05-09-2014
SSL Certificate Stores
Hey everyone, I'm trying to get a lay of the land for OS and Application Certificate Stores. Can someone confirm that I have this concept right?
If the application you're using say Firefox has it's own trusted CA store, it uses that exclusively. So if you're running firefox in Windows, Firefox will only check the validity of certificates on it's own store, and not ever reference the Microsoft Store.
As opposed to using internet explorer in Windows where it exclusively uses the Microsoft CA store.
This is something I'm unsure of, does iOS, Linux and Android provide a trusted suite of CA's? Where is it in the File system? It's my impression that these OS' use the SSL command suite to verify certificates? Or do these OS' offer no store, and just hope that the application is doing the checking of certificates?
For instance, right now I"m using google chrome in linux. When I go into the browser settings and advanced settings, to certificates, I get a list of trusted CA's. Where is this list coming from my Linux OS, or the browser itself?
9 More Discussions You Might Find Interesting
1. Web Development
Hello everybody
Hope somebody can help me
I'm trying to install SSL Certificate on Apache/mod_ssl on Linux with Zend for Oracle.
I bought and downloaded certificate from certificate from Network Solutions. Than I followed the instructions to the dot.
I created a directory for certificate... (2 Replies)
Discussion started by: Trusevich
2 Replies
2. Web Development
Dear All
Anyone know how to issue two different certification on apache virtualhost fyi i have one virtualhost eg 69.192.1.25:443 already signed with verisign how can i configure another virtualhost 69.192.1.25:443 which signing with another certificate which self signing. i search net not... (1 Reply)
Discussion started by: netxus
1 Replies
3. AIX
Hello,
I am new in UNIX, and some one asks me to install SSL certificates to allow exchange with an external system.
Can someone tell how to install certificate (ex : verisignxxx.cer) on a UNIX server?
Many thanks.
Tibo (4 Replies)
Discussion started by: tibo51
4 Replies
4. Cybersecurity
Hi guys.
I have some questions about ssl certificates.
I looked at SSL providers and saw that they are providing 2 types of certificates: per server or per domain.
my server host name is: srv1.example.com
I have a smtp, imap, web server on this box. but all services accessed by different... (1 Reply)
Discussion started by: majid.merkava
1 Replies
5. Web Development
we are doing TCP for our systems. I have a working SSL certificate on prodction webserver. Im planning to export it to our DR server for TCP purposes. However when I export based on the procedure below, it doesn't work. When I restart the DR webserver, it still says the certifcate is expired.Any... (1 Reply)
Discussion started by: lhareigh890
1 Replies
6. Red Hat
Hi,
I want to renew the ssl certificate for one of my application on tomcat without down time. I want to know what would the possible impacts for the users who currently have sessions to the app.
Regards,
Arumon (1 Reply)
Discussion started by: arumon
1 Replies
7. Web Development
Hi,
I was trying to enable SSL cert on WebLogic 10.3 (CentOS),
I don't have a third party Certificate Authority(C.A) to get the .csr file certified.
Is there an alternate way that replaces the step sending .csr file to CA ?
Thanks
SZS (1 Reply)
Discussion started by: szs
1 Replies
8. Red Hat
Hi guys,
I'm trying to generate a key using the genkey command in centos 6.4 and RHEL6.4, Every thing seems to go cool but I get this error message bad certificate request error -8016 and no key/cert is generated. I don't want use the many openssl(s) commands instead since genkey is a shourtcut... (4 Replies)
Discussion started by: leo_ultra_leo
4 Replies
9. Web Development
Hello!
I had a cron job running on my website, activating a php script every friday. The Php script just activated another photo to add in the gallery. It worked fine until I got an SSL certificate for my website, then everything broke.
This was the command before:
lynx -source... (0 Replies)
Discussion started by: AGDesign
0 Replies
LEARN ABOUT NETBSD
ssl_ctx_set_cert_store
SSL_CTX_set_cert_store(3) OpenSSL SSL_CTX_set_cert_store(3)
NAME
SSL_CTX_set_cert_store, SSL_CTX_get_cert_store - manipulate X509 certificate verification storage
LIBRARY
libcrypto, -lcrypto
SYNOPSIS
#include <openssl/ssl.h>
void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store);
X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx);
DESCRIPTION
SSL_CTX_set_cert_store() sets/replaces the certificate verification storage of ctx to/with store. If another X509_STORE object is currently
set in ctx, it will be X509_STORE_free()ed.
SSL_CTX_get_cert_store() returns a pointer to the current certificate verification storage.
NOTES
In order to verify the certificates presented by the peer, trusted CA certificates must be accessed. These CA certificates are made
available via lookup methods, handled inside the X509_STORE. From the X509_STORE the X509_STORE_CTX used when verifying certificates is
created.
Typically the trusted certificate store is handled indirectly via using SSL_CTX_load_verify_locations(3). Using the
SSL_CTX_set_cert_store() and SSL_CTX_get_cert_store() functions it is possible to manipulate the X509_STORE object beyond the
SSL_CTX_load_verify_locations(3) call.
Currently no detailed documentation on how to use the X509_STORE object is available. Not all members of the X509_STORE are used when the
verification takes place. So will e.g. the verify_callback() be overridden with the verify_callback() set via the SSL_CTX_set_verify(3)
family of functions. This document must therefore be updated when documentation about the X509_STORE object and its handling becomes
available.
RETURN VALUES
SSL_CTX_set_cert_store() does not return diagnostic output.
SSL_CTX_get_cert_store() returns the current setting.
SEE ALSO
ssl(3), SSL_CTX_load_verify_locations(3), SSL_CTX_set_verify(3)
1.0.1i 2009-07-20 SSL_CTX_set_cert_store(3)