Re: My bank has an invalid cert

2011-08-26 Thread Crypto Sal
ows... toss out the extra monitors and set the display to 800x600. Well not quite that bad but close. If I have much more trouble with them I'm going to close my accounts. On Thu, Aug 25, 2011 at 05:08:40PM -0400, Crypto Sal wrote: Do you log into 'Web Broker' or 'Easy Web&#x

Re: My bank has an invalid cert

2011-08-25 Thread Crypto Sal
it and you break it. Something is desperatly wrong. On Thu, Aug 25, 2011 at 02:10:11PM -0400, Crypto Sal wrote: Firefox has its own certificate store. It doesn't share '/etc/ssl/certs'. If we had the bank URL, we would be able to better help you to resolve this issue. On 08/25

Re: My bank has an invalid cert

2011-08-25 Thread Crypto Sal
error message which Firefox generates because I can't find the root cert. On Thu, Aug 25, 2011 at 04:44:07PM -0400, Crypto Sal wrote: Can you please *be* specific and provide us with an exact URL for those of thus that don't live in Canada or use TDWaterhouse? I see TD has several sit

Re: My bank has an invalid cert

2011-08-25 Thread Crypto Sal
wrote: TDWaterhouse In Canada. I'm in Calgary. THose idjots tell me to reboot my computer when their Apache servers in TO send me a misconfiguration message. I told them yesterday we build it and you break it. Something is desperatly wrong. On Thu, Aug 25, 2011 at 02:10:11PM -0400, Crypto

Re: My bank has an invalid cert

2011-08-25 Thread Crypto Sal
Firefox has its own certificate store. It doesn't share '/etc/ssl/certs'. If we had the bank URL, we would be able to better help you to resolve this issue. On 08/25/2011 01:45 PM, t...@terralogic.net wrote: I know you are trying to help. But it doesn't help me to defer to a package manage

Re: issue with p12 creation and network solutions EV SSL

2011-04-23 Thread Crypto Sal
On 04/21/2011 06:51 PM, James Chase wrote: I have done this multiple years in a row with the exact same process but now I get the following error when I try to create my SSL: openssl pkcs12 -export -chain -CAfile cachain.crt -out my.domain.com.p12 -inkey my.domain.com.key -in MY.DOMAIN.COM.crt

Re: Cert chain verification failures

2011-03-30 Thread Crypto Sal
On 03/29/2011 01:16 PM, David Coulson wrote: On 3/29/11 12:58 PM, Bruce Stephens wrote: Add the -showcerts option to the s_client commands and you'll see the first server returns a chain of certificates where the second offers only the end server certificate. Okay, I see that - Makes sense. When

Re: Client certificate chains

2011-03-21 Thread Crypto Sal
On 03/22/2011 12:09 AM, plot.lost wrote: Or do you simply mean you looked manually at the x509 output (probably -text) and it looks correct to you? Yes, using -text to manually check the chain. Have you confirmed this alert is in response to your cert? You can use s_client with -debug, or r

Re: Intermediate root CA's -- lost and confused :( **SOLVED**

2010-09-13 Thread Crypto Sal
On 09/13/2010 10:12 PM, Paul B. Henson wrote: On Mon, 13 Sep 2010, Tim Hudson wrote: You need to correct your server configuration so that it correctly sends out the chain. Ok, I figured out what was wrong. I only had the SSLCertificateChainFile configured in the specific ssl virtual host, b

Re: Adobe Acrobat Certificates?

2010-08-16 Thread Crypto Sal
On 08/16/2010 10:52 AM, Jakob Bohm wrote: On 16-08-2010 11:51, Steve Roylance wrote: Ivo, GlobalSign offers Adobe CDS based certificates to the market so we are very familiar with Adobe Acrobat. If you want to create a simple PKCS#12 self signed certificate and you have Acrobat Pro, then

Re: 1.0.0o no fallback to SSLv2?

2010-08-15 Thread Crypto Sal
On 08/14/2010 09:11 PM, Stefan de Konink wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Dear Steve, Op 15-08-10 01:52, Dr. Stephen Henson schreef: OpenSSL 1.0.0 doesn't include any SSLv2 cipersuites by default and new logic means it doesn't send out an SSLv2 compatible client hello if

Re: Stunnel 4.29 released

2009-12-03 Thread Crypto Sal
Works fine for me on Windows 7 (IE 8 and FF 3.5.5) On 12/03/2009 03:02 PM, Carter Browne wrote: I think it is a problem with your website - the copy on the backup site works properly. The browsers think the .exe file is a directory not a file. I've had not problems with earlier versions (sta

Re: how to merge multiple public domain certs into one file?

2009-11-16 Thread Crypto Sal
On 11/16/2009 03:46 AM, Hécber Córdova wrote: Since 0.9.8f OpenSSL supports SNI (server name indication) TLS extension. Support of this extension in mod_ssl is discussed on httpd-...@apache.org for years, and even if it haven't yet got into release, you definitely can find patches in the apache b

Re: cURL, paypal, and .cer files

2009-08-23 Thread Crypto Sal
On 08/20/2009 10:25 PM, btate wrote: I'm trying to integrate with paypal's payflow gateway via cURL. I can't for the life of me get their certificates right and neither paypal or verisign seem to have any idea how to do it. So I'm going to ask here. I basically have a bunch of .cer files that

Re: Howto create a certificate for multiple domains?

2009-08-12 Thread Crypto Sal
On 08/12/2009 09:50 AM, Goetz Babin-Ebell wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 deblarinteln schrieb: | Hi, | | well I have to create a certificate for our maindomian as well as for some | subdomains. | | The structure will look pretty much like this: | | mydomain.tld | mail.myd

Re: Maximum RSA/DSA key length

2009-07-30 Thread Crypto Sal
On 07/30/2009 08:05 AM, Alexander Lamaison wrote: I'm calling PEM_read_bio_RSAPrivateKey and PEM_read_bio_DSAPrivateKey with private keys loaded from files on disk. I read the file into a string, put that into a BIO and then call the function. At the moment, I'm reading the entire key file into

Re: cannot create openssl master certificate on my Exchange2007 Server!Help needed!

2009-07-22 Thread Crypto Sal
Exchange2007 will accept both a CER file (binary encoded PKCS7 file or straight up PEM encoded PKCS7 file) or a PEM (Base64) encoded crt file via the *Import-ExchangeCertificate* cmdlet. Same can be said for IIS 6 and 7. Both Default to the CER container format. Exchange2007 has a function to

Re: creating a certifiicate chain

2009-06-06 Thread Crypto Sal
On 06/06/2009 05:35 PM, Jerry Wang wrote: Hi, Does OpenSSL already have a function for creating a certificate chain? Thanks, Jerry Jerry, It depends how you mean it. Do you want OpenSSL to create the Root and the Intermediates and then the Entity cert? Or are you looking for OpenSSL to co

Re: TLS w/LDAP

2009-05-30 Thread Crypto Sal
On 05/30/2009 12:52 AM, John Kane wrote: Thanks for the response, Kyle. I've pretty much deduced what the error is, but just cannot figure out where it is coming from. It only happens when I turn on TLS for LDAP. There are really no 'variables' defined in the LDAP configs; nothing using the

Re: Passing parameters to openssl for CSR

2009-01-27 Thread Crypto Sal
On 01/27/2009 08:57 PM, Thor wrote: Hi guys, I'm wondering if its possible to pass parameters to openssl when creating a CSR, specifically the country name, state name, locality name, organization name, common name etc? The reason being, I ideally would like to automate the process of creat

Re: One certificate for both hostname and IP

2009-01-26 Thread Crypto Sal
On 01/26/2009 08:40 PM, Marco De Vitis wrote: Il giorno 26/gen/09, alle ore 05:14, Crypto Sal ha scritto: Do any other clients (s_client, web browser, etc) exhibit the same behavior or an error message? If yes, what's the error response? Well, I currently do not know how to apply

Re: One certificate for both hostname and IP

2009-01-25 Thread Crypto Sal
On 01/25/2009 11:35 AM, Marco De Vitis wrote: Il giorno 24/gen/09, alle ore 16:54, Dr. Stephen Henson ha scritto: You don't say which give a warning. If you use the IP version in subjectAltname do you get a warning for the hostname or the IP address? If the hostname but not IP address try addi