A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

2
votes
1answer
20 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
8
votes
1answer
15k views

SSL certificate chain verification

After reading many articles and watching many tutorials I decided to be specific because there are some things about SSL certificate chain verification and SSL cetificate verification in general that ...
2
votes
0answers
8 views

Signtool validation fails when signing and validating are done in different machines

I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
4
votes
2answers
14k views

How to go about an ssl certificate renewal

I've got an ssl certificate from godaddy, and it's time to renew. I ended up with a single "keystore" file, which I give to my webserver (jetty). This is the process I went through to generate the ...
11
votes
2answers
1k views

Is StartSSL.com a trustworthy site? [closed]

I just got the following email: Dear StartCom customers, This electronic mail message was created by StartCom's Administration Personnel: StartCom, a leading global Certificate ...
6
votes
2answers
1k views

Root SSL certificates and browser support

I have given three certs to be install on nginx AddTrustExternalCARoot.crt PositiveSSLCA2.crt www_example_com.crt So I concat them into a chained cert cat www_example_com.crt PositiveSSLCA2.crt ...
31
votes
4answers
13k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
18
votes
5answers
2k views

Who is responsible for revoking a certificate?

The CA issues certificates to clients/servers. Whenever a request is made by the client/server, the certificate is used to verify the identity. Now, if a certificate needs to be revoked then who does ...
0
votes
0answers
28 views

Generating a cert for use to digitally sign an email

I am having some issues generating certs, past a certain point. So far, I have done the following to generate a CSR, and have obtained an intermediate cert from the provider, and another CRT file. I ...
2
votes
2answers
43 views

CA Certificate Lifecycle

I'm planning to implement a new PKI with 2 tiers of CAs. I'll have end entity certificates with a lifetime of up to 5 years. This means my Issuing CA should be valid for 10 years, in order to be able ...
7
votes
3answers
336 views

what do you do when an ssl certificate expires and your app uses ssl pinning?

I originally posted this question on StackOverflow, but reposted here due to lack of responses. I am trying to decide if it's a good idea to do ssl pinning in my iOS game that uses a server to ...
0
votes
0answers
23 views

Weird connection error prompts, Rootkits & MitM?

Can someone give me insight on these connection error prompts? https://imgur.com/a/FEHJj My internet kept reconnecting two weeks ago and I couldn't access the internet until I performed a hard reset ...
6
votes
1answer
119 views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
1
vote
1answer
99 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
4
votes
2answers
4k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
16
votes
3answers
596 views

What email addresses are treated as trusted?

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider ...
3
votes
2answers
103 views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
12
votes
4answers
9k views

Do I really need all these Certificate Authorities in my browser or in my keychain?

There are lots of strange looking Certificate Authorities in my keychain as well as Firefox. I am sure they are legitimate CAs (as they are the same on my Mac and PC and other computers I checked). ...
2
votes
1answer
104 views

Strange CA certificate prompt

My network went down for a minute today, then this window popped up: Can someone here clarify this for me? I was using firefox. I had google, youtube and outlook open. My name isn't even close to ...
1
vote
1answer
103 views

Why is CAcert not trusted by my browser?

I am fairly new to encryption and SSL. Today I googled a bit (read some atricles about security) and encountered the site https://cacert.org. I clicked it and was surprised. Chrome showed me a "not ...
107
votes
14answers
29k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
0
votes
2answers
333 views

How does a Certificate Private Key get transferred on import / export?

I am fairly new to certificates in general and have setup my own standalone CA for testing purposes. I have noticed some interesting behavior of private keys which I'm trying to find some ...
0
votes
2answers
289 views

Creating root CA to issue certificates programatically

I have to generate a self signed root CA and use it to issue to certificates programatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
1
vote
1answer
32 views

Man in the middle with certificate signed by known CA and DNS spoofing can work?

Assuming that I have a certificate for my local webserver signed by a well known CA like Verisign (so it will be trusted by browsers), and I'm able to DNS poisoning in Man-in-the-Middle to redirect a ...
0
votes
1answer
44 views

SSL certificate for server authentication

to clear my understandings: I create self signed certificate first keytool -genkey -alias mysign -keyalg RSA -keystore mykeystorename.jks the firstname of the self sign has to be my domain name? ...
-3
votes
0answers
25 views

Certification authority [duplicate]

A. Because there are multiple certificate authorities (CAs) for the Web PKI it is possible to buy multiple certificates for the same domain signed by different CAs. How would a browser treat these ...
0
votes
0answers
34 views

Should CAs refrain from declaring HSTS policies that cover CRL hosts?

CRLs are usually not served over HTTPS, which makes sense. Further, according to this related answer, some clients may refuse to follow HTTPS URLs when validating certificates. Now, suppose a ...
0
votes
1answer
27 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
2
votes
1answer
71 views

Can a DNS “route” change cause an SSL certificate error?

What I mean by "route change": As a working example, mysite.example.net is set up as: mysite.example.net. 3600 IN CNAME some-other-site.elsewhere.com. some-other-site.elsewhere....
8
votes
2answers
11k views

What damage could be done if a malicious certificate had an identical “Subject Key Identifier”?

I'm looking at the the Subject Key Identifier attribute of a CA certificate and am trying to understand the role it plays in validation and infer how validating client software could get it wrong. ...
18
votes
2answers
900 views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
3
votes
0answers
57 views

How to use openssl ca with prime256v1?

I am new on encryptation world, and reading about this, mostly websites say to use the prime256v1 for better performance and security. After some days testing, finally I get my openssl CA structure ...
11
votes
3answers
34k views
3
votes
1answer
396 views

How to generate keystore for root signed certificate?

I need to create keystore and truststore with root signed certificates. I have these files (at this step they are identical for client and for server): client_cert.pem client_prv_key.pem root_cert....
1
vote
1answer
83 views

Is or was it possible to register a wildcard certificate to third level subdomain?

The use of a null byte in a certificate cn is very well known… and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of ...
0
votes
1answer
63 views

Creating self-signed certificate for localhost and trusting fully

As an accompanyment to a web application we plan to have a node application running as a windows service running on the client computer. This will run a small web server which will listen on port XXXX ...
4
votes
2answers
73 views

Trusting the “subject” of an x509 certificate

A bit of background. Our organization is working on a document format that will be ingested by our software. We're using the CMS format to verify the integrity (by validating the signature). The CMS ...
1
vote
1answer
164 views

Letsencrypt not valid in Firefox or PHP, but valid in Chromium

I just moved one of my websites to https, using Letsencrypt. I am using Linux, and my Chromium correctly verifies website certificate, but Firefox shows it as invalid. I also have an API on the ...
28
votes
4answers
41k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
7
votes
4answers
6k views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
5
votes
1answer
82 views

Why are short-lived certificates so rare?

Let's encrypt recently left beta and limits the maximal life-time of certificates to 90 days and recommends 60 days. Now whenever I start talking about the issues of certificate revocation (e.g. OCSP ...
3
votes
0answers
83 views

SSL certificate and price difference [closed]

After reading this discussion, Why are there very expensive and cheap SSL same type certificates? I surfed over the internet “Symantec Secure Site Pro with EV SSL Certificates”. I found something ...
15
votes
5answers
2k views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
1
vote
1answer
47 views

How is PKCS#10 and x509 related?

I'm unable to make sense of them using the RFCs. Can anyone help? When I use this function, http://www.pyopenssl.org/en/stable/api/crypto.html#x509req-objects , am I creating a PKCS#10 format CSR?
1
vote
1answer
67 views

How to determine effective trust chain for cert on MacOS X?

I'm seeing some curious issues with cert verification for an Issuer: Entrust - L1K cert that was issued and is in use (per inspection of the cert in Chrome and Firefox) for an internal site here. I ...
1
vote
0answers
32 views

How to provide our customers ability to self service client certificate creation?

We have an API for B2B customers to access our platform. We require each B2B customer to have a client certificate. This is not the URL SSL certificate (https). The CN of each customer's client ...
3
votes
1answer
43 views

SHA 1 no impact to root certificate

I ran a scan on a server and the results of the authentication for digital certificate was as follows : Certificate 1 (root) signature algorithm: Sha256withRSA Certificate 2 (chain of trust) ...
72
votes
4answers
28k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
4
votes
2answers
45 views

What is the difference between Digital certification revocation and retiring?

Certificate management tools use options called revocation and retiring digital certificates.Can someone explain what is the difference between both?
1
vote
1answer
36 views

which the field represents digital signature value of CA in a certificate?

Normally CA signs the certificate with its private key and produces digital signature of it.The digital signature value will be displayed in certificate. My question is what is the field name that ...