A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

3
votes
1answer
68 views

How does Let's Encrypt prevent imposters?

Because Let's Encrypt doesn't provide Entity Validation, is it true that one can, for example, generate a certificate that has "Facebook Inc." as Organization for a bogus domain faceb00k.com?
1
vote
2answers
47 views

When should I create and use my own CA?

I was taking a look to one Docker tutorial in which is explained how to create and use our own CA for encrypting the communication between the Docker client and the daemon and immediately a couple of ...
14
votes
3answers
2k views

Why is it more secure to use intermediate CA certificates?

I've read that using Intermediate CA certificates is more secure because this way the Root CA is offline. So, if the Intermediate is compromised it does not impact the Root CA. What I understand is ...
0
votes
2answers
28 views

How to convert a SSL certificate to an authority?

How can one convert an SSL cert provided by an authority to another authority, so one can generate "valid" certs for different domains?
2
votes
2answers
81 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
2
votes
0answers
11 views

Signtool validation fails when signing and validating are done in different machines

I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
20
votes
5answers
2k views

Who is responsible for revoking a certificate?

The CA issues certificates to clients/servers. Whenever a request is made by the client/server, the certificate is used to verify the identity. Now, if a certificate needs to be revoked then who does ...
0
votes
0answers
28 views

Generating a cert for use to digitally sign an email

I am having some issues generating certs, past a certain point. So far, I have done the following to generate a CSR, and have obtained an intermediate cert from the provider, and another CRT file. I ...
2
votes
2answers
45 views

CA Certificate Lifecycle

I'm planning to implement a new PKI with 2 tiers of CAs. I'll have end entity certificates with a lifetime of up to 5 years. This means my Issuing CA should be valid for 10 years, in order to be able ...
11
votes
2answers
1k views

Is StartSSL.com a trustworthy site? [closed]

I just got the following email: Dear StartCom customers, This electronic mail message was created by StartCom's Administration Personnel: StartCom, a leading global Certificate ...
0
votes
0answers
23 views

Weird connection error prompts, Rootkits & MitM?

Can someone give me insight on these connection error prompts? https://imgur.com/a/FEHJj My internet kept reconnecting two weeks ago and I couldn't access the internet until I performed a hard reset ...
6
votes
1answer
123 views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
3
votes
2answers
105 views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
1
vote
1answer
108 views

Why is CAcert not trusted by my browser?

I am fairly new to encryption and SSL. Today I googled a bit (read some atricles about security) and encountered the site https://cacert.org. I clicked it and was surprised. Chrome showed me a "not ...
1
vote
1answer
32 views

Man in the middle with certificate signed by known CA and DNS spoofing can work?

Assuming that I have a certificate for my local webserver signed by a well known CA like Verisign (so it will be trusted by browsers), and I'm able to DNS poisoning in Man-in-the-Middle to redirect a ...
0
votes
1answer
45 views

SSL certificate for server authentication

to clear my understandings: I create self signed certificate first keytool -genkey -alias mysign -keyalg RSA -keystore mykeystorename.jks the firstname of the self sign has to be my domain name? ...
-3
votes
0answers
25 views

Certification authority [duplicate]

A. Because there are multiple certificate authorities (CAs) for the Web PKI it is possible to buy multiple certificates for the same domain signed by different CAs. How would a browser treat these ...
0
votes
0answers
35 views

Should CAs refrain from declaring HSTS policies that cover CRL hosts?

CRLs are usually not served over HTTPS, which makes sense. Further, according to this related answer, some clients may refuse to follow HTTPS URLs when validating certificates. Now, suppose a ...
2
votes
1answer
104 views

Strange CA certificate prompt

My network went down for a minute today, then this window popped up: Can someone here clarify this for me? I was using firefox. I had google, youtube and outlook open. My name isn't even close to ...
0
votes
1answer
28 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
2
votes
1answer
72 views

Can a DNS “route” change cause an SSL certificate error?

What I mean by "route change": As a working example, mysite.example.net is set up as: mysite.example.net. 3600 IN CNAME some-other-site.elsewhere.com. some-other-site.elsewhere....
1
vote
1answer
102 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
3
votes
0answers
58 views

How to use openssl ca with prime256v1?

I am new on encryptation world, and reading about this, mostly websites say to use the prime256v1 for better performance and security. After some days testing, finally I get my openssl CA structure ...
1
vote
1answer
83 views

Is or was it possible to register a wildcard certificate to third level subdomain?

The use of a null byte in a certificate cn is very well known… and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of ...
0
votes
1answer
65 views

Creating self-signed certificate for localhost and trusting fully

As an accompanyment to a web application we plan to have a node application running as a windows service running on the client computer. This will run a small web server which will listen on port XXXX ...
4
votes
2answers
73 views

Trusting the “subject” of an x509 certificate

A bit of background. Our organization is working on a document format that will be ingested by our software. We're using the CMS format to verify the integrity (by validating the signature). The CMS ...
1
vote
1answer
171 views

Letsencrypt not valid in Firefox or PHP, but valid in Chromium

I just moved one of my websites to https, using Letsencrypt. I am using Linux, and my Chromium correctly verifies website certificate, but Firefox shows it as invalid. I also have an API on the ...
5
votes
1answer
83 views

Why are short-lived certificates so rare?

Let's encrypt recently left beta and limits the maximal life-time of certificates to 90 days and recommends 60 days. Now whenever I start talking about the issues of certificate revocation (e.g. OCSP ...
3
votes
0answers
83 views

SSL certificate and price difference [closed]

After reading this discussion, Why are there very expensive and cheap SSL same type certificates? I surfed over the internet “Symantec Secure Site Pro with EV SSL Certificates”. I found something ...
1
vote
1answer
47 views

How is PKCS#10 and x509 related?

I'm unable to make sense of them using the RFCs. Can anyone help? When I use this function, http://www.pyopenssl.org/en/stable/api/crypto.html#x509req-objects , am I creating a PKCS#10 format CSR?
1
vote
1answer
67 views

How to determine effective trust chain for cert on MacOS X?

I'm seeing some curious issues with cert verification for an Issuer: Entrust - L1K cert that was issued and is in use (per inspection of the cert in Chrome and Firefox) for an internal site here. I ...
1
vote
0answers
32 views

How to provide our customers ability to self service client certificate creation?

We have an API for B2B customers to access our platform. We require each B2B customer to have a client certificate. This is not the URL SSL certificate (https). The CN of each customer's client ...
3
votes
1answer
44 views

SHA 1 no impact to root certificate

I ran a scan on a server and the results of the authentication for digital certificate was as follows : Certificate 1 (root) signature algorithm: Sha256withRSA Certificate 2 (chain of trust) ...
1
vote
1answer
36 views

which the field represents digital signature value of CA in a certificate?

Normally CA signs the certificate with its private key and produces digital signature of it.The digital signature value will be displayed in certificate. My question is what is the field name that ...
4
votes
2answers
45 views

What is the difference between Digital certification revocation and retiring?

Certificate management tools use options called revocation and retiring digital certificates.Can someone explain what is the difference between both?
1
vote
0answers
71 views

HTTPS: Same certificate, different public key

I have a web server, Debian, and the site uses a HTTPS cert from Thawte. The root certificate meant to be on top of my verification chain is also on the server, in /etc/ssl/certs, because the APT ...
3
votes
0answers
106 views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...
4
votes
2answers
201 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
4
votes
2answers
81 views

Does client send request to CA when SSL handshaking?

In other words, if Certificate Authority goes down, does this mean that all HTTPS sites that purchased SSL certs from this CA will also become unavailable?
1
vote
2answers
78 views

understanding client certificate - pfx on the general

Today I am given a pfx and told to access a website. I have absolutely no idea what was given to me initially, so please kindly confirm my understanding on a general level 1) the pfx is a container ...
1
vote
2answers
60 views

Subdomains on a multidomain EV SSL [closed]

I have a domain https://joshmurray.eu/ which has a Standard SSL certificate. I also have two subdomains: http://one.joshmurray.eu/ and http://two.joshmurray.eu/. I wish to upgrade my SSL certificate ...
0
votes
2answers
40 views

Files related/required to a digital certificate

I am new to digital certification and I am trying to understand it as well as get my domain certified. I know this question may be broad, but can someone give me a general idea of the usage of the ...
1
vote
2answers
62 views

What are the steps to take after adding an invalid certificat authority?

in order to pay my bills online internet , I have to go through the website for my internet provider , type the login and password then I redirect to a page your connection is not private i proceed to ...
1
vote
0answers
39 views

Approved Certificate Authorities for certification/compliance with HIPAA, PCI etc

Are there any requirements in PCI or HIPAA, or other security standards that may impact general government, payment processing, healthcare, that would disqualify any CA vendors that are trusted by the ...
3
votes
1answer
80 views

Is a CA obligated to issue a certificate for a proven legitimate request?

As hinted at in Does any technology prevent a CA unilaterally revoking a certificate?, I'm a little uncomfortable with the possibility that CAs effectively licensing a website to operate (given the de ...
0
votes
2answers
46 views

Local certification authority and certificate chain

I know that I can set up a local certification authority for a local network. I can issue certificates for all the devices in my network, and as long as they trust me, they can use such certificates ...
11
votes
2answers
793 views

Is using HTTP for OCSP a potential vulnerability? [duplicate]

While inspecting my CA-approved cert, I noticed the following oddities: Extensions/CRL Distribution Points: Not Critical URI: http://crl2.alphassl.com/gs/gsalphasha2g2.crl Extensions/Authority ...
0
votes
1answer
92 views

Are Free SSL/TLS Certificates Trustworthy ? Can Cert Providers Snoop On Traffic? [duplicate]

I know nothing about encryption, SSL, TLS, certificates and have come across several companies offering free SSL/TLS certificates. How trustworthy are these offers? Why would I want to adopt this ...
3
votes
1answer
65 views

SSL negotiating too low a protocol?

I'm trying to diagnose a potential SSL/TLS problem between a Mac client and a Windows server. I have generated my own root cert and signed a cert for the server, and installed the root cert on the ...
15
votes
6answers
2k views

What's the point of the CA?

So a Certificate Authority certifies that a website corresponds to a given organization. Why is this necessary? When I interact with a business or organization, I do it one of a couple ways: I ...