Search through config files to find SSL configuration:
grep -i -r "SSLCertificate" /etc/httpd/* | grep -v "#"
^{(for RedHat-based distributions; such as CentOS, Fedora, RHEL, etc.)}
grep -i -r "SSLCertificate" /etc/apache2/* | grep -v "#"
^{(for Debian-based distributions; such as Ubuntu, Raspbian, LinuxMint, etc.)}
Combine individual certificates into a PFX from separate files:
Extract the certificate(s) in a PFX to combined PEM file:
openssl pkcs12 -in [certificate].pfx -nokeys -out [cert file].crt
Extract the private key in a PFX to a separate file:
openssl pkcs12 -in [certificate].pfx -nodes -nocerts -out [key file].crt
Decode a PKCS#7 (P7B) into PEM-format:
openssl pkcs7 -print_certs -in [certificate].p7b -out [cert].crt
Check a remote certificate installation:
openssl s_client -connect [server:port] -servername [fqdn] -CAfile [intermediate].crt
Generate a new CSR using an existing private key:
openssl req -new -out [csr file].csr -key [private key].key
Native OS tools to list certificate infos:
Windows: certutil -dump [path to pfx]
Linux: openssl pkcs12 -info -in [path to pfx]
Check which certificate the server is handing out:
openssl s_client -connect 127.0.0.1:443
To make the result cleaner you can also run:
openssl s_client -connect 127.0.0.1:443 | grep "s:/"
To Check the date of the server certificate being handed out:
echo | openssl s_client -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -dates
- or - openssl s_client -connect 127.0.0.1:443 | openssl x509 -noout -dates

Make sure rewrite module is enabled and under the http port 80 Virtual Host put:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

DigitalOcean adds a DENY ALL to the IPtable firewall in linux, so if 443 isn't explicitly allowed, it will not work.
Run the following commands as root or sudo to make changes to the firewall.
iptables -L Lists current firewall rules.
iptables -A INPUT -p tcp --dport https -j ACCEPT Adds HTTPS 443 rule to ALLOW.
iptables -D INPUT 5 MAKE SURE TO CHANGE 5 to whichever line number the DROP ALL is located.
iptables -A INPUT -j DROP Adds the DROP ALL back to the end of the table.

To get a duplicate:

1. Generate a CSR from the new server
2. Login to your DigiCert account and click on the order number
3. Click the gray button 'Get a Duplicate'
4. Paste or upload the new CSR into the window
5. Select the server and click 'Submit'

Your duplicate will be at the bottom of the order page.

openssl ocsp -issuer DigiCertHighAssuranceCA-3.crt.pem -no_nonce -VAfile DigiCertHighAssuranceCA-3.crt.pem -url http://ocsp.digicert.com -serial 0xSERIALNUMBERHERE

You can also check if you have the certificate file by changing -serial to -cert and pointing to the file

Please use the commands below to view and compare the modulii of the certificate, private key, and CSR.
openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa -noout -modulus -in privateKey.key | openssl md5
openssl req -noout -modulus -in CSR.csr | openssl md5
For each of those, you will receive the file's modulus, which looks something like a77c7953ea5283056a0c9ad75b274b96
If each is the same value (exactly), then the cert, key, and req are a match.

The IMAP and POP certificate need to be set using these two commands in the Exchange Management Shell:
set-POPSettings -X509CertificateName mail.yourdomain.com
set-IMAPSettings -X509CertificateName mail.yourdomain.com

The page includes other resources that aren't secure.
Anything that is a callout (such as image links) to a non-https:// will result in this.
It is very common with WordPress sites, and can be mitigated with a plugin.
You can check for insecure elements at https://whynopadlock.com

Convert a keystore (JKS) file into a PKCS#12 (P12 or PFX) file:

keytool -importkeystore -srckeystore [keystore].jks -destkeystore [pfx file].pfx -deststoretype PKCS12 -srcalias [jks file alias] -deststorepass [keystore password] -destkeypass [pfx password]

Convert a PKCS12 file into a keystore file:

keytool -importkeystore -srckeystore [pfx file].pfx -destkeystore [keystore].jks -srcstoretype PKCS12 -alias [jks file alias] -deststorepass [jks store password] -destkeypass [jks key password] -srcstorepass [pfx password]

Dump your keystore contents to a text file:
keytool -list -v -keystore [keystore file].jks > [text file].txt

Use a link like this:
https://www.digicert.com/order/order-1.php?renewid=XXXXXXXX&promo_code=PPPPPPPPP
Replace XXXXXXXX with the number of the order to be renewed and PPPPPPPPP with the promo code you want to apply.

Yes, as long as the IP address is in the public space.
The following address ranges are disallowed:

• 0.x.x.x (0.0.0.0/8)
• 10.x.x.x (10.0.0.0/8)
• 100.64.x.x-164.127.x.x (100.64.0.0/10)
• 127.x.x.x (127.0.0.0/8)
• 169.254.x.x (169.254.0.0/16)
• 172.16.x.x-172.31.x.x (172.16.0.0/12)
• 192.0.0.x (192.0.0.0/24)
• 192.0.2.x (192.0.2.0/24)
• 192.88.99.x (192.88.99.0/24)
• 192.168.x.x (192.168.0.0/16)
• 198.18.x.x-198.19.x.x (198.18.0.0/15)
• 198.51.100.x (198.51.100.0/24)
• 203.0.113.x (203.0.113.0/24)
• 224.x.x.x-255.x.x.x (224.0.0.0/3)

A PKCS#12/P12/PFX certificate is one that would be created on the server by exporting the installed certificate with its private key.
Using our utility, you can highlight the cert then click 'Export' to make a .pfx file, which is a PKCS12 file.

They just need to select the re-key option. There is no need for a new CSR.
It will be re-emailed to the CS Certificate Requester found under the "Company Contacts" tab

Then, they can click on the link in the email again.
Once they click on the link, it will be installed in the browser they used to click on the link.
They can then export it from their browser as a .pfx file, OR if they used IE, it's installed in the windows store, and they're usually set.

There WILL be a link in the email he receives. It's an exact duplicate of the original. If he's working with a code signing cert, there's no way to log in to his account and download them. That's not the way our code certs work, so he must be looking at something else unless he can pass on that email to us so we can take a closer look.

Send email to the email address listed for the master user on the account asking for permission to do so. If he can respond to it with an approval, then you are good.
If not, then he's stuck unless you can reach the master user on a verified phone number to approve him.

https://www.digicert.com/easy-csr/openssl.htm

Retail/MPKI:

1. Log into your DigiCert account www.digicert.com
2. Select "My Certificates"
3. Click on the applicable order number
4. Under the heading Reissue Actions, click on "Add, Remove, or Change Domains"
5. Enter in your new CSR, Reason (optional), and server software
6. Edit the new details match the desired changes
7. Select "Process Reissue". Make sure you include all the needed domains. Leaving an additional domain name section blank will remove that SAN from the certificate
8. Our support team will re-validate the changes and reissue the certificate.
   ^{NOTE: It may be necessary to complete a domain control validation for the new or changed domain name before we can issue the certificate.}
9. Install your new certificate

CertCentral:

1. Log into your DigiCert account www.digicert.com
2. Select "Certificates" in the left bar
3. Select the "Orders" sub-menu item
4. Click on the applicable order number
5. Click "Reissue Certificate"
6. Paste or upload the new CSR, fill in the Common Name, SANs*, Server Platform, and Reason*
   ^{* if applicable}
7. Click "Request Reissue". If the request needs to be approved by an account admin, you will be notified. Else the certificate reissue is complete

Reissuing the certificate while removing a domain name will revoke all previous copies of the certificate.
If no domains are removed, the older certificate(s) will not be revoked.

"I need to download the safenet installer for my code cert. Can you provide a link?"
https://www.digicert.com/custsupport/fetch-safenet-driver.php?order_id=XXXXXXXX
^{Make sure to change the XXXXXXXX to match the order number associated with the EV Code Signing Order.}

If they need to reinstall the certificate to their token, give them this link
https://www.digicert.com/util/DigiCertHardwareCertificateInstaller.zip
Alternatively, they will get a link to the Digicert Hardware Installer after clicking re-key.

Contact the master user on the account via email
- OR -
Contact the organization through a verified phone number to find out who it should be updated to.

"Can I create an account without placing an order?"
Yup!

If the original purchase of the current SSL was within the past 30 days then we can offer a full/complete refund, and it may be given either as a credit to the account or to the original payment source. If the purchase date of your order is more than 30 days past then we can offer a partial refund that is calculated to a pro-rated amount based on the number of months remaining until expiration of your order; and the refund could only be given as a credit to the account (because the bank will no longer have a the transaction gateway open to initiate a refund). This manual upgrade process also helps to reduce any down-time you might have on the existing server running the current cert.

Just log in, click on the order number of that certificate, then click download.
After you do so, click on the blue link labelled 'Download Individual Certificates'
You need to download the 2nd intermediate and the new root certificate.
Install those and I think you should be all set without additional errors.

https://www.ssllabs.com/ssltest/index.html

It could be various things like:

• The new certificate was installed but not actually applied
• It was installed to one server, but not another (assuming you have multiple servers)
• The new certificate wasn't assigned to all of the services being used
• The clock is actually wrong on that client machine for some reason
• The client cached an old certificate

A PKCS#12, also called a PFX or P12, is a file that contains your private key and the certificate chain.
Since you create your own private key, we are not capable of providing the certificate in PKCS#12 format.
However, it is easy to create a P12/PFX using our DigiCert Utility:
www.digicert.com/util

First, create the CSR in the DigiCert Utility
Next, use the new CSR to re-key your certificate
Then, import the new, re-keyed certificate into the Utility
Finally, export the certificate in PFX format

"Is there a way to (easily) convert a PFX cert to a P12?"
They are the same thing, just rename it

I'm not sure which server you are running, but I can point out a few things to get you headed in the right direction for working with the cipher suites, which is where I would start.

Windows: IIS Crypto - This is third party program, not related to DigiCert in any way, but it does provide a GUI to manage the ciphers in place of trying to edit the Registry in Windows.

Apache: You would edit your SSL conf file, which will include a section for the ciphers.
 • For Apache, it might be located in /etc/httpd/conf.d/
 • For Apache2, it might be located in /etc/apache2/mods-available/
You should adjust the cipher suite to the following:

Tomcat: Edit the server.xml to set the sslProtocol= and ciphers= to what you want to use.
Citrix: There are multiple different products with different interfaces. I would consult that product's documentation.

httpd.conf usually refers to httpd-ssl.conf as an include (Make sure that include is not commented out).
Inside of httpd-ssl.conf is where the SSL Configuration is generally at (Make sure to set SSLEngine ON)
Also look for <VirtualHost :443> (or similar) being setup as a separate site. If it is, you will need to enable it with
a2ensite /path/to/website-name.conf
or whatever the filename is.
You should also make sure to enable mod_ssl by running
a2enmod SSL or a2enmod mod_ssl

Domain authorization request emails are sent to anyone listed on the WHOIS record of the domain as well as (admin,administrator,hostmaster,postmaster)@domain.com In order to send it to a different email address, you will need to update the registrant on the WHOIS record for the domain with your web registrar (such as GoDaddy or Network Solutions or we can set you up with a unique hash value that can be entered as either a DNS TXT record or DNS CNAME record

Currently we do not offer email or personal ID certificates through our regular retail website, but they are available through our subscription-based MPKI program. That program would be recommended if you had over 50 users needing certificates for the same domain. You can read about the program here:
http://www.digicert.com/managed-pki-ssl.htm
http://www.digicert.com/client-certificates.htm

If you just need a few email or personal ID certificates, and not the whole Managed PKI program on top of it, I would recommend using this site to find a provider:

http://www.sslshopper.com/email-certificates-smime-certificates.html

If you opened the link in IE or Google Chrome than the certificate was automatically generated and added into your computers certificate store. You can run our DigiCert Utility to sign or export the certificate to use on other machines.

If you used Mozilla Firefox you can export it by the following:
Tools -> Options -> Advanced Tab -> Certificates Tab -> View Certificates

Then choose the certificate from the list and choose 'Backup'

http://www.openssl.org/related/binaries.html

First, convert the JKS to a PFX/P12

keytool -importkeystore -srckeystore JKS_FILE -destkeystore PFX_FILE -srcstoretype JKS -deststoretype PKCS12 -srcstorepass JKS_PASSWORD -deststorepass PFX_PASSWORD -srcalias JKS_ALIAS -destalias PFX_ALIAS -srckeypass JKS_KEY_PASSWORD -destkeypass PFX_KEY_PASSWORD -noprompt

Then, extract the key from the PFX/P12

openssl pkcs12 -in PFX_FILE -out KEY_FILE -nodes

For Windows, it is easiest if you run our Certificate Utility from any Windows server/workstation where the certificate is currently installed (or install the certificate on that machine, if necessary). If the certificate is in the list of active certs in the utility, select it and choose 'Export' and there will be an option for PFX.

You can run netsh http show sslcert to view the certificate/bindings.
Then you can delete that binding with netsh http delete sslcert ipport=0.0.0.0:443
and add the new binding with netsh http add sslcert ipport=0.0.0.0:443 appid={APP_ID} certhash=THUMBPRINT
See: http://msdn.microsoft.com/en-us/library/windows/desktop/cc307236%28v=vs.85%29.aspx for more info.

Digital Signature, Key Encipherment (a0)
Add-ons available: Non-Repudiation, Data Encipherment, Encipher Only

Retail-class documentation:
https://www.digicert.com/clients/rest/docs/retail
Services (MPKI/CertCentral)-class documentation:
https://www.digicert.com/services/v2/documentation

Plesk uses a non-standard interface for Apache. Run the following to restart it:
/usr/local/psa/admin/bin/httpdmng --reconfigure-all

For quick access to custom search engines,
type chrome://settings/searchEngines into the address bar
or right-click the address bar and select "Edit Search Engines..."

Taken from entrust*
In Microsoft's responses to their SHA-1 deprecation policy, they state the following: "The SHA1 deprecation policy does not impact SHA1 root certificates, because Windows relies on other means to validate root certificates besides the signature. But all root CAs are expected to switch to use SHA2 to sign any subordinate CA certificates, CRLs, etc."
So please do not be concerned if the website you are visiting does not use a SHA-2 signed root certificate.

Individual:

• Org = Organization Name
• CN = Organization Name

Organization:

• OLD WAY:
  • Org = Organization Name
  • CN = Organization Name
• NEW WAY:
  • Org = Organization Name
  • CN = First.Last of DS User

SSL v2: openssl s_client -connect SITE_NAME:443 -ssl2 -quiet
SSL v3: openssl s_client -connect SITE_NAME:443 -ssl3 -quiet
TLS 1.0: openssl s_client -connect SITE_NAME:443 -tls1 -quiet
TLS 1.1: openssl s_client -connect SITE_NAME:443 -tls1_1 -quiet
TLS 1.2: openssl s_client -connect SITE_NAME:443 -tls1_2 -quiet
It will return the certificate if the protocol is enabled or it will give a handshake failure if the protocol is disabled (or the HTTPS connection is down)

Open the .jar file using 7-Zip. Navigate to the META-INF Directory and then extract the SERVER.RSA to your machine.
Rename it to a .p7b and you will then be able to click on it and view the details as a normal certificate from Windows.

When single logon is enabled, users can access multiple applications with only one request for the Token Password during each computer session. This alleviates the need for the user to log on to each application separately

NOTE: Setting the single logon using SAC Tools will not include a Windows Logon on the single logon process. This must be configured by the system administrator.
This option is disabled by default.

To enable single logon:
1. Open SafeNet Authentication Client Tools
2. Open Advanced View ("gear" icon in the top-right)
3. In the left pane, select Client Settings
4. In the right pane, select the Advanced tab.
5. Check the box for Enable single logon
6. Do one of the following:
   1. To save your changes, click Save
   2. To ignore your changes click, Discard
7. To activate the single logon feature, logout of the current user and login again

With this setting enabled, you can log into your Windows workstation, log into the token once, then as long as you don't log out or disconnect the token, you will not have to log in again to sign additional files.

DigiCertClickID will be a 8 character unique identifier. This is how the seal checks with DigiCert to ensure the seal is valid for the domain
The XXXXXXXX is where the unique identifier will be shown
data-language can contain "en", "es", "ja" (English, Spanish, and Japanese (respectively))

In the example, you will see a section that has "7", "m", "black"
The "7" identifies which logo you want to use (Options are 3, 5, and 7 for OV; and 10, 11, and 13 for EV)
The "m" identifies the size (Options are s, m, l for Small, Medium, and Large)
The "black", identifies which font color to use (Options are black or white)
Site Seal sizes are (80x58, 100x73, 130x94) (s,m,l)