I made some research in Google and was unable to find the way to get CA certificates already installed in system
My problem is that my application should pass authentication through swissID authentication system.
SwissID provides with USB key which stores certificates. When user inserts USB to soscket windows/MAC automatically installs p12 certificates to system.
My problem is that I can't find way to get this certificates from OS and pass them to NetworkAccessManager.
Programming language is: C++
Framework: Qt4.7
OS: Windows/MacOS/Linux
Any help is appreciate.
Thanks
Best Regards
Taron Sargsyan
What I was looking for was
QList QSslConfiguration::caCertificates ();
From Qt4 documentation.
Returns this connection's CA certificate database. The CA certificate database is used by the socket during the handshake phase to validate the peer's certificate. It can be moodified prior to the handshake with addCaCertificate(), addCaCertificates(), and setCaCertificates().
Related
our company proxy brokes the SSL Connections and the proxy use our own CA.
So i have always tell the applications i use (RubyGems, Python Pip, Azure CLI ...) to use our company CA Certificate.
Does anyone know, how i can use our CA Certificate with a local Terraform installation?
Is the CA deployed to your OS's certificate store or can you import it? If so, Terraform (and probably other tools) should just be able to work with a proxy like this with no other configuration. If you need some further direction, tell us what operating system and how you typically access you have to the CA.
Edit:
#Kreikeneka have you have the certain the location CentOS expects to import into the store. There is a command you need to run that actually imports it update-ca-trust. Have you run this? If the cert is being used for SSL and you just need to trust it when going through your proxy, that is all you should need to do. You shouldn't need to tell your tools (Terraform, PIP, etc) to trust it for SSL with the proxy. If the cert is imported into your certificate store, it should be passively usable from any connection on from the machine from any process.
If you are using the cert for client authentication to the proxy then just trusting the cert by placing it in the certificate store probably won't work.
I'm not clear from your comments if you need the cert for SSL or for client authentication to the proxy. Check with your IT what it is really used for if you aren't sure and get back to us.
As of CentOS 6+, there is a tool for this. Per this guide,
certificates can be installed first by enabling the system shared CA
store:
update-ca-trust enable
Then placing the certificates to trust as CA's
in /etc/pki/ca-trust/source/anchors/ for high priority
(non-overridable), or /usr/share/pki/ca-trust-source/ (lower priority,
overridable), and finally updating the system store with:
update-ca-trust extract
Et voila, system tools will now trust those
certificates when making secure connections!
Source:
https://serverfault.com/questions/511812/how-does-one-install-a-custom-ca-certificate-on-centos
Is it possible to store the client certificate for rabbitmq server in the windows certificate store?
I know that doing so in the c# client is supported, but haven't seen any mention of a similar option for the server itself.
the ssl_options in rabbit.config mention only using certificates stored on the file system.
Not at this time. Support for the Windows cert store would have to be added to Erlang itself.
I am new to TLS/SSL so this might be a very basic question, but I've been searching a lot an could not find an answer.
I am trying to implement a TLS/SSL client. This client will run on an embedded unit with Windows OS on it (XPe or WES7). My implementation uses GnuTLS.
How do I get the list of trusted authorities to my unit so my client can verify the server's certificate? Is it supposed to be a file stored on the client side, that the client is responsible for keeping up to date? Or can my client somehow get this list from the internet each time it is needed and not maintain it locally?
The Certificating Authority (CA) master certificates are stored client side and the client is responsible for keeping them up to date. Keeping them up to date isn't as hard as it sounds, as CA certificates aren't changed that often - most are valid for 5-10 years at least.
Client side storage is necessary because any given internet site your application uses might be compromised.
To get a list, you might start by looking at the CA certificates distributed with a browser or at the cacerts file distributed with Java. Before releasing your code, you'll probably want to check that the certs you use are genuine by checking them against information provided by the CA.
Go to any Windows machine and run "certman.msc" from command-line. Export each CA certificate (Intermediate Certificates, Trusted Authorities) to file (BER, PEM), then import these certificates into your embedded software. Now you can validate email certificates, the same way Windows does (i.e. using various x.509 related RFCs and CRLs)
I have academical project to build communicator with Public Key Infrastructure. For communication between server and clients I'll use SSL/TLS and I need for them certificates. I have to build Certificate Authority with CRL and I can do this with openSSL but this tool is only good for manual administrative not for making certificates automatically in remote CA.
To be clear: Clients must register and login to communicator using certificates but it should be made invisible for them. I've tried running openSSL as process in Java but it's not working properly - my previous problem.
Have you any good advice for making simple PKI?
You can use and extend EJBCA. It takes some getting used to but it has support for some HSM's, and it should not be hard to create a small PKI with it. Open source.
A replacement for simple operations of OpenSSL, would be Bouncy castle. To have better CA support you should also use the EJBCA.
To create certificates automatically in the client (I assume you use a client web browser) is a bit trickier. Some browser can generate private client keys and then get them signed by the CA server.
Generating client side certificates in browser and signing on server
In that case, I would also use the EJBCA to make it manageable.
I'm asking this question because I have gone through the tutorial posted here:
Preventing Duplication of the x509 Certificate Used on a WCF Client?
And I am not understanding why the client couldn't just go to another computer and install the Root CA and install the Public CA to connect from a different computer?
I want to be able to install a certificate on a client's computer that only authorizes that computer to connect to the WCF service. If they "buy" another certificate, I would create it off the Root CA and install it on the other computer they want which would now authorize that computer (2 computers can now connect to this service ONLY).
How does the posted method prevent a different computer from being authenticated if the client just copies the Root CA and Public CA and installs it onto a different computer?
You can install end-user certificate to Windows certificate storage and when installing the certificate, specify that the private key should be non-exportable. Such key can not be exported and thus copied (at least in theory). Next, you can give the user a hardware with the key -- a USB cryptotoken or smartcard. Such hardware also doesn't let private keys to be exported from the device, yet you need to be aware of this attack.