to be for HPDM Server Cert.

  Can anyone help with this?  I can't find the configuration files for the service to generate their own certificates.  If I did I would try at least to change the config to do not use MD5.

  Hello

  These certiricates between HPDM server and MRC are not designed for customizable. Please submite one scenario if you have concerns of security on it.

  Just for info:

  hpdmcert. Key is for communication between the server HPDM and gateway HPDM

  hpdmskey.keystore is for communication between the server HPDM and MRC

  server_keystore is for the commhucation between HPDM server and the Console HPDM

• Flex + self signed SSL Cert

  We have an SSL certificate that is self-signed on our application server. When we run the application flex from outside of our network and try to access the web service, flex throws the following error:

  Failed to load the WSDL. If there are currently online, please verify the format of the WSDL and URI file

  We did install the certificate on client computers for IE and Firefox, but nothing seems to fix it, as we have tested the service via http and it works fine, but when you switch to https is when it breaks. To test further we loaded the wsdl for the service from outside of our network and were able to see with the crossdomain.xml file that resides on the server. At this point, we are at a loss of what could be the problem.

  Does anyone have any suggestions?

  Thanks in advance. If you need information additional just ask.

  Pony up the $15 for a cert play. You've already spent more in a way that tries to "solve" this problem.

• Flex iOS app refuses to connect to a self-signed SSL server: error 2032

  Hello everyone, thank you for reading this and I hope you could help me with this problem.

  I'll cut to the Chase. I am currently working on a mobile app in Flex for Android and iOS and the app has to get a few HTTP requests and retrieve information from a server, which is currently developing a teammate.

  Everything had to be working very well until we decided a few days before when we have integrated a SSL self-signed certificate in order to make connections more secure, etc.

  On the side of the app, this change, lying just to replace the http with https url and it seems to work perfectly, or that's what we thought.

  Tests on the Simulator or on an Android device worked well, he just showed the warning provided access to a server that had a rogue certificate that could be ignored without any problem. But when we tried to test a Release on a camera of the iPhone version, it would not just work more. A connection every time trying to be established with the server, error 2032 flash is triggered and it fails miserably does not display not warning about certificates not approved at all. For me, it's really confusing that it works on Android devices, but not on the iPhone device.

  I searched on the Web for people having the same problem but I couldn't find an answer to this specific issue of Flex-iOS-Self-signature-SSL. I found this post unanswered questions: http://forums.adobe.com/message/3359072#3359072 but nothing much.

  I tried to create a crossdomain.xml file on the server with guaranteed set to false, and some other stuff to avoid crossdomain policies, but it changed nothing and the problem persists.

  I'm really out of clues, sort of desperate and have no idea how fix it. If anyone knows something related to this problem, please, help me, I'll be less grateful.

  Thank you!

  We decided to buy a verified SSL certificate, and it worked. We can say that the problem is solved, but it wasn't actually because the connection must be established and that the invited user to accept or decline the self-signed certificate, not only do not make the connection.

• Flex [mobile] iOS app refuses to connect to a self-signed SSL server: error 2032. Ring the bells?

  Hello everyone, thank you for reading this and I hope you could help me with this problem.

  I'll cut to the Chase. I am currently working on a mobile app in Flex for Android and iOS and the app has to get a few HTTP requests and retrieve information from a server, which is currently developing a teammate.

  Everything had to be working very well until we decided a few days before when we have integrated a SSL self-signed certificate in order to make connections more secure, etc.

  On the side of the app, this change, lying just to replace the http with https url and it seems to work perfectly, or that's what we thought.

  Tests on the Simulator or on an Android device worked well, he just showed the warning provided access to a server that had a rogue certificate that could be ignored without any problem. But when we tried to test a Release on a camera of the iPhone version, it would not just work more. A connection every time trying to be established with the server, error 2032 flash is triggered and it fails miserably does not display not warning about certificates not approved at all. For me, it's really confusing that it works on Android devices, but not on the iPhone device.

  I searched on the Web for people having the same problem but I couldn't find an answer to this specific issue of Flex-iOS-Self-signature-SSL. I found this post unanswered questions: http://forums.adobe.com/message/3359072#3359072 but nothing much.

  I tried to create a crossdomain.xml file on the server with guaranteed set to false, and some other stuff to avoid crossdomain policies, but it changed nothing and the problem persists.

  I'm really out of clues, sort of desperate and have no idea how fix it. If anyone knows something related to this problem, please, help me, I'll be less grateful.

  Thank you!

  We decided to buy a verified SSL certificate, and it worked. We can say that the problem is solved, but it wasn't actually because the connection must be established and that the invited user to accept or decline the self-signed certificate, not only do not make the connection.

• Thunderbird does not recognize a self-signed SSL certificate

  Dear support,

  I have a very strange problem that I don't understand.

  I run a server ISP offering IMAP and TLS/SSL HTTPS encryption. Both services use the same SSL certificate issued by RapidSSL/GeoTrust Server edward.ennabe.de

  When I open an https connection to the server, Firefox correctly solves the certificate chain and use the certification authority root Equifax (which is correct).
  However, when I try to connect to a mailbox via Thunderbird, all I get in the hierarchy of certificates is my server edward.ennabe.de. I don't think that it's "working as intended", or is it?

  Is something wrong with my Thunderbird or My Dovecot configuration? What is really strange that firefox recognizes it correctly.

  Thanks in advance

  Kind regards

  ZeroEnna

  In Thunderbird, click the 'Détails' tab in the display of the certificate.
  See all certificates of CA listed in the field "Certificate hierarchy" also installed in your Thunderbird certificate store?
  When checking this look for the tab 'authorities '.
  If there are no certificates listed in the missing chain in the Thunderbird certificate store (for some reason any), you can try to export it in Firefox and import them into Thunderbird.

• Safari no longer works with SSL self-signed certificates?

  With the last Safari (9.0.3) on OS X (running 10.11.3) and iOS (9.2.1) operating system, I can no longer connect to sites that use self-signed SSL certificates. Previously, I was warned that the site certificate was not "valid", but given the opportunity to continue anyway. This is the behavior I want to come back. It still works fine in Chrome, Firefox. but now just Safari gives me an error "Safari can't open the Page" as it would if it could not reach the server. Specifically, it says "Safari can't open the page https://myselfsignedhost.com because Safari is unable to establish a connection to the server myselfsignedhost.com.

  It does not give me the opportunity to inspect the certificate, add the certificate to my keychain, trust the cert, ignore the warning once or anything else that would be useful... He's just pretending like it can't connect. Am I missing something? How to restore old functionality? This 'bug' makes safari completely useless for me.

  OK, some info... This seems to apply only to SOME sites with self signed SSL CERT... The only obvious thing I can think is that maybe it applies to sites where the SSL certificate when the page was first loaded?

  If I open a new window private, I can access the page without problem. If I open a new standard, I can also open the page, until I quit safari. Once I left, it stops loading with the same error...

  If I manually add the SSL certificate to my keychain as being approved, the page also works... There may be a cache of certificate somewhere that is out of date?

• ASA5505 IPSEC only with self-signed certificates

  Hi all

  I have little Cisco training and was assigned to a pilot project. We have cleaning of the ASA from another Department, but I do not have access to support. It is running ASA v9.1 and ASDM 7.1. If all goes well I'll be sent on training and we can buy a nice 5520.

  So I scoured the internet for a guide that is easy to do as my title says, but I'm having major trouble. I find a lot of outwardly signed with self-signed SSL VPN or VPN IPSEC with CERT support but I can't only get ASA self-signed IPSEC IKEv2 with certificate authentication. Also, to make it even worse, I have to provide the user with the software, the profile and the certificate in hand. No access to the web or download portal.

  If you know where I can get good installation guide for this type of use please by all means save me here. If this isn't possible, I'm cool with that, let me know.

  Thank you fo any help you can provide

  Jay

  If the ASA uses a certificate issued by a certification authority that is in-store customer trust root CA, then the certificate of identity ASA didn't need to be imported by the customer.

  Which is why it's usually recommend to follow the path of using experienced public CA because they are alreay included in most modern browsers and so the client has no need to know how to import certificates etc.

  If you are using a local certification authority that is not in the store trusted CA of the customer to deliver your ASA certificate or identity certificates on the SAA signing root then you must take additional measures at the level of the customer.

  In the first case, you could import the CA certificate in the store root CA of the client trusted root. After that, all the certificates it has issued (the IE the ASA certificate of identity) would automatically be approved by the customer.

  On the second case, certificate of identity of the SAA is would have installed on the client because it (the ASA) basically as it's own root certification authority. Usually, I install them in the CA store root confidence of my client, but I guess that's technically not necessary, as long as the customer knows to trust this certificate.

• IdP custom self-signed certificate with error "Exception in law Service...". »

  Hi all

  We strive to use the identity provider 2 OAuth with self-signed SSL certificate and it seems that this approach are not supported by the system.

  OAuth authentication endpoint is not accessible from the mobile application - Chrome debugger HTTP call tells to the endpoint of the status "cancelled".

  Use of "Desktop Web Viewer" gives the possibility to add exceptions for host security, but at the stage of the passage "code" parameter Manager experience Mobile endpoint [1] forwarding flow always breaks with message 'Exception in the Service during processing of the result from the identity provider' passed as parameter in the call to redirect to the Web Viewer [2].

  Here, I would like to note that the right is turned off for the project.

  I wonder, is the error above caused by unreliable connection? Is it possible to use the custom with self-signed SSL certificate identity provider?

  Thank you for considering my question.

  [1] https://es.publish.adobe.com/oauth2?code=AAAAAAAAAAAAAAAAAAAAAA.9lqAHfrL0wjBCcQ-zGCW2Am6E6 M.AHySE6B2oTLWVfJMDVl5ExOct2vY...

  [2] web Viewer

  Hello

  Free signed SSL of entitlement certificates are not supported. The connection is interrupted by the server because the certificate is not approved.

  Tukker - Klaasjan

• Sefl-signed ssl certificate is not possible?

  Hi all
  
  the ILO is not yet possible to let flex' webservice or httpservice to connect to a
  WebService https secured by a self-signed certificate? There is absolutely no reason
  for me to buy a 'real' certificate just for encryption purposes.
  I installed crossdomain.xml on the target server, the Web service works well when pasting
  the URL in the browser and I have installed the certificate in IE (which I use here), then
  is no error and shows the OWL small lock in the address bar. But Flex refuses to work,
  except for run the application locally (means by clicking on "run" in flex builder).
  I'm using Flex 2.01 so important.
  
  So, could someone help me? Or Flex so ignorant for self-signed webservices?
  
  Good bye
  sysFor

  Hi sysfor,

  I am using the appropriate production and development self-signed SSL certificates in & don't test, no problems so far.
  Flex/Flash is not the authentication of SSL certificates - this task is delegated to the browser.

  So I suppose you are faced with a different type of problem - your crossdomain.xml is not configured correctly.
  Have you checked the log of policyfiles.txt?
  Another point, you're probably doing is called direct URL (https://myhost/path). Instead, you must use a relative path. For example if your swf file has been downloaded from the server myhost, then he should just make the calls in / path.

  See you soon,.
  Dmitri.

• SG300-28 import self-signed SHA2 certificate to the SSL Protocol (including the format? How do I?)

  1. What is the format a certificate and private key combination should play during import to use SSL?

  2. how actually import you - via CLI or web interface.

  I'm trying to import an SSL certificate that is self-signed in the SG300-28 to secure the connection to the web interface of the switch. The certificate is signed by my own 'certification authority' / custom root certificate.

  I tried to do it via the graphical interface of web management (security > SSL server > server SSL authentication) and the command-line via SSH. I will detail my exact process below. I had no problem importing a certificate created in the same way to the Cisco RV320 router, although the web interface is different.

  How to create a certificate that is accepted by the switch?

  (Image Active) firmware version: 1.4.0.88

  My approach:

  1. OpenSSL 1.0.1f January 6, 2014; on an ubuntu 14.04 machine
  2. Create my own, certificate of self-signed root:

   openssl genrsa -out rootCA.key 2048 openssl req -x509 -new -nodes -key rootCA.key -days 3650 -out rootCA.pem

  3. create a private key and the real certificate and sign them using the rootCA.pem:

   openssl genrsa -out switch.key 2048 openssl req -new -key switch.key -out switch.csr openssl x509 -req -in switch.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out switch.crt -days 3500

  for later use, export the public key of the switch.key - file using

   openssl rsa -in switch.key -pubout > switch.pubkey

  4. open the web interface of the switch and check for the SSL settings (Security > SSL server > server SSL authentication).

  4.1 click "import certificate".

  4.2 paste the contents of the switch.crt file in the ' certificate:'-textbox

  4.3 to import pair of RSA keys

  4.4. Paste the contents of the switch.pubkey file in the public key field

  4.5 by selecting the 'Clear text' radiobutton control and paste the contents of the inside switch.pubkey

  4.6 click 'apply '.

  4.7 receive an error message 'invalid key head '.

  The private key looks like this (oviously, I created a new one for this example):

   -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEA3gOvNzKqULXnT7zL9fl4KJAZMo5eYHfwPSN0wl385na37oHz [23 more lines truncated] aB7Pooa60anjIVJmlSIp4WJ8U+52BMKJZ5rqHnJ1sBBo1zpAtcdspg== -----END RSA PRIVATE KEY-----

  I also receive a header invalid key error when you try to import the private via CLI SSH key using:

   switch(config)#crypto key import rsa

  I also converted the certificate and the private in PKCS12 and then back to the PEM key that gives me the following private key "head" which is not always accepted when pasting in the CLI:

   Bag Attributes localKeyID: FE 24 88 34 66 BE E9 DB CE 4E 91 23 2C 0E 03 B1 A7 58 32 24 Key Attributes:  -----BEGIN PRIVATE KEY----- MIIEvgIBA[...] -----END PRIVATE KEY-----

  What key header miss / what am doing wrong in general?

  It seems that ' import key cryptographic rsa "command is not suitable for import SSL key related private, but rather for the importation of SSH keys. Code "key header is missing" means that switch expects anything other than "-----BEGIN RSA PRIVATE KEY-----", for example the headers that you can see after the execution of ' view keys cryptographic rsa "(- START PRIVATE KEY ENCRYPTED SSH2-).

  To get your SSL certificate installed, you have two options:

  The CLI option:

  • create a RSA private key with command

   switch(config)#crypto certificate 2 generate key-generate 1024

  • create the certificate request with

   switch#crypto certificate 2 request

  (don't forget to provide all information for this order, including '' cn '' and so on). Note that this command must be executed inside the privileged mode and not in mode configuration as the previous command.

  • After you run this command, you'll get sign certificate request (CSR). Copy and paste it into the new file on the server that hosts your certification authority.
  • now sign this CSR file with the command that you have already used:

   openssl x509 -req -in switch.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out switch.crt -days 3500

  • After signing to just open the file "switch.crt" and copy all content between BEGIN and END section including.
  • and import this certificate with order

   switch(config)#crypto certificate 2 import

  • and finally for your certificate to be active, do it with the following command:

   switch(config)#ip https certificate 2

  WebGUI option:

  Here, the procedure is similar to the CLI:

  • You must click on "Generate certificate request" in the "Security-> SSL server-> server SSL authentication" section, fill in all necessary data and click on "Generate certificate request."
  • you will get CSR data you need to paste into the server with the certificate of the CA.
  • sign the certificate with the command openssl similar as mentioned previously
  • and import a certificate with maintaining "import RSA Key-Pair" unchecked.

  Personally I've never managed to get imported both key and certificate from the outside.

• Configure SSL for OUD 4444 port Admin port-> replace the self signed certificates used

  Hi Experts,

  When installing OUD choose Certification self-signed for ports 1636 and 4444.

  Later I change the certificates used by the port of 1636 to a new key file containing the CA certificates. (Track the steps of: https://docs.oracle.com/cd/E52734_01/oud/OUDAG/security_clients_severs.htm#OUDAG00050)

  But same procedure does not have to replace the self signed certificates used by ports 4444!  Everyone is configured SSL (with Cert CA) on the Administration port?

  I couldn't even start the servers, you see an error:

  """

  category = gravity CORE = NOTICE msgID = 458891 msg = the directory server sent a notification to alert generated by the class org.opends.server.core.DirectoryServer (org.opends.server.DirectoryServerShutdown alert type, alert ID 458893): the directory server started the shutdown process.  Stop was launched by an instance of the org.opends.server.core.DirectoryServer class and the reason for the closure was an error occurred trying to start the directory server: NullPointerException (File.java:277 AdministrationConnector.java:843 AdministrationConnector.java:675 AdministrationConnector.java:182 ConnectionHandlerConfigManager.java:356 DirectoryServer.java:2932 DirectoryServer.java:1584 DirectoryServer.java:10108)

  «[27/sep / 2015:06:22:53-0400] category = gravity = NOTICE msgID = 458955 msg = the directory server CORE is now stopped "«»

  Post edited by: 1976902

  Sorry, I cannot help here - here are a few possibilities.

  Change connector Administration certificate

  https://docs.Oracle.com/CD/E52668_01/E54669/HTML/ol7-genssc-auth.html

  The failure of the handshake could occur for various reasons:

  • Incompatible encryption suites in use by the client and the server. This would require the customer to use (or allow) a suite of encryption supported by the server.
  • Incompatible versions of SSL in use (the server can only accept TLS v1, while the client is capable of using SSL v3 only).
  • Incomplete trust for the certificate of the server path
  • The certificate is issued to another area.
  • incomplete certificate trust path between the certificate for the server, and a certification authority root.
  • In most cases, this is because the certificate is not present in the trust store

• Faced with Windows 2008 R2 PKI, self-signed certificates & view iPad customer Secure Authentication to view connection server: UGH!

  Background: I was instructed to create a VMware View isolated laboratory test so that HIGHER-UPS can see how they could access the VM dedicated as well as how their developers could put related clones on-the-fly. The project was successful! Yay!

  Addendum: A boss wants to see how VMware View works when accessing his computer virtual dedicated via his iPad on the internet... And who needs a secure SSL connection.

  The problem is: the domain name I chose casually because the lab did not belong to me... So I can't have a real certificate from a trusted commercial certification authority.

  So I'll try to roll my own public Windows 2008 R2 PKI and... All that forcing the iPad to use DC/DNS server in the lab... Get only the single get iPad trust view connection server by importing a sort of certificate.

  Can I export/import a certificate of the CA of DC to the iPad via an attachment... And it happens with confidence. But how to create a login to view the server certificate and electronic-mail/import in the iPad so it happens with confidence? Whenever I try to export the certificate of the certificate of the view connection server store, send it to the iPad and install... The connection server certificate appears as 'not reliable' and the VMware View client will not connect.

  (Of course, I could get sloppy and set the iPad Client to accept untrusted connections... "But I want to solve the problem of approved connection).

  I could be missing something royally on the self-signed certificates and certificate chains.

  (It is a first for me dealing with Active Directory Windows Certificate Services. In the past, I always just installed expensive commercial SSL CA certificates in the certificates Windows Server stores before.)

  Any help or direction, you can provide would be appreciated. I'm rather confused.

  See you soon!

  Keegan

  Hello

  Maybe was your initial problem that the provided certificate must be a descendant of a trusted root, such as Verisign cert or

  the root certificate must be installed and all the intermediate certificates in the trust chain down to the one you use?

  Concerning

  AndyR

• Stopped working self-signed certificates

  All a sudden (and not after a Firefox update) 41.0 Firefox stopped accepting SSL certificates self-signed on various websites that it had been accepted for months. I generated certificates myself.

  The link / button to add exceptions and import the certificate has disappeared from the "Untrusted connection" error page

  Things I've tried so far:

  • Import certificates via preferences > advanced > Certificates > view certificates > servers. The imported certificates, but Firefox seems to ignore.
  • Exit Firefox, remove cert8.db in my profile, then restart Firefox
  • Restart Firefox in safe mode
  • Import the certificate in the keychain of the OS (what makes Web sites work on Chrome and Safari)

  Generated certificates are signed "PKCS #1 SHA-256 with RSA encryption", they are not expired and have been generated with

     openssl req -x509 -nodes -days 1095 -newkey rsa:2048 -keyout server.key -out server.crt
  

  In addition to the issue of trust, https://www.ssllabs.com/ssltest/ reported no problems with these certificates, they are fine ("' If trust issues are ignored: has '")

  The only way I can access these sites Web is via a private window: If the certificate has been imported previously (via preferences) private session window accesses Web sites without problem. If the certificate has not been imported, again, I have the option to add a temporary exception and after that is done, it works fine.

  This problem does not appear on another computer, even if the Firefox profile is synchronized between the two.
  The problem does not appear on Firefox 41.0 a colleague (same OS and hardware)
  Certificates signed by a real certification authority are accepted very well.

  UPDATE:

  I have marked this as resolved, but apparently the problem returned once a week, completely randomly.

  The best solution I've found so far is to leave Firefox, delete the following files from my profile, and then restart Firefox:

  • SiteSecurityServiceState.txt
  • cert_override.txt
  • cert8.DB

  Finally, I fixed that by doing a Firefox "Refresh" (under topic: support) and re - sync my profile.

• Create safer self-signed certificates on IOS router?

  I use a router in 1921 and use partially as an AnyConnect (WebVPN) server for remote access in the location.  The certificate I used was a self-signed certificate & trustpoint generated on the router.  I am running as the last IOS available track to ensure that it has all the latest features.

  Do a quick check of SSL against her of Qualys, he seems to have a lot of weaknesses and known vulnerabilities.

  * Poodle TLS

  * TLS 1.0 only

  * SHA1

  * Diffie-Hellman 1024 bits

  * Some algorithms of older encryption which seem to be available (but I've never specified), as TLS RC4_128_MD5

  The encryption mechanism and controls to create the cert don't give me much choice in the matter.

  Is there a new or better way to create a more secure certificate chain on an IOS router?  I couldn't find the instructions anywhere.

  Robert

  Take a look at my guide to private networks virtual Suite-B.  It creates more secure certificates.  Note my comment about the minimum software version to use.

  https://www.IFM.NET.nz/cookbooks/Cisco-IOS-router-IKEv2-AnyConnect-Suite-B-crypto.html