A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

0
votes
0answers
21 views

Some Windows servers do not seem to have RSA certificates. What is wrong? [migrated]

Some Windows Server 2012 machines have certificates. Some do not. I am running this command: Get-ChildItem -Path Cert:\CurrenterUser\My | Where-Object { $_.PrivateKey -is [System.Security....
0
votes
1answer
29 views

Is stolen client side certificate a valid concern for SSL communication? How to build an automatic revocation system?

In the context of server to server communication, we do TLS/SSL with client certificate authentication. So the communication looks like the following: service_a on Host_A (as the SSL client) --> ...
0
votes
0answers
11 views

Security Concerns of importing SharePoint Root Authority to Trusted Root Certification Authorities store

We are experiencing slowness because of SharePoint's STS certificate CRL checking. This is a known issue and there is a Microsoft Workaround for it: https://support.microsoft.com/en-us/kb/2625048 The ...
0
votes
1answer
62 views

Perfoming a MITM to intercept SSL/TLS with valid certificate

Supposing an attacker is able to perform a Man In The Middle attack and intercept requests from a client that wants to connect to an HTTPS server (let's say www.google.com). The attacker has a valid ...
0
votes
2answers
85 views

How TLS certificate chain is verified

Assume the verification of a TLS certificate chain. Suppose the chain has certificates A-B-C-D where D is the root certificate and A is signed by B, B by C, C by D. Suppose the intermediate ...
0
votes
1answer
59 views

Do I have the private keys to CAs installed on my browser?

Could someone please help explain the following comment from Why was the private key of the Superfish certificate so easily extractable? The main issue with private key extraction is the use of ...
4
votes
2answers
61 views

How to trust root CA

When I download a browser such as Mozilla, it comes bundled with several root Certificates. How do I trust that these certificates are legitimate? How do I know that my download does not contain ...
0
votes
2answers
20 views

Integrity of downloaded Oracle JDK (/software in general) [duplicate]

Found something related Why aren't application downloads routinely done over HTTPS? This is a question about general security from a noob. I couldn't find anything relevant about this topic via ...
1
vote
0answers
16 views

Are GeoTrust SHA-256 intermediate chain and cross-root legacy support, mutually exclusive?

I have purchased a GeoTrust TrueBusiness ID SHA-256 with EV SSL Certificate. According to GeoTrust website, I must also install the corresponding intermediate certificate, which is "GeoTrust EV SSL ...
0
votes
1answer
64 views

Who is responsible for generating public key during secure communication?

This must be easy but I am getting a little confused. Say, facebook.com, it has a certificate which is signed by an intermediary CA. Who generated that public key that I can see in facebook ...
0
votes
1answer
78 views

How to create a server certificate from a letsencrypt.org certificate?

I have created a letscrypt.org certificate using letsencrypt run which works fine as a SSL certificate on apache2. How can I create another server certificate signed (and thus trusted) by the ...
1
vote
2answers
47 views

Should each service running on a domain have a separate certificate?

I have a domain name with dynamic DNS (DDNS) for my home server on which I expose multiple services (web server, wikis, issue trackers, etc.) online. Some services are hosted by the same software (e.g....
1
vote
1answer
21 views

Regarding Openssl.config file: What is the importance of policy matching when creating a self-signed certificate with the aid of this file?

When trying to go through some material for self-signing a certificate, one of the steps required me to set policy conditions in this config file. See: https://www.phildev.net/ssl/opensslconf.html ...
2
votes
3answers
79 views

What specific information is used to verify an SSL certificate?

When a CA's SSL certificate is stored in a browser, a server which presents a certificate signed by this CA can be verified by the browser. My question is: How exactly is this verification done? I ...
1
vote
1answer
45 views

Do not trust all intermediate certificates

I have a trust store containing SSL certificate chain up to Root CA certificate: Root CA -> Intermediate CA - SSL certificate According what I saw as a best practice, only Root CA certificate should ...
0
votes
1answer
34 views

Key usage extension on certificate

When I create a CSR and provide the block of encrypted text to a Root CA (e.g. Verisign, Thawte), what or who will determine the Key Usage extension attributes like: Digital Signature Non-...
1
vote
1answer
40 views

Can we provide our external certificates to a customer's SQL Server for SSL?

In designing hosted software that interfaces with a client's SQL Server over TCP/IP and we may wish to offer the option of using SSL/TLS. One architecture that seems attractive is where we generate a ...
4
votes
2answers
75 views

Can a SSL Certificate dictate protocol?

I know you can set the protocol/cipher via your web server: Nginx: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; Apache: SSLProtocol all -SSLv2 SSLCipherSuite ...
0
votes
1answer
20 views

Certificate Verification in openssl

I was going through the openssl server-client program given here---> http://simplestcodings.blogspot.com.br/2010/08/secure-server-client-using-openssl-in-c.html. I can see both the client and server ...
2
votes
3answers
58 views

Does a certificate authority use different private keys?

I was wondering whether a CA has different private keys to sign certificates with? Is there a risk of crypto-analysis (or something similar) when a CA signs thousands of certificates with the same ...
-4
votes
1answer
62 views

Why is it not possible to fake a digital certificate? [duplicate]

When a client accesses an HTTPS webpage, (please correct me if I'm wrong), it just checks whether the certificate of that website has been signed by a trusted CA or not, but does not ask directly the ...
1
vote
1answer
88 views

Is it secure to distribute Certificate Revocation Lists over HTTP? [duplicate]

I'm still trying to understand the functionality of a Certificate Authority, so if this obvious, I apologize. I understand CRLs play a role when the CA wants to invalidate a certain SSL certificate. ...
3
votes
1answer
95 views

How does Let's Encrypt prevent imposters?

Because Let's Encrypt doesn't provide Entity Validation, is it true that one can, for example, generate a certificate that has "Facebook Inc." as Organization for a bogus domain faceb00k.com?
1
vote
2answers
68 views

When should I create and use my own CA?

I was taking a look to one Docker tutorial in which is explained how to create and use our own CA for encrypting the communication between the Docker client and the daemon and immediately a couple of ...
16
votes
3answers
2k views

Why is it more secure to use intermediate CA certificates?

I've read that using Intermediate CA certificates is more secure because this way the Root CA is offline. So, if the Intermediate is compromised it does not impact the Root CA. What I understand is ...
0
votes
2answers
37 views

How to convert a SSL certificate to an authority?

How can one convert an SSL cert provided by an authority to another authority, so one can generate "valid" certs for different domains?
3
votes
2answers
89 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
2
votes
0answers
15 views

Signtool validation fails when signing and validating are done in different machines

I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
21
votes
5answers
2k views

Who is responsible for revoking a certificate?

The CA issues certificates to clients/servers. Whenever a request is made by the client/server, the certificate is used to verify the identity. Now, if a certificate needs to be revoked then who does ...
0
votes
0answers
30 views

Generating a cert for use to digitally sign an email

I am having some issues generating certs, past a certain point. So far, I have done the following to generate a CSR, and have obtained an intermediate cert from the provider, and another CRT file. I ...
2
votes
2answers
55 views

CA Certificate Lifecycle

I'm planning to implement a new PKI with 2 tiers of CAs. I'll have end entity certificates with a lifetime of up to 5 years. This means my Issuing CA should be valid for 10 years, in order to be able ...
11
votes
2answers
2k views

Is StartSSL.com a trustworthy site? [closed]

I just got the following email: Dear StartCom customers, This electronic mail message was created by StartCom's Administration Personnel: StartCom, a leading global Certificate ...
0
votes
0answers
26 views

Weird connection error prompts, Rootkits & MitM?

Can someone give me insight on these connection error prompts? https://imgur.com/a/FEHJj My internet kept reconnecting two weeks ago and I couldn't access the internet until I performed a hard reset ...
7
votes
1answer
145 views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
3
votes
2answers
130 views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
1
vote
1answer
133 views

Why is CAcert not trusted by my browser?

I am fairly new to encryption and SSL. Today I googled a bit (read some atricles about security) and encountered the site https://cacert.org. I clicked it and was surprised. Chrome showed me a "not ...
1
vote
1answer
37 views

Man in the middle with certificate signed by known CA and DNS spoofing can work?

Assuming that I have a certificate for my local webserver signed by a well known CA like Verisign (so it will be trusted by browsers), and I'm able to DNS poisoning in Man-in-the-Middle to redirect a ...
0
votes
2answers
75 views

SSL certificate for server authentication

to clear my understandings: I create self signed certificate first keytool -genkey -alias mysign -keyalg RSA -keystore mykeystorename.jks the firstname of the self sign has to be my domain name? ...
0
votes
0answers
37 views

Should CAs refrain from declaring HSTS policies that cover CRL hosts?

CRLs are usually not served over HTTPS, which makes sense. Further, according to this related answer, some clients may refuse to follow HTTPS URLs when validating certificates. Now, suppose a ...
2
votes
1answer
134 views

Strange CA certificate prompt

My network went down for a minute today, then this window popped up: Can someone here clarify this for me? I was using firefox. I had google, youtube and outlook open. My name isn't even close to ...
0
votes
1answer
30 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
2
votes
1answer
86 views

Can a DNS “route” change cause an SSL certificate error?

What I mean by "route change": As a working example, mysite.example.net is set up as: mysite.example.net. 3600 IN CNAME some-other-site.elsewhere.com. some-other-site.elsewhere....
1
vote
1answer
120 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
3
votes
0answers
68 views

How to use openssl ca with prime256v1?

I am new on encryptation world, and reading about this, mostly websites say to use the prime256v1 for better performance and security. After some days testing, finally I get my openssl CA structure ...
1
vote
1answer
84 views

Is or was it possible to register a wildcard certificate to third level subdomain?

The use of a null byte in a certificate cn is very well known… and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of ...
0
votes
1answer
104 views

Creating self-signed certificate for localhost and trusting fully

As an accompanyment to a web application we plan to have a node application running as a windows service running on the client computer. This will run a small web server which will listen on port XXXX ...
4
votes
2answers
76 views

Trusting the “subject” of an x509 certificate

A bit of background. Our organization is working on a document format that will be ingested by our software. We're using the CMS format to verify the integrity (by validating the signature). The CMS ...
1
vote
1answer
231 views

Letsencrypt not valid in Firefox or PHP, but valid in Chromium

I just moved one of my websites to https, using Letsencrypt. I am using Linux, and my Chromium correctly verifies website certificate, but Firefox shows it as invalid. I also have an API on the ...
5
votes
1answer
88 views

Why are short-lived certificates so rare?

Let's encrypt recently left beta and limits the maximal life-time of certificates to 90 days and recommends 60 days. Now whenever I start talking about the issues of certificate revocation (e.g. OCSP ...
3
votes
0answers
87 views

SSL certificate and price difference [closed]

After reading this discussion, Why are there very expensive and cheap SSL same type certificates? I surfed over the internet “Symantec Secure Site Pro with EV SSL Certificates”. I found something ...