A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

0
votes
0answers
21 views

Should CAs refrain from declaring HSTS policies that cover CRL hosts?

CRLs are usually not served over HTTPS, which makes sense. Further, according to this related answer, some clients may refuse to follow HTTPS URLs when validating certificates. Now, suppose a ...
2
votes
1answer
62 views

Strange CA certificate prompt

My network went down for a minute today, then this window popped up: Can someone here clarify this for me? I was using firefox. I had google, youtube and outlook open. My name isn't even close to ...
0
votes
1answer
23 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
-3
votes
0answers
45 views

How do I find out what CA credentials certificates are OK to disable? [on hold]

I need help with figuring what is OK to disable on my certificate's and what does Hong Kong really need to be there for?
2
votes
1answer
55 views

Can a DNS “route” change cause an SSL certificate error?

What I mean by "route change": As a working example, mysite.example.net is set up as: mysite.example.net. 3600 IN CNAME some-other-site.elsewhere.com. ...
0
votes
0answers
17 views

How can I use unique PKI from host to client [closed]

I have hundreds of machines i would like to have unique credentials/certs on. I also have a even more cell phones i need to run diagnostics on the machines. Is there a way i can do this? I will also ...
1
vote
1answer
82 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
3
votes
0answers
46 views

How to use openssl ca with prime256v1?

I am new on encryptation world, and reading about this, mostly websites say to use the prime256v1 for better performance and security. After some days testing, finally I get my openssl CA structure ...
1
vote
1answer
82 views

Is or was it possible to register a wildcard certificate to third level subdomain?

The use of a null byte in a certificate cn is very well known… and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of ...
0
votes
1answer
48 views

Creating self-signed certificate for localhost and trusting fully

As an accompanyment to a web application we plan to have a node application running as a windows service running on the client computer. This will run a small web server which will listen on port XXXX ...
4
votes
2answers
65 views

Trusting the “subject” of an x509 certificate

A bit of background. Our organization is working on a document format that will be ingested by our software. We're using the CMS format to verify the integrity (by validating the signature). The CMS ...
1
vote
1answer
97 views

Letsencrypt not valid in Firefox or PHP, but valid in Chromium

I just moved one of my websites to https, using Letsencrypt. I am using Linux, and my Chromium correctly verifies website certificate, but Firefox shows it as invalid. I also have an API on the ...
5
votes
1answer
77 views

Why are short-lived certificates so rare?

Let's encrypt recently left beta and limits the maximal life-time of certificates to 90 days and recommends 60 days. Now whenever I start talking about the issues of certificate revocation (e.g. OCSP ...
3
votes
0answers
79 views

SSL certificate and price difference [closed]

After reading this discussion, Why are there very expensive and cheap SSL same type certificates? I surfed over the internet “Symantec Secure Site Pro with EV SSL Certificates”. I found something ...
1
vote
1answer
33 views

How is PKCS#10 and x509 related?

I'm unable to make sense of them using the RFCs. Can anyone help? When I use this function, http://www.pyopenssl.org/en/stable/api/crypto.html#x509req-objects , am I creating a PKCS#10 format CSR?
1
vote
1answer
59 views

How to determine effective trust chain for cert on MacOS X?

I'm seeing some curious issues with cert verification for an Issuer: Entrust - L1K cert that was issued and is in use (per inspection of the cert in Chrome and Firefox) for an internal site here. I ...
1
vote
0answers
29 views

How to provide our customers ability to self service client certificate creation?

We have an API for B2B customers to access our platform. We require each B2B customer to have a client certificate. This is not the URL SSL certificate (https). The CN of each customer's client ...
3
votes
1answer
31 views

SHA 1 no impact to root certificate

I ran a scan on a server and the results of the authentication for digital certificate was as follows : Certificate 1 (root) signature algorithm: Sha256withRSA Certificate 2 (chain of trust) ...
1
vote
1answer
33 views

which the field represents digital signature value of CA in a certificate?

Normally CA signs the certificate with its private key and produces digital signature of it.The digital signature value will be displayed in certificate. My question is what is the field name that ...
4
votes
2answers
37 views

What is the difference between Digital certification revocation and retiring?

Certificate management tools use options called revocation and retiring digital certificates.Can someone explain what is the difference between both?
1
vote
0answers
67 views

HTTPS: Same certificate, different public key

I have a web server, Debian, and the site uses a HTTPS cert from Thawte. The root certificate meant to be on top of my verification chain is also on the server, in /etc/ssl/certs, because the APT ...
3
votes
0answers
72 views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...
4
votes
2answers
133 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
4
votes
2answers
76 views

Does client send request to CA when SSL handshaking?

In other words, if Certificate Authority goes down, does this mean that all HTTPS sites that purchased SSL certs from this CA will also become unavailable?
1
vote
2answers
65 views

understanding client certificate - pfx on the general

Today I am given a pfx and told to access a website. I have absolutely no idea what was given to me initially, so please kindly confirm my understanding on a general level 1) the pfx is a container ...
1
vote
2answers
52 views

Subdomains on a multidomain EV SSL [closed]

I have a domain https://joshmurray.eu/ which has a Standard SSL certificate. I also have two subdomains: http://one.joshmurray.eu/ and http://two.joshmurray.eu/. I wish to upgrade my SSL certificate ...
0
votes
2answers
40 views

Files related/required to a digital certificate

I am new to digital certification and I am trying to understand it as well as get my domain certified. I know this question may be broad, but can someone give me a general idea of the usage of the ...
1
vote
2answers
60 views

What are the steps to take after adding an invalid certificat authority?

in order to pay my bills online internet , I have to go through the website for my internet provider , type the login and password then I redirect to a page your connection is not private i proceed to ...
1
vote
0answers
34 views

Approved Certificate Authorities for certification/compliance with HIPAA, PCI etc

Are there any requirements in PCI or HIPAA, or other security standards that may impact general government, payment processing, healthcare, that would disqualify any CA vendors that are trusted by the ...
3
votes
1answer
80 views

Is a CA obligated to issue a certificate for a proven legitimate request?

As hinted at in Does any technology prevent a CA unilaterally revoking a certificate?, I'm a little uncomfortable with the possibility that CAs effectively licensing a website to operate (given the de ...
0
votes
2answers
45 views

Local certification authority and certificate chain

I know that I can set up a local certification authority for a local network. I can issue certificates for all the devices in my network, and as long as they trust me, they can use such certificates ...
11
votes
2answers
779 views

Is using HTTP for OCSP a potential vulnerability? [duplicate]

While inspecting my CA-approved cert, I noticed the following oddities: Extensions/CRL Distribution Points: Not Critical URI: http://crl2.alphassl.com/gs/gsalphasha2g2.crl Extensions/Authority ...
0
votes
1answer
83 views

Are Free SSL/TLS Certificates Trustworthy ? Can Cert Providers Snoop On Traffic? [duplicate]

I know nothing about encryption, SSL, TLS, certificates and have come across several companies offering free SSL/TLS certificates. How trustworthy are these offers? Why would I want to adopt this ...
3
votes
1answer
49 views

SSL negotiating too low a protocol?

I'm trying to diagnose a potential SSL/TLS problem between a Mac client and a Windows server. I have generated my own root cert and signed a cert for the server, and installed the root cert on the ...
15
votes
6answers
2k views

What's the point of the CA?

So a Certificate Authority certifies that a website corresponds to a given organization. Why is this necessary? When I interact with a business or organization, I do it one of a couple ways: I ...
11
votes
2answers
832 views

How long can X.509 certificate chains be?

Usually, I only see certificate chains with a root CA, an intermediate one, and a third one for the particular SSL/TLS website; but can X.509 certificate chains be deeper than 3 levels? Is there a ...
4
votes
2answers
87 views

Good way to obtain an EV SSL certificate for personal use? [closed]

I would like to obtain some sort of digital certificate for personal use. I would like to use this for encrypting and signing e-mails, digitally signing contracts, and for providing authentication of ...
3
votes
2answers
128 views

Can a CN-only certificate bypass a name constraint if the CA goes rogue?

I am trying to cross-certify an internal issuer certificate, adding a name constraint for our domain. However, it seems that an attacker could bypass this protection by putting the desired host name ...
1
vote
0answers
128 views

MQTT (Mosquitto) certificate SSL23_GET_CLIENT_HELLO:unknown protocol [closed]

I'm been desperately trying to get my MQTT clients to connect to my MQTT broker which is set up with a certificate from a CA. To be able to get the CA certificate, I've used the letsencrypt python ...
1
vote
2answers
119 views

What is the purpose of SSL Certificate Authority (CA)?

What is the purpose of an SSL Certificate Authority? How would a CA prevent dishonestcompany.com from doing something dishonest? What does the CA signing of the SSL/TLS cert for ...
0
votes
0answers
81 views

When connection is slow, all sites provide certificate for same domain name

My home connection is sometimes very slow - or non-existent at all. I have not found the cause of the problem yet. Generally, rebooting the router works. Sometimes, when the connection becomes slow, ...
0
votes
2answers
103 views

How In-House Certificate Authority works (e.g. EJBCA)

I have a simple (dumb?) question with respect to EJBCA. I have been exploring how In-house CAs work and issue certificates. However, I am not able to understand who will be trusted on the top level in ...
6
votes
2answers
858 views

How does an attack on a digital signature work?

In our IT Security class we have been told that you need CA's to prevent attacks on a digital signature. Sadly, our docent didn't elaborate how such attack would be performed - I can only guess that ...
0
votes
1answer
62 views

What is the difference between a certificate, a signature and a thumbprint in case of windows exe/binaries?

I am trying to understand the difference between signature , thumbprint and certificate in context of windows executable and binaries. I looked up on internet before posting this question but I did ...
1
vote
2answers
72 views

Reissuing certificates with SHA-2

I recently setup my own CA, and imported the CA cert into devices across the company. I then deployed certificates to our various servers, etc.. All using SHA-1 signatures (the default in the tool I ...
1
vote
1answer
93 views

TinyCA missing CRL information in root and leaf certificates

I setup a new CA using TinyCA. When creating the CA i used an internal host name for the crl url exactly as follows: http://myserver.com/crl.pem And I have exported the CRL to that location, and I ...
1
vote
0answers
42 views

How Do I Create a Production Client Authentication Certificate for Azure Key Vault?

I am learning about Azure Key Vault, and one of the scenarios it supports is certificate authentication, which you can read about here. The samples do a great job of explaining how to make a ...
81
votes
4answers
11k views

What prevents me from buying a SSL certificate for a domain I don't control?

Can I simply build a webserver, make its hostname "google.com", create a CSR off that server, and send that to a Certificate Authority for signing? Let's say I pick the cheapest and dodgiest outfit I ...
1
vote
1answer
145 views

What does browser do when it queries xxx.example.com and it gets a certificate for yyy.example.com(top level domain is same)?

The question is actually about what level of validations browser does when it gets certificates of some other domains like case 1: Accessing abc.google.com and got def.google.com case 2: Accessing ...
3
votes
2answers
107 views

When should I renew certification authority?

What is best practice in renewing certification authorities? I mean when should I renew certification authority? For example, suppose I have the following setup: 1. Root CA with validity of 30 years ...