Mohan WebSite

2012 SERVER (64)
2016 windows (9)
AIX (13)
Amazon (40)
Ansibile (19)
Apache (135)
Asterisk (2)
cassandra (2)
Centos (230)
- ftp (5)
- IPTABLES (15)
- SFTP (1)
- swap (3)
Centos RHEL 7 (270)
centos8 (3)
chef (3)
cloud (2)
cluster (3)
Coherence (1)
DB2 (5)
DISK (25)
DNS (9)
Docker (31)
Eassy (11)
ELKS (1)
EXCHANGE (3)
Fedora (6)
GIT (3)
GOD (2)
Grub (1)
Hacking (10)
Hadoop (6)
health (2)
horoscope (23)
Hyper-V (10)
IIS (15)
JAVA (7)
JBOSS (32)
jenkins (1)
Kubernetes (9)
Ldap (5)
Linux (189)
Linux Commands (166)
Load balancer (5)
mariadb (14)
Mongodb (4)
MQ Server (24)
MYSQL (84)
Nagios (5)
NaturalOil (13)
Nginx (36)
Ngix (1)
openldap (1)
Openstack (6)
Oracle (35)
Perl (3)
Postfix (19)
Postgresql (1)
PowerShell (2)
Python (3)
qmail (36)
Redis (12)
RHCE (28)
SCALEIO (1)
Security on Centos (29)
Shell (64)
Solaris (58)
Sql Server 2012 (4)
squid (3)
SSH (10)
SSL (14)
Storage (1)
TIPS on Linux (28)
tomcat (62)
Ubuntu (1)
Uncategorized (30)
Veritas (2)
vfabric (1)
VMware (28)
Weblogic (38)
Websphere (71)
Windows (19)
Windows Software (2)
wordpress (1)
ZIMBRA (17)

PFX Certificate

What is a PFX Certificate

PKCS #12 is one of the family of standards called Public-Key Cryptography Standards (PKCS), published by RSA Laboratories. It defines a file format commonly used to store X.509 private keys with accompanying public key certificates,
protected with a password-based symmetric key PFX Certificate?

In practice .pfx is just another file extension for a PKCS#12 or .p12 type certificate.

Convert PFX to PEM

This command will convert a pfx certificate to a X509 pem encoded certificate. The use of the -nodes flag will give the option to password protect the private key in the new pem encoded certificate.
For information on converting pem to der encoded certificates.
Export ALL: Public Certificates, Private Keys, and CA Chain as single certificate

Encrypt private key with a password

openssl pkcs12 -in Certificate.pfx -out NewCertificate.pem

Do not encrypt private key

openssl pkcs12 -in Certificate.pfx -out NewCertificate.pem -nodes

Export Public Certificate from pfx

openssl pkcs12 -in Certificate.pfx -out NewCertificate.pem -nokeys -clcerts

Export Private Key from pfx

openssl pkcs12 -in certificate.pfx -out certificate.key -nocerts -nodes

Export Certificate Authority (CA) Chain from pfx

openssl pkcs12 -in certificate.pfx -out ca-chain.pem -nokeys -cacerts

Convert PFX to JKS ( Java Keystore )

If you do have Keytool application and your PKCS#12 file, launch the one-line command:

keytool -importkeystore -srckeystore source.p12 -srcstoretype pkcs12 -srcalias Alias -destkeystore target.jks -deststoretype jks -deststorepass password -destalias Alias

DER vs. CRT vs. CER vs. PEM

Certificates and Encodings

At its core an X.509 certificate is a digital document that has been encoded and/or digitally signed according to RFC 5280.

In fact, the term X.509 certificate usually refers to the IETF’s PKIX Certificate and CRL Profile of the X.509 v3 certificate standard, as specified in RFC 5280, commonly referred to as PKIX for Public Key Infrastructure (X.509).
X509 File Extensions

The first thing we have to understand is what each type of file extension is. There is a lot of confusion about what DER, PEM, CRT, and CER are and many have incorrectly said that they are all interchangeable. While in certain cases some can be interchanged the best practice is to identify how your certificate is encoded and then label it correctly. Correctly labeled certificates will be much easier to manipulat
Encodings (also used as extensions)

.DER = The DER extension is used for binary DER encoded certificates. These files may also bear the CER or the CRT extension. Proper English usage would be “I have a DER encoded certificate” not “I have a DER certificate”.
.PEM = The PEM extension is used for different types of X.509v3 files which contain ASCII (Base64) armored data prefixed with a “—– BEGIN …” line.

Common Extensions

.CRT = The CRT extension is used for certificates. The certificates may be encoded as binary DER or as ASCII PEM. The CER and CRT extensions are nearly synonymous. Most common among *nix systems
CER = alternate form of .crt (Microsoft Convention) You can use MS to convert .crt to .cer (.both DER encoded .cer, or base64[PEM] encoded .cer) The .cer file extension is also recognized by IE as a command to run a MS cryptoAPI command (specifically rundll32.exe cryptext.dll,CryptExtOpenCER) which displays a dialogue for importing and/or viewing certificate contents.
.KEY = The KEY extension is used both for public and private PKCS#8 keys. The keys may be encoded as binary DER or as ASCII PEM.

The only time CRT and CER can safely be interchanged is when the encoding type can be identical. (ie PEM encoded CRT = PEM encoded CER)
Common OpenSSL Certificate Manipulations

There are four basic types of certificate manipulations. View, Transform, Combination , and Extraction
View

Even though PEM encoded certificates are ASCII they are not human readable. Here are some commands that will let you output the contents of a certificate in human readable form;
View PEM encoded certificate

Use the command that has the extension of your certificate replacing cert.xxx with the name of your certificate
openssl x509 -in cert.pem -text -noout openssl x509 -in cert.cer -text -noout openssl x509 -in cert.crt -text -noout
1
2
3

openssl x509 -in cert.pem -text -noout
openssl x509 -in cert.cer -text -noout
openssl x509 -in cert.crt -text -noout

If you get the folowing error it means that you are trying to view a DER encoded certifciate and need to use the commands in the “View DER encoded certificate below”

unable to load certificate 12626:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE
1
2

unable to load certificate
12626:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE

View DER encoded Certificate

openssl x509 -in certificate.der -inform der -text -noout
1

openssl x509 -in certificate.der -inform der -text -noout

If you get the following error it means that you are trying to view a PEM encoded certificate with a command meant for DER encoded certs. Use a command in the “View PEM encoded certificate above
unable to load certificate 13978:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1306: 13978:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:380:Type=X509
1
2
3

unable to load certificate
13978:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1306:
13978:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:380:Type=X509

Transform

Transforms can take one type of encoded certificate to another. (ie. PEM To DER conversion)
PEM to DER

openssl x509 -in cert.crt -outform der -out cert.der
1

openssl x509 -in cert.crt -outform der -out cert.der

DER to PEM

openssl x509 -in cert.crt -inform der -outform pem -out cert.pem
1

openssl x509 -in cert.crt -inform der -outform pem -out cert.pem

Combination

In some cases it is advantageous to combine multiple pieces of the X.509 infrastructure into a single file. One common example would be to combine both the private key and public key into the same certificate.

The easiest way to combine certs keys and chains is to convert each to a PEM encoded certificate then simple copy the contents of each file into a new file. This is suitable for combining files to use in applications lie Apache.
Extraction

Some certs will come in a combined form. Where one file can contain any one of: Certificate, Private Key, Public Key, Signed Certificate, Certificate Authority (CA), and/or Authority Chain.

IIS 7 Presentation from Microsoft

IIS 7 architecture diagram

HTTP Request Processing in IIS

IIS 7 and above have a similar HTTP request-processing flow as IIS 6.0. The diagrams in this section provide an overview of an HTTP request in process.

The following list describes the request-processing flow that is shown in Figure 1:

When a client browser initiates an HTTP request for a resource on the Web server, HTTP.sys intercepts the request.
HTTP.sys contacts WAS to obtain information from the configuration store.
WAS requests configuration information from the configuration store, applicationHost.config.
The WWW Service receives configuration information, such as application pool and site configuration.
The WWW Service uses the configuration information to configure HTTP.sys.
WAS starts a worker process for the application pool to which the request was made.
The worker process processes the request and returns a response to HTTP.sys.
The client receives a response.

Securing IIS 7

[gview file=”http://rmohan.com/wp-content/uploads/2013/10/Securing-and-Tuning-IIS7.pptx”]

IIS 7: The Administrator’s Guide

[gview file=”http://rmohan.com/wp-content/uploads/2013/10/IIS7.ppt”]

Architecting a Scalable WebHosting Platform with Internet Information Services (IIS)

[gview file=”http://rmohan.com/wp-content/uploads/2013/10/WIA302_Deml.pptx”]

Extending Internet Information Services (IIS) 7.x

[gview file=”http://rmohan.com/wp-content/uploads/2013/10/SVR06.pptx”]

weblogic document from Oracle

Weblogic documents from oracle

[gview file=”http://rmohan.com/wp-content/uploads/2013/10/weblogic1.pdf”] [gview file=”http://rmohan.com/wp-content/uploads/2013/10/weblogic2.pdf”] [gview file=”http://rmohan.com/wp-content/uploads/2013/10/weblogic3.pdf”] [gview file=”http://rmohan.com/wp-content/uploads/2013/10/weblogic4.pdf”] [gview file=”http://rmohan.com/wp-content/uploads/2013/10/weblogic5.pdf”]

qmail install

QMAIL DEPENDS NEED TO BE INSTALLED FIRST

yum -y update

yum install httpd*
yum install mod*
yum install php*

yum install libtool*
yum install autoconf*

======================================
Note: yum reinstall centos-release
======================================

To install PHP 5.3 On centos 5.6

http://www.how2centos.com/installing-php-5-3-3-on-centos-5-5-tutorial/
wget http://rpms.famillecollet.com/enterprise/remi-release-5.rpm
rpm -Uvh remi-release-5*.rpm epel-release-5*.rpm
yum install perl*

yum clean all && yum update

yum update kernel\*
yum install mysql*
or
yum install mysql-server mysql mysql-devel mysql-mmm

yum groupinstall “Development Tools”

yum -y install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel

yum -y install perl-HTML-Parser perl-DBI perl-Net-DNS perl-Digest-SHA1

yum install perl* (Fedora)

yum install perl (centos )
yum install perl-Net* (Centos)
yum install perl-suidperl (Centos )

yum install openssl*

yum install libss-devel*

yum install perl-CPAN

yum install perl-ExtUtils-Embed

yum install perl-HTML*

perl -MCPAN -e shell

install Bundle::CPAN

yum install spamassassin spambayes perl-Archive-Tar perl-IO-Zlib

qmail install

mkdir /downloads

cd /downloads
wget http://www.qmailrocks.org/downloads/qmailrocks.tar.gz

tar zxvf qmailrocks.tar.gz
cd /downloads/qmailrocks

mkdir -p /var/qmail

mkdir /usr/src/qmail
groupadd nofiles
useradd -g nofiles -d /var/qmail/alias -s /sbin/nologin -p’*’ alias
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p’*’ qmaild
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p’*’ qmaill
useradd -g nofiles -d /var/qmail -s /sbin/nologin -p’*’ qmailp
groupadd qmail
useradd -g qmail -d /var/qmail -s /sbin/nologin -p’*’ qmailq
useradd -g qmail -d /var/qmail -s /sbin/nologin -p’*’ qmailr
useradd -g qmail -d /var/qmail -s /sbin/nologin -p’*’ qmails
groupadd vchkpw
useradd -g vchkpw -d /home/vpopmail -s /sbin/nologin -p’*’ vpopmail
cd /usr/src/qmail

tar zxvf /downloads/qmailrocks/qmail-1.03.tar.gz

tar zxvf /downloads/qmailrocks/ucspi-tcp-0.88.tar.gz

mkdir -p /package

chmod 1755 /package

cd /package

tar zxvf /downloads/qmailrocks/daemontools-0.76.tar.gz
mkdir /var/log/qmail

cd /var/log/qmail

mkdir qmail-send qmail-smtpd qmail-pop3d

chown -R qmaill:root /var/log/qmail

chmod -R 750 /var/log/qmail
mkdir /var/qmail/supervise

cd /var/qmail/supervise

mkdir -p qmail-smtpd/log qmail-send/log qmail-pop3d/log

chmod +t qmail-smtpd qmail-send qmail-pop3d

##########################
NOTE
Applying qmail patch install normal qmail and Vpopmail and than install the pactch
############
cd /usr/src/qmail/qmail-1.03

patch </downloads/qmailrocks/patches/qmail-delphus-RELEASE.patch

echo 211 > /usr/src/qmail/qmail-1.03/conf-split

echo 255 > /usr/src/qmail/qmail-1.03/conf-spawn

vi conf-groups
nofiles

vi conf-vpopmail
/home/vpopmail/
cp /home/vpopmail/include/vauth.h .

cp /home/vpopmail/include/vlimits.h .

cp /home/vpopmail/include/vpopmail_config.h .

cp /home/vpopmail/include/vpopmail.h .

make man && make setup check

fatal: unable to find group qnofiles
make: *** [auto_uids.c] Error 111
./config-fast mohan.com

/downloads/qmailrocks

download vpopmail-5.4.30

tar -zxvf vpopmail-5.4.30.tar.gz

./configure –enable-logging=p –disable-clear-passwd

make install-strip

crontab -e

40 * * * * /home/vpopmail/bin/clearopensmtp 2>&1 > /dev/null
Install ucspi-tcp
cd /usr/src/qmail/ucspi-tcp-0.88/

RH 9/RHEL/Fedora/Slackware users: You will need to patch ucspi-tcp with an additional errno patch:

patch < /downloads/qmailrocks/patches/ucspi-tcp-0.88.errno.patch

make && make setup check
Install ucspi-tcp
Install Daemontools

cd /package/admin/daemontools-0.76

RH 9/RHEL/Fedora/Slackware users:You will need to patch daemontools with an additional errno patch:

cd /package/admin/daemontools-0.76/src

patch < /downloads/qmailrocks/patches/daemontools-0.76.errno.patch

cd /package/admin/daemontools-0.76

package/install
cp /downloads/qmailrocks/scripts/finalize/linux/pop3d_run /var/qmail/supervise/qmail-pop3d/run

cp /downloads/qmailrocks/scripts/finalize/linux/pop3d_log /var/qmail/supervise/qmail-pop3d/log/run

cp /downloads/qmailrocks/scripts/finalize/linux/smtpd_run /var/qmail/supervise/qmail-smtpd/run

cp /downloads/qmailrocks/scripts/finalize/linux/smtpd_log /var/qmail/supervise/qmail-smtpd/log/run

cp /downloads/qmailrocks/scripts/finalize/linux/send_run /var/qmail/supervise/qmail-send/run

cp /downloads/qmailrocks/scripts/finalize/linux/send_log /var/qmail/supervise/qmail-send/log/run
cp /downloads/qmailrocks/scripts/finalize/rc /var/qmail/

cp /downloads/qmailrocks/scripts/finalize/qmailctl /var/qmail/bin/
chmod 755 /var/qmail/rc /var/qmail/bin/qmailctl

chmod 751 /var/qmail/supervise/qmail-pop3d/run
chmod 751 /var/qmail/supervise/qmail-pop3d/log/run

chmod 751 /var/qmail/supervise/qmail-smtpd/run
chmod 751 /var/qmail/supervise/qmail-smtpd/log/run

chmod 751 /var/qmail/supervise/qmail-send/run
chmod 751 /var/qmail/supervise/qmail-send/log/run

echo ./Maildir > /var/qmail/control/defaultdelivery

echo 255 > /var/qmail/control/concurrencyremote

chmod 644 /var/qmail/control/concurrencyremote

echo 30 > /var/qmail/control/concurrencyincoming

chmod 644 /var/qmail/control/concurrencyincoming

echo ‘345600’ > /var/qmail/control/queuelifetime

ln -s /var/qmail/bin/qmailctl /usr/bin

ln -s /var/qmail/supervise/qmail-send /var/qmail/supervise/qmail-smtpd /var/qmail/supervise/qmail-pop3d /service
echo ‘postmaster@mohan.com’ > /var/qmail/alias/.qmail-root
echo ‘postmaster@mohan.com’ > /var/qmail/alias/.qmail-postmaster
echo ‘postmaster@mohan.com’ > /var/qmail/alias/.qmail-mailer-daemon

ln -s /var/qmail/alias/.qmail-root /var/qmail/alias/.qmail-anonymous

chmod 644 /var/qmail/alias/.qmail*

#########################################################################

touch mfcheck authreq chkuser heloreq maxrcpt
touch logregex

touch badhelo badmailfrom badmailto badmailfromnorelay badmailtonorelay dnsblskip

vi mfcheck =1
vi authreq =1
vi mfcheck =1
vi tlsreq = 1

After installation you should put some dnsbl lists into /var/qmail/control/dnsbllist, f.e.:
echo “sbl-xbl.spamhaus.org\ndul.dnsbl.sorbs.net” > /var/qmail/control/dnsbllist
taps

control/taps Contains a regex style list of addresses to tap and the email address to send the copy to, separated by a colon.
Examples
•To tap all email and send a copy to admin@example.com add a line like:
.*:admin@example.com
•To tap a whole domain and send a copy to admin@example.com add a line like:
.*@domain.com:admin@example.com
•To tap an individual email address and send a copy to archive@example.com add a line like:
user@domain.com:archive@example.com
#########################################################################

mv /usr/lib/sendmail /usr/lib/sendmail.old

mv /usr/sbin/sendmail /usr/sbin/sendmail.old

chmod 0 /usr/lib/sendmail.old /usr/sbin/sendmail.old
ln -s /var/qmail/bin/sendmail /usr/lib/sendmail

ln -s /var/qmail/bin/sendmail /usr/sbin/sendmail

rpm -qa | grep sendmail
sendmail-milter-8.14.4-20.fc15.x86_64
sendmail-cf-8.14.4-20.fc15.noarch
sendmail-8.14.4-20.fc15.x86_64
rpm -e –nodeps sendmail
rpm -e –nodeps sendmail-cf
rpm -e –nodeps sendmail-milter
rpm -qa | grep postfix
spamass-milter-postfix-0.3.2-1.fc15.noarch
postfix-2.8.3-1.fc15.x86_64
rpm -e –nodeps postfix spamass-milter-postfix

cd /downloads/qmailrocks/

tar zxvf ezmlm-0.53-idx-0.41.tar.gz

cd ezmlm-0.53-idx-0.41

make && make setup
cd /downloads/qmailrocks

tar zxvf autorespond-2.0.5.tar.gz

cd autorespond-2.0.5

make && make install

cd /downloads/qmailrocks

tar zxvf vqadmin-2.3.6.tar.gz

Qmail 64-bit

When building QmailRocks on 64-bit Linux you will see this error when you get to step 6, installing Vqadmin:
checking build system type… Invalid configuration `x86_64-unknown-linuxoldld’: machine `x86_64-unknown’ not recognized
configure: error: /bin/sh ./config.sub x86_64-unknown-linuxoldld failed

Go back to just before the step where you configure:
./configure –enable-cgibindir=/path/to/your/cgi-bin –enable-htmldir=/path/to/your/html/directory

Then run:
libtoolize –force

Now start over at the configure step again
copy config.guess and config.sub from vpomail directory to vqadmin directory because vqadmin has old config.guess and config.sub files does not have the definitions for the 64 bit operating systems.

/downloads/qmailrocks/vpopmail-5.4.13 # cp config.guess config.sub ../vqadmin-2.3.6
cp config.sub /downloads/qmr/vqadmin-2.3.7/
cp config.guess /downloads/qmr/vqadmin-2.3.7/

cd vqadmin-2.3.6
./configure –enable-cgibindir=/var/www/cgi-bin –enable-htmldir=/var/www/html
make && make install-strip
cd /var/www/cgi-bin/vqadmin

chmod 644 .htaccess

AuthType Basic
AuthUserFile /var/www/cgi-bin/vqadmin/.htpasswd
AuthName vQadmin
require valid-user
satisfy any
htpasswd -bc /var/www/cgi-bin/vqadmin/.htpasswd admin bija123
chmod 644 .htpasswd
cd /etc/httpd/conf.d

vi vqadmin.conf

<Directory “/var/www/cgi-bin/vqadmin”>
deny from all
Options ExecCGI
AllowOverride AuthConfig
Order deny,allow
</Directory>

/etc/init.d/httpd restart

http://192.168.1.12/cgi-bin/vqadmin/vqadmin.cgi/

cd /downloads/qmailrocks

tar zxvf maildrop-1.6.3.tar.gz

cd maildrop-1.6.3

./configure –prefix=/usr/local –exec-prefix=/usr/local –enable-maildrop-uid=root –enable-maildrop-gid=vchkpw –enable-maildirquota

make && make install-strip && make install-man
tar -zxvf qmailadmin-1.2.14.tar.gz

cd qmailadmin-1.2.14

./configure –enable-cgibindir=/var/www/cgi-bin/ –enable-htmldir=/var/www/html

–enable-imageurl=../../images –enable-imagedir=/var/www/html/images –enable-domain-autofill –enable-ezmlmdir=/usr/local/bin/ezmlm –enable-autorespond=/usr/bin/autorespond
make && make install-strip
echo ‘127.:allow,RELAYCLIENT=””‘ >> /etc/tcp.smtp

qmailctl cdb

vi /var/qmail/supervise/qmail-smtpd/run

exec /usr/local/bin/softlimit -m 600000000 \
exec /usr/local/bin/softlimit -m 600000000 \

qmailscanner

./configure –domain rmohan.com \
–admin postmaster \
–local-domains “rmohan.com” \
–add-dscr-hdrs yes \
–scanners vscan,verbose_spamassassin \
–dscr-hdrs-text “X-Antivirus-MYDOMAIN” \
–ignore-eol-check yes \
–sa-quarantine 0 \
–sa-delete 0 \
–sa-reject no \
–sa-subject “:SPAM:” \
–sa-alt yes \
–sa-debug no \
–notify admin \
MTRACK STRACK

# mtrack is a script to help understand the log output from qmail-send, by grouping together all of the log lines which pertain to a given message.
# strack is another log file tracking script. It does for qmail-smtpd logs what mtrack does for qmail-send logs

cd /var/qmail/bin/
wget http://qmail.jms1.net/scripts/mtrack
wget http://qmail.jms1.net/scripts/strack
chmod 751 mtrack strack

ln -s /var/qmail/bin/mtrack /usr/bin/
ln -s /var/qmail/bin/strack /usr/bin/

# test:
cat /var/log/qmail/qmail-send/current
cat /var/log/qmail/qmail-send/current | mtrack
cat /var/log/qmail/qmail-smtpd/current
cat /var/log/qmail/qmail-smtpd/current | strack

Hostname Verification failed for certificate with CommonName cluster2.rmohan.com

” for domain “mohan” running in development mode.>
<Oct 21, 2013 1:03:19 AM SGT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to RUNNING.>
<Oct 21, 2013 1:03:19 AM SGT> <Notice> <WebLogicServer> <BEA-000360> <The server started in RUNNING mode.>
<Oct 21, 2013 1:03:49 AM SGT> <Warning> <Security> <BEA-090504> <Certificate chain received from cluster2.rmohan.com – 192.168.1.41 failed hostname verification check. Certificate contained cluster1.rmohan.com but check expected cluster2.rmohan.com>
<Oct 21, 2013 1:03:49 AM SGT> <Warning> <Security> <BEA-090504> <Certificate chain received from cluster2.rmohan.com – 192.168.1.41 failed hostname verification check. Certificate contained cluster1.rmohan.com but check expected cluster2.rmohan.com>
<Oct 21, 2013 1:06:16 AM SGT> <Warning> <netuix> <BEA-423420> <Redirect is executed in begin or refresh action. Redirect url is /console/console.portal?_nfpb=true&_pageLabel=ServerControlServersPage.>
<Oct 21, 2013 1:06:51 AM SGT> <Warning> <Security> <BEA-090504> <Certificate chain received from cluster2.rmohan.com – 192.168.1.41 failed hostname verification check. Certificate contained cluster1.rmohan.com but check expected cluster2.rmohan.com>
<Oct 21, 2013 1:06:51 AM SGT> <Warning> <Security> <BEA-090504> <Certificate chain received from cluster2.rmohan.com – 192.168.1.41 failed hostname verification check. Certificate contained cluster1.rmohan.com but check expected cluster2.rmohan.com>
<Oct 21, 2013 1:06:57 AM SGT> <Warning> <Socket> <BEA-000449> <Closing the socket, as no data read from it on 192.168.1.2:51,146 during the configured idle timeout of 5 seconds.>
<Oct 21, 2013 1:06:57 AM SGT> <Warning> <Socket> <BEA-000449> <Closing the socket, as no data read from it on 192.168.1.2:51,145 during the configured idle timeout of 5 seconds.>

BEA-090504 – Certificate chain received from localhost – 127.0.0.1 failed hostname verification check. Certificate contained xyz.abc.com but check expected localhost
OR
BEA-090482 – BAD_CERTIFICATE alert was received from localhost.localdomain – 127.0.0.1. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.

There are two ways to solve it.

1. Disable Flags – Jugaad way 😉
Put the following flags at the right places.
Node Manager: -Dweblogic.nodemanager.sslHostNameVerificationEnabled=false
Admin Server: -Dweblogic.security.SSL.ignoreHostnameVerification=true

2. Recreate the Certificates – The recommended way.
Node manager by default uses the WebLogic demo identity keystore. The keystore is generated at install time using the CertGen utility. The generated private key uses the common name (cn) resolved by Java.

2.1 Set the PATH
. $WL_HOME/server/bin/setWLSEnv.sh

2.2 Backup DemoIdentity.jks under $WL_HOME/server/lib

2.3 Generate the private key.
java utils.CertGen -cn -keyfilepass DemoIdentityPassPhrase -certfile newcert -keyfile newkey

2.4 Import the key generated above to the keystore.
java utils.ImportPrivateKey -keystore DemoIdentity.jks -storepass DemoIdentityKeyStorePassPhrase -keyfile newkey.pem -keyfilepass DemoIdentityPassPhrase -certfile newcert.pem -alias demoidentity

2.5 Copy DemoIdentity.jks to $WL_HOME/server/lib

2.6 Restart your nodemanager.

How to fix mod_ssl CRIME CVE-2012-4929 SSL/TLS CRIME

How can we mitigate CVE-2012-4929 SSL/TLS CRIME attack against HTTPS in Red Hat Enterprise Linux 5 or 6

httpd refuses to start when SSLCompression on is used in /etc/httpd/conf.d/ssl.conf
How can we mitigate CVE-2012-4929 SSL/TLS CRIME attack against HTTPS in Red Hat Enterprise Linux 5 or 6 on httpd and mod_ssl?

will focus only on fixing the problem. On RHEL server 5.x and 6.x the easy way is to simply disable SSL compression.
In newer Apache versions this can be done using the cmd: “SSLCompression off”

But in RHEL this will not work and you will get the following error
“Invalid command ‘SSLCompression’, perhaps misspelled or defined by a module not included in the server configuration”

As described in RHEL support site the way to do is:

Add the following to “export OPENSSL_NO_DEFAULT_ZLIB=1? /etc/sysconfig/httpd and then restart the service, like:

export OPENSSL_NO_DEFAULT_ZLIB=1

# echo “export OPENSSL_NO_DEFAULT_ZLIB=1? >> /etc/sysconfig/httpd
# service httpd restart

openssl s_client -connect localhost:443

.
-bash-4.1# openssl s_client -connect localhost:443
CONNECTED(00000003)
depth=0 C = –, ST = SomeState, L = SomeCity, O = SomeOrganization, OU = SomeOrganizationalUnit, CN = mohan111, emailAddress = root@mohan111
verify error:num=18:self signed certificate
verify return:1
depth=0 C = –, ST = SomeState, L = SomeCity, O = SomeOrganization, OU = SomeOrganizationalUnit, CN = mohan111, emailAddress = root@mohan111
verify return:1
—
Certificate chain
0 s:/C=–/ST=SomeState/L=SomeCity/O=SomeOrganization/OU=SomeOrganizationalUnit/CN=mohan111/emailAddress=root@mohan111
i:/C=–/ST=SomeState/L=SomeCity/O=SomeOrganization/OU=SomeOrganizationalUnit/CN=mohan111/emailAddress=root@mohan111
—
Server certificate
—–BEGIN CERTIFICATE—–
MIIDCzCCAnSgAwIBAgICRhAwDQYJKoZIhvcNAQEFBQAwgaExCzAJBgNVBAYTAi0t
MRIwEAYDVQQIDAlTb21lU3RhdGUxETAPBgNVBAcMCFNvbWVDaXR5MRkwFwYDVQQK
DBBTb21lT3JnYW5pemF0aW9uMR8wHQYDVQQLDBZTb21lT3JnYW5pemF0aW9uYWxV
bml0MREwDwYDVQQDDAh0YWdpdDExMTEcMBoGCSqGSIb3DQEJARYNcm9vdEB0YWdp
dDExMTAeFw0xMzEwMTcxMzA1NTBaFw0xNDEwMTcxMzA1NTBaMIGhMQswCQYDVQQG
EwItLTESMBAGA1UECAwJU29tZVN0YXRlMREwDwYDVQQHDAhTb21lQ2l0eTEZMBcG
A1UECgwQU29tZU9yZ2FuaXphdGlvbjEfMB0GA1UECwwWU29tZU9yZ2FuaXphdGlv
bmFsVW5pdDERMA8GA1UEAwwIdGFnaXQxMTExHDAaBgkqhkiG9w0BCQEWDXJvb3RA
dGFnaXQxMTEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJvMjBwCChoJH74j
dPECdB+saT/HqMtRP7w2cGi/G+7/VmNfFMLN3VqDMuUiAwXBSMrhDDhBO69+aMvj
oZHupGgVLTAzRJa9uP9PquFfjOuxEUvnKzlg0gwCqWH06GCu0ZcooIsduTRLOE9X
tbSgN2snQ00XEV1Xl9niWgvKFUnxAgMBAAGjUDBOMB0GA1UdDgQWBBQpJ2Y+9O+d
knVbGpff1za/RE6ngzAfBgNVHSMEGDAWgBQpJ2Y+9O+dknVbGpff1za/RE6ngzAM
BgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAHp1LU5VuP/b4euNRJdvK0eu
vxi8STrqmUOuQ90v1jZgqMaLT1/tQ/5+h2E5gUDL4pdi7IoTldB3xBcfR8vvnfgC
cOvRmqIyUFgDeULFNk+lcFq0FdDIm/AbZxAT5hlQZU5EQUfkws5qerwmOlp9Gs2n
WPmDOjcmvTWsrSevbyQU
—–END CERTIFICATE—–
subject=/C=–/ST=SomeState/L=SomeCity/O=SomeOrganization/OU=SomeOrganizationalUnit/CN=mohan111/emailAddress=root@mohan111
issuer=/C=–/ST=SomeState/L=SomeCity/O=SomeOrganization/OU=SomeOrganizationalUnit/CN=mohan111/emailAddress=root@mohan111
—
No client certificate CA names sent
—
SSL handshake has read 1533 bytes and written 310 bytes
—
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher    : DHE-RSA-AES256-SHA
Session-ID: 11311947FC0F863B4646C035BFB7E84BBDE6E263B43D50318E253FDDF970F9C1
Session-ID-ctx:
Master-Key: 3C4E725A784B5412E40F9502159639C73611DCD3A5515F6E3132545458F0032A1812FA563BAEC15CF24689577C128B76
Key-Arg   : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
TLS session ticket:
0000 – 91 88 07 7a aa ac 4e c5-9c a5 21 7d a3 d6 fc d9   …z..N…!}….
0010 – 90 3e bd 2d a3 c3 3b 1d-98 10 30 32 d9 27 46 8e   .>.-..;…02.’F.
0020 – 18 77 d5 31 41 d0 9f c5-21 6b 37 92 32 fb d0 7b   .w.1A…!k7.2..{
0030 – 63 f7 5a 1c d3 24 92 f7-1c 3f 35 f2 a3 04 75 87   c.Z..$…?5…u.
0040 – 68 eb 01 06 62 18 26 1e-83 f0 4a e6 f1 bb 12 cc   h…b.&…J…..
0050 – f0 35 e8 fa ee 50 c0 0c-4f 6e a7 c4 e2 10 27 ee   .5…P..On….’.
0060 – 66 4b 7c bf 96 36 a9 c4-90 3c 62 f5 96 d9 ca d6   fK|..6…<b…..
0070 – 7a 33 b5 d4 2d ec fd 89-58 61 de cb d0 b0 8a ec   z3..-…Xa……
0080 – d2 a6 14 de 92 8a 58 9f-d4 71 e4 95 c7 9c 94 09   ……X..q……
0090 – 65 a1 b6 7c a2 93 b4 60-00 d6 da 81 ea 0a 6d 48   e..|…`……mH
00a0 – ff 51 d1 94 b3 66 7d 7a-28 5c a4 7a c3 74 61 1b   .Q…f}z(\.z.ta.
00b0 – d5 61 52 06 10 f3 c4 a8-13 eb 3c 35 e3 44 56 5c   .aR…….<5.DV\

Start Time: 1382016174
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)

IIS7 redirect HTTP to HTTPS

Memorise

IIS7 redirect HTTP to HTTPS

April 14, 2013

The method of setting up an IIS7 redirect HTTP to HTTPS is to Require SSL on the site or part of the site and set up a custom 403.4 error page. To do this, just following these steps:

Install your SSL certificate in IIS 7 and bind it to your website
In IIS, click on the site name, and go to the SSL Settings section
Check Require SSL and Require 128-bit SSL and click Apply
After doing this, users will normally receive error:
Create a new text file and paste the following into it:

<html>
<head><title>Redirecting…</title></head>
<script language=”JavaScript”>
function redirectHttpToHttps()
{
var httpURL= window.location.hostname + window.location.pathname + window.location.search;
var httpsURL= “https://” + httpURL;
window.location = httpsURL;
}
redirectHttpToHttps();
</script>
<body>
</body>
</html>

6. Save the file as redirectToHttps.htm in your C:\Inetpub directory

7. Back in IIS, click on the site name and double-click the Error Pages option

8. Click Add… and enter 403.4 as the Status code. Browse for the redirectToHttps.htm file you just created and click OK

9. Select the error code and press Edit Feature Settings…

10. Click the Custom error pages option and again browse for the redirectToHttps.htm file

11. Test the site by going to http://www.yoursite.com and making sure it redirects

A caveat of using a custom error page to do an IIS7 redirect from HTTP to HTTPS is that the web browser must have JavaScript enabled for the redirection to work.

If you get “Lock violation” error in IIS 7.5

All you need to do is to open file “%windir%\System32\inetsrv\config\applicationHost.config” and remove ‘defaultPath’ from the following line:

GUI Version

URL Rewrite has a GUI to allow you to enter rules within IIS 7; in the background all this does is edit the web.config file of the site. I will show you how to create a rule both ways.

In the following example we will redirect HTTP to HTTPs using URL Rewrite. You will need the following items completed in order for this to work correctly.

– SSL Certificate for site installed in IIS.
– Site properly installed and configured for SSL (site set up and binding in IIS configured).
– URL Rewrite 2.0 is installed on the sever.

GUI Version

– Select the website you wish to configure
– In the “Features View” panel, double click URL Rewrite

You will notice there are currently no rules configured for this site. Click “Add Rules…” in the Actions menu to the right of the “Features View” panel

Use the default “Blank rule” and press “OK”.

When editing a rule there are the “Name” field and 4 configuration pull down boxes.

– Enter “Redirect to HTTPS” in the name field.
– Next we will configure the first configuration pull down box called “Match URL”, on the right side of “Match URL” press the down arrow to expand the box.

Within the “Match URL” configuration box we will set the following settings:

Requested URL: Matches the Pattern
Using: Regular Expressions
Pattern: (.*)

We can now edit the next configuration pull down box which is “Conditions”, Press “Add…” to add a new condition to the configuration

We will configure the condition with the following settings:

Condition Input: {HTTPS}
Check if input string: Matches the Pattern
Pattern: ^OFF$

Press “OK”

href=”http://rmohan.com/wp-content/uploads/2013/10/031010_2252_Automatical7.png”>

You should now see the rule configured on the main screen of the URL Rewrite module.

Test your site, it should now redirect from HTTP to HTTPS.

If we exam the web.config file we can see where the rule was entered. If we entered the rule directly into the web.config file it would show up in the GUI.

Test your site, it should now redirect from HTTP to HTTPS.

If we exam the web.config file we can see where the rule was entered. If we entered the rule directly into the web.config file it would show up in the GUI.

Web.Config Rule

You can also edit the web.config file of the site directly and you will be able to see the rule in the GUI. You will need to enter the following within the <system.webServer> </system.webServer> elements.

<rule name="Redirect to HTTPS" stopProcessing="true">

<match url="(.*)" />

<conditions><add input="{HTTPS}" pattern="^OFF$" />

</conditions>

<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="SeeOther" />

</rule>

When implementing this solution you need to make sure to use relative paths for all references on your page because there is a possibility you will get a warning asking you if you want to display secure and insecure items. For example, if you have a logo on your page and the URL to this logo is http://domain/images/logo.jpg, do not use the whole path because including the http:// will hard code this image to use http and not https

IIS 7.5 Export the Private key

Overview: Migrating your SSL certificate from one Windows server to another Windows server will require you to export and then import your SSL key pair from server A to server B using a PFX backup file.

A. To Export a Server Certificate

In the Run dialog box, type mmc, and then click OK. The Microsoft Management Console (MMC) appears.
If you do not have Certificate Manager installed in the MMC, you’ll need to install it.
1. On the File menu, click Add/Remove Snap In
2. Click Add and then Select Certificates from the Available Standalone Snap-ins dialog box and click Add
3. Select Computer Account and then Local Computer
4. The Certificate Manager MMC has been installed
In the console tree in the left-hand pane expand the Certificates (Local Computer) node, and then the Personal node. Note that to view certificates in the local machine store, you must be in the Administrator role.

Right-click the certificate you want to export, click All Tasks, and click Export to start the Certificate Export Wizard.
Click Next.
On Export Private Key, click Yes to export the private key.Important: You must export the private key along with your certificate for it to be valid on your target server. Otherwise, you will have to request a new certificate for the target server.
In the Export File Format dialog box, click the format you want for the certificate. If the certificate has already been formatted, that format is selected as the default (should be .pfx). Click Next.Do not select Delete the private key if export is successful, because this will disable the SSL site that corresponds to that private key.
Select the “include all certificates in the certification path if possible” checkbox.

Continue to follow steps in the wizard, and enter a password for the certificate backup file when prompted. Using a strong password is highly recommended because it ensures that the private key is well protected.
Type the name of the file you want to export, or click Browse to search for the file. Click Next.
Click Finish to complete the Certificate Export Wizard.

B. To Import a Server Certificate

In the Run dialog box, type mmc, and then click OK. The Microsoft Management Console (MMC) appears.
If you do not have Certificate Manager installed in the MMC, see step 2 above.
In the console tree in the left-hand pane expand the Certificates (Local Computer) node, and then the Personal node.

1. Right-click on Certificates, click All Tasks, and click Import to start the Certificate Import Wizard.
2. Click Next.
3. Enter the password used when the PFX file was exported and check the Mark the private key as exportable checkbox and click Next.
4. Select Place all certificates in the following store: Personal and click Next.
5. Click Finish to complete the Certificate Import Wizard.
How to assign an Imported SSL Certificate to a Web Site in IIS
1. Now the SSL keys are on the target server. Next we assign the certificate to the site in IIS.
2. Open the Internet Information Services (IIS) Manager. From the Start button select Programs > Administrative Tools > Internet Information Services Manager.
3. In IIS Manager, double-click the local computer, and then double-click the Web Sites folder.
4. Right-click the Web site for which you want to assign the imported certificate, and then click Properties. By default it will be Default Web Site, yours may be different.
1. Select the Directory Security tab and click Server Certificate in the Secure communications section.
2. Click Next in the Welcome to the Web Server Certificate Wizard window.
3. Select Assign an existing certificate, Click Next.
4. Select the certificate from the list and finish the wizard.
5. Stop, then Start the web server for that site.