Linked Questions
24 questions linked to/from Checklist on building an Offline Root & Intermediate Certificate Authority (CA)
90
votes
12
answers
18k
views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
- 50.9k
40
votes
9
answers
40k
views
How does SSL/TLS PKI work?
We have lots of questions that address portions of SSL/TLS as it relates to PKI, but none of them seem to bring everything together. A canonical answer that we can point people to I think would be ...
- 12.5k
30
votes
5
answers
19k
views
Creating my own CA for an intranet
I need to create my own CA for an intranet and unfortunately it seems there's no good answer about this on Security.SE.
There are many resources online about this, but all of them are different and ...
user42178
22
votes
6
answers
25k
views
How can I enumerate all the saved RSA keys in the Microsoft CSP?
I have an application that is creating several keys and storing them in various stores (in this case the Machine store).
How can I enumerate all the keys on a given Windows system?
...
- 50.9k
9
votes
6
answers
2k
views
Should the bit-strength selection of a child certificate be influenced by the CA or the chain?
All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
- 50.9k
14
votes
4
answers
2k
views
Why isn't OCSP required by default in browsers?
According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers.
Can someone please explain why this isn't ...
- 6,279
14
votes
1
answer
7k
views
How does adding a random serial number improve a certificate's security?
This article says:
"Finding collisions is a tricky process, since it requires you to muck
with the bits of the public key embedded in the certificate (see this
paper for more details). Also, ...
- 50.9k
11
votes
3
answers
10k
views
Getting started with SmartCards; what equipment do I need, what do I need to know?
I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it.
Are all SmartCard slots capable of reading and writing a blank card?
Are there compatibility ...
- 50.9k
16
votes
1
answer
4k
views
Renewing Microsoft Certificate Services Root Certificate
We currently have Microsoft Enterprise Certificate Server installed on a domain member machine which issues 1 year certificates to users for authenticating to VPN.
We'd like to start issuing web ...
- 613
7
votes
1
answer
10k
views
AIA/CRL locations for Offline Root
I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building
It's an ...
- 223
9
votes
2
answers
3k
views
X.509 certificate policies question
I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies.
To quote from the X.509 RFC:
In an end entity certificate, these policy ...
- 641
3
votes
1
answer
19k
views
What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?
MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed.
Based on this and this KB article the EKU section of the certificate should contain "Client ...
- 50.9k
7
votes
2
answers
10k
views
Windows Firewall Connection Security with Certificate
I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
- 403
7
votes
1
answer
6k
views
What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?
I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance.
For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
- 50.9k
6
votes
2
answers
4k
views
What tools exist to help me monitor OCSP certificate validation failures?
The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online ...
- 20.8k
6
votes
2
answers
1k
views
How practical is a certificate's "basic constraint" property in protecting my HTTPS / SSL session?
Suppose a leaf node creates a certificate for a different domain, acting as a CA.
Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be ...
- 50.9k
9
votes
2
answers
1k
views
I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?
I want to send out SMIME certificates with my emails, and want to deploy the following PKI
Root01 (All EKU, All Constrants, No Restrictions)
PolicyInt01 (Internal applications, not trusted by 3rd ...
- 50.9k
7
votes
3
answers
438
views
Limiting the root certificate chain
I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
- 535
4
votes
1
answer
2k
views
What happens to a certificate's Basic Constraints when a policy map is used?
One feature of a Basic Constraint when applied to a certificate (CA or end certificate) is that I can specify the maximum number of CAs that are permitted in the chain.
I'm planning on having a 2 ...
- 50.9k
5
votes
1
answer
2k
views
Should I install my subordinate Certificate Authority on the domain controller? Why?
I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a ...
- 51
2
votes
2
answers
2k
views
How do I constrain Windows Smartcards for AD Authentication so that "anyExtendedKeyUsage" is not implied?
This document describes how there are 3 ways to constrain a SmartCard certificate
The Enhanced Key Usage field defines one or more purposes for which
the public key may be used. RFC 5280 states “...
- 50.9k
2
votes
1
answer
2k
views
When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?
When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism?
Related information on a different answer
Consider using HTTP instead ...
- 50.9k
1
vote
2
answers
637
views
Can revoked certificates be "lost" if the base CRL is updated before expiration?
Assumption
Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
- 50.9k
3
votes
1
answer
402
views
Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?
Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature.
Then sometime in July I need to revoke that certificate.
My ...
- 50.9k