I have the following problem setting up a connection via TLS for MongoDB. I performed the creation of the two .pem keys (server and client) but after successfully starting the server via the command: mongod --tlsMode requireTLS \ --tlsCertificateKeyFile <path to TLS/SSL certificate and key PEM file> \ --tlsCAFile <path to root CA PEM file> --bind_ip <hostnames> I cannot get the client to connect using this command:mongosh --tls --tlsCertificateKeyFile <path to client PEM file> \ --tlsCAFile <path to root CA PEM file> as I get the following error. Can someone help me?
Related
Can't open config/certs/http_ca.crt for reading, No such file or directory
139762353411904:error:02001002:system library:fopen:No such file or directory:crypto/bio/bss_file.c:69:fopen('config/certs/http_ca.crt','r')
139762353411904:error:2006D080:BIO routines:BIO_new_file:no such file:crypto/bio/bss_file.c:76:
unable to load certificate
getting this issue does anybody help me to figure out this problem
https://www.elastic.co/guide/en/elasticsearch/reference/8.0/configuring-stack-security.html#_connect_clients_to_elasticsearch_5 ..... following this documentation for connecting of Elasticsearch to filebeat
$ sudo openssl x509 -fingerprint -sha256 -in config/certs/http_ca.crt
Instead of fingerprint you can also use the CA certificate (2nd option in the document) to establish SSL between Filebeat and Elasticsearch.
Try the below settings in your filebeat.yml for ES connection. Note: In case you want to disbale SSL, you can add the line "ssl.verification_mode: none"
output.elasticsearch:
hosts: ["https://localhost:9200"]
username: "elastic"
password: "xxxxxxxxxxxxxxxxxxxxxx"
ssl.certificate_authorities: "/etc/elasticsearch/certs/http_ca.crt"
index: "myindex"
pipeline: "mypipeline"
I have deployed my project on a compute engine VM instance. React is running on some port and Spring Boot server is running on another port. I've downloaded certs for a subdomain on the VM. How do I apply them to the project so that it opens on HTTPS
We get PEM file from Let's Encrypt using certbot
certbot certonly -a standalone -d example.com
Create PKCS12 format using openssl
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out keystore.p12 -name tomcat -CAfile chain.pem -caname root
Add these properties to application.properties to add SSL certificate from Let's Encrypt
server.port: 443
security.require-ssl=true
server.ssl.key-store:/etc/letsencrypt/live/example.com/keystore.p12
server.ssl.key-store-password: store-password
server.ssl.keyStoreType: PKCS12
server.ssl.keyAlias: tomcat
You may install NGINX on your instance and use it as a reverse proxy to pass requests to each server depending on the subdomain, then you may update the configuration with SSL config.
If you plan on using certificates issued by Let's Encrypt, then you can use Certbot to amend the NGINX configuration with SSL config automatically.
I'm trying to make a client connect to some servers via https, using openssl library.
The call stack is something like this:
SSL_library_init();
SSL_load_error_strings();
SSL_CTX *ctx = SSL_CTX_new(TLSv1_method());
SSL_CTX_load_verify_locations(ctx, "file_with_trusted_certificates", NULL);
SSL *ssl = SSL_new(ctx);
BIO *bio = BIO_new_socket(...);
SSL_set_bio(ssl, bio, bio);
SSL_connect(ssl);
SSL_get_verify_result(ssl);
I have 2 servers with ssl certificates, which I have extracted using openssl tool and put into "file_with_trusted_certificates" file:
openssl s_client -showcerts -connect server_url:443
The problem is the following: one server is validated (though if not using file_with_trusted_certificates it fails with error 19: self signed certificate in certificate chain), but the check of the second server always fails with error 20: unable to get local issuer certificate. When passing
"-CAfile file_with_trusted_certificates"
to openssl tool, both servers get validated.
What I am doing wrong, why doesn't the second server also get validated?
The servers have different ciphers, and the one that succeeds has secure renegotiation enabled.
EDIT:
The C client runs on a arm device, which has libssl v0.9.8. The openssl tool run on the embedded device yields the same result as the C application: error 20 for first server and OK for the other. Using a linux environment, the openssl tool yield OK for both server, but then, maybe the version of the C application would do the same.
After some trial-error, I managed to find the problem.
I needed to add the certificate of the issuer of the root certificate in the chain in "file_with_trusted_certificates" file, but I added just the root certificate in the chain:
Common name: Baltimore CyberTrust Root -> I added this
Issuer: GTE CyberTrust Global Root -> I needed to add the certificate of this
Interestingly, it was working for the other server because the root certificate in the chain was self-signed and authorized:
Common name: AddTrust External CA Root
Issuer: AddTrust External CA Root
I have used Postgres and love its way to handle the database connection.
I have to use now Matlab and Physionet's flat database system to retrieve data.
However, I do not understand the logic in some cases, like in ptbdb.
How can you check if a connection exists to a database in Matlab?
How can you monitor what the system is doing when connecting to the database?
It would be very nice to be able to ping the system or something like that to know what is the problem. I get no information now what is the problem.
My connection was disconnected continuously because it was not secure.
The topic is about secure connection between Matlab and PostgreSQL, which is undocumented widely, for instance, discussed here about Secure SSL connection between Matlab and PostgreSQL.
Summary of the blog post
Make appropriate changes in
Generate certificate for the server; diseserver.csr, root.crt; postgreSQL directry (diseserver.key, diseserver.crt, and root.crt); please see more precisely here
postgresql.conf
pg_hba.conf
generate client certificates
convert key to pkcs8 format
check correct version of JDBC driver
check client certificate
dbtest.m
Certificate for the server
$openssl req -out diseserver.csr -new -newkey rsa:2048 -nodes -keyout diseserver.key
postgresql.conf
ssl = on
ssl_cert_file = 'diseserver.crt' # (change requires restart)
ssl_key_file = 'diseserver.key' # (change requires restart)
ssl_ca_file = 'root.crt' # (change requires restart)
pg_hba.conf
hostnossl all all 0.0.0.0/0 reject
hostssl mytable all 0.0.0.0/0 cert map=ssl clientcert=1
Generate client certificates
$mkdir ~/.postgresql
$cd ~/.postgresql
$openssl req -out postgresql.csr -new -newkey rsa:2048 -nodes -keyout postgresql.key
Convert key to pkcs8 format
$openssl pkcs8 -topk8 -inform PEM -outform DER -in postgresql.key -out postgresql.pk8 -nocrypt
Check client certificate
jdbc:postgresql://diseserver.mydomain.org/mytable?ssl=true&sslfactory=org.postgresql.ssl.jdbc4.LibPQFactory&sslmode=verify-full&
dbtest.m matlab function
function dbtest
driver = 'org.postgresql.Driver';
[~,username] = system('whoami');
url = 'jdbc:postgresql://diseserver.mydomain.org/mytable?ssl=true&sslfactory=org.postgresql.ssl.jdbc4.LibPQFactory&sslmode=verify-full&';
myconn = database('mytable', username, '', driver, url);
if ~isempty(myconn.Message)
fprintf(2,'%s\n', myconn.Message);
else
fprintf(1, 'Connected!\n');
end
end
In order to enable SSL in Appengine.
I try to enable SSL for my custom domain
So far I found this article:
setup SSL on AppEngine... Assigned URLs "empty"
openssl genrsa -out rsaprivkey.pem 1024
openssl req -new -x509 -key rsaprivkey.pem -out dsacert.pem
then I uploaded the generated .pem to google app SSL setting page
dsacert.pem > PEM encoded X.509 certificate
rsaprivkey.pem > Unencrypted PEM encoded RSA private key
However, I got this error message after Upload.
What should I do next?
Domain name in certificate should only contain allowed characters (RFC
1034).
Solve!
It this article
setup SSL on AppEngine... Assigned URLs "empty"
when open ssl asks you questions for your app's name, make sure to
include the entire url as in your answer, www.abc.com to secure
https://www.abc.com
But I didn't find any place to enter my app's name during the openssl pem generation at first.
finally I find out the domain should be filled in organization and common name fields.
http://www.rackspace.com/knowledge_center/article/generate-a-csr-with-openssl
Organization Name (eg, company) [Internet Widgits Pty Ltd]: > example.com
Common Name (eg, YOUR name) > *.example.com