I’m trying to implement HTTPS communication. I converted my .p7b bundle to .crt file. Also I have the private key file which has .pem extension. I’m providing my defaults.ini and sample.ini file’s screenshots below.
default.ini
sample.ini
certificate paths:
C:\Program Files\GrafanaLabs\grafana\grafana.crt
C:\Program Files\GrafanaLabs\grafana\grafana_key.pem
Error ( still can not connect via port 443)
Do you have any suggestions guys?
Related
how to add a trusted CA for local Consul docker container?
So I have a consul running as a docker container and I am able to access it using chrome at localhost:8500 after exposing the ports, as expected. But due to company setting there is a security CA being added that chrome trusts, since it is added to MacOS keychain, but consul does not seems to trust when I try to use golang library to connect to consul
x509: “Menlo Security Intermediate CA” certificate is not trusted"
I get a certificate is not trusted error. I am able to export the CA to a RootCA.cer file from the keychain but how do I configure consul image to trust this CA file?
https://iotech.force.com/edgexpert/s/article/secure-consul-tls
I see articles like this
ca_file is used to check the authenticity of the client and server connections
cert_file is provided to clients and server to verify the agent's authenticity
key_file is used with the certificate to verify the agent's authenticity
but for me, the .cer export file will be used as cert_file?
how should I do it in docker compose?
consul:
image: dockerproxy.comp.com/consul:latest
ports:
- "9500:9500"
First, thanks to all who may or may not try to help me.
My Problem: I'm trying to create an ssl certificate with Let's Encrypt. Already installed everything mentioned in the documentation. I decided to use certbot / since it seemed to be the easiest way for me to fulfill my needs.
We have freed both ports 80 and 443 and every request that comes to one of these ports are redirected to my Ubuntu 18.04 machine's internal IP address.
There are no configurations on this machine, so nothing listens on port 80 or 443, as you can see on my netstat command:
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 895/systemd-resolve
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1211/sshd
tcp6 0 0 :::22 :::* LISTEN 1211/sshd
After creating the certificate I'll run a spring boot application, which should use the certificate.
As far as I understood from the documentation, it isn't required to have running applications listening on these ports. It ought be possible to create the certificate by using the standalone parameter. So I guess certbot creates a small application listening to one of these ports on it's own to verify that I'm the one, who I claim to be. Right?
placeholder.example.com is as you will assume a placeholder. I think it's obvious why I'm not publishing my domainname, when having port 80 & 443 opened.
root#urlaub:/# certbot certonly --standalone --preferred-challenges http -d placeholder.example.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for placeholder.example.com
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. placeholder.example.com (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://placeholder.example.com/.well-known/acme-challenge/jCJ4waxV0aYPxjqDI3OcBXXPReNSrse1kd6piK9Dwdo: Connection refused
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: placeholder.example.com
Type: connection
Detail: Fetching
http://placeholder.example.com/.well-known/acme-challenge/jCJ4waxV0aYPxjqDI3OcBXXPReNSrse1kd6piK9Dwdo:
Connection refused
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
EDIT: I've had tried this a lot of times, without success. Now there are 13 .pem files in /etc/letsencrypt/keys
Can I convert them to .p12 file to use it in an spring boot application?
It was an issue with the redirection to my server machine. So the above used command works properly and I was able to create a certificate. If anyone wants to use it: go for it.
My intent was to use it in a spring boot application and needed a pkcs12 file. I was able to convert the .pem files created by certbot to a .p12 file by using following command:
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out keystore.p12 -name tomcat -CAfile chain.pem -caname tomcat
In your application.properties you've to put following:
server.port: PORTNUMBER
server.ssl.key-store:/etc/letsencrypt/live/<YOURDOMAIN>/keystore.p12
server.ssl.key-store-password: <PASSWORD YOU WERE PROMPTED WHEN CREATING THE CERTIFICATE>
server.ssl.keyStoreType: PKCS12
server.ssl.keyAlias: tomcat
With Let's Encrypt if you use HTTP validation, you will need a server serving requests on port 80 (HTTP) for placeholder.mydomain.com so that the Let's Encrypt server can download the file .well-known/acme-challenge/jCJ4waxV0aYPxjqDI3OcBXXPReNSrse1kd6piK9Dwdo. This is how Let's Encrypt validates that you have control over the domain. Note: That filename is generated dynamically and will be different each time you attempt validation.
Another option that I use is to use DNS validation and then create the special record in my DNS server. You can then create the certificates on your desktop for any service that requires SSL for that domain name.
I have installed Mirth connect and it is running on https://example.com:8443 but it throwing https warning. If I run https://example.com it doesn't show any warning because ssl certificate is instaled. The issue is with the port. Please help me out from this problem.
Thanks.
Mirth Connect generates a new self-signed certificate on first startup. You can replace this with your own cert, it's the "mirthconnect" alias in the keystore.jks file. Follow the Changing The Server Certificate section in the user guide.
I have created a LAMP Bitnami VM on Google Cloud Platform Compute Engine.
vsftpd is installed already and I have edited the options to include:
listen=YES
listen_address=0.0.0.0
write_enable=YES
local_enable=YES
anonymous_enable=NO
local_umask=022
userlist_enable=YES
userlist_deny=NO
userlist_file=/etc/vsftpd.allowed_users
I have the PHP server up and running on http://my-ip-address but when I try to navigate to ftp://my-ip-address the browser just hangs.
I haven't used ftp for about 100 years so I'm not sure if I'm going about this the right way.
Do I need to do something with the firewall? I tried to do that but GCP wouldn't accept ftp as a protocol.
I've also tried with Filezilla but I get 'connection timed out'.
What am I missing please?
Make sure you have GCP firewall rule (ingress) in place to allow tcp:21 for FTP traffic to reach to the instance.
You can install tcpdump package on the server to monitor the traffic for verification.
To monitor the traffic on port 21 (ftp) can use the following syntax:
sudo tcpdump -i interface port 21
Example: sudo tcpdump -i eth0 port 21
I verified this on the GCE LAMP Bitnami VM with vsftpd package installed and was able to ftp from browser.
Moreover, FTP is an insecure protocol. You can set-up SFTP for more security and encrypted traffic.
Yes you missing Google Cloud Firewall, You have open some ports to make a successful connection with your ftp server. Go and visit this Set up an FTP Server on Google Cloud Platform -siteyaar.com blog post, This will help you.
First add this line in vsftpd.conf file.
pasv_min_port=40000
pasv_max_port=50000
After that open this ports 20,21,990,40000-50000 from Google cloud Firewall.
Dear Greetings I try to deploy new Archive in my server; the Archive incloud web service use HTTPS and I use port 8443 because I already used 443 for another Archive. The web serive it's working in TIBCO Designer, but when I try to deploy it returns below error: BW-EXT-LOG-100000 Failed to initialize end point associated with ProtocolHandler ["http-bio-8443"] java.io.IOException: An AXSecurityException was thrown while trying to create the server socket on the port [ 8443] with the message: couldn't find a self-signed certificate in chain Could you please advise me?
I found in new Archive there is one process connect to 443 ,change all process to connect to 8443