We're trying to connect to external HTTPS service in Tibco?
However upon clicking SSL url, it asked for certificate PEM file. May I know what's the reason?
The issue is external HTTPS service that I am trying to connect is authenticated by user name & password, and not via certificate.
Any information or reference is appreciated.
Thanks!
He is asking actually about the public certificate of the server you want to connect to. That the way to check that the server is really who it says it is, and therefore you ensure that the connection is trusted, and you are connecting where really you want.
Related
I am having a doubt regarding SSL certificate. We've some third party vendor who has exposed their services but asks for SSL certifcate to be attached in request.
Our java code is deployed on Weblogic server. Now we have configured SSL certificate (complete chain) in WLS using keystore. it's done on port 9003. Now when I connect with putty to my WLS over SSH and try to curl the test url of the third party vendor, I am getting un authorized error.
Upon inquiring the same to third party vendor, they said I must send my certificate with the request.
Now my question is, if my server is configured with the SSL certificate, do I need to attach certificate with every request ?
The certificate which is used to authenticate your server against some browser and the certificate which is used to authenticate yourself as a client against another server are unrelated. While in some cases they might be the same in other cases they are different. In other words: you need to attach the client certificate which is required by the other server with each request. curl will not magically do this for you.
I am trying to workout how to configure a CXF consumer to use https, but use basic authentication.
I presume we need to attach our certificate using the httpj:engine-factory but whenever I try and do that the server generated the follwing error:
javax.net.ssl.SSLHandshakeException: null cert chain
EDIT: I believe what is happening is that the server is requesting a client certificate, but the client does not send one. For "One Directional" SLL, I don't think the server should be asking for a certificate from the client.
How do I prevent the server from requesting a client certificate?
Any assistance greatly appreciated.
You need to install certificate in your JVM trust store. Please go through below link:
How to solve javax.net.ssl.SSLHandshakeException Error?
It turned out to be quite simple. In the httpj:engine-factory, there is a setting for client authentication.
<sec:clientAuthentication want="false" required="false"/>
This controls whether the server requests a certificate from the client. I had copied this from samples with Bi-Directional SSL and these values were set to true.
We have a web server running on linux machine where we configured 'SSLVerifyClient' as 'require' in ssl.conf file.
Does this needs client who is utilizing the service from web browser(like firefox or chrome) needs a certificate.
If yes, then it is not possible to distribute client certificate to every user as there can be some thousands of users, how to overcome this problem.
If no, then how the data passed over network is secure? I know that certificate helps in encrypting data so that no one who don't have certificate can read data.
Please help me in clarifying my doubts
If you don't use client certificate, the https connection is still safe:
Only the client and the server can read/write the content
The identity of the server is assured by a certificate authority
Client certificate only give you client authentication in the beginning of the connection. To encrypt the data, the public key of the server is used in the beginning (See public key encryption).
If you identify the client with cookies set after login/password submit, it is still safe: you have identify the client.
When SSLVerifyClient is set to require, the client MUST pass a client certificate. You would generate these via OpenSSL, and sign them with a certificate authority that you install via SSLCACertificateFile.
How you distribute those certificates is an issue you'll have to solve yourself.
I am trying to resolve a problem whereby trying to set a users password over LDAP is failing because of an access denied error - even though I am authenticating against the AD with an admin user.
An answer found in stackoverflow says that either I have to run the IIS user as the admin user (which does work) or i should connect to LDAP via SSL.
I cant go with the first option because I am using Elastic Beanstalk which will create and terminate instances so i cant change/set the user that IIS will be running as. So I am trying to use the LDAP over SSL idea.
My question is does that still require that the client itself also have a certificate installed in order to establish trust with the Domain controller? Or does this work just by installing a cert on the Domain controller and allowing the connection over SSL?
If it requires a certificate on the client then I have the same problem as i cant install anything on the client server other than the deployed app since Beanstalk is going to recereate and terminate that instance at will.
So does LDAPS require a cert on the client?
Is there a better way to solve my problem given the infrastructure i am using?
So does LDAPS require a cert on the client?
no, LDAPS do not require client certificate. Domain controller certificate is sufficient to utilize LDAPS. More details about LDAPS and certificate requirement: LDAP over SSL (LDAPS) Certificate
trying to set a users password over LDAP is failing because of an access denied error
there might be over9000 reasons why you receive this message. You need to check whether you are successfully authenticated on DC, if yes, check whether you have permissions and privileges (especially, if UAC is enabled). I would set up audit policies (on failed user password changes) and check Security eventlog to figure out what is going wrong.
No.
For openldap, I achieved this by adding this line to ldap.conf. But be aware of that, when you do that, your connections will be open to attacks like man-in-the-middle or any other.
TLS_REQCERT never
This is what I found using trial and error approach:
Actually, LDAPS server always asks for client certificate. You can verify that by turning on SCHANNEL log and observing the following message:
If there is no client authentication certificate than LDAPS connection still succeeds, i.e. no client authentication certificate is required indeed. But if you have some invalid client authentication certificate (in my case it was an expired cert installed long ago by a third party app) the connection will fail w/o any error or warning in SCHANNEL log on the client side. It took me a while to figure this out.
Yes of corse your client need a certificate to allow ladps communication betwen
him and de server.
According to
windowsitpro.com:
As an option, you can use LDAPS for client authentication -- but doing so requires that you also install a client authentication certificate on each of your clients."
I need to make something like ssl certificate authentication at website. As far as I understand my task I need to get user's ssl certificate and send it to server what will decide can user be authenticated or not.
How can I get user's SSL by javascript and send it to server? Is it possible at all? Or maybe my approach is wrong or I do not understand my task correctly.
Maybe my solution will be useful for somebody. At IIS server configuration we need to check require users certificates checkbox. Than user when opens site will be asked for a certificate form personal certificates storage.
After if public certificate can be accessed from a Request object (c#) at server. From it we can get user's details and allow or deny login