Discussions / FAQs

Generally, PFX files are generated without a password. When importing and being asked for a password this can normally be left blank. Some systems insist that a password is entered. Therefore we recommend regenerating the PFX file with a password. This can be done using OpenSSL First convert the PFX file to PEM. ```text openssl pkcs12 -in cert.pfx -out cert.pem -nodes ``` Then convert the PEM file back to PFX and specify a password ``` openssl pkcs12 -export -out cert.pfx -in cert.pem Enter Export Passord: Verifying - Enter Export Password: ```

Once the order is complete there is the option to download the certificate from the order management page within your account. Within the Certificates section of the order management page is the option to select [Show CA Certs]. Clicking this will reveal the intermediate and root certificates linked to your certificate. [Download Certificate Docs](https://docs.servertastic.com/docs/https-orders#download-certificate)

Due to strict validation requirements set down by all Certificate Authorities wildcard EV certificates are not available from any provider. You can obtain [EV Multi-Domain SSL certificates](https://www.servertastic.com/ssl-multi-domain).

The above key constraints mean that the certificate is allowed to issue signed certificates. It is not possible to purchase a publicly trusted certificate with these constraints from any Certificate Authority. If such a certificate were issued it would be possible to sign an end-entity certificate for any domain and it automatically be trusted by browsers. This creates a significant security risk as the owner of such a certificate could simply just issue a certificate for google.com or paypal.com and inspect all traffic between the user and the server. The main reason for requiring such a certificate is to install on a firewall type device that performs deep packet inspection. This is essentially performing a Man-in-the-Middle attack on the end user using the firewall by breaking end-to-end encryption for that user. The only option is to create a self-signed certificate with these key constraints and then add it as a trusted certificate on all the end user devices connecting through the firewall either via a group policy or asking the end users to install the certificate.

Due to changes implemented by the CA Browser Forum certificates can only have a maximum validity period of 397 days to be trusted by browsers. You can reissue your certificate multiple times during the life of your certificate plan to obtain the full validity. For more information please see our guide on [Multi-Year HTTPS Certificates](https://docs.servertastic.com/docs/multi-year-https-certificates)