This answer is late but I wanted to post it for anybody else that comes searching in here: I found an MSDN blog article that gave a solution using CryptoKeySecurity here, and here is an example of a solution in C#: var rsa = certificate.PrivateKey as RSACryptoServiceProvider; if (rsa != null) { // Modifying the … Read more
Here is a list of four good books on the subject (SSL/TLS): SSL and TLS: Theory and Practice SSL and TLS: Designing and Building Secure Systems SSL & TLS: Essentials Securing the Web Network Security with OpenSSL Here are some good books on PKI: Understanding PKI: Concepts, Standards, and Deployment Considerations Planning for PKI: Best … Read more
Nginx has ssl_password_file parameter. Specifies a file with passphrases for secret keys where each passphrase is specified on a separate line. Passphrases are tried in turn when loading the key. Example: http { ssl_password_file /etc/keys/global.pass; … server { server_name www1.example.com; ssl_certificate_key /etc/keys/first.key; } server { server_name www2.example.com; # named pipe can also be used instead … Read more
I’ve just discovered that the files godaddy supplied with my certificate are both intermediate certificates (in fact they seem to both be the same intermediate certificate). I got the correct root and intermediate certificates by double clicking on my certificate and looking at the certificate path… from here I could also download each of these … Read more
I have solved this issue by converting this .crt file into a .pfx file using following method. To convert .crt to .pfx, we need CSA certificate (Private Key) provided by hosting provider. Below are the steps to convert this: Download and install OpenSSL software from below link based on your system type https://slproweb.com/products/Win32OpenSSL.html Run the … Read more
Yes, it is possible to do it with one server. But the caveat is that it works on clients that support SNI – which is most modern browsers. This is how you do it: //function to pick out the key + certs dynamically based on the domain name function getSecureContext (domain) { return crypto.createCredentials({ key: … Read more
Although this question was more specifically about IP addresses in Subject Alt. Names, the commands are similar (using DNS entries for a host name and IP entries for IP addresses). To quote myself: If you’re using keytool, as of Java 7, keytool has an option to include a Subject Alternative Name (see the table in … Read more