$ curl -Ii http://chez.jcz.fr/.well-known/acme-challenge/sometestfile
curl: (28) Failed to connect to chez.jcz.fr port 80 after 76163 ms: Operation timed out
$ nmap -Pn chez.jcz.fr
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2023-02-04 10:52 PST
Nmap scan report for chez.jcz.fr (109.16.70.70)
Host is up.
Other addresses for chez.jcz.fr (not scanned): 2001:470:c94a::100
rDNS record for 109.16.70.70: 70.70.16.109.rev.sfr.net
All 1000 scanned ports on chez.jcz.fr (109.16.70.70) are filtered
Nmap done: 1 IP address (1 host up) scanned in 203.78 seconds
I configure my site "chez.jcz.fr" with the PFX client certificate, but I can't. Hence the unavailability of my site. I manage to create the PFX certificate. When I consult it, it is valid. But the verification of the client with the server is not done.
If the site is not available, let's encrypt can still create the certificate. Is it this ? Hence the message above and the slowness I noticed.
$ nmap -Pn chez.jcz.fr
Starting Nmap 7.80 ( https://nmap.org ) at 2023-02-05 19:22 UTC
Stats: 0:00:06 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 2.00% done; ETC: 19:28 (0:05:43 remaining)
Nmap scan report for chez.jcz.fr (109.16.70.70)
Host is up (0.28s latency).
Other addresses for chez.jcz.fr (not scanned): 2001:470:c94a::100
rDNS record for 109.16.70.70: 70.70.16.109.rev.sfr.net
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 44.03 seconds
I know.
But my main problem is to find a way to create my three certificates: PFX, server Key and Server crt for Apache 2.4.55.
Any help on this would be appreciated.
I don't put the PFX certificate in apache, but in the "my" store so that it is available in my Google Chrome browser.
The certificates I use in Apache are the ".pem" ones that Let's Encrypt created.
I already explained everything in my other topic.
Actually, I think that is correct. They are setting up two-way authentication and the client needs to send a cert to the server. Clients dictate what format is needed to send to the server. In Chrome's case I believe it requires pfx.
That said, I am far from expert in two-way but that's what I understand so far.
From that Wiki: As it requires provisioning of the certificates to the clients and involves less user-friendly experience, it's rarely used in end-user applications.
So now, I would really LOVE to hear their specific requirements.
What (problem/security issue) are they trying to overcome?
[quote=""]Actually, I think that is correct. They are setting up two-way authentication and the client needs to send a cert to the server. Clients dictate what format is needed to send to the server. In Chrome's case I believe it requires pfx.
That said, I am far from expert in two-way but that's what I understand so far.[/quote]
You understood well. I'm trying to set up two-way identification.
me too because the procedure to create the PFX client certificate is far too complicated to do from the files provided by let's encrypt.
with a Let' Encrypt certificate, my site is accessible to everyone.
I want it to be accessible only by those who have my client certificate.
This is for privacy reasons.
