ISE 1.3 public wildcard cert

Similar Questions

• Problem of generation of ISE CSR Cisco with wildcard certificate.

  We buy the Wildcard SSL certificate to be used in Cisco ISE but when I enter the following attributes given by the seller, I have this error.

  « *. domain.com is not a valid generic name. The attributes that I created in the CSR as follows:

  CN = *. domain.com

  SAN

  DNS name: ise.domain.com

  The above parameters is given by the seller. They said I should put this attribute because the certification authority (DigiCert), accepts that this certificate wildcard question format.

  The seller rejected my previous CSR I created successfully with the following attributes below. This is based on the Cisco Documentation.

  CN = ISE.domain.com

  SAN

  DNS name: ise.domain.com

  DNS name: *. domain.com

  I just want to confirm if the attribute given by the seller are valid for the Cisco ISE generate the CSR. Or to use the valid FQDN in the entrances to CN and not the generic name. And use the generic name in the name SAN DNS entry.

  Please advice. Appreciate the prompt respose of the expert.

  Thank you.

  Kind regards

  Mike

  Mike,

  A wildcard cert is definitely the way to go in a distributed environment.  Use the host name the node of your Admin got into the CN field:

  CN = ise, OR = domain, OU = com

  then enter the SAN field as asown above the CSR.

  Please rate useful messages and mark this question as answered if, in fact, does that answer your question.  Otherwise, feel free to post additional questions.

  Charles Moreton

• Wildcard SSL cert on ASA

  Is it possible to use a wildcard on a SAA SSL certificate? In other words, instead of getting a specific cert with the FQDN of the ASA, we would use the emitted wildcard cert?

  Absolutely, it is particularly necessary in environments of ASA vpn load balancing. When you connect to a FULL domain name which translates an IP load balancing, one of the ASAs will make a http redirect to its individual host name, your browser (or AnyConnect) will attempt this connection and ASA must have a certificate for this specific host name. Have a certificate wildcard on all the ASAs solves this. I've got this running on several clients.

  If you need help with setting up, let me know.

  You can generate keys private on the SAA (and later export it to another ASA or other devices other than cisco), or you can import a certificate with existing wildcard characters with the private keys (to the PKCS12-BASE64 format)

  Kind regards

  Roman

• Display external URLS and CERT

  Hello

  Looking just for clarification on some things. This isn't how my environment is set up today, but that's how I intend to make

  Display the connection servers:

  viewconn1.mydomain.com - 192.168.200.10

  viewconn2.mydomain.com (replica) - 192.168.200.20

  See Security servers:

  viewsec1.mydomain.com (combined with viewconn1) - 192.168.100.10

  viewsec2.mydomain.com (combined with viewconn2) - 192.168.100.20

  All these servers have IP addresses in the 192.168.x.x range. All servers in my DMZ servers are also in this range and I use a firewall to manage any type of NAT.

  I intend to load balance all these servers for my internal users, I would like that all reviews / zero clients to connect through the view.mydomain.com address. Really, I wish that my internal users and external (internet) connect via view.mydomain.com

  When it comes to certificates, what is the best way to handle this. I'll need a 3rd party CA for my security servers, this way my users who connect with their personal computers do not receive any certificate warnings. Can I purchase a SSL certificate for view.mydomain.com and install it on all 4 servers?

  As for the security gateway PCoIP, the external IPs can we internal dmz IP such as 192.168.100.10, because I have my NAT firewall, or must it be the public address provided by my ISP?

  I went through the documentation already, but he is still not 100% clear to me.

  Thank you

  Mike

  According to what external certification authority you choose, you have 3 Options. (Not all are supported by each CA, your CA representative may help).

  1. A certificate of wildcart, *. mycompany.com. so you can use it on all the components of the view and you're done. Two issues can arrise:
     1. If you address your servers via IP or a name like "view.local.domain"-> cert warning
     2. Some clients may behave erratically or generate warnings when they see wildcard certificates. In an environment of view I never had those problems (I use wildcard Certs issued by Rapidssl and Wiew software Clients, hardware PCoIP Clients and browsers in their latest Version.)
  2. Some CA offers the ability to add "alternative names" to your cert, so you get 1 (!) "Certificate which fits for"view.mycorp.com"as well as regards let them say ' View - 01.mycorp.com and ' view - 2.domain.local", sometimes even the IP addresses are allowed. The good thing: you don't have ' t get a certificate warning, even if bypass you the loadbalancer (view.mycorp.com) and speak directly to a server connection (see - 01.mycorp.com)
     1. Note that it should work in theory, I did it, but never with a view. Not sure if the display server like it.
  3. As discussed in previous discussions, you can obtain a certificate of "view.mycorp.com" and he slam to all servers within the party. I forge avoid this, because:
     1. As soon as you communicate directly with a connection to the server, you get a cert warning, because the name does not match cert. It is not so dramatic for users, but even more for the components of VMWare as talko to each other (maybe it's one Orchestrator, vCops or other)

  Regarding the Configuration of your PCoIP gateway: you must configure the public IP (what is known in the world) in the settings of the server, without worrying if the server that has the intellectual property or is behind a NAT device that transmits the requests.

• Secondary ISE cannot join the head node with error message

  Hello

  I just installed the secondary ISE and made the following points, but when I try to reach the head node, I received the cannot authenticate the primary ISE, please check the server or the certificate and try again.

  -promote the secondary image of autonomous primary

  -export the seconary cert self

  -import the cert in primary school

  -try to add not on the used secondary IP and host with super admin user name

  I noticed one thing that instruction on the ISE 1.1.1 import cert on mentioned primary section:

  1. Choose Administration > system > certificates.
  2. In operations of certificate on the left navigation pane, click certificate authority certificates.

  but there is no certificate authority certificates in the left pane. I chose to store the certificates instead

  

  any suggestions?

  Hello

  Did you put the primary secondary node? You tried to save the node in the wrong direction. To register with the primary node of a node, the application for registration must be initiated from the primary node.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Could not import the Wildcard on SAA certificate

  Hi all

  I'm trying to implement a GoDaddy Wildcard (*. mydomain.mytld) cert for a number of clubs, among which there is our ASA. I put away the old certs and did some housekeeping on their trustpoints, etc., with the result pretty much own config. (I'm on 8.3).

  I needed to register for the cert in a different area (Exchange 2010) and I exported the cert in cisco-pasteable format REB to make it ready for deployment ahead on the ASA. Here's what I've done (with cry ca debugging on), causing a failure to import the wildcard certificate. Can anyone shed light on what I'm doing wrong? What I was doing was essentially installation TP for root and intermediate and then import the actual device cert.

  The installation program two trustpoints for RootCA and intermediate TP:

  gate0 (config) # crypto ca trustpoint gdroot
  gate0(config-ca-Trustpoint) # Terminal registration
  gate0(config-ca-Trustpoint) # revo no
  ---------

  gate0 (config) # crypto ca trustpoint gdinter
  gate0(config-ca-Trustpoint) # register terminal
  domain name full mydomain.tld gate0(config-ca-Trustpoint) #.

  ----------------

  These authenticate:

  authenticate the cry ca gate0 (config) # gdroot
  Enter the base-64 encoded certificate authority.
  End with the word "quit" on a line by itself
  -BEGIN CERTIFICATE-

  -CERTIFICATE OF END-
  quit smoking

  INFO: Certificate has the following attributes:
  Fingerprints: [snip]
  Do you accept this certificate? [Yes/No]: Yes

  Certificate of the CA Trustpoint accepted.

  % Certificate imported successfully
  CRYPTO_PKI: Recording of Cert not found, return E_NOT_FOUND
  View the contents of the current certificate:
  1 certificate:
  SERIES: 00
  ISSUER: OU = Go Daddy class 2 Certification Authority, o = Go Daddy Group\, Inc., c = US
  CRYPTO_PKI: crypto_process_ra_certs (trust_point = gdroot)

  authenticate the cry ca gate0 (config) # gdinter
  Enter the base-64 encoded certificate authority.
  End with the word "quit" on a line by itself
  -BEGIN CERTIFICATE-
  -CERTIFICATE OF END-
  quit smoking

  INFO: Certificate has the following attributes:
  Fingerprints: [snip]
  Do you accept this certificate? [Yes/No]: Yes

  Trustpoint "gdinter" is a subordinate certification authority and is a non self-signed certificate.

  Certificate of the CA Trustpoint accepted.

  % Certificate imported successfully
  gate0 (config) # CRYPTO_PKI: Cert record not found, return E_NOT_FOUND
  CRYPTO_PKI: No appropriate trustpoints not found to validate the serial number of certificate: 0301, object name: serialNumber = 07969287, cn = Go Daddy Secure Certification Authority, or =http://certificates.godaddy.com/repository, o is GoDaddy.com------, Inc., l is Scottsdale, st = Arizona, c = US, name of the issuer: OU = Go Daddy class 2 Certification Authority, o = Go Daddy Group\, Inc., c = US.

  CRYPTO_PKI: Recording of Cert not found, return E_NOT_FOUND
  View the contents of the current certificate:
  1 certificate:
  SERIES: 0301
  ISSUER: OU = Go Daddy class 2 Certification Authority, o = Go Daddy Group\, Inc., c = US
  Certificate 2:
  SERIES: 00
  ISSUER: OU = Go Daddy class 2 Certification Authority, o = Go Daddy Group\, Inc., c = US
  CRYPTO_PKI: crypto_process_ra_certs (trust_point = gdinter)

  Import the "peripheral": wildcard cert

  Crypto ca import gdinter RECs
  ATTENTION: Registration certificate is configured with a complete domain name
  that differs from the fqdn of the system. If this certificate will be
  used for VPN authentication, this can cause connection problems.

  You want to continue with this registration? [Yes/No]: Yes

  % The FQDN in the certificate name will be: mydomain.tld

  Enter the base 64 encoded certificate.
  End with the word "quit" on a line by itself

  -BEGIN CERTIFICATE-
  -CERTIFICATE OF END-
  quit smoking

  ERROR: Cannot analyse or check the imported certificate
  CRYPTO_PKI: cannot define ca cert object (0 x 722)
  CRYPTO_PKI: status = 65535: could not get the key of the cert usage

  You can see a problem due to not have generated the CSR on the SAA (with ASA's private key) because you use a character generic cert.

  There is a here document which explains how to get around that.

• Secure gateway problem

  I have a problem with connecting through Secure Gateway.

  The following error occurs when access to the content environment using Secure Gateway

  

  -L' environment manages 2 servers Secure Gateway (load balanced using Fortigate)

  -Secure gateway servers are configured to run Connection Broker and RDP using the same IP address

  -Its configured to use an ssl wildcard certificate

  

  I cannot pntsc use with success (from the outside) and retrieve the office setting (on Secure Gateway).

  The client is configured as below (same FULL domain name is used that matched the wildcard cert)

  

  

  The proxy for Connection Broker and Proxy for the RDP traffic using the same IP and port, which is accessible from the outside because I can conect with success the broker through the Secure Gateway, what could be the problem with the part of proxy RDP? Specifc parameters for Fortigate?

  The bridge of desktop services shows that at the time of the error:

  10:56:19 - 2924:2772 - security [972] context OK

  10:56:19 - 2924:2772 - SSL handshake ok [972]

  10:56:19 - 2924:2772 - [972] given Extra after the SSL handshake

  10:56:19 - 2924:2772 - [972] reading data, 569 bytes

  10:56:19 - 2924:2772 - client full ticket, broker auth required = true

  10:56:19 - 2924:2772 - CProxyThread::validateTicket [972]: ticket timeout = 300, connect the window = 15

  10:56:19 - 2924:2772 - [972] CProxyThread::validateTicket: CTicketCache::handleConnectMsg returned 3

  10:56:19 - 2924:2772 - CProxyThread::validateTicket [972]: ticket not found in the cache, with broker ticket validation...

  10:56:19 - 2924:2772 - CProxyThread::validateTicket [972]: successfully validated the ticket

  10:56:19 - 2924:2772 - CProxyThread::validateTicket [972]: after validating, call the addTicketAfterValidateIf returned 4

  10:56:19 - 2924:2772 - CProxyThread::validateTicket [972]: ticket added, connection was not possessed or current thread added to the owners, after validation

  10:56:19 - 2924:2772 - CProxyThread::ConnectToServer [816]: disable the nagle algorithm

  10:56:19 - 2924:2772 - * Handle to Thread [972 816] 00000478, Id 00000ad4

  10:56:19 - 2924:2772 - Start [972 816]: 9:56:19.112 08/01/2014

  10:56:19 - 2924:2772 - [972 816] NL, XXXX, XXX, XXX XX XXXX, XXXX, XXXX, Wildcard SSL, *. [email protected], of 10.3.72.32:3389

  10:56:29 - 2924:2772 - Server [972 816] Recv 0

  10:56:29 - 2924:2772 - [972] CTicketCache::handleProxyEnd returned 10

  10:56:29 - 2924:2772 - [972 816] proxy's client 0 bytes, 0 bytes Server

  10:56:29 - 2924:2772 - Server SSL channel cleaning [972]

  10:56:29 - 2924:2772 - [972] 37 bytes of handshake data sent

  10:56:29 - 2924:2772 - [972] 0000 15 03 01 00 20 4 b 5 a: 96 c2 e0 a6 e5 1 7 a 1 d 89... K.Z.... z...

  10:56:29 - 2924:2772 - [972] finished cleaning.

  10:56:29 - 2924:2772 - end of thread [972 816].

  Clues?

  People with the same problem, we managed to make it work using the Source IP Hash option in the Fortigate.

  Thanks Andrew for the fast support!

• Bypass SSL Certification before going to the Passthrough Web

  I have WLC 2106.

  I have it configured as webpassthrough.

  whenever someone wants to connect, it certification request in Internet Explorer.

  is there a way I can get around the cert when you open IE it would take you to passthrough page?

  If you use the WIFI network for one type of access client, you probably want to buy a public SSL CERT vendors like Entrust, Verisign and RapidSSL are those that I have used in the past.

• Not pulling not updated on the Server internal Flash

  Hello

  Two years, I configured an internal server to distribute Flash updated to Windows endpoints. It works well, until he appears, this month of May.  My end points are so stuck on 13.0.0.214. If something has changed

  Check that I did:

  1. update script on the server always pulls files. Destination folder indicates v14 has been downloaded

  Pulling the version.xml from the update server to update internal (via https) confirms this.

  For info:

  < version >

  "" < ActiveX major= "14" " minor="0" buildMajor="0"" buildMinor= "145"/ >

  "' < Plugin major="14"" minor= "0" buildMajor= "0" " buildMinor="145"/ >

  "" < MacPlugin major= "14" " minor="0" buildMajor="0"" buildMinor= "145"/ >

  "< SAUConfig checkFrequency="1"/ >"

  < / version >

  2 CNAME 'flashupdate' is always in the DNS system

  3 domain wildcard cert is valid and linked to HTTPS such that I get no warning of the cert when you browse the internal update server https://flashupdate.domain.local (IIS 7)

  On an endpoint, here is a sample flashinstall.log (could not find the error codes mean!) for about the last 30 minutes. I used FlashPlayerUpdateService.exe to start manually.

  2014 7-9 + 14-45 - 44.830 [info] 1628 flashupdate.domain.local

  2014 7-9 + 14-45 - 44.830 [info] flashupdate.domain.local 1629

  2014 7-9 + 14-45 - 44.831 [info] 1614

  2014 7-9 + 14-45 - 44.831 [info] 1616

  2014 7-9 + 14-45 - 44.832 [info] 1618

  2014 7-9 + 14-45 - 44.835 [info] 1608

  2014 7-9 + 14-45 - 44.835 [info] 1612

  2014 7-9 + 14-45 - 44.837 [info] 1620

  2014 7-9 + 15-18-0, 225 [info] 1628 flashupdate.domain.local

  2014 7-9 + 15-18-0, 236 [info] 1629 flashupdate.domain.local

  2014 7-9 + 15-18-0, 238 [info] 1614

  2014 7-9 + 15-18-0, 239 [info] 1615

  2014 7-9 + 15-18-0, 240 [info] 1618

  2014 7-9 + 15-18-0, 242 1619 1063 [info]

  2014 7-9 + 15-18-0, 282 [info] 1628 flashupdate.domain.local

  2014 7-9 + 15-18-0, 283 [info] 1629 flashupdate.domain.local

  2014 7-9 + 15-18-0, 283 [info] 1614

  2014 7-9 + 15-18-0, 284 [info] 1615

  2014 7-9 + 15-18-0, 284 [info] 1618

  2014 7-9 + 15-18-0, 287 [info] 1608

  2014 7-9 + 15-18-0, 288 [info] 1612

  2014 7-9 + 15-18-0, 289 [info] 1620

  2014 7-9 + 15-18-0, 289 [info] 1604

  This is an output of LS endpoint for C:\Windows\SysWOW64\Macromed\Flash showing that nothing moves

  43871 total

  -r - r - r - 1 usergroup 16435888 May 15 12:18 Flash32_13_0_0_214.ocx

  -rw-rw-rw-1 user group 4609272 9 Jul 16:18 FlashInstall.log

  Usergroup - rwxrwxrwx 1 1863856 15 May 13:18 FlashPlayerPlugin_13_0_0_214.exe

  -rwxrwxrwx 1 user group 257712 May 15 13:18 FlashPlayerUpdateService.exe

  Group of users - rw-rw-rw-1 511152 May 15 12:18 FlashUtil32_13_0_0_214_ActiveX.dll

  Usergroup - rwxrwxrwx 1 847536 May 15 12:18 FlashUtil32_13_0_0_214_ActiveX.exe

  Usergroup - rwxrwxrwx 1 847536 15 May 13:18 FlashUtil32_13_0_0_214_Plugin.exe

  -rw-rw-rw-1 user group 16361136 May 15 13:18 NPSWF32_13_0_0_214.dll

  Group of users - rw-rw-rw-1 1583299 May 15 12:18 activex.vch

  Usergroup - rw-rw-rw-1 856 15 May 13:18 flashplayer.xpt

  -rw-rw-rw-1 user group 0 9 Jul 16:25 ls.txt

  -rw-rw-rw-1 user group 135 9 Jul 15:52 mms.cfg

  -rw-rw-rw-1 user group 1598803 May 15 13:18 plugin.vch

  The mms.cfg looks like:

  AutoUpdateDisable = 0

  SilentAutoUpdateEnable = 1

  SilentAutoUpdateServerDomain = flashupdate.domain.local

  SilentAutoUpdateVerboseLogging = 1

  I know that

  1. the internal update server is able to communicate with Adobe and download the updates (I used wget in verbose mode to check the result).

  2. on the verge of ending, I manually browse and download files update v14 without problem, so config and web hosting permissions looks ok

  3. the update of the endpoint for a reason any still refuses to remove the updated files. So, the idea seems to be in the mysterious error codes?

  So I'm stuck - please help!

  Hello

  I'm glad it works for you now.

  The Setup log file you posted contains any errors, codes just information that indicates the proper functioning of the background update features.

  To clarify one of your points, the internal update server does not communicate with Adobe servers to download the update package.  As an administrator, you or someone else, would need to download the update package (fp_background_update.cab) and send the files (in the structure provided) on your internal server.  It is a process unless automate you it.  Once the files are displayed on your server, it can take up to an hour for updates start to appear on your machines users (of course, depending on how your environment is configured, you can to clear the cache of your server so that the new files to download).

  --

  Maria

• ISE supports wildcard certificates?

  Hello guys,.

  My client is not a certification authority, but has rather wildcard certificates.

  I implémenterai ISE in 3 locations (each location independent and with all the services of the ise). don't have look in the dept of wildcard certificates, but ISE supports this type of certificates? The certs I need is only for corporate users of not shown with the ssl certificate error when accessing the ise portals content.

  If wild certificates supported, then each independent site will have to create a separate CSR for each of them?

  Thank you!

  Emilio

  Version 1.2 that comes out seems to, but not the old version.

  

• How can I know the FULL domain name &amp; names for the installation of a digital certificate Public in ISE?

  We are implemented a project with Cisco ISE; but comments Portal appears to users as a "untrusted site". For problems, a public digital certificate must be installed in Cisco ISE, so he can send it to users who enter the comments Web portal.

  Now... to sell me the certificate, VERISIGN needs to know settings ISE of the certificate, such as name of area COMPLETE, names subnames, etc... How can these parameters of ISE?

  Thaks a lot!

  This isn't an easy question to answer, there are a ton of variables to include

  Local web site Central Web Auth or Auth

  LWA, the WLC is the "man in the Middle" to the request of the customer for PSN (server nodes), the WLC takes the request webauth and resembles webauth then the redirect URL that you put in the WLC

  If the redirect webauth URL is https://ise01.mycompany.com:8443/guestportal/login.action, the WLC is a redirect but the virtual IP address comes in 1.1.1.1, who was as trustworthy or redirection complains, then you may have to get the public certificate for the fqdn of 1.1.1.1, and the comment server. You can create a CSR using openssl or you can just enter in ISE and create a CSR, but you can only set CN = ise01.mycompany.com and nothing else, as long you have a single NHP is good, but if you have several Ssnp, you need to change your CSR so that you have to use openssl to create CSR using a file openssl.cnf and then with openssl, you do the following:

  openssl req - new - nodes-out openssl.cnf omf-01 - ise04.csr - config

  You must do it the way I said above regardless of CWA or LWA, if you have more than one PSN, you must point to a FULL VIP domain name and then configure your DNS to answer for these host names. With LWA, you get virtual IP WLC involved 1.1.1.1, so you don't have to worry about getting a certificate for this, it is a cleaner installation, but you must always do all the rest. It must ensure that users of your guests have the opportunity to join the portal comments and be able to solve the given DNS the dns server that they have been configured with.

  Content of the file openssl.cnf:

  [req]
  nom_distinctif = req_distinguished_name
  req_extensions = v3_req
  default_bits = 2048

  [req_distinguished_name]
  countryName = name of the country (2-letter codes)
  countryName_default = en
  localityName = name of the locality (for example, City)
  organizationalUnitName = organizational unit name (for example, section)
  commonName = Common Name (eg, YOUR name)
  commonName_max = 64
  emailAddress = Email address
  emailAddress_max = 40

  [v3_req]
  keyUsage = keyEncipherment, dataEncipherment
  extendedKeyUsage = AutClient, serverAuth
  subjectAltName = @alt_names

  [alt_names]
  DNS.1 = guest.mycompany.com
  DNS.2 = guest.mycompany.com
  DNS.3 = ise01.mycompany.com

• ISE rebuild - Cert Question

  Had to rebuild our ISE primary and secondary (HA) devices because of the hardware failure. Currently, I have improved the capacity of the disk with disks mirrored with HSP. In the reconstruction, I was unable to use my backup.

  So my question is: if I have to generate a new certificate request (CSR) signature to get my CERT to bind correctly?

  Thank you

  Dave

  Hello

  When you rebuild the ISE server, it will bring self cert signed thereon.

  You can also join servers with self signed certs.

  Make sure you self-signed the other needs to be there in the store of trust of ISE.

  Config backup contain also system certificates.

  Concerning

  Gagan

  PS: rate if this can help!

• Wildcard SSL Cert "Installed successfully", but doesn't show - ASA5505 9.2 (2) 4

  I am installing a certificate with wildcards on an ASA5505, but it is not appear after installation.

  The cert is in use elsewhere very well.  I installed the intermediate CA certs and which shows very well.  Import the PKCS12 format file (also imported elsewhere very well).  Interface ASDM said that it has been imported "successfully."  But the cert never appears in the list of installed certificates, or it appears in drop downs to assign a cert to an interface.

  Thoughts?

  Please try to download the certificate via the command line:

  Example of configuration:

  conf t

  Crypto ca trustpoint Wildcard_certificate
  Terminal registration

  output
  !
  crypto ca Wildcard_certificate pkcs12 import

  "Then paste the PKCS12 PEM format" and type "quit" and then Enter.

  While you download the certificate please activate debugs the following on the SAA.
    debug operations cryptographic ca 255
  Crypto ca 255 debug messages

  Debugs will give a clear picture of what happens when you try to download the certificate.

  Concerning

  Véronique

• ISE cert

  When I generate a cert and use THAWT tiral version to try the cert, demand that I copy - paste it says:

  The CSR must include an organization name.

  I use ISE 1.1.1

  https://SSL-Certificate-Center.thawte.com/process/retail/trial_product_selector;JSESSIONID=05DB2EB1E2E8FD67154B46999D600182? UID = f7293ccbbdb28c74c6a817943e96b3bd & local = THAWTE_US

  Hello

  Please use this guide to generate the csr, I couldn't see the link you posted above. You have a screenshot of the error, also a screenshot of the CSR details?

  http://www.Cisco.com/en/us/docs/security/ISE/1.1.1/user_guide/ise_man_cert.html#wp1077292

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• extract 'e' string of public key parameter appearing in cert digital.

  Hello
  How can I extract the "e" parameter of a digital public key (2048 bits) RSA appearing in cert chain. ? In the internet properties > content > certificates
  I can get this param. Besides (don't have the key code...).
  
  Thank you
  
  example:
  30 82 01 0 a 02 82 01 01 00 c4 2d 15 d5 8 c 9 c 26 4 c this 35 32 eb 5f 59 01 a6 5 a 61 81 59 3 b 70 b8 63 ab e3 dc 3d c7 2A b8 c9 d3 33 79 e4 3A ed 3 c 30 23 84 8 b3 30 14 b6 b2 87 c3 3d 95 54 04 9th df 99 dd 0 b 25 1st of 21 65 29 7 35 a8 a9 54 eb F6 f7 32 39 26 55 95 ad ef fb fe 58 86 9th d7 d4 f4 00 8 d 8 c 2 has 0 c 42 04 bd this a7 3f f6 04 EA 80 f2 ef 52 69 66 a1 aa da be 1 ad 5 d to da 2 c 66 ea 1A 6B bb e5 1A 51 4A 00 48 98 75 29 b9 d8 c7 2f C8 ee f8 66 6 d 0a 9 c f3 CF 78 b3 7 c a2 f8 a3 f2 B5 c3 f3 b9 7 a 91 c1 a7 e6 25 2nd ed 12 65 6F f6 a8 9 c 6 a 12 44 53 70 30 95 c3 9 2 b 58 2 b 3d 08 74 4A f2 c be 51 b0 bf 87 d0 4 c 27 58 6B b5 c5 35 9 17 31 0 b 8f f8 af d EE 81 36 05 89 08 98 FC 3 ad has 25 87 c0 49 ea a7 fd 67 f7 45 8th af 97 cc 14 e2 39 36 85 7th b5 1A 37 fd 16 f6 71 9 a 11 74 30 16 fe 13 94 a3 3f 84 0d 02 03 01 00 01 4f

  BigInteger e = ((RSAPublicKey)CertificateFactory.getInstance("X.509").generateCertificate(new FileInputStream(certFile)).getPublicKey()).getPublicExponent();