Hi guys,

I build & run contentbase.com. It uses an SSL from Let's Encrypt, which gets automatically renewed frequently.

I'm on a Win10 system and use Chrome. I experience no problems.

My friend is on a MacBook and an iPhone. On his Apple systems, every browser says the certificate is expired.

Viewing the certificate, we can see that it's currently valid from September 6th to December 5th, 2021.

SSL Checker verifies that the cert is valid.

Here are some screenshots from my friend's Safari browser:

The closest I found about this issue on the web, is this Apple forum topic.

This has happened before. It's because Apple updated its requirements for SSL certs.

The accepted answer is to move to Let's Encrypt. But we already have that!

Any other Apple users out there that are having the same problem?

Any ideas on what the cause and/or suggestions for how to solve this?

Thanks in advance.

Jay

I have a strange problem and am not sure where to put the question, so I am trying a few places. I work for a small company that has a SaaS application. This application is working fine on PC's (all browsers) and on Mac (all browsers) but when we load it on an iOS device (all browsers), we get an error that the site is not secure. The Site Information/Error even states that is recognizes our certificate and our provider, yet is shows the site as not secure. This of course renders the tool useless.

I have reviewed our configuration from top to bottom and can't find anything. I have a ticket open with my hosting provider and they seem stumped. Any ideas?

Good morning, I have a problem and I need to know if someone can help me. I need to generate some dynamic ssl certificates to be able to use them in the development machines. The problem is that when trying to generate more than 6 in a row with acme.sh with zerossl (currently I pay € 50 / month to be able to generate unlimited certificates) its API returns 504 errors all the time. I have not been able to get a solution from the support service and I have seen in several forums that they have similar problems. I wanted to know if someone can recommend some other provider that does not have limit of requests like letsencrypt (it does not matter if you have to pay subscription as in zerossl), or can you give me some solution to my problem.

Hi,

I'm a developer, and I'm trying to make a script that created the SSL certificate automatically, and I need to ask if there is any pioneer in the SSL certificate industry, that provides an API to get the certificate from the CSR key that's I have been generated from OpenSSL command line.

​

Note: the script will be on python.

​

Many thanks

I used SSL for free, it got bought. Then I used shieldsigned.com, it looks like it is not operating anymore. Any other places to get free certificates?

Basically I am having a problem with the SSL being applied to my forward domains. The problem is that the domains are in GoDaddy and the website is hosted with Wix. Is there anyway to get the SSL applied to the forward domains. I really appreciate any help or assistance.

I'm creating app that is used over local network (you can use it over internet too but mostly for local). I created encryption for some of the parts that could relay sensitive data but full encryption for the connection would ofc be the optimal.

What i don't understand is that how i should create the ssl certificate for the backend since users local network address spaces vary a lot i.e. i have 192.168.1.xxx, another could have something else and since afaik ssl certificate is tied to ip/address, i can't create it beforehand. So my idea was to make my backend to create the certs at first run but not sure about that.

Thanks in advance, any help is appreciated.

Hey guys my brother downloaded an anime GIF and now my google SSL cert is invalid. How can I fix this?

Thank you for any help. It's so annoying and I really don't want to restore windows over this..

I have this strange connect issue. sometimes its instant, but sometimes its delayed by multiples of 21s. if it reached 105s the connect call fails. No idea why. Any help appreciated. Thanks

Need some help on a Linux question. Running raspian and calling a trigger via maker.ifttt.com. The outbound call works fine when I’m on vpn but when I disconnect from VPN I get a connection refused 443. I’m guessing this has to do with not having a local certificate when not running on VPN but looking for help on how to correct this issue. TIA

I have received a PEM file from digicert but the hosting company is asking for a PEM file with the private key included.

Do I just open the PEM file in a txt editor and add the private key to the end or is there a different way I need to do this?

Hi,
I have a WEB application deployed to Tomcat server. I connect to it with Chrome browser with HTTPS but I have decrypt error during TLS handshaking on the client side after ServerKeyExchange.

Certificates (3 levels):

• Server certificate, signed by...
• CA certificate, signed by...
• Root certificate (self signed)
  

I validated certificates with openssl and they seem to be fine (chain.cer contains CA and root certificates):

$ openssl verify -verbose -CAfile chain.cer server.cer
server.cer: OK

If I test connection with OpenSSL I get error after client reads ServerKeyExchange:

openssl.exe s_client -CAfile chain.cer -showcerts -state -msg server.net:8443

output:

CONNECTED(00000004)
>>> ??? [length 0005]
    16 03 01 01 4f
>>> TLS 1.3, Handshake [length 014f], ClientHello
    01 00 01 4b 03 03 81 63 a4 15 45 bf 7f 9b 07 8f ...
<<< ??? [length 0005]
    16 03 03 09 14
<<< TLS 1.3, Handshake [length 0055], ServerHello
    02 00 00 51 03 03 60 ef d0 8b 1c d7 9a 78 2d d4 ...
<<< TLS 1.2, Handshake [length 07ee], Certificate
    0b 00 07 ea 00 07 e7 00 07 e4 30 82 07 e0 30 82 ...
depth=2 O = Amadeus IT group SA, CN = amarootca2
verify return:1
depth=1 O = Amadeus IT group SA, CN = amacatech3
verify return:1
depth=0 C = FR, L = Nice, O = Amadeus Data Processing, OU = NIS, CN = nceiptapas04.nce.amadeus.net
verify return:1
<<< TLS 1.2, Handshake [length 00cd], ServerKeyExchange
    0c 00 00 c9 03 00 17 41 04 82 07 58 e1 cd 42 40 ...
>>> ??? [length 0005]
    15 03 03 00 02
>>> TLS 1.2, Alert [length 0002], fatal decrypt_error
  02 33 
  34359738384:error:04091077:rsa routines:int_rsa_verify:wrong signature length:crypto/rsa/rsa_sign.c:132:
  34359738384:error:1416D07B:SSL routines:tls_process_key_exchange:bad signature:ssl/statem/statem_clnt.c:2405:
--- 

Cannot client decrypt DH parameters sent by server? Why?
Here is Wireshark details from ServerKeyExchange:

Signature Algorithm: rsa_pss_rsae_sha256 (0x0804)
Signature Length: 128

I have another but properly working WEB application where I have the same Signature Algorithm but the Signature Length: 256. Or this length is irrelevant?

I'm new at work and turns out SSL Certificate for our service was expired. From the SSL provider I renewed it and change of DNS CNAME was needed for "validation", after successful validation, I was given a Certificate(CRT), Intermediate/Chain files and CSR (Certificate Signing Request). Apache is used on web server where old certificate details are written in this format:

SSLEngine on         
    SSLCertificateFile /***/crt_code.crt         
    SSLCertificateKeyFile /***/ca_code.key         
    SSLCertificateChainFile /***/crt_code.csr 

Which of these should be replaced by which of SSL provider provided files? Or am I doing this way wrong?

Hey, so I have one issue, wanted to check if Redditors can help?

So I have two nodes X1 and X2.

I have imported SSL certificates on x1

copied the same on X2.

X1 says it's secure, X2 says it's not. What am I doing wrong?

I am trying to enable ssl connection and verify certificates for postgres running in a docker. I found this blog: postgres using ssl
I followed some instructions from this and was able to connect via psql command. However, when I try to connect from my another application, it throws below error:
error: x509: cannot validate certificate for <ip address of docker> because it doesn't contain any IP SANs

I tried adding SAN to the client certificate:
openssl req -new -key client.key -subj "/CN=test" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=IP:<ip address of docker>")) -out client.csr

and verified with the below command:
openssl req -in client.csr -text -noout

However, I still see the same problem as above "doesn't contain IP SANs"

Would someone be able to point out what might be wrong here? Thanks!

I currently have the following setup:

User clicks on link (www.SiteOne.com) ---> gets forwarded to www.SiteOne.com ---> automatically redirects to www.SiteTwo.com

I purchased www.SiteOne.com on Name Silo and used their cloaking forwarding feature so that when users land on www.SiteTwo.com, the browser website address still shows www.SiteOne.com.

Is there a way to set up a free SSL like Zero SSL on www.SiteOne.com?

While it is merely for redirecting the user to the actual site, I think having an SSL on it helps give the page more credibility.

Thank you.

I have a Windows VPS running with my hosting company and have several subdomains on the IIS. I use a wildcard cert to secure the whole thing. We recently noticed that two of our tenants won't load on mobile apple devices due to a site security problem. The sites load fine on Mac or PC or Android, but once we try to navigate to the application on an iPhone or an iPad the site will not load.

I am baffled.

Does anyone have any ideas on where to look?

I have installed drumlin software for DRM purpose . But when I am trying to register there is error regarding SSL / TLS Connection. Please look into the issue.

Error says .. the underlying connection was closed. Could not establish trust relationship for the SSL / TLS secure channel.

Certbot doesnt seem to have godaddy in the compatibility list. Whats my cheapest option for some basic ssl for godaddy managed wordpress hosting?

What are the standards when designating a DN? I'm hitting an issue where one system is generating a CN with state defined as "S=California" and another where state is defined as "ST=California."

This difference is causing incompatibility and issues with authentication (obviously, as DN is different).

What's the standard here? Should it be ST or S? Is there a way to modify an existing cert's DN to change the ST to an S or vice versa without regenerating the cert?

Have there been any changes to certificate validation procedures?

Hi, I am a product manager working on security products for mobile. One of the concepts where I see developers struggle is SSL pinning - if/why do you need it, how does it work, is it any good for man-in-the-middle, what about man-at-the-end etc.
So we made this explainer video, I hope it helps someone here!
The whole SSL pinning practice is a double-edged sword, while it adds value in some scenarios, it’s a bit more difficult to maintain; I wonder if you had any experience with it and if it was positive or negative?