Is there a possibility to generate an java.security.cert.X509Certificate from an byte[]?

Generate X509Certificate from byte[]?

I&#39;ve created a chain hierarchy like this.

    root-ca ==&gt; signing-ca ==&gt; subordinate-ca ==&gt; server

It is mentioned to create chain bundle, the lowest should go first.

    $ cat server.crt subordinate-ca.crt signing-ca.crt &gt; server.pem

But verification fails.

    $ openssl verify -CAfile root-ca.crt server.pem
    error 20 at 0 depth lookup:unable to get local issuer certificate

However, if I change the order it seems to work.

    $ cat signing-ca.crt subordinate-ca.crt server.crt &gt; server.pem
    $ openssl verify -CAfile root-ca.crt server.pem
    server.pem: OK

So what would be the error here? 


The chain after &quot;cat&quot; looks like below.

    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----

More info: According to &quot;http://www.herongyang.com/crypto/openssl_verify_2.html&quot;, I perform the following test which works.

    $ cat signing-ca.crt subordinate-ca.crt &gt; inter.crt
    $ openssl verify -CAfile root-ca.crt -untrusted inter.crt server.crt
    server.crt: OK

Does that mean all the links are good?


OK, I finally discover that this cannot be done through OpenSSL command line (or at least easily). http://openssl.6102.n7.nabble.com/check-certificate-chain-in-a-pem-file-td43871.html


How does an SSL certificate chain bundle work?

I&#39;m using *openssl* to create self-signed certs. I&#39;m getting this error with the certs I generated:

&gt; javax.net.ssl.SSLHandshakeException:
&gt; java.security.cert.CertificateException: No subject alternative names
&gt; present

&lt;br&gt;
Does anyone know how to specify &quot;Subject alternative name&quot; while creating a cert?
This is how I&#39;m generating a keystore:
       
    sudo $JAVA_HOME/bin/keytool -genkey -dname &quot;CN=192.168.x.xxx, OU=I, O=I, L=T, ST=On, C=CA&quot; -alias tomcat -validity 3650 -keyalg RSA -keystore /root/.keystore -keypass abcd -storepass abcd

To generate a key:

     openssl s_client -connect 192.168.x.xxx:8443 2&gt;/dev/null

Please help! Thanks!

How to add subject alernative name to ssl certs?

I have an X.509 certificate which has the following 2 timestamps:

    [&#39;validFrom&#39;] = String(13) &quot;120314165227Z&quot;
    [&#39;validTo&#39;]   = String(13) &quot;130314165227Z&quot;

What does the postfix character &#39;Z&#39; mean. Does it specify the timezone?

What does the &#39;Z&#39; mean in Unix timestamp &#39;120314170138Z&#39;?

I am trying to generate a self-signed certificate with OpenSSL with SubjectAltName in it.While I am generating the csr for the certificate, my guess is I have to use v3 extensions of OpenSSL x509.
I am using :

    openssl req -new -x509 -v3 -key private.key -out certificate.pem -days 730

Can someone help me with the exact syntax?


How can I generate a self-signed certificate with SubjectAltName using OpenSSL?

I faced the following issue.

I run the following code

    var binaryData = File.ReadAllBytes(pathToPfxFile);
    var cert = new X509Certificate2(binaryData, password);

in two processes. One of the processes runs under `LOCAL_SYSTEM` and there this code succeeds. Another one runs inside IIS under a local user account belonging to &quot;Users&quot; local group and there I get the following exception:

    System.Security.Cryptography.CryptographicException
    Object was not found.
    at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
    at System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromBlob(Byte[] rawData, IntPtr password, UInt32 dwFlags, Boolean persistKeySet, SafeCertContextHandle&amp; pCertCtx)
    at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[] rawData, Object password, X509KeyStorageFlags keyStorageFlags)
    at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData, String password)
    //my code here

So I Googled a bit and found [this answer][1] to a kind of similar question. I tried to enable `LoadUserProfile` for the application pool and it works now.

The problem is I don&#39;t get what exactly happens when I set `LoadUserProfile` and what consequences that might have. I mean if it&#39;s a &quot;good&quot; thing then why it is not &quot;on&quot; by default and why is it there after all?

What exactly happens when I set `LoadUserProfile` in IIS pool and what negative consequences can it have?


  [1]: https://stackoverflow.com/a/10048789/57428

What exactly happens when I set LoadUserProfile of IIS pool?

What is the difference between X509Certificate2 and X509Certificate in .NET?

I am using a `SslServerSocket` and client certificates and want to extract the CN from the SubjectDN from the client&#39;s `X509Certificate`.

At the moment I call `cert.getSubjectX500Principal().getName()` but this of course gives me the total formatted DN of the client. For some reason I am just interested in the `CN=theclient` part of the DN. Is there a way to extract this part of the DN without parsing the String myself?

How to extract CN from X509Certificate in Java?

I am developing a TCP client to connect OpenSSL server with the certificate authentication. I have using .crt and .key files shared by server team. These certificates are generated by OpenSSL commands.

I am using [`SslStream`](https://msdn.microsoft.com/en-us/library/system.net.security.sslstream%28v=vs.85%29.aspx) object to authenticate the Tcp client by calling [`SslStream.AuthenticateAsClient`](https://msdn.microsoft.com/en-us/library/system.net.security.sslstream.beginauthenticateasclient%28v=vs.85%29.aspx) method by passing server `IP`, [`SslProtocols.Ssl3`](https://msdn.microsoft.com/en-us/library/system.security.authentication.sslprotocols%28v=vs.85%29.aspx) and `X509CertificateCollection`.

I am getting the following error:

&gt; Authentication failed because the remote party has closed the transport stream


Authentication failed because remote party has closed the transport stream

I&#39;m having a problem when I use the method `X509Store.Certificates.Find`

    public static X509Certificate2 FromStore(StoreName storeName, 
              StoreLocation storeLocation, X509FindType findType, string findValue)
    {
        X509Store store = new X509Store(storeName, storeLocation);
        store.Open(OpenFlags.ReadOnly);
        try
        {
            //findValue = &quot;7a6fa503ab57b81d6318a51ca265e739a51ce660&quot;
            var results = store.Certificates.Find(findType, findValue, true);

            return results[0];                
        }
        finally
        {
            store.Close();
        }
    }
In this case the Find Method returns 0 results (`results.Count == 0`), but if I put the findValue as constant the method find the certificate.

    public static X509Certificate2 FromStore(StoreName storeName, 
               StoreLocation storeLocation, X509FindType findType, string findValue)
    {
        X509Store store = new X509Store(storeName, storeLocation);
        store.Open(OpenFlags.ReadOnly);
        try
        {         
            //findValue= &quot;7a6fa503ab57b81d6318a51ca265e739a51ce660&quot;
            var results = store.Certificates.Find(findType, 
                                  &quot;7a6fa503ab57b81d6318a51ca265e739a51ce660&quot;, true);
            return results[0];
        }
        finally
        {
            store.Close();
        }
    }

Problems with X509Store Certificates.Find FindByThumbprint

   I am using this code to find the certificate by its thumbprint. certificate exists in certificate manager in personal certificate store but this code is not finding that certificate.

Please tell me where I&#39;m doing wrong in it.
 
 

    namespace ConsoleApplication1
    {
    	class Program
    	{
    		static void Main(string[] args)
    		{
                string certThumbPrint = &quot;‎‎fe14593dd66b2406c5269d742d04b6e1ab03adb1&quot;;
    			X509Store certStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
    			// Try to open the store.
    
    			certStore.Open(OpenFlags.ReadOnly);
    			// Find the certificate that matches the thumbprint.
    			X509Certificate2Collection certCollection = certStore.Certificates.Find(
                    X509FindType.FindByThumbprint, certThumbPrint, false);
    			certStore.Close();
    
    			// Check to see if our certificate was added to the collection. If no, 
                // throw an error, if yes, create a certificate using it.
    			if (0 == certCollection.Count)
    			{
    				Console.WriteLine(&quot;Error: No certificate found containing thumbprint &quot; );
    			}
    			Console.ReadLine();
    }

How to find certificate by its thumbprint in C#

I am trying to embrace the mysteries of SSL communication and have found a great tutorial on [this site][1]. I was trying to test my own certificate. Using Visual Studio 2012, I simply added an existing file (my certificate in .pfx format) and then changed the &quot;certificate&quot; and &quot;password&quot; settings in app.config. However, when trying to run it, I got an error:

&gt;CryptographicException was unhandled: System cannot find the specified file

Then, I tried the same in my Web Service. There I got some more details about the error:

    System.Security.Cryptography.CryptographicException: System cannot find specified file.
    
       at System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr)
       at System.Security.Cryptography.X509Certificates.X509Utils._QueryCertFileType(String fileName)
       at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromFile(String fileName, Object password, X509KeyStorageFlags keyStorageFlags)
       v System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password)
       v TestServer.DataService.LoadSoap() v c:\Users\Administrator\Documents\Visual Studio 2012\Projects\TestServer\TestServer\DataService.asmx.cs:line 48

I have written this question to the author of the article, but since his last reply was in March 2012, I am not sure, whether he will reply. If somebody could help me with this problem, I would be very grateful.

P.S.: When exporting the certificate from .cer to .pfx, I have changed the title of the file exported. Although I doubt its effect on the problem, I&#39;d rather mention it.

  [1]: http://www.codeproject.com/Articles/326574/An-Introduction-to-Mutual-SSL-Authentication

CryptographicException was unhandled: System cannot find the specified file

The closest answer that I found is using &quot;grep&quot;.

    &gt; openssl x509 -text -noout -in cert.pem | grep DNS

Is there better way to do this? I only prefer command line.

Thanks.

How to display the Subject Alternative Name of a certificate?

    //cert is an EF Entity and 
    //    cert.CertificatePKCS12 is a byte[] with the certificate.

    var certificate = new X509Certificate(cert.CertificatePKCS12, &quot;SomePassword&quot;);

When loading a certificate from our database, on our staging server (Windows 2008 R2/IIS7.5) we get this exception:

    System.Security.Cryptography.CryptographicException: An internal error occurred.
    
       at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
       at System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromBlob(Byte[] rawData, IntPtr password, UInt32 dwFlags, Boolean persistKeySet, SafeCertContextHandle&amp; pCertCtx)
       at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[] rawData, Object password, X509KeyStorageFlags keyStorageFlags)

**NOTE:** This issue does not happen locally (Windows 7/Casini).

Any insight is greatly appreciated.

X509Certificate Constructor Exception

I&#39;m trying use self-signed certificate (c#):

    X509Certificate2 cert = new X509Certificate2(
        Server.MapPath(&quot;~/App_Data/myhost.pfx&quot;), &quot;pass&quot;);

on a shared web hosting server and I got an error:

    System.Security.Cryptography.CryptographicException: An internal error occurred.

stack trace ends with

    System.Security.Cryptography.CryptographicException.
        ThrowCryptogaphicException(Int32 hr) +33
    System.Security.Cryptography.X509Certificates.X509Utils.
        _LoadCertFromFile(String fileName, IntPtr password, UInt32 dwFlags, 
            Boolean persistKeySet, SafeCertContextHandle&amp; pCertCtx) +0
    System.Security.Cryptography.X509Certificates.X509Certificate.
        LoadCertificateFromFile(String fileName, Object password, 
            X509KeyStorageFlags keyStorageFlags) +237
    System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(
        String fileName, String password) +131

On my dev machine it loads ok.
The reason I load *.pfx not a *.cer file because I need a private key access (cer file loads Ok).
I made pfx on my dev mochine like that:

    makecert -r -n &quot;CN=myhost.com, E=admin@myhost.com&quot; -sky exchange -b 01/01/2009
        -pe -sv myhost.pvk myhost.cer
    &lt;b&gt;pvk2pfx&lt;/b&gt; -pvk myhost.pvk -spc myhost.cer -pfx myhost.pfx -po pass&lt;/code&gt;

I am using version v5.131.3790.0 of makecert


&quot;An internal error occurred.&quot; when loading pfx file with X509Certificate2

    root@sclrdev:/home/sclr/certs/FreshCerts# curl --ftp-ssl --verbose ftp://{abc}/ -u trup:trup --cacert /etc/ssl/certs/ca-certificates.crt
    * About to connect() to {abc} port 21 (#0)
    *   Trying {abc}...
    * Connected to {abc} ({abc}) port 21 (#0)
    &lt; 220-Cerberus FTP Server - Home Edition
    &lt; 220-This is the UNLICENSED Home Edition and may be used for home, personal use only
    &lt; 220-Welcome to Cerberus FTP Server
    &lt; 220 Created by Cerberus, LLC
    &gt; AUTH SSL
    &lt; 234 Authentication method accepted
    * successfully set certificate verify locations:
    *   CAfile: /etc/ssl/certs/ca-certificates.crt
      CApath: /etc/ssl/certs
    * SSLv3, TLS handshake, Client hello (1):
    * SSLv3, TLS handshake, Server hello (2):
    * SSLv3, TLS handshake, CERT (11):
    * SSLv3, TLS alert, Server hello (2):
    * SSL certificate problem: unable to get local issuer certificate
    * Closing connection 0
    curl: (60) SSL certificate problem: unable to get local issuer certificate
    More details here: http://curl.haxx.se/docs/sslcerts.html
    
    curl performs SSL certificate verification by default, using a &quot;bundle&quot;
     of Certificate Authority (CA) public keys (CA certs). If the default
     bundle file isn&#39;t adequate, you can specify an alternate file
     using the --cacert option.
    If this HTTPS server uses a certificate signed by a CA represented in
     the bundle, the certificate verification probably failed due to a
     problem with the certificate (it might be expired, or the name might
     not match the domain name in the URL).
    If you&#39;d like to turn off curl&#39;s verification of the certificate, use
     the -k (or --insecure) option.


curl: (60) SSL certificate problem: unable to get local issuer certificate

I&#39;m adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps:

    openssl req -new &gt; cert.csr
    openssl rsa -in privkey.pem -out key.pem
    openssl x509 -in cert.csr -out cert.pem -req -signkey key.pem -days 1001
    cat key.pem&gt;&gt;cert.pem

This works, but I get some errors with, for example, Google Chrome:

&gt; This is probably not the site you are looking for!&lt;br&gt;
&gt; The site&#39;s security certificate is not trusted!

Am I missing something? Is this the correct way to build a self-signed certificate?


How to generate a self-signed SSL certificate using OpenSSL?

There seems to be a lot of confusing, sometimes conflicting, information with regards to making a .NET HTTPListener HTTPS capable. My understanding is as follows:

* One&#39;s C# code needs an `https` prefix (for example, `https://*:8443`) in order for the listener to understand that it needs to service SSL requests at this port.

* The actual SSL handshake happens under the covers and is handled by `http.sys` (buried somewhere on the Windows machine). The C# code doesn&#39;t have to explicitly manage the SSL handshake, because it happens under the covers.

* One needs to have a &quot;X.509 trusted certificate&quot; on the `httpListener` machine, and somehow that certificate needs to be bound to port 8443 (in this example).

Is my understanding above correct? If not, please educate me.

Regarding X.509 certificates, my understanding is:

* Use `makecert` to create an X.509 certificate. This certificate gets stored in the personal store and needs to get moved over to the Trusted Store (this is where the HTTP listener will look). It seems I can use `certMgr` to perform the move, or I can use `mmc` to effect the move. It seems there is more than one X.509 certificate format (`DER`, `Base64`, `pks`, pswd protected, `pks` private, etc.)... Is there a preferred format I should use?

Once I get the certificate into the trusted store, I need to bind it to the TCP port. I am on Windows&amp;nbsp;7: should I be using `httpcfg` or `netsh`?



Httplistener with HTTPS support

I used the following steps to create a new Java keystore with a pair of private/public key to be used by a Java (internal) server with TLS. Please notice that the certificate is selfsigned:
	
1) Generate key with AES256

	openssl genrsa -aes256 -out server.key 1024

2) Generate cert request for CA

	openssl req -x509 -sha256 -new -key server.key -out server.csr

3) Generate self signed expiry-time 10 years

	openssl x509 -sha256 -days 3652 -in server.csr -signkey server.key -out selfsigned.crt


4) Use a program like [KeyStoreExplorer](http://keystore-explorer.sourceforge.net/) to import the pair (private key and selfsigned certificate) in a new JKS 

This works but I&#39;d like to implement the last step without using a GUI.

I know how to import the self signed certificate only:

    // create the keystore and import the public key. THIS WILL NOT IMPORT THE PRIVATE KEY SO THE KEYSTORE CAN&#39;T BE USED ON THE SERVER TO MAKE THE TLS CONNECTION
	/usr/java/jdk1.6.0_45/bin/keytool -import -alias myservercert -file server.crt -keystore mykeystore.jks

So the question is: how can I create a Java KeyStore and import both the certificate with the public key and the private key without using a GUI?

Importing the private-key/public-certificate pair in the Java KeyStore

When I make an x509 certificate to encrypt and decrypt messages, I got some error information and could not able to fix this problem. Could someone ever happen to solve this bug? thanks.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details:

&gt; System.Security.Cryptography.CryptographicException: keyset does not exist。
&gt; 
&gt; Source Error: 
&gt; 
&gt; Line 53:             using (RSACryptoServiceProvider
&gt; rsaProviderDecrypt =
&gt; (RSACryptoServiceProvider)cerDecrypt.PublicKey.Key) Line 54:          
&gt; { Line 55:                 plainHashBytes =
&gt; rsaProviderDecrypt.Decrypt(encryptedHashBytes, false); Line 56:       
&gt; rsaProviderDecrypt.Clear(); Line 57:                
&gt; rsaProviderDecrypt.Dispose();
&gt; 
&gt; Source File:
&gt; E:\PayUSite\PayMvcApp\Controllers\HashMessageController.cs    Line: 55
&gt; 
&gt; 
&gt; Stack Trace: 
&gt; 
&gt; 
&gt; [CryptographicException: keyset does not exist. ]   
&gt; System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32
&gt; hr) +41   
&gt; System.Security.Cryptography.RSACryptoServiceProvider.DecryptKey(SafeKeyHandle
&gt; pKeyContext, Byte[] pbEncryptedKey, Int32 cbEncryptedKey, Boolean
&gt; fOAEP, ObjectHandleOnStack ohRetDecryptedKey) +0   
&gt; System.Security.Cryptography.RSACryptoServiceProvider.Decrypt(Byte[]
&gt; rgb, Boolean fOAEP) +579

  
**source code:**

    string docFile = Server.MapPath(&quot;~/docx/DirectAccess_StepByStep.doc&quot;);
    HashAlgorithm hash = HashAlgorithm.Create(&quot;SHA1&quot;);
    byte[] hashedBytes;
    using (FileStream fs = new FileStream(docFile, FileMode.Open))
    {
        //compute message hash value
        hashedBytes = hash.ComputeHash(fs);
        hash.Dispose();
        fs.Close();
    }
        
    string hashedString = Convert.ToBase64String(hashedBytes);
        
    //encrypt message digest
    string priKeyFile = Server.MapPath(&quot;~/certificate/WosMiddle.pfx&quot;);
    X509Certificate2 certEncrypt = new X509Certificate2(priKeyFile, &quot;123456&quot;);
    byte[] encryptedHashBytes;
    using (RSACryptoServiceProvider rsaProviderEncrypt = (RSACryptoServiceProvider)certEncrypt.PrivateKey)
    {
        encryptedHashBytes = rsaProviderEncrypt.Encrypt(hashedBytes, false);
        rsaProviderEncrypt.Dispose();
    }
        
    //decrypt message digest
    string pubKeyFile = Server.MapPath(&quot;~/certificate/WosMiddle-pubkey.cer&quot;);
    X509Certificate2 cerDecrypt = new X509Certificate2(pubKeyFile);
    byte[] plainHashBytes;
    using (RSACryptoServiceProvider rsaProviderDecrypt = (RSACryptoServiceProvider)cerDecrypt.PublicKey.Key)
    {
        //***will throw error message here...***
        plainHashBytes = rsaProviderDecrypt.Decrypt(encryptedHashBytes, false);
        rsaProviderDecrypt.Dispose();
    }
        
    //verify message whether was modified
    string docFile2 = Server.MapPath(&quot;~/docx/DirectAccess_StepByStep.doc&quot;);
    HashAlgorithm hash2 = HashAlgorithm.Create(&quot;SHA1&quot;);
    byte[] hashedBytes2;
    using (FileStream fs2 = new FileStream(docFile2, FileMode.Open))
    {
        //compute message hash value
        hashedBytes2 = hash.ComputeHash(fs2);
        fs2.Close();
    }
        
    //compare hash value
    bool isEqual = plainHashBytes.SequenceEqual(hashedBytes2);

All X509certificate Solutions on Gang of Coders

Total of 20 X509certificate Solutions