Certificate authorities verify the owner information of certificates by signing them.
2
votes
2answers
149 views
distribution mechanisms for CRLs
From the X.509 RFC:
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer ...
11
votes
4answers
406 views
What alternatives are there to the existing Certificate Authority system for SSL?
Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
1
vote
0answers
81 views
Why not buy cheap SSL certificates? [duplicate]
Possible Duplicate:
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
The comparison in Godaddy's website, makes it clear: they're just cheaper ...
3
votes
2answers
113 views
Why firefox shows some connections are not secure?
I am using internet by connecting mobile phone to my laptop using usb. From yesterday,my browser (firefox) shows for all most all website. Why this happen? How can i solve this?
4
votes
2answers
135 views
What is the state of the Windows Update certificate after Flame?
May 28, The Flame malware is discovered in Iran and by Kaspersky Labs.
June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
2
votes
1answer
81 views
Which .CER file format is more secure for purposes of an AIA record?
What file format is most appropriate or secure for the AIA record in a PKI certificate?
The options I'm aware of are:
DER encoded binary X.509 (.cer)
Base-64 encoded X.509 (.cer)
I also have the ...
4
votes
3answers
567 views
How is an X509 certificate signer verified?
Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is,
...
1
vote
1answer
59 views
For SSL certs, is some sort of connection to the issuing CA (or other network resource) required for the SSL connection to be established?
I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL".
Background:
I am deploying ...
4
votes
5answers
444 views
Is Spoofing a CA signed certificate possible?
I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway.
When a communication starts with a server, during the client handshake, the ...
10
votes
4answers
1k views
Are there technical disadvantages in using free ssl certificates?
Note this question is related, except this one is about free SSL certs.
There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
23
votes
9answers
1k views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
2
votes
1answer
97 views
Curious about best start for autoresponding Certificate Authority (CA)
I am just getting started trying to implement some internal PKI ideas, where my app would need a cert to 'sign' messages. Since this is all completly internal, we have some degree of trust, and I ...
5
votes
2answers
163 views
What kind of certificate do I need to be able to sign my own subdomain certificates?
We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...).
...
3
votes
4answers
2k views
How are Chrome and Firefox validating SSL Certificates?
How are Chrome and Firefox validating SSL Certificates?
Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?
10
votes
3answers
157 views
Domain name expiration and TLS
If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
1
vote
1answer
155 views
Signature and Timestamp for Long Term Document Archival Question
I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.
As far as I understand, I ...
4
votes
4answers
755 views
Can an intermediate CA be trusted like a self-signed root CA?
Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
4
votes
2answers
188 views
Is it possible to modify a CA without having to reissue all of the derived certificates?
Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I ...
-6
votes
4answers
200 views
Is TLS-in-TLS supported in any software? Does it make sense? [closed]
I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
3
votes
0answers
145 views
How secure is HTTP basic authentication over SSL? [duplicate]
Possible Duplicate:
Is BASIC-Auth secure if done over HTTPS?
I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
2
votes
2answers
82 views
Does it make sense that OCSP returns state for the signer CA itself
I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...
2
votes
1answer
854 views
SSL cert not turning green anymore
I'm running a drupal site and have asked about this issue pertaining specifically to the drupal aspect of it here. I know that the "Green" https url doesn't show up because the cert itself isn't ...
3
votes
2answers
1k views
Internal SSL Certificates?
As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
1
vote
1answer
414 views
How do I use OpenSSL with the Java Keytool?
I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
8
votes
1answer
215 views
Why can the validity of an SSL certificate exceed the registration period of a domain?
I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
0
votes
1answer
180 views
Purpose and Uses of Root SSL Certificates
I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?).
When and ...
-1
votes
2answers
227 views
Request/Creating a Code Signing Certificate
I have need for a code signing certificate which is trusted by a CA in the windows domain. How do I request/create this certificate?
Do I have to request a code signing certificate on the ...
2
votes
1answer
130 views
Any problems with UCC (multidomain) SSL certs on iOS and Windows Phones?
Are they any known issues with UCC (multidomain) SSL certs on iOS or Windows Phone?
Let's say I want to have Exchange server under outlook.mycompany.com and RemoteApp Portal under ...
3
votes
2answers
149 views
SSL Certificate Signing by a CA
Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return.
What I don't understand is what, ...
4
votes
2answers
568 views
What are the advantages of EV Certificate?
What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit?
I know that the ...
4
votes
1answer
2k views
What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?
What root certificates are/are not updated when the following checkbox is checked?
Additional questions
If I manually remove a root certificate, will this service replace that very certificate?
...
2
votes
1answer
238 views
How does DCOM authentication compare to RPC based authentication/auth?
The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM
A CA running Windows Server 2003, Enterprise Edition, ...
1
vote
3answers
435 views
What is the most secure way to do OCSP signing without creating validation loops?
I'd like to enable the most secure OCSP validation that Windows 2008 SP1 and newer support.
Based on the following information, am I required to implement id-pkix-ocsp-nocheck on my OCSP ...
1
vote
1answer
305 views
What are attribute certificates? Why would someone partition a certificate by reason codes?
In "How Certificate Revocation Works" a brief mention of Attribute Certificate and Reason Code partition is made:
If validated by a client that supports partitioned and indirect CRLs,
the IDP ...
4
votes
1answer
422 views
Can a certificate have multiple chains and multiple self-signed roots?
The following MSFT document has this paragraph:
All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed
...
8
votes
2answers
3k views
Checklist on building an Offline Root & Intermediate Certificate Authority (CA)
Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite.
Here is an image of the default cryptography settings ...
1
vote
2answers
106 views
Does Convergence solve the problem of hacked CAs?
My question is about the Firefox AddOn Convergence.
So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
6
votes
3answers
349 views
Getting started with SmartCards; what equipment do I need, what do I need to know?
I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it.
Are all SmartCard slots capable of reading and writing a blank card?
Are there compatibility ...
5
votes
3answers
853 views
How do I check that I have a direct SSL connection to a website?
I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
7
votes
1answer
140 views
Does dnssec protect against malicious registrars?
With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).
This is especially ...
6
votes
1answer
2k views
What is the actual value of a certificate fingerprint?
In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
4
votes
4answers
322 views
Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was:
CA with RSA keys capable of signing RSA and EC CSRs
CA with ...
4
votes
7answers
901 views
What is the danger of hosting your SSL certificate yourself?
I have Active Directory Certificate Services on my server, which makes it possible for me to deliver an SSL certificate for the websites hosted on the same server.
I know that normally, I need to ...
31
votes
3answers
3k views
Are all SSL Certificates equal?
After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against.
Are all SSL ...
2
votes
4answers
933 views
What web browsers support OCSP stapling? Are the privacy and performance features the same?
OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
1
vote
2answers
154 views
SSL/TLS Certificate Authority supply policy
I would like to ask for recommendations regarding the following issue:
As a company with a number of customers worldwide we supply our product to many different sites. We need to shape our policy ...
0
votes
2answers
474 views
Issuing browser certificates to Chrome and Firefox with Microsoft CA
Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval.
Since many browsers either block or don't support ActiveX controls, how can I enroll them using a ...
4
votes
2answers
685 views
How does DNSSec work? Are there known limitations or issues?
Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:
DNS spoofing, especially on wifi or shared medium
Registrars that abuse their ...
4
votes
1answer
935 views
Getting a Root CA accepted in systems and browsers
I would like to ask about the procedures for a given CA to get one of its root CAs (SSL issuance CA) to get accepted and installed as a trusted root CA in operating systems and browsers.
2
votes
3answers
164 views
What is the worse that could happen if a government wanted to interfere with a CA?
In our time of SOPA, PIPA and ACTA, I was wondering what could happen if a government wanted to remove the certificate of a website ?
CA are companies, so they would have to obey to instructions from ...
