You can do this via openssl:

1. Install openssl package (if you are using Windows, download binaries [here][1]).

2. Generate private key: `openssl genrsa 2048 &gt; private.pem`

3. Generate the self signed certificate: `openssl req -x509 -days 1000 -new -key private.pem -out public.pem`

4. If needed, create PFX: `openssl pkcs12 -export -in public.pem -inkey private.pem -out mycert.pfx`

  [1]: https://www.openssl.org/related/binaries.html

EGit strikes again. I made the mistake of trying to switch to a different branch in EGit and it somehow messed up and checked out no branch. I then made a commit to this non-branch, and then when I realized I wasn&#39;t tracking the right branch, I ran the following:

    $ git checkout issue2
    Warning: you are leaving 1 commit behind, not connected to any of your branches:

        bada553d My commit message

    If you want to keep them by creating a new branch, this may be a good time to do so with:

        git branch new_branch_name ....

    Branch issue2 set up to track remote branch issue2 from origin.
    Switched to a new branch issue2. 

Now that I&#39;ve botched things, how do I associate that commit with my current branch? I&#39;m not interested in creating a brand new branch, I just want to pull that commit into my branch, `issue2`. 

Warning: you are leaving 1 commit behind, not connected to any of your branches

**PREMISE:**

After playing around with variadic templates a little bit, I realized that achieving anything which goes slightly beyond the trivial meta-programming tasks soon becomes pretty cumbersome. In particular, I found myself wishing for a way to perform **generic operations over an argument pack** such as *iterate*, *split*, *loop* in a `std::for_each`-like fashion, and so on.

After watching [this lecture by Andrei Alexandrescu][1] from C++ and Beyond 2012 on the desirability of `static if` into C++ (a construct borrowed from the [D Programming Language][2]) I had the feeling that some sort of `static for` would come handy as well - and I feel more of these `static` constructs could bring benefit.

So I started wondering if there is a way to achieve **something like this** for argument packs of a variadic template function (*pseudo-code*):

    template&lt;typename... Ts&gt;
    void my_function(Ts&amp;&amp;... args)
    {
        static for (int i = 0; i &lt; sizeof...(args); i++) // PSEUDO-CODE!
        {
            foo(nth_value_of&lt;i&gt;(args));
        }
    }

Which would get translated *at compile-time* into something like this:

    template&lt;typename... Ts&gt;
    void my_function(Ts&amp;&amp;... args)
    {
        foo(nth_value_of&lt;0&gt;(args));
        foo(nth_value_of&lt;1&gt;(args));
        // ...
        foo(nth_value_of&lt;sizeof...(args) - 1&gt;(args));
    }

In principle, `static_for` would allow for even more elaborate processing:

    template&lt;typename... Ts&gt;
    void foo(Ts&amp;&amp;... args)
    {
        constexpr s = sizeof...(args);

        static for (int i = 0; i &lt; s / 2; i++)
        {
            // Do something
            foo(nth_value_of&lt;i&gt;(args));
        }

        static for (int i = s / 2; i &lt; s; i++)
        {
            // Do something different
            bar(nth_value_of&lt;i&gt;(args));
        }
    }

Or for a more expressive idiom like this one:

    template&lt;typename... Ts&gt;
    void foo(Ts&amp;&amp;... args)
    {
        static for_each (auto&amp;&amp; x : args)
        {
            foo(x);
        }
    }

**RELATED WORK:**

I did some search on the Web and found out that *something* does indeed exist:

 - [This link][3] describes how to convert a parameter pack into a Boost.MPL vector, but that only goes half the way (if not less) towards the goal;
 - [this question on SO][4] seems to call for a similar and slightly related meta-programming feature (splitting an argument pack into two halves) - actually, there are several questions on SO which seem to be related to this issue, but none of the answer I have read solves it satisfactorily IMHO;
 - [Boost.Fusion][5] defines algorithms for converting an argument pack into a *tuple*, but I would prefer:
   1. not to create **unnecessary temporaries** to hold arguments that can (and should be) perfectly forwarded to some generic algorithms;
   2. have a **small, self-contained** library to do that, while Boost.Fusion is likely to include way more stuff than is needed to address this issue.

**QUESTION:**

Is there a relatively simple way, possibly through some template meta-programming, to achieve what I am looking for without incurring in the limitations of the existing approaches?


  [1]: http://channel9.msdn.com/Events/GoingNative/GoingNative-2012/Static-If-I-Had-a-Hammer%20I%20have
  [2]: http://dlang.org/index.html
  [3]: http://blog.shandyba.com/2009/12/17/converting-variadic-template-arguments-pack-to-boost-mpl-sequence/
  [4]: https://stackoverflow.com/questions/5484930/split-variadic-template-arguments
  [5]: http://www.boost.org/libs/fusion/

How to make generic computations over heterogeneous argument packs of a variadic template function?

How to easily create self signed SSL certificate for testing purposes?

How to create self signed SSL certificate for test purposes?

<p>How to easily create self signed SSL certificate for testing purposes?</p>


I wanted to install Zend Framework 2. So I downloaded the skeleton application. As mentioned in the ZF2 manual, we have to issue the command 

&lt;!-- language: lang-sh --&gt;

    php composer.phar install 

Inside the skeleton. 

But I&#39;m getting an error 
&gt; You must enable the openssl extension to download files via https

Then I enabled the ssl_module in my wamp, I checked the php_ini file and I can see the following line

&gt; extension=php_openssl.dll

Still I&#39;m getting the same error. Anybody having any clue what I missed out?



You must enable the openssl extension to download files via https

I&#39;d love to use nginx to serve a website with multiple domain names and SSL:

- webmail.example.com
- webmail.beispiel.de

Both use the same vhost so I only set the server_name twice.
Problem is, that I need nginx to serve the correct ssl certificate for each domain name.

Is this possible with one vhost or do I need to set up two vhosts?



nginx - set multiple server_name with ssl-support

I&#39;ve read tons of documentation related to this problem but I still can&#39;t get all the pieces together, so I&#39;d like to ask a couple of questions.

1. First of all I&#39;ll describe briefly the authentication procedure as I understand it, as I may be mistaken in that regard: A client starts a connection, which a server responds to with a combination of public key, some metadata and digital signature of a trusted authority. Then the client takes the decision if she trusts the server, encrypts some random session key with the public key and sends it back. This session key can be decrypted only with private key stored on the server. Server does this and then the HTTPS session begins.

2. So, if I&#39;m correct above, the question is how the man-in-the-middle attack can occur in such scenario? I mean, even if somebody intercepts the server (e.g. www.server.com) response with public key and has some means to make me think that he is www.server.com, he still wouldn&#39;t be able to decrypt my session key without the private key.

3. Speaking about the mutual authentication, is it all about the server confidence about the client identity? I mean, the client can already be sure that she is communicating with the right server, but now the server wants to find out who the client is, right?

4. And the last question is about the alternative to the mutual authentication. If I act as a client in the situation described, what if I send a login/password in the HTTP header after the SSL session is established? As I see it, this information can&#39;t be intercepted because the connection is already secured and the server can rely on it for my identification. Am I wrong? What are the downsides of such an approach compared with mutual authentication (only security issues are important, not the implementation complexity)?

SSL and man-in-the-middle misunderstanding

I am trying to create Client Certificates Authentication for my asp.net Website.

In order to create client certificates, I need to create a Certificate Authority first:

&gt; makecert.exe -r -n “CN=My Personal CA” -pe -sv MyPersonalCA.pvk -a
&gt; sha1 -len 2048 -b 01/01/2013 -e 01/01/2023 -cy authority
&gt; MyPersonalCA.cer

Then, I have to import it to IIS 7, but since it accepts the .pfx format, i convert it first

    pvk2pfx.exe -pvk MyPersonalCA.pvk -spc MyPersonalCA.cer -pfx MyPersonalCA.pfx

After importing MyPersonalCA.pfx, I try to add the https site binding to my Web Site and choose the above as SSL Certificate, but I get the following error:

![enter image description here][1]


Any suggestions?

  [1]: http://i.stack.imgur.com/ixq6G.png

IIS 7 Error &quot;A specified logon session does not exist. It may already have been terminated.&quot; when using https

Java SSLHandshakeException &quot;no cipher suites in common&quot;

I can&#39;t seem to force https on the free usage tier of elastic beanstalk.

I have tried the following suggestion at https://stackoverflow.com/questions/6858492/how-to-force-https-on-amazon-elastic-beanstalk-without-failing-the-health-check

Using this Apache rewrite rule

    RewriteEngine On
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteCond %{REQUEST_URI} !^/status$ 
    RewriteCond %{REQUEST_URI} !^/version$ 
    RewriteCond %{REQUEST_URI} !^/_hostmanager/ 
    RewriteRule . https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

When I try that, http requests do not get redirected to https as I would like. Instead, the http page loads normally. I&#39;ve also tried to use the X-Forwarded-Port header with the same result. 

I&#39;ve also tried the following rewrite rule

    RewriteCond %{SERVER_PORT} 80
    RewriteRule . https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

And this rule causes a redirect loop. So it would seem that the apache rewrite rules don&#39;t pick up the Elastic Load Balancer headers X-Forwarded-Port and  X-Forwarded-Proto, but also a redirect loop isn&#39;t what I am going for either.

Please help. I am new to AWS, Elastic Beanstalk, and not very familiar with Apache rules. I am not too sure where to go from here. Thanks.

How to force https on elastic beanstalk?

For some reason I am unable to use CURL with HTTPS. Everything was working fine untill I ran upgrade of curl libraries. Now I am experiencing this response when trying to perform CURL requests:  **Problem with the SSL CA cert (path? access rights?)**

Following suggestions posted here on related issues I have tried to do the following:

* Disable verification for host and peer

        curl_setopt($cHandler, CURLOPT_SSL_VERIFYHOST, false);
        curl_setopt($cHandler, CURLOPT_SSL_VERIFYPEER, true);

* Enable `CURLOPT_SSL_VERIFYPEER` and point to cacert.pem downloaded from http://curl.haxx.se/docs/caextract.html

        curl_setopt($cHandler, CURLOPT_SSL_VERIFYPEER, true);  
        curl_setopt($cHandler, CURLOPT_CAINFO, getcwd() . &quot;/positiveSSL.ca-bundle&quot;);

* I also tried to do the same thing with positiveSSL.ca-bundle which was provided as bundle CA certificate for the server I am trying to connect to.

* Edit php ini settings with `curl.cainfo=cacert.pem` (file in the same directory and accessible by apache)

* Rename `/etc/pki/nssdb` to `/etc/pki/nssdb.old`
 
Unfortunatelly none of the above are able to solve my problem and I constantly get  Problem with the SSL CA cert (path? access rights?) message.

And I don&#39;t need this verification in the first place (I am aware of security issues).

Does anybody have any other suggestions?

**UPDATE**

After updating to the latest libraries and restart of the whole box, not just apache which I was doing it all seems to be working now again!!!


PHP CURL CURLOPT_SSL_VERIFYPEER ignored

I am using

    import requests
    requests.post(url=&#39;https://foo.com&#39;, data={&#39;bar&#39;:&#39;baz&#39;})

but I get a request.exceptions.SSLError.
The website has an expired certficate, but I am not sending sensitive data, so it doesn&#39;t matter to me.
I would imagine there is an argument like &#39;verifiy=False&#39; that I could use, but I can&#39;t seem to find it.

How do I disable the security certificate check in Python requests

I want to host a HTTPS-only static website using Amazon S3 and CloudFront. Here&#39;s what I&#39;ve done so far:

 1. Set up an S3 bucket for static website hosting and put my website files in it
 2. Created a CloudFront distribution and pointed it to the S3 bucket
 3. Added a CNAME record in my domain&#39;s nameservers for the `www` subdomain pointing to the CloudFront bucket.

So far, so good - I can access my website using the `www.example.com` address. However, I want the site to be available via HTTPS only, for which I bought an SSL certificate from GoDaddy.

Now, the question is:

 1. Is there a way to install this third-party SSL certificate on my S3-hosted website?
 2. Is there a way to have an automatic http to https redirect with this setup?

HTTPS for Amazon S3 static website

&gt; DNS A-records require that an IP address be hard-coded into your application’s DNS configuration

...which [Heroku recommends avoiding](https://devcenter.heroku.com/articles/apex-domains). Heroku suggests two workarounds:

&gt; ...using a DNS provider that supports CNAME-like functionality at the apex, and using subdomain redirection`.

My question revolves around the latter option (because the former isn&#39;t supported by DreamHost AFAIK):

**Is it possible to redirect from the root (i.e. apex or &#39;naked&#39;) domain to the &#39;www&#39; subdomain for HTTPS requests without the browser throwing up?**

Heroku thinks not:
&gt; ...applications requiring SSL encryption should use the ALIAS/ANAME configuration on the root domain. Subdomain redirection will cause a browser error when the root domain is requested over SSL (i.e. https://example.com).

...but I&#39;m hoping that&#39;s an incomplete (or incorrect) statement.

### CLARIFICATION UPDATE:

The real issue with redirecting from apex to &#39;www&#39; is that typing `https://example.com` directly into a browser will raise a certificate warning. Sure, it&#39;s an edge case, but not a small one.

### SOLUTION UPDATE:

I solved this problem with [DNSimple](https://dnsimple.com). (Didn&#39;t even have to transfer my domain!)  

I believe that easyDNS offers a similar feature, but surprised to find that most other domain hosting companies don&#39;t.


HTTPS redirect from root domain (i.e. apex or &#39;naked&#39;) to &#39;www&#39; subdomain without browser throwing up?

I wanted to list the certificates stored in a PKCS12 keystore. 

The keystore has the extension `.pfx`

How to list the certificates stored in a PKCS12 keystore with keytool?

I am supplied with a jks keystore named ABCC_client.store. When I import this keystore to cacerts and try connecting it says No such Algorithm error. PFA the stacktrace

        Caused by: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class:   com.sun.net.ssl.internal.ssl.DefaultSSLContextImpl)
    	at java.security.Provider$Service.newInstance(Provider.java:1245)
    	at sun.security.jca.GetInstance.getInstance(GetInstance.java:220)
    	at sun.security.jca.GetInstance.getInstance(GetInstance.java:147)
    	at javax.net.ssl.SSLContext.getInstance(SSLContext.java:125)
    	at javax.net.ssl.SSLContext.getDefault(SSLContext.java:68)
    	at javax.net.ssl.SSLSocketFactory.getDefault(SSLSocketFactory.java:102)
    	at org.apache.axis.components.net.JSSESocketFactory.initFactory(JSSESocketFactory.java:61)
    	at org.apache.axis.components.net.JSSESocketFactory.create(JSSESocketFactory.java:79)
    	... 32 more
    Caused by: java.security.UnrecoverableKeyException: Cannot recover key
    	at sun.security.provider.KeyProtector.recover(KeyProtector.java:311)
    	at sun.security.provider.JavaKeyStore.engineGetKey(JavaKeyStore.java:121)
    	at sun.security.provider.JavaKeyStore$JKS.engineGetKey(JavaKeyStore.java:38)
    	at java.security.KeyStore.getKey(KeyStore.java:763)
    	at com.sun.net.ssl.internal.ssl.SunX509KeyManagerImpl.&amp;lt;init&amp;gt;(SunX509KeyManagerImpl.java:113)
    	at com.sun.net.ssl.internal.ssl.KeyManagerFactoryImpl$SunX509.engineInit(KeyManagerFactoryImpl.java:48)
    	at javax.net.ssl.KeyManagerFactory.init(KeyManagerFactory.java:239)
    	at com.sun.net.ssl.internal.ssl.DefaultSSLContextImpl.getDefaultKeyManager(DefaultSSLContextImpl.java:170)
    	at com.sun.net.ssl.internal.ssl.DefaultSSLContextImpl.&amp;lt;init&amp;gt;(DefaultSSLContextImpl.java:40)
    	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
    	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
    	at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
    	at java.lang.Class.newInstance0(Class.java:355)
    	at java.lang.Class.newInstance(Class.java:308)
    	at java.security.Provider$Service.newInstance(Provider.java:1221)
    	... 39 more


But if I use this keystore independently i.e without adding it to cacerts it works. 

Some googling led to me to http://joewlarson.com/blog/2009/03/25/java-ssl-use-the-same-password-for-keystore-and-key/ which says that password might me different for the key and the keystore.

Caused by: java.security.UnrecoverableKeyException: Cannot recover key

Currently I have the following entry in my `.gitconfig` in my user directory.

    ...
    [http]
    	sslCAInfo=C:\\Users\\julian.lettner\\.ssh\\git-test.pem
    ...

This sets the certificate to use when interacting with the git server (required by my company&#39;s git server).

But now I cannot clone other repositories (for example a public repository on GitHub), because the client always uses the configured certificate which gets rejected by other servers.

How can I circumvent this certification issue? Can I configure Git to use the Windows Certificate Store to authenticate?

How do I configure Git to trust certificates from the Windows Certificate Store?

I am using the below openssl command for storing my public key into a .pem file.

    openssl&gt; x509 -in E:/mycert.pem -pubkey  -out E:/mypubkey.pem

But when i try to use this command, it is storing the whole certificate info in the mypubkey.pem file.

I have seen that i can save my public key using

    openssl&gt; x509 -pubkey -noout -in cert.pem &gt; pubkey.pem

But it is throwing an error. I can&#39;t use &quot;&gt;&quot; operator.

Content Type	Original Author	Original Content on Stackoverflow
Question	Dima Stopel	View Question on Stackoverflow
Solution 1 - Ssl	Dima Stopel	View Answer on Stackoverflow

How to create self signed SSL certificate for test purposes?

Ssl Problem Overview

Ssl Solutions

Solution 1 - Ssl

How to make generic computations over heterogeneous argument packs of a variadic template function?

Warning: you are leaving 1 commit behind, not connected to any of your branches

Attributions