Tagged Questions
2
votes
1answer
36 views
Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA
I would like to ask if it is possible to use different CA for the client certificate and the web certificate?
For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
5
votes
3answers
86 views
What are the risks of a localhost signed cerificate?
In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections.
Suppose we use this CA to sign a key for "localhost" for use in ...
8
votes
1answer
175 views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
2
votes
2answers
91 views
Looking for general guidance on securing web API application for client applications and users
I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.
After a lot of googling ...
1
vote
1answer
107 views
Why a web server HTTPS certificate can't sign its subdomain HTTPS certificates?
Why having a valid certificate for "exampe.com" I can't make a "child" certificate for "subdomain.example.com"?
What insecurities will arise if browsers start allowing domain's certificates to be ...
4
votes
2answers
71 views
Using SSL Certification in Multiple Locations
I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access.
The ...
2
votes
1answer
71 views
Certificate Chains When Importing Signed CSR Response
I'm interfacing with a secure web service, and authenticating using a client certificate. I'm confused about step #3 in the client configuration:
Generate a private key into keystore
Generate a CSR ...
0
votes
2answers
92 views
Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]
I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
3
votes
2answers
91 views
Why are SSL certificates valid only from a certain date?
Each SSL certificate is valid starting from a specific date and up to the expiration date.
What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
41
votes
10answers
2k views
Why do we not trust an SSL certificate that expired recently?
Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
3
votes
1answer
92 views
Certification authority only for certain domains
Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
2
votes
2answers
401 views
Protecting against SSL Strip [duplicate]
I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe?
Does it depend on the cert strength?
Do you ...
4
votes
1answer
103 views
For a desktop application, why use an SSL certificate from a trusted authority?
When a web browser connects to a server and downloads an SSL certificate, a third-party trusted authority ensures that the client is talking to the host that it's looking for. If the host uses a ...
10
votes
1answer
336 views
How does OCSP stapling work?
I've been looking into OCSP stapling for HTTPS, which looks pretty interesting. From what I can tell, it's essentially a way of offloading CRLs from the CA to the server, allowing for everything to be ...
3
votes
4answers
476 views
Is it possible to create a self signed certificate authority?
Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious.
To explain my question : Suppose I sign a public ...
2
votes
2answers
170 views
Forged SSL without installation of root CA, possible?
Consider visiting a secure website like Gmail. Is it possible to forge the website certificate only by having full control over the internet provider?
I mean is it practically possible for a provider ...
1
vote
3answers
208 views
Server Certificates, certificate authority, and servers
I currently have a valid wildcard certificate installed on OS X 10.8.2 server. To make sure we know what I'm talking about the cert is *.domain.com (example only) I'd love to use this to secure as ...
4
votes
3answers
117 views
Issuing SSL certificates for device automation software package without domain names
We are developing the automation software for Windows which communicates with the certain devices via our own private connection protocol. That software package consists of several server (including ...
0
votes
1answer
514 views
How to create trusted chain of certificates if I have the last certificate?
Good day.
During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using)
My server is:
telnet xmpp.odnoklassniki.ru ...
11
votes
4answers
403 views
What alternatives are there to the existing Certificate Authority system for SSL?
Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
1
vote
0answers
81 views
Why not buy cheap SSL certificates? [duplicate]
Possible Duplicate:
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
The comparison in Godaddy's website, makes it clear: they're just cheaper ...
4
votes
2answers
135 views
What is the state of the Windows Update certificate after Flame?
May 28, The Flame malware is discovered in Iran and by Kaspersky Labs.
June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
4
votes
3answers
562 views
How is an X509 certificate signer verified?
Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is,
...
1
vote
1answer
59 views
For SSL certs, is some sort of connection to the issuing CA (or other network resource) required for the SSL connection to be established?
I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL".
Background:
I am deploying ...
4
votes
5answers
439 views
Is Spoofing a CA signed certificate possible?
I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway.
When a communication starts with a server, during the client handshake, the ...
10
votes
4answers
1k views
Are there technical disadvantages in using free ssl certificates?
Note this question is related, except this one is about free SSL certs.
There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
23
votes
9answers
1k views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
5
votes
2answers
161 views
What kind of certificate do I need to be able to sign my own subdomain certificates?
We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...).
...
3
votes
4answers
2k views
How are Chrome and Firefox validating SSL Certificates?
How are Chrome and Firefox validating SSL Certificates?
Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?
10
votes
3answers
157 views
Domain name expiration and TLS
If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
4
votes
4answers
750 views
Can an intermediate CA be trusted like a self-signed root CA?
Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
-6
votes
4answers
200 views
Is TLS-in-TLS supported in any software? Does it make sense? [closed]
I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
3
votes
0answers
145 views
How secure is HTTP basic authentication over SSL? [duplicate]
Possible Duplicate:
Is BASIC-Auth secure if done over HTTPS?
I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
2
votes
1answer
848 views
SSL cert not turning green anymore
I'm running a drupal site and have asked about this issue pertaining specifically to the drupal aspect of it here. I know that the "Green" https url doesn't show up because the cert itself isn't ...
3
votes
2answers
1k views
Internal SSL Certificates?
As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
1
vote
1answer
411 views
How do I use OpenSSL with the Java Keytool?
I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
8
votes
1answer
215 views
Why can the validity of an SSL certificate exceed the registration period of a domain?
I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
0
votes
1answer
179 views
Purpose and Uses of Root SSL Certificates
I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?).
When and ...
2
votes
1answer
130 views
Any problems with UCC (multidomain) SSL certs on iOS and Windows Phones?
Are they any known issues with UCC (multidomain) SSL certs on iOS or Windows Phone?
Let's say I want to have Exchange server under outlook.mycompany.com and RemoteApp Portal under ...
4
votes
2answers
547 views
What are the advantages of EV Certificate?
What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit?
I know that the ...
1
vote
2answers
106 views
Does Convergence solve the problem of hacked CAs?
My question is about the Firefox AddOn Convergence.
So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
5
votes
3answers
846 views
How do I check that I have a direct SSL connection to a website?
I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
7
votes
1answer
140 views
Does dnssec protect against malicious registrars?
With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).
This is especially ...
6
votes
1answer
2k views
What is the actual value of a certificate fingerprint?
In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
4
votes
4answers
322 views
Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was:
CA with RSA keys capable of signing RSA and EC CSRs
CA with ...
4
votes
7answers
894 views
What is the danger of hosting your SSL certificate yourself?
I have Active Directory Certificate Services on my server, which makes it possible for me to deliver an SSL certificate for the websites hosted on the same server.
I know that normally, I need to ...
31
votes
3answers
3k views
Are all SSL Certificates equal?
After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against.
Are all SSL ...
1
vote
2answers
154 views
SSL/TLS Certificate Authority supply policy
I would like to ask for recommendations regarding the following issue:
As a company with a number of customers worldwide we supply our product to many different sites. We need to shape our policy ...
4
votes
2answers
684 views
How does DNSSec work? Are there known limitations or issues?
Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:
DNS spoofing, especially on wifi or shared medium
Registrars that abuse their ...
2
votes
3answers
164 views
What is the worse that could happen if a government wanted to interfere with a CA?
In our time of SOPA, PIPA and ACTA, I was wondering what could happen if a government wanted to remove the certificate of a website ?
CA are companies, so they would have to obey to instructions from ...
