4

As I came across the same problem I did some research and found the following: Common name in the CSR code needs to be of a certain format. General requirements are latin alphanumeric characters and no special symbols like ! @ # $ % ^ ( ) ~ ? > < & / \ , . " ' _ More peculiarities are described here for your reference. IDN (International Domain ...


3

The name verification is guided by RFC 2818 Section 3.1, more specifically on wildcards: Matching is performed using the matching rules specified by [RFC2459]. If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the ...


2

If you have purchase a standard, single domain SSL certificate, then it will be for one domain, so you can only use it for domainname.com or www.domainname.com. If you have purchased a wildcard or UCC certificate then it will allow either unlimited subdomains (in the case of a wildcard) or mulitple domains up to a certain number (in the case of ...


2

Per https://letsencrypt.org/docs/integration-guide/ : Let’s Encrypt accepts RSA keys from 2048 to 4096 bits in length, and P-256 and P-384 ECDSA keys. That’s true for both account keys and certificate keys. You can’t reuse an account key as a certificate key. So you can have EC-based certificates, but note that they will for now still be signed by a RSA-...


2

how can this work when it takes so long for the changes to propagate? The propagation time (“up to 48 hours for the changes to be known world wide”) is a conservative estimate of the time that various DNS servers around the world may have records for your domain stored in their internal cache. However, when carrying out its DNS validation (as per the ACME ...


1

Only the EV = Extended Validation certificates give you the green bar. It looks different, though, in each browser, these are just examples: None of the OV / DV give it to you. The OV certificates just contain company information in it, are worth in my opinion only to State authorities.


1

What they're really doing with this question is trying to decide which of several possible formats you want the certificate delivered in, without actually asking you. Choose Apache -- even if you aren't using Apache -- because this should get you the certificate and chain files you need, in an easily usable format for anything in AWS. This is the standard ...


1

It's a common mistake to think that when you create your own SSL certificate they are self-signed. You can also create your own CA, and sign your certificates with it (yeah, the CA certificate will be self signed too, but so are the "real" CA certificates - every certificate chain is started by the CA certificate, and CA is created from scratch). The main ...


1

It's important to understand that SSL certificates come in two "flavors": Self-signed - In which case, you generate them entirely on your own with no additional cost. CA-signed - In which case, a recognized certificate authority (Symantec, GeoTrust, GoDaddy, etc) signs the cert. Is this a public facing website? If so, then I'd strongly suggest ...


1

EV/High Assurance SSL certs use unique object IDs that are inserted into the extended policy field of the SSL certificate. Most applications (browsers) that support EV-SSL have this OID and CA fingerprint hard coded into them. When they get a successful match, the browser then displays the extended data. You don't mention your usage case, but if this is ...


1

Generating your own self signed SSL certificates is a bit of a challenge if you've only dabbled in web design. A good tutorial is here http://www.akadia.com/services/ssh_test_certificate.html You should at least call Barracuda and ask them what they can help you with since you use their service.


Only top voted, non community-wiki answers of a minimum length are eligible