Tag Info

Hot answers tagged

77

Installing a root/CA Certificate Given a CA ceritificate file 'foo.crt', follow these steps to install it on Ubuntu: Create a directory for extra CA certificates in /usr/share/ca-certificates sudo mkdir /usr/share/ca-certificates/extra Copy the '.crt' file to the directory sudo cp foo.crt /usr/share/ca-certificates/extra/foo.crt Let Ubuntu add the ...


36

Given a CA certificate file 'foo.crt', follow these steps to install it on Ubuntu: First, copy your CA to dir /usr/local/share/ca-certificates/ sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt then, update CA store sudo update-ca-certificates That's all. You should get this output: Updating certificates in /etc/ssl/certs... 1 added, 0 ...


11

You can download the certificate manually with openssl and add it into your local trusted certificates: echo -n | openssl s_client -connect download.01.org:443 | \ sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | \ sudo tee '/usr/local/share/ca-certificates/download_01_org.crt' sudo update-ca-certificates


9

Run sudo dpkg-reconfigure ca-certificates That should give you a list where you can deselect CAs. The list of CAs is stored in the file /etc/ca-certificates.conf. If you edit this file manually you need to run sudo update-ca-certificates to update the actual certificates in /etc/ssl/certs/ (if you use dpkg-reconfigure that is done automatically). ...


9

The problem here is that Firefox does not have a 'central' location where it looks for certificates. It just looks into the current profile. That's why modifying /usr/share/ca-certificates or other similar directories won't work with Firefox. This is something that has been requested for years; see issues 620373, 449498 and 454036 (and probably there are ...


7

The easiest way is to import the certificate into a sample firefox-profile and then copy the cert8.db to the users you want equip with the certificate. First import the certificate by hand into the firefox profile of the sample-user. Then copy /home/${USER}/.mozilla/firefox/${randomalphanum}.default/cert8.db into the users firefox-profiles. That's it. ...


7

Anyone can teach about Ubuntu and a certification is not required. Manuals for 11.10 can be found here. Particularly the Ubuntu desktop help will be useful to you if you want to cover the desktop (the other 2 are about server and installing).


6

Given the extra information you've provided, it is probably easier for me to start another answer. It doesn't appear that the dummy "snakeoil" certificate is being presented to the Windows client. The "snakeoil" certificate is generated with a subject of CN=Ubuntu, while the certificate being presented to the Windows box has a subject of CN=Production. So ...


4

Part One: With Firefox, back up the certificate as a .p12 file. In Firefox, click Edit > Preferences to display the Preferences dialog. On the Preferences dialog, click the Advanced button. On the Advanced form, click the the View Certificates button to display the Certificate Manager dialog. On the Certificate Manager dialog, click the Your ...


4

You could disable password-based login on the ssh server and remove the iptables rules. Nobody will then be able to brute-force a password-login because it's disabled, but trusted users with their key-pairs would be able to login from everywhere. To limit the usage of the keys, you can specify which hosts they can be used from with the from parameter in ...


4

This is a known bug in wget 1.12. As you are running an unsupported version of ubuntu the best course of action would be to upgrade to a supported version . wget 1.14 is the latest version in ubuntu and has fixed this bug.


4

Why must Ubuntu respect Indian law? Mozilla handles the certificate vetting for most Linux distributions (and most applications - even Chrome uses's Mozilla's NSS AFAIK) and they're bundled into ca-certificates along with some Debian infrastructure certificates. Mozilla is the party that the Indian government has to prove their value to. They've been in ...


3

I went around for a bit, and seems that your "Company name" is too long for openSSL. This is a bug. You should upgrade your system to precise or later to fix this. Remove any blocking package and upgrade your system. That should fix the issue.


3

It may be too late to help you, but I'm posting this here for future reference. I had the same problem. I ended up just typing the file name in the address at the top and it worked. Took me an hour to figure it out though.


3

You can sign PDF files with gpg/seahorse. Learn more: https://help.ubuntu.com/community/GnuPrivacyGuardHowto You can for instance use OpenSignPDF, that can be download here: http://opensignature.sourceforge.net/english.php I hope this answers your question.


3

1 . No 2.Yes you can use. But you should obtain permission from canonical 3.AFAIK no 4.I don't know about such sites, But you are already doing it here(askubuntu.com) 5.There is no need of permissions to teach ubuntu


3

The "snakeoil" certificate is automatically generated when the ssl-cert package is installed. It is a self signed certificate, so revoking it doesn't make much sense. You can easily generate a new one though: sudo make-ssl-cert generate-default-snakeoil --force-overwrite You will probably have to restart any service that was making use of that ...


3

You removed all certificates yourself when you ran sudo rm -rf /etc/ssl/certs/*. That broke your system. One thing you can do to fix this is to reinstall the package they come from: sudo apt-get install --reinstall ca-certificates This should be relatively safe. If that doesn't work, you may need to purge the package out and reinstall it but don't attempt ...


3

Ok, found the answer after much poking around and searching. apt-get install ca-certificates Probably apt-get install ssl-cert is needed too if you haven't already installed it.


3

They are NOT safe and that is why they are marked as Untrusted. These were bogus certificates. See this article on EFF: On March 15th, an HTTPS/TLS Certificate Authority (CA) was tricked into issuing fraudulent certificates that posed a dire risk to Internet security. Based on currently available information, the incident got close to — but was not ...


3

Turns out it there's a bug with certificates in Pidgin 2.10.10 (libpurple 2.10.10): In version 2.10.10 it's no longer possible to connect to a XMPP server which uses a self signed SSL certificate. The error message is: The certificate for could not be validated. The certificate chain presented is invalid. The connection is possible if the ...


3

Extensions .crt, .pem and .cer are interchangeable, just change the file name extension, they have the same form. Try this: $ sudo cp mycert.cer /usr/share/ca-certificates/mycert.pem $ sudo dpkg-reconfigure ca-certificates $ sudo update-ca-certificates $ git config --global http.sslCAInfo /usr/share/ca-certificates/mycert.pem


3

TL;DR For everything to work and not only your browser, you need to add that CA certificate to the system's trusted CA repository. In ubuntu: Go to /usr/share/ca-certificates/ Create a new folder, i.e. "sudo mkdir school" Copy the .crt file into the school folder Make sure the permissions are OK (755 for the folder, 644 for the file) Run "sudo ...


2

To access a website with https, whether you are using a CLI or GUI browser, you don't need your shool certificate. To use git via http(s) you need to register your public key in your profile settings on GitHub. More infos here. Change your GitHub profile here. Try this: sudo apt-get install w3m w3m https://github.com/ … works without an additionally ...


2

As alternative you can download the ssl certificate by hand. Afterwards pidgin starts without problems. To download the certificate you can use openssl command line utility. leo@linu:~/.purple/certificates/x509/tls_peers$ openssl s_client -connect YOUR_SERVER:PORTNUMBER Now copy the part beginning with "----BEGIN CERTIFICATE----". If you print the ...


2

I've sent a message on 01.org contact form concerning this certificate problem and linking to this thread. We'll see if it's a man in the middle attack, a server misconfiguration or a new parent certificate unknown on client side. update, I had a response from intel : Appreciate you letting us know. We are aware of the situation and we are ...


2

Check System date time and timezone in Ubuntu. Provide Proper time and timezone and then try to browse https site. If you have wrong time in your system you will get Untrusted connection error while connecting to site that uses ssl.


2

If you're fine with using the command line, this is easily done using gpg --gen-revoke. The revocation certificate is stored in revoke.asc (in your home directory if you do not change anything else) and you should replace mykey by your key id. gpg --output revoke.asc --gen-revoke mykey Remember to store it in a save place, for example by printing it to a ...


2

I also have this problem, try this: openssl s_client -host google.com -port 443 this command will also print a cert chain, the last one is: s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority so you also need ...



Only top voted, non community-wiki answers of a minimum length are eligible