A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

19
votes
7answers
4k views

Why are self signed certificates not trusted and is there a way to make them trusted?

I have locally made a Root CA certificate. I used the CA cert to sign the IA cert and used the IA cert to sign the server certificate. When I try to access the local server which uses the server ...
3
votes
1answer
46 views

Should my company change the internal Root CA hash method from SHA-1 to SHA-2?

My company have a Root Certificate Authority which is installed on a Windows Server 2003 and uses SHA-1 as hash method. We will migrate to Windows Server 2012. Checking the root certificates of my ...
3
votes
2answers
36 views

Question about SSL certificate and third party server

I have a system which consume web-services from a public server on Internet (but the data are not public) I have to provide credentials in Basic Auth to get the data, that is why we use SSL. The ...
2
votes
0answers
52 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
-1
votes
0answers
21 views

What prevents certificate spoofing? [duplicate]

If someone takes the information on a legitimate certificate and provides it to an illegitimate server for distribution of the certificate as if it were the illegitimate server's certificate what tips ...
1
vote
1answer
38 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
3
votes
1answer
47 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
3
votes
3answers
155 views

Why are root certificate authorites allowed to issue certficates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
0
votes
2answers
38 views

How to avoid writing .pem while signing a csr?

I am using following command to sign a certificate, openssl ca \ -in client.csr \ -keyfile server.key \ -cert server.crt \ -outdir ./some_dir \ ...
0
votes
0answers
35 views

Validation client certificate for site in iis

Input: I send client certificate to client. He uses it to work with my web application which works in IIS. I installed CA certificate (which was used to create client certificate) on web server. AFAIK ...
0
votes
3answers
83 views

what do you do when an ssl certificate expires and your app uses ssl pinning?

I originally posted this question on StackOverflow, but reposted here due to lack of responses. I am trying to decide if it's a good idea to do ssl pinning in my iOS game that uses a server to ...
1
vote
0answers
24 views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...
1
vote
2answers
78 views

Self-signed cert - how it works

I am new to SSL / digital certificates / signatures. What I know is that a digital signature must be verified/decrypted using the public key. So a cert that is signed by a CA must be ...
0
votes
2answers
90 views

SSL digital certificate process - high level

I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database. In this case, I have an web server and needs to implement SSL ...
0
votes
0answers
32 views

Mutual Authentication and Authorisation with Certificates from various CAs

Edit: Having read this question and answer I have a bit more of an understanding. My question now then, is: can I use a certificate that a user has had signed by a registered CA such as VeriSign, ...
0
votes
1answer
73 views

How does a Certicate Private Key gets transferred on import / export?

I am fairly new to certificates in general and have setup my own standalone CA for testing purposes. I have noticed some interesting behavior of private keys which I'm trying to find some ...
3
votes
1answer
86 views

Why would Amazon include an already trusted Root CA in the bug report they filed to get into Mozilla's truststore?

Amazon will soon be a trusted Root CA. To this end Mozilla Bug #1172401 was filed a while back to get into Mozilla's trust store. Along with 4 of their own Root CAs they've included a fifth one ...
1
vote
2answers
120 views

Why/when would a CA make a generated public key available to the public at large?

I'm confused about this section in my CEH security exam training material: A CA is able to perform a number of roles in addition to the validation process outlined here. Some actions that a CA is ...
5
votes
1answer
113 views

Securely build a list of trusted CAs

Some distributions of the cURL bundle include a utility mk-ca-bundle.pl which compiles a ca-bundle.crt from Mozilla's root certificate store for use as a list of trusted authorities. The script prints ...
2
votes
1answer
54 views

How does Windows certificate manager verify a file's certificate, if the root certificate is not in the store?

I'm working on a project which requires certificate verification for executable files. I have created my own trusted root certificate store, and used openssl to perform verification. However, when I ...
2
votes
2answers
54 views

Why not to use the same subordinate issuer CA for generating certificates that will be used for different things?

Microsoft has recommended my organization to use different subordinate issuer CAs in order to issue certificates that will be used for different things. For example, they recommend to use a CA for ...
11
votes
3answers
185 views

Why is Firefox shipped with expired root certificates?

What's the purpose of shipping Firefox with expired root certs? I checked and there are two expired certs listed. In fact the company's website for the first expired cert (A-Trust) states that the ...
15
votes
2answers
263 views

How much of a problem is it that Windows “hides” some of the trusted root CA certs?

Based on information on this page, Windows actually trusts many more root CA certificates than what are displayed when a user launches certmgr.msc and navigates to Trusted Root Certification ...
3
votes
1answer
75 views

Designing a PKI environment

For our company I was given the task to design a durable, structured PKI environment for mainly client authentication purposes. We need a Root CA with a couple of Intermediate CAs, like this: ...
13
votes
3answers
1k views

Should I be concerned that Google no longer trusts specific Symantec root CA cert that is also on my Windows system?

This is related to this other question which refers to Google moving to distrust the "Class 3 Public Primary CA" root certificate operated by Symantec Corporation, across Chrome, Android, and Google ...
5
votes
2answers
92 views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
3
votes
0answers
53 views

How does a Sign tool work?

My basic understanding about sign tool is: 1.It loads the zipfile(may be exe,jar,ddl,apk..) which has to be signed to its memory(cache memory of the sign tool). 2.It will verify it, and unzip the ...
8
votes
2answers
589 views

How do user receive server's certificate?

Let's imagine our user's computer wants to talk to some server for the first time in history via https. The computer sends a hello message, the server sends his public key and the certificate, ...
6
votes
2answers
197 views

Why do Symantec not believe their customers will be affected by Google distrusting this root certificate?

So Google will be moving to distrust the “Class 3 Public Primary CA” root certificate operated by Symantec Corporation, across Chrome, Android, and Google products, because it is no longer going to ...
1
vote
2answers
93 views

Verification of client certificates

I've read a lot of articles about client certificates. Please correct me if I'm wrong: client certificates are issued using CA CA could be created by myself (self-signed) or bought client ...
3
votes
1answer
76 views

TLS - How to know a CRL URL is not changed

If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be ...
0
votes
2answers
125 views

Why can you not trust a certificate directly?

If you want to set up a service that is signed using some Certificate Authority system (SSL/TLS, certain configurations of IKE, etc), if you want to use a self-signed certificate (e.g., for testing), ...
6
votes
1answer
59 views

Why does the issuance speed of a CA depend on the number of certs they have already issued?

I have seen proprietary testing results of pummelling a CA for a long time and measuring its throughput (certs issued / second). It was found that CAs become slower to issue new certificates as the ...
2
votes
1answer
57 views

What, or who, exactly is a Certificate Authority (CA) for TPM attestation?

I'm learning about and researching the Trusted Platform Module (TPM) to incorporate into a solution involving remote machines. As I understand it: all attestation methods (AIK, DAA) still require ...
4
votes
1answer
81 views

Issuing and managing large numbers of certificates for client authentication

I am developing an Internet of Things product and plan to use client certificate authentication, issuing each "thing" its own certificate on the production line so that it may authenticate with a ...
0
votes
0answers
27 views

PKI, one sub CA for each certificate type VS one for all the certificates type

I'm trying to set a PKI where I can find 3 types of certificates: A client certificate to use in HTTPS communications A web server certificate to use in HTTPS communication A VPN certificate to use ...
12
votes
1answer
455 views

How secure is “Let's Encrypt”?

I just configured and installed a free SSL certificate from Let's Encrypt. It's great, and very easy to set up. However in this post-Snowden era, I was wondering how secure this really is. For ...
13
votes
4answers
1k views

How do certificate issuers become trusted?

From what I understand, the certificate scheme that TLS/SSL relies on works because your computer has trust for major CA issuers built into it. That is, your OS is installed with certificates for ...
1
vote
1answer
43 views

How to read certificate chains in OpenSSL

I'm trying to understand how to read the output of OpenSSL commands. Currently, I am trying to understand how Certificate Chains work. When I give the command (using a standard ca bundle) openssl ...
2
votes
2answers
72 views

What's the difference between Comodo Premium and Positive SSL certificates [duplicate]

I'm just about to buy a SSL certificate from Comodo, I've doing a research in many CAs, many of them have this kinda premium certificate, and another like positiveSSL, rapidSSL, and instantSSL. The ...
42
votes
7answers
5k views

Is there any legitimate reason to install yourself as a root CA?

Follow up from comments on another question. Is there any reason as to why you might install yourself as a root CA on your own network? The only reason I can think of is forcing computers in the ...
30
votes
4answers
4k views

Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?

By my admittedly limited understanding of how HTTPS/TLS works, the end user (me) initiates a connection with a remote server which signs every one of its messages with a public key. This public key ...
3
votes
1answer
184 views

Check root certificates and certificate authorities on new PC

First Lenovo was caught shipping Superfish with new PCs, which included a universal self-signed certificate authority, and now Dell has been caught shipping PCs with a similar root certificate. What ...
1
vote
0answers
33 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
0
votes
0answers
43 views

Mysql SSL handshake: symmetric key exchange with CA or server key?

I have my MySQL database set up to require server and client identify verification, with both presenting their certificates signed by the same CA (mysql user was set up with 'require X509'). ...
3
votes
1answer
68 views

Why does SSL EV certification have a range of encryption (40-128 bit)?

I would like to get SSL-EV certification for my company website. After comparing a list of providers, I am confused by their advertisements. Why do all providers say that their certifications ...
2
votes
1answer
23 views

Which CRL should an intermediate CA crlDistributionPoint contain?

Given a root certificate authority (CA) and an intermediate CA signed by the root: Which CRL should the crlDistributionPoints contain to for the intermediate CA? The root CA's CRL or the ...
1
vote
0answers
62 views

How to import Comodo certificates into Keystore?

I'm trying to create a Keystore. I've already generated a Private Key, generated and sent a certificate request to a CA (Comodo), and I've received a ZIP file from the CA (Comodo) containing four ...
1
vote
1answer
53 views

Self created CA root for client certificates [duplicate]

My company wants to use client certificates for clients on production. We have a HTTPS certificate. As I understand we need a CA root certificate to create client certificates. Question: is it OK if I ...
4
votes
1answer
92 views

S/MIME certificates and “information leakage”

I'm considering getting an S/MIME certificate that verifies my name and email address. I've been trying to ascertain what information "leaks" if I do. The Wikipedia page on S/MIME says: Depending ...