cheap certs

First use the following file gitlab_run.sh to generate the Letsencrypt certificate.Source:Https://github.com/flasheryu/docker-letsencrypt-nginx-proxy-companion-examples#!/bin/bash# This example would run a basic nginx server provisionned with an index.htmlfile# Make sure to replace"site.example.com"With a public accessible domain poiting to the server you'll run this on.# this nginx container would get a Configur Ation generated by the Docker-gen instance and act as a reverse-ProxyEcho "starting

Charles Proxy, like Fiddler under Windows, can view HTTPS traffic, but when you check HTTPS requests using the CA certificate provided by Charles, the following error occurs on Firefox 35 Web page:Twitter.com uses a invalid security certificate. The certificate is not trusted because the issuer certificate has. (Error code:sec_error_expired_issuer_certificate)The reason is said to be this: The more recent versions's Firefox only allow certs with star

stateNEWtcpdpt:sshACCEPT tcp--anywhere anywherestatenewtcp dpt:httpACCEPTtcp--192.168.0.0/16 anywhere statenewtcpdpt:ldapaccepttcp-- 192.168.0.0/16anywhere stAtenewtcpdpt:ldaps Second, installation, configuration OpenLDAPYum install-y openldap-servers openldap-clientsCreate log relatedMkdir/var/log/slapdchmod 755/var/log/slapd/chown ldap:ldap/var/log/slapd/sed-i "/local4.*/d"/etc/rsyslog.confcat gt;>/etc/rsyslog.conf Third, create a certificateCd/etc/pki/tls/certsmake Slapd.pem Here is an exam

Salt naturally also provides the API, the use of the API for Automation is very helpful, we use the rest-style API, of course, everyone knows that the salt is written by Python, then naturally provided the corresponding API, but not recommended, because the call Python API's program must be running on master, and this API is not friendly to Python31[Email protected] ~]#Yum InstallPyopenssl salt-Api–y2[Email protected] ~]# Salt-call--Local Tls.create_self_signed_cert3 Local:4Created Private Key:"

Private Static voidTrustallhttpscertificates ()throwsException {javax.net.ssl.trustmanager[] trustallcerts=NewJavax.net.ssl.trustmanager[1]; Javax.net.ssl.TrustManager TM=NewMiTM (); trustallcerts[0] =TM; Javax.net.ssl.SSLContext SC=javax.net.ssl.SSLContext. getinstance ("SSL"); Sc.init (NULL, Trustallcerts,NULL); Javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory (SC. getsocketfactory ()); } Static classMiTMImplementsJavax.net.ssl.TrustManager, Javax.net.ssl.X509TrustManager { Pu

will be named by the certificate serial number.The following is a detailed example of certificate generation.Use OpenSSL to generate certificates in Linux1. First, we need to create a basic ca directory structure.Create the newcerts, cert, private, and CRL directories under the CA directory specified in the OpenSSL. CNF file. (The CA root directory specified here is/etc/SSL/democa)$ Sudo mkdir certs$ Sudo mkdir private$ Sudo mkdir CRL$ Sudo mkdir new

Define ('ucp _ MAILER_MAX ', '2013') dnl Define ('confuserdb _ SPEC ','/etc/mail/userdb. db') dnl Define ('confprivacy _ FLAGS ', 'authwarnings, novrfy, noexpn, restrictqrun') dnl Define ('confauth _ options', 'A') dnl TRUST_AUTH_MECH ('external DIGEST-MD5 CRAM-MD5 login plain ') dnl Define ('confauth _ MECHANISMS ', 'external GSSAPI DIGEST-MD5 CRAM-MD5 Login plain ') dnl Dnl define ('confcacert _ path', '/usr/share/ssl/certs ') Dnl define ('confcace

/redmine/net/smtp. rb21 22 class SMTP23 24 Revision = % q $ Revision: 10709 $. split [1] 25 26 # The default SMTP port, port 25.27 def SMTP. default_port28 2529 end30 31 @ use_tls = true32 @ verify = nil33 @ certs = nil34 35 def SMTP. enable_tls (verify = OpenSSL: SSL: VERIFY_PEER, certs = nil) 36 @ use_tls = true37 @ verify = verify38 @ certs = certs39 end40 41

-days3560Youareabouttobeaskedtoenterinformationthatwillbeincorporatedintoyourcertificaterequest.WhatyouareabouttoenteriswhatiscalledaDistinguishedNameoraDN.TherearequiteafewfieldsbutyoucanleavesomeblankForsomefieldstherewillbeadefaultvalue,Ifyouenter'.',thefieldwillbeleftblank.-----CountryName(2lettercode)[XX]:CNStateorProvinceName(fullname)[]:HALocalityName(eg,city)[DefaultCity]:ZZOrganizationName(eg,company)[DefaultCompanyLtd]:stu31OrganizationalUnitName(eg,section)[]:techCommonName(eg,yournam

generate a private key 5. CD/etc/pki/CA/ 6. chmod 600 private/cakey. pem Change permissions 7. CD/etc/nginx/certs/ 8. OpenSSL ca-In nginx. req-out nginx. Cert generates certificates for itself 9. mkdir/etc/nginx/certs create directory to store certificates 10. CD/etc/nginx/certs/ 11. OpenSSL genrsa 1024> nginx. Key generates the Private Key 12. ch

Use CA to sign the certificate and CA to sign the certificate This article original from the http://blog.csdn.net/voipmaker reprint indicate the source. This series of articles is divided into three parts. It mainly introduces how to build your own certificate issuing service, generate certificate requests, and sign the generated certificate request through the self-built CA and finally apply it to the service. This article is the last one. In combination with the previous two articles, you

Build your own CA to sign the certificate and build a ca certificate This article original from the http://blog.csdn.net/voipmaker reprint indicate the source. This series of articles is divided into three parts: build your own certificate issuing service, generate a certificate request, and sign the generated certificate request through the self-built CA and finally apply it to the service, This article describes how to use the CA Service in the previous article to sign the certificate. Thi

) []:HeNan Locality Name (eg, city) [Default City]:ZhengZhou Organization Name (eg, company) [Default Company Ltd]:ZZU Organizational Unit Name (eg, section) []:tec Common Name (eg, your name or your server's hostname ) []:rootca.net.org Email Address []: # mkdir -pv /etc/httpd/certs # cd /etc/httpd/certs/ # openssl genrsa 1024 >httpd.key Generating RSA private key, 1024 bit long modulus .......+

encrypt the data sent to the server to complete the key exchange;(5) The service uses this key to encrypt the resource requested by the user, responding to the client;Iv. process of establishing a private CABoth the CA and the application certificate are on the same machine.1, CA-side operation processOperation Steps:1, generate the private key file;2, generate self-signed certificate;3. Related Supporting documentsTouch/etc/pki/ca/index.txtEcho01 >/etc/pki/ca/serialNote:(1) When the private ke

/ca/{certs,crl,newcerts}[[email protected] ~]# Touch/etc/pki/ca/{serial,ind Ex.txt}[[email protected] ~]# echo >/etc/pki/ca/serialTo use a certificate for secure communication with a server, you need to request a certificate from the CA:Step: (Take httpd as an example)(1) Use the certificate of the host to generate the private key;[Email protected] ~]# MKDIR/ETC/HTTPD/SSL [[email protected] ~]# Cd/etc/httpd/ssl[[email protected] ~]# (Umask 077; OpenSS