Hi,
we are having the installed cerificates in our unix server's.
The certificates are in following format : cacert.pem,cert8.db,ois294.sem,CertGenCAKey.der,ss_keystore.jks
So i want to know the Expiry date for these certificates. how to get the valid FROM to TO dates for these kind of... (1 Reply)
HI,
I want to know the certificate expiry dates and who is owner of the certificate installed in UNIX.
example certiface name
1)SSL
2)Veri Sign Trust Network (1 Reply)
Hello everybody
Hope somebody can help me
I'm trying to install SSL Certificate on Apache/mod_ssl on Linux with Zend for Oracle.
I bought and downloaded certificate from certificate from Network Solutions. Than I followed the instructions to the dot.
I created a directory for certificate... (2 Replies)
Dear All
Anyone know how to issue two different certification on apache virtualhost fyi i have one virtualhost eg 69.192.1.25:443 already signed with verisign how can i configure another virtualhost 69.192.1.25:443 which signing with another certificate which self signing. i search net not... (1 Reply)
Hi guys.
I have some questions about ssl certificates.
I looked at SSL providers and saw that they are providing 2 types of certificates: per server or per domain.
my server host name is: srv1.example.com
I have a smtp, imap, web server on this box. but all services accessed by different... (1 Reply)
we are doing TCP for our systems. I have a working SSL certificate on prodction webserver. Im planning to export it to our DR server for TCP purposes. However when I export based on the procedure below, it doesn't work. When I restart the DR webserver, it still says the certifcate is expired.Any... (1 Reply)
Hey everyone, I'm trying to get a lay of the land for OS and Application Certificate Stores. Can someone confirm that I have this concept right?
If the application you're using say Firefox has it's own trusted CA store, it uses that exclusively. So if you're running firefox in Windows, Firefox... (4 Replies)
Hello!
I had a cron job running on my website, activating a php script every friday. The Php script just activated another photo to add in the gallery. It worked fine until I got an SSL certificate for my website, then everything broke.
This was the command before:
lynx -source... (0 Replies)
Discussion started by: AGDesign
0 Replies
LEARN ABOUT MOJAVE
curlopt_pinnedpublickey
CURLOPT_PINNEDPUBLICKEY(3) curl_easy_setopt options CURLOPT_PINNEDPUBLICKEY(3)NAME
CURLOPT_PINNEDPUBLICKEY - set pinned public key
SYNOPSIS
#include <curl/curl.h>
CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PINNEDPUBLICKEY, char *pinnedpubkey);
DESCRIPTION
Pass a pointer to a zero terminated string as parameter. The string can be the file name of your pinned public key. The file format
expected is "PEM" or "DER". The string can also be any number of base64 encoded sha256 hashes preceded by "sha256//" and separated by ";"
When negotiating a TLS or SSL connection, the server sends a certificate indicating its identity. A public key is extracted from this cer-
tificate and if it does not exactly match the public key provided to this option, curl will abort the connection before sending or receiv-
ing any data.
On mismatch, CURLE_SSL_PINNEDPUBKEYNOTMATCH is returned.
The application does not have to keep the string around after setting this option.
DEFAULT
NULL
PROTOCOLS
All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
EXAMPLE
CURL *curl = curl_easy_init();
if(curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
curl_easy_setopt(curl, CURLOPT_PINNEDPUBLICKEY, "/etc/publickey.der");
/* OR
curl_easy_setopt(curl, CURLOPT_PINNEDPUBLICKEY, "sha256//YhKJKSzoTt2b5FP18fvpHo7fJYqQCjAa3HWY3tvRMwE=;sha256//t62CeU2tQiqkexU74Gxa2eg7fRbEgoChTociMee9wno=");
*/
/* Perform the request */
curl_easy_perform(curl);
}
PUBLIC KEY EXTRACTION
If you do not have the server's public key file you can extract it from the server's certificate.
# retrieve the server's certificate if you don't already have it
#
# be sure to examine the certificate to see if it is what you expected
#
# Windows-specific:
# - Use NUL instead of /dev/null.
# - OpenSSL may wait for input instead of disconnecting. Hit enter.
# - If you don't have sed, then just copy the certificate into a file:
# Lines from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.
#
openssl s_client -servername www.example.com -connect www.example.com:443 < /dev/null | sed -n "/-----BEGIN/,/-----END/p" > www.example.com.pem
# extract public key in pem format from certificate
openssl x509 -in www.example.com.pem -pubkey -noout > www.example.com.pubkey.pem
# convert public key from pem to der
openssl asn1parse -noout -inform pem -in www.example.com.pubkey.pem -out www.example.com.pubkey.der
# sha256 hash and base64 encode der to string for use
openssl dgst -sha256 -binary www.example.com.pubkey.der | openssl base64
The public key in PEM format contains a header, base64 data and a footer:
-----BEGIN PUBLIC KEY-----
[BASE 64 DATA]
-----END PUBLIC KEY-----
AVAILABILITY
PEM/DER support:
7.39.0: OpenSSL, GnuTLS and GSKit
7.43.0: NSS and wolfSSL/CyaSSL
7.47.0: mbedtls
7.49.0: PolarSSL
sha256 support:
7.44.0: OpenSSL, GnuTLS, NSS and wolfSSL/CyaSSL
7.47.0: mbedtls
7.49.0: PolarSSL
Other SSL backends not supported.
RETURN VALUE
Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or CURLE_OUT_OF_MEMORY if there was insufficient heap space.
SEE ALSO CURLOPT_SSL_VERIFYPEER(3), CURLOPT_SSL_VERIFYHOST(3), CURLOPT_CAINFO(3), CURLOPT_CAPATH(3),
libcurl 7.54.0 December 21, 2016 CURLOPT_PINNEDPUBLICKEY(3)