How to convert a PFX to a seperate .key/.crt file

In this article I’m going to show you the commands you need to convert your .PFX Certificate file to a seperate certificate and keyfile. This article can come in handy when you need to import your certificates on devices like Cisco routers/loadbalancers etc. where you probably need to import the certificates and keyfiles in plain text (unencrypted). My tool of choice (but there might be others) is OpenSSL for Windows, which can be downloaded here

So after you installed OpenSSL you can start it from it’s Bin folder. I’d like to put OpenSSL\Bin in my path so I can start it from any folder. Fire up a command prompt and cd to the folder that contains your .pfx file. First type the first command to extract the private key:

openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]

What this command does is extract the private key from the .pfx file. Once entered you need to type in the importpassword of the .pfx file.  This is the password that you used to protect your keypair when you created your .pfx file.  If you cannot remember it anymore you can just throw your .pfx file away, cause you won’t be able to import it again, anywhere!.  Once you entered the import password OpenSSL requests you to type in another password, twice!. This new password will protect your .key file.

Now let’s extract the certificate:

openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.crt]

Just press enter and your certificate appears.

Now as I mentioned in the intro of this article you sometimes need to have an unencrypted .key file to import on some devices.  I probably don’t need to mention that you should be carefully. If you store your unencrypted keypair somewhere on an unsafe location anyone can have a go with it and impersonate for instance a website or a person of your company.  So always be extra careful when it comes to private keys! Just throw the unencrypted keyfile away when you’re done with it, saving just the encrypted one.

The command:

openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]

Again you need to enter an import password. This time you need to enter the new password that you created in step 1.  After that you’re done. You decrypted your private key. In the folder you ran OpenSSL from you’ll find the certifcate (.crt) and the two private keys (encrypted and unencrypted).

Update 07-07-2014:

In some cases you might be forced to convert your private key to PEM format. You can do so with the following command:

openssl rsa -in [keyfile-encrypted.key] -outform PEM -out [keyfile-encrypted-pem.key]

via: https://www.markbrilman.nl/2011/08/howto-convert-a-pfx-to-a-seperate-key-crt-file/

 

How to Clean up the WinSxS Directory and Free Up Disk Space on Windows Server 2008 R2.

Source: Disk Cleanup Wizard addon lets users delete outdated Windows updates on Windows 7 SP1 or Windows Server 2008 R2 SP1

Download Update for Windows Server 2008 R2 x64 Edition (KB2852386).

After you install this update, follow these steps to clean up Windows update files.

Note You must have administrator permissions to do this.

1. Start the Disk Cleanup wizard. To do this, use one of the following methods:
   • Method 1: Click Start, type cleanmgr in the Start Search box, and then click OK.
   • Method 2: Click Start, click All Programs, click Accessories, click System Tools, and then click Disk Cleanup.
   • Method 3: If a Low Disk Space notification appears, click the notification to open the Disk Cleanup wizard.
2. Select the Windows 7 or Windows Server 2008 R2 system drive, and then click OK.NoteThis operation might take several seconds because the Disk Cleanup wizard searches for files on the drive that can be cleaned up.
3. If the Windows Update Cleanup option is not displayed on the Disk Cleanuptab, click Clean up system files. If the Windows Update Cleanup option is displayed on the Disk Cleanup tab, go to step 5.Note The Windows Update Cleanup option is available only when you log on by using administrator permissions.
4. Select the Windows 7 or Windows Server 2008 R2 system drive, and then click OK.
5. On the Disk Cleanup tab, select Windows Update Cleanup, and then click OK.Note By default, the Windows Update Cleanup option is already selected.
6. When a dialog box appears, click Delete Files.

Notes

• The Disk Cleanup wizard runs in the background.
• You may have to restart the computer to finish the cleanup process.

How To Send Fortigate Syslog Messages To Syslog Server

Server # config log syslogd setting

Server (setting) # set status enable (enable logging to a remote syslog server).

Server (setting) # set facility local0  (identifies the source of the log message to syslog).

Server (setting) # set server 10.20.10.113 (the IP address of the syslog server).

Server (setting) # end

Windows Update stuck in Stage 3 restart loop

Windows Update stuck in Stage 3 restart loop

I have install windows updates yet the server keep say “update stage 3 of 3 0%” and then reboot itself. This goes on in a loop.

To solve this do the following:

1. Boot the server with ERD commander disk.
2. Open CMD.
3. Run command takeown /f C:\Windows\winsxs\pending.xml
4. Rename the c:\windows\winsxs\pending.xml with command Ren c:\windows\winsxs\pending.xml pending.old
5. Reboot the server

How to Restart FortiGate Services

How to Restart FortiGate Services

When browsing to the forfIgate GUI I got response “error 400”

I restated the httpsd on the fortIgate to solve the issue.

To restart the httpsd do the following:

1. Login to the fortIgate using ssh and admIn user
2. Run the command get system performance top
3. Press ctrl+c to stop the command.
4. Locate the httpsd and its process Id. the process Ids are on the second column from the left.
5. Run the command dIag sys kIll 11 <process-Id>
6. Try to brows again to the GUI.

Example:

Run Time:  45 days, 18 hours and 50 minutes

0U, 0S, 100I; 4031T, 2260F, 149KF

miglogd       44      S       0.1     0.4

proxyworker       52      S       0.0     1.0

proxyworker       53      S       0.0     1.0

httpsd       66      S       0.0     0.8

httpsd      126      S       0.0     0.7

ipsengine       60      S <     0.0     0.6

ipsengine       72      S <     0.0     0.6

How To Solve Windows Update error 8000FFFF

if you receive Windows Update error 8000FFFF, it means that there are Windows‌registry values that are blocking the update from being downloaded and installed.

1. Open the Registry Editor by clicking the Start button , typing regedit into the Search box, and then pressing ENTER.‌   if you are prompted for an administrator password or confirmation, type the password or provide confirmation.
2. In the left pane, find and double-click HKEY_LOCAL_MACHINE, and then click COMPONENTS.
3. Right-click COMPONENTS, and then click Export. By default, this file is saved to your desktop, but you can choose any folder.
4. In the File Name text box, type COMPONENTS. You have now created a back up copy of the registry values you’re going to be removing.
5. In the right pane, search for PendingXmlIdentifier, right-click it, and then click Delete. PendingXmlIdentifier might not be listed.
6. In the right pane, search for NextQueueEntryIndex, right-click it, and then click Delete. NextQueueEntryIndex might not be listed.
7. In the right pane, search for AdvancedInstallersNeedResolving, right-click it, and then click Delete.AdvancedInstallersNeedResolving might not be listed.
8. Restart your computer and then run Windows Update again.

—–

Note

If you need to restore the registry values you modified, double-click the COMPONENTS.reg file on your desktop, and then follow the steps.  Administrator permission required If you are prompted for an administrator password or confirmation, type the password or provide confirmation. You can delete this file once you are finished with it.

——

Error codes this applies to:

• WindowsUpdate_8000ffff
• 0x8000ffff
• 8000ffff

AdvancedInstallersNeedResolving

via Windows Update error 8000FFFF.

Fortigate SSL VPN not working

If the fortigate memory goes too high, and the device drops to conserve mode then the SSL VPN may stop working correctly, or at all.

This is usually happens when the fortigate memory is above 75%.

To solve this:

1. Run command: diagnose system top 10 or diag sys top 10 or get system performance top. The command will give you the top memory usage processes

For example:

xxxxx # diag sys top 10

Run Time:  121 days, 6 hours and 5 minutes

8U, 91S, 1I; 4031T, 1966F, 148KF

 initXXXXXXXXXXX        1      S       0.0     0.2

         cmdbsvr       38      S       0.0     0.5

(The most left number is the PID and the most right number is the current RAM usage)

2. If you see among the processes a process name reported or a process name forticron then kill them
3. To kill those processes run diagnose system kill 9 <pid_int> or diag sys kill 9 <pid_int>
4. Verify that the fortigate memory usage gone below 75%.
5. Test connection with VPN.

http://docs-legacy.fortinet.com/fadc/4-1-0/index.html#page/FortiADC_Handbook/looking_for_system_intensive_processes.html

http://pack3tlife.com/2014/08/26/fortinet-restart-ssl-vpn-process/

Use PowerShell to Find and Remove Inactive Accounts from AD

Keeping Active Directory (AD) tidy can help reduce replication bandwidth if you have domain controllers in different sites, and make troubleshooting and management easier. In this Ask the Admin, I’ll show you how to easily remove a computer account from AD, and how to query the directory for accounts that haven’t been used in a long time.

Remove Computer Accounts Using PowerShell

To remove one or more computer accounts using PowerShell, log on to Windows Server 2012 R2, or a Windows 8 management workstation that’s a member of your Active Directory domain, using an account that has permission to delete AD objects. If you decide to run the commands on a machine that isn’t a domain controller, the AD module for PowerShell must be installed.

• Open a PowerShell prompt, using either the icon on the desktop taskbar (Windows Server), or by switching to the Start screen, typing powershell and selecting Windows PowerShell from the search results (Windows 8).
• In the PowerShell prompt, type remove-adcomputer -identity workstation01 and press ENTER, replacing workstation01 with the name of the computer account you want to remove.

Search AD for Inactive Computer Accounts

Now that we know how to remove computer accounts using the command line, let’s query AD for computer accounts that haven’t been used for a long time. Computer account passwords are automatically reset by AD every 30 days, so you can determine yourself what length of time you should let pass before deleting the accounts from AD. A year or more would likely be a safe option.

In this example, I’m going to use the get-adcomputer cmdlet, and the select and sort object cmdlets to format the results:

get-adcomputer -filter * -properties passwordlastset | select name, passwordlastset | sort passwordlastset

We need to add in the –properties parameter because the passwordlastset attribute is not displayed in the results by default. Select name and sort are then used to ‘pull out’ and order only the required information.

Now let’s add a more complex filter. We can use the get-date cmdlet to create a variable that sets the filter to show accounts that have had their accounts reset more than one year ago. To create the variable, type $date = (get-date).addyears(-1) and press Enter.

Now we can modify the command to include a less than (-lt) argument in the filter:

get-adcomputer -filter {passwordlastset -lt $date} -properties passwordlastset | select name, passwordlastset | sort passwordlastset

Finally, once we are sure the filter is right, we need to add the remove-adobject cmdlet as follows, without the select and sort cmdlets. Notice that I’m using the remove-adobject cmdlet and not remove-adcomputer, because remove-adcomputer is not able to delete accounts that have embedded ‘leaf’ objects, such as computer accounts for virtual machines.

 

get-adcomputer -filter {passwordlastset -lt $date} -properties passwordlastset | remove-adobject -recursive -verbose -confirm:$false

Via Use PowerShell to Find and Remove Inactive Accounts from AD.

Installing GoDaddy SSL Certificate in F5 BIG-IP

Installing an SSL Certificate in F5 BIG-IP Load balancer

After your certificate request is approved, you can download your SSL and intermediate certificate from within the SSL application. For more information see Downloading Your SSL Certificate. Both of these files must be installed on your Web server.

You may also download the intermediate certificate from the repository.

NOTE: When downloading your certificate, select Apache as your server type.

To Install SSL Certificates

1. Launch the F5 BIG-IP Web GUI.
2. Under Local Traffic, select SSL certificates.
3. Select the name you assigned to the certificate under General Properties.
4. Browse to the your_domain_name.crt file that you received from us.
5. Click Open and then Import.

Enabling Your Intermediate Certificate Using BIG-IP Loadbalancer v.9

1. In the Web GUI, select Local Traffic, then SSL certificates, and then Import.
2. Under Import Type, select Certificate, and then Create New.
3. Enter “GoDaddy” as your certificate name.
4. Browse to the gd _bundle.crt file that you received from us, click Open, and then click Import.

To Enable Your SSL

1. Create or open the SSL Profile for the certificate.
2. Under Configuration, select Advanced.
3. Select the SSL certificate (public/private key pair) that you installed at the beginning of these instructions.
4. Under the Chain, browse to the “GoDaddy” (gd_bundle.crt) file that you imported in the previous step, then Save and Exit the configuration.

Using Your SSL Using an Earlier Version of BIG-IP Loadbalancer

1. Inside of your SSL account, download the primary (your_domain_name.crt) and intermediates bundle ( gd_bundle.crt ) certificate files.
2. Move your primary and intermediate certificates to the BIG-IP device. This can be done via FTP.
3. Rename your primary certificate from your_domain_name.crt to your.domain.name.crt and copy it to the /config/bigconfig/ssl.crt/ folder.
4. Copy the intermediates bundle (gd_bundle.crt ) to the /config/bigconfig/ssl.crt/ folder.
5. Restart the proxy using these commands:

 

# bigpipe proxy <IP Address>:443 disable
# bigpipe proxy <IP Address>:443 enable

Via Installing an SSL Certificate in F5 BIG-IP Loadbalancer | GoDaddy Help | GoDaddy Support.

How to fix SSL MITM vulnerability on F5 BIG-IP LTM 9.4.7

1. You can test your SSL Server vulnerability on https://www.ssllabs.com/ssltest/index.html.

This free online service performs a deep analysis of the configuration of any SSL web server on the public Internet.

2. Test results for x.x.com can show that it is vulnerable to MITM attacks because it supports insecure renegotiation, effectively allowing an active man-in-the-middle attacker to inject arbitrary content into an encrypted data stream.

This is called also – “plaintext injection” attack or “Project Mogul” issue. A Man in the Middle attack allows an attacker to inject an arbitrary amount of chosen plain text into the application protocol stream data during a secure session renegotiation that uses SSL version 3.x or TLS version 1.x. This may provide an attacker the ability to perform arbitrary actions on affected websites with user’s credentials. This vulnerability does not allow one to decrypt the intercepted network communication. 

3. You can test which F5 Product and version is affected with SSL Renegotiation vulnerability.

http://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html.

In my case BIG-IP LTM 9.4.7 is affected. 

The IETF has adopted as RFC5746: Transport Layer Security (TLS) Renegotiation Indication Extension a new extension to the TLS standard that addresses this issue. F5 Product Development has implemented this new extension beginning in BIG-IP versions 10.2.3 and 11.0.0.

For BIG-IP versions 9.4.x, 9.3.x prior to 9.3.1 HF8, and 10.0.x prior to 10.0.1 HF3:

1. Take care though to check that your virtual server does _not_ depend on (benign) renegotiations. If you’re not sure, you can use:

bigpipe profile clientssl all show all | grep -e PROFILE -e mid-stream

2. Apply an iRule similar to the following to each SSL virtual server. The iRule resets the connection if client-side SSL renegotiation is attempted.

 

when CLIENT_ACCEPTED {
# initialize TLS/SSL handshake count for this connection
set sslhandshakecount 0
}
when CLIENTSSL_HANDSHAKE priority 1 {
# a handshake just occurred
incr sslhandshakecount
# is this the first handshake in this connection?
if { $sslhandshakecount > 1 } {
# log (rate limited) the event (to /var/log/ltm)
log “\[VS [IP::local_addr]:[TCP::local_port] client [IP::remote_addr]:[TCP::remote_port]\]:TLS/SSL renegotiation”
# if not, close the clientside connection
reject
}
}

Links:

SSL Test site

SSL and TLS Authentication Gap vulnerability Explanation 1

SSL and TLS Authentication Gap vulnerability Explanation 2

F5 products and versions that have been evaluated for this Security Advisory