A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

0
votes
2answers
122 views

How In-House Certificate Authority works (e.g. EJBCA)

I have a simple (dumb?) question with respect to EJBCA. I have been exploring how In-house CAs work and issue certificates. However, I am not able to understand who will be trusted on the top level in ...
6
votes
2answers
862 views

How does an attack on a digital signature work?

In our IT Security class we have been told that you need CA's to prevent attacks on a digital signature. Sadly, our docent didn't elaborate how such attack would be performed - I can only guess that ...
0
votes
1answer
71 views

What is the difference between a certificate, a signature and a thumbprint in case of windows exe/binaries?

I am trying to understand the difference between signature , thumbprint and certificate in context of windows executable and binaries. I looked up on internet before posting this question but I did ...
1
vote
2answers
76 views

Reissuing certificates with SHA-2

I recently setup my own CA, and imported the CA cert into devices across the company. I then deployed certificates to our various servers, etc.. All using SHA-1 signatures (the default in the tool I ...
1
vote
1answer
132 views

TinyCA missing CRL information in root and leaf certificates

I setup a new CA using TinyCA. When creating the CA i used an internal host name for the crl url exactly as follows: http://myserver.com/crl.pem And I have exported the CRL to that location, and I ...
1
vote
0answers
50 views

How Do I Create a Production Client Authentication Certificate for Azure Key Vault?

I am learning about Azure Key Vault, and one of the scenarios it supports is certificate authentication, which you can read about here. The samples do a great job of explaining how to make a self-...
82
votes
4answers
11k views

What prevents me from buying a SSL certificate for a domain I don't control?

Can I simply build a webserver, make its hostname "google.com", create a CSR off that server, and send that to a Certificate Authority for signing? Let's say I pick the cheapest and dodgiest outfit I ...
1
vote
1answer
156 views

What does browser do when it queries xxx.example.com and it gets a certificate for yyy.example.com(top level domain is same)?

The question is actually about what level of validations browser does when it gets certificates of some other domains like case 1: Accessing abc.google.com and got def.google.com case 2: Accessing *....
3
votes
2answers
119 views

When should I renew certification authority?

What is best practice in renewing certification authorities? I mean when should I renew certification authority? For example, suppose I have the following setup: 1. Root CA with validity of 30 years ...
0
votes
0answers
35 views

How do the eduroam WPA-Enterprise 802.1X certificates look like?

As outlined in another answer, the official eduroam WiFi profiles available from https://cat.eduroam.org/ (verified for uWaterloo and uOttawa), as well as sample official instructions of the ...
-1
votes
1answer
39 views

SSL cert and region performance [closed]

I was asked to find the best available SSL cert for deploying a global solution in which performance is critical. But... does it really matter who is going to be the CA? AFAIK (never set up SSL ...
1
vote
1answer
122 views

What can a trusted certificate do?

I am doing some reading about security on mobile applications because I found an article about Man in the Middle Attacks. I saw in that article and in many other places (including security....
19
votes
7answers
5k views

Why are self signed certificates not trusted and is there a way to make them trusted?

I have locally made a Root CA certificate. I used the CA cert to sign the IA cert and used the IA cert to sign the server certificate. When I try to access the local server which uses the server ...
4
votes
1answer
97 views

Should my company change the internal Root CA hash method from SHA-1 to SHA-2?

My company have a Root Certificate Authority which is installed on a Windows Server 2003 and uses SHA-1 as hash method. We will migrate to Windows Server 2012. Checking the root certificates of my ...
3
votes
2answers
49 views

Question about SSL certificate and third party server

I have a system which consume web-services from a public server on Internet (but the data are not public) I have to provide credentials in Basic Auth to get the data, that is why we use SSL. The ...
2
votes
0answers
84 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
1
vote
1answer
103 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
3
votes
1answer
83 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
4
votes
3answers
195 views

Why are root certificate authorites allowed to issue certficates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
0
votes
2answers
44 views

How to avoid writing .pem while signing a csr?

I am using following command to sign a certificate, openssl ca \ -in client.csr \ -keyfile server.key \ -cert server.crt \ -outdir ./some_dir \ ...
0
votes
0answers
57 views

Validation client certificate for site in iis

Input: I send client certificate to client. He uses it to work with my web application which works in IIS. I installed CA certificate (which was used to create client certificate) on web server. AFAIK ...
7
votes
3answers
329 views

what do you do when an ssl certificate expires and your app uses ssl pinning?

I originally posted this question on StackOverflow, but reposted here due to lack of responses. I am trying to decide if it's a good idea to do ssl pinning in my iOS game that uses a server to ...
1
vote
0answers
53 views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...
2
votes
2answers
133 views

Self-signed cert - how it works

I am new to SSL / digital certificates / signatures. What I know is that a digital signature must be verified/decrypted using the public key. So a cert that is signed by a CA must be verified/...
0
votes
2answers
129 views

SSL digital certificate process - high level

I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database. In this case, I have an web server and needs to implement SSL ...
0
votes
1answer
115 views

Mutual Authentication and Authorisation with Certificates from various CAs

Edit: Having read this question and answer I have a bit more of an understanding. My question now then, is: can I use a certificate that a user has had signed by a registered CA such as VeriSign, ...
0
votes
2answers
322 views

How does a Certificate Private Key get transferred on import / export?

I am fairly new to certificates in general and have setup my own standalone CA for testing purposes. I have noticed some interesting behavior of private keys which I'm trying to find some ...
3
votes
1answer
127 views

Why would Amazon include an already trusted Root CA in the bug report they filed to get into Mozilla's truststore?

Amazon will soon be a trusted Root CA. To this end Mozilla Bug #1172401 was filed a while back to get into Mozilla's trust store. Along with 4 of their own Root CAs they've included a fifth one (...
1
vote
2answers
136 views

Why/when would a CA make a generated public key available to the public at large?

I'm confused about this section in my CEH security exam training material: A CA is able to perform a number of roles in addition to the validation process outlined here. Some actions that a CA is ...
5
votes
1answer
114 views

Securely build a list of trusted CAs

Some distributions of the cURL bundle include a utility mk-ca-bundle.pl which compiles a ca-bundle.crt from Mozilla's root certificate store for use as a list of trusted authorities. The script prints ...
2
votes
1answer
112 views

How does Windows certificate manager verify a file's certificate, if the root certificate is not in the store?

I'm working on a project which requires certificate verification for executable files. I have created my own trusted root certificate store, and used openssl to perform verification. However, when I ...
2
votes
2answers
66 views

Why not to use the same subordinate issuer CA for generating certificates that will be used for different things?

Microsoft has recommended my organization to use different subordinate issuer CAs in order to issue certificates that will be used for different things. For example, they recommend to use a CA for ...
11
votes
3answers
199 views

Why is Firefox shipped with expired root certificates?

What's the purpose of shipping Firefox with expired root certs? I checked and there are two expired certs listed. In fact the company's website for the first expired cert (A-Trust) states that the ...
15
votes
2answers
557 views

How much of a problem is it that Windows “hides” some of the trusted root CA certs?

Based on information on this page, Windows actually trusts many more root CA certificates than what are displayed when a user launches certmgr.msc and navigates to Trusted Root Certification ...
3
votes
1answer
98 views

Designing a PKI environment

For our company I was given the task to design a durable, structured PKI environment for mainly client authentication purposes. We need a Root CA with a couple of Intermediate CAs, like this: ...
13
votes
3answers
1k views

Should I be concerned that Google no longer trusts specific Symantec root CA cert that is also on my Windows system?

This is related to this other question which refers to Google moving to distrust the "Class 3 Public Primary CA" root certificate operated by Symantec Corporation, across Chrome, Android, and Google ...
5
votes
2answers
184 views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
3
votes
0answers
71 views

How does a Sign tool work?

My basic understanding about sign tool is: 1.It loads the zipfile(may be exe,jar,ddl,apk..) which has to be signed to its memory(cache memory of the sign tool). 2.It will verify it, and unzip the ...
8
votes
2answers
599 views

How do user receive server's certificate?

Let's imagine our user's computer wants to talk to some server for the first time in history via https. The computer sends a hello message, the server sends his public key and the certificate, ...
6
votes
2answers
246 views

Why do Symantec not believe their customers will be affected by Google distrusting this root certificate?

So Google will be moving to distrust the “Class 3 Public Primary CA” root certificate operated by Symantec Corporation, across Chrome, Android, and Google products, because it is no longer going to ...
1
vote
2answers
104 views

Verification of client certificates

I've read a lot of articles about client certificates. Please correct me if I'm wrong: client certificates are issued using CA CA could be created by myself (self-signed) or bought client ...
3
votes
1answer
113 views

TLS - How to know a CRL URL is not changed

If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be ...
0
votes
2answers
140 views

Why can you not trust a certificate directly?

If you want to set up a service that is signed using some Certificate Authority system (SSL/TLS, certain configurations of IKE, etc), if you want to use a self-signed certificate (e.g., for testing), ...
6
votes
1answer
69 views

Why does the issuance speed of a CA depend on the number of certs they have already issued?

I have seen proprietary testing results of pummelling a CA for a long time and measuring its throughput (certs issued / second). It was found that CAs become slower to issue new certificates as the ...
2
votes
1answer
131 views

What, or who, exactly is a Certificate Authority (CA) for TPM attestation?

I'm learning about and researching the Trusted Platform Module (TPM) to incorporate into a solution involving remote machines. As I understand it: all attestation methods (AIK, DAA) still require ...
4
votes
1answer
134 views

Issuing and managing large numbers of certificates for client authentication

I am developing an Internet of Things product and plan to use client certificate authentication, issuing each "thing" its own certificate on the production line so that it may authenticate with a ...
0
votes
0answers
35 views

PKI, one sub CA for each certificate type VS one for all the certificates type

I'm trying to set a PKI where I can find 3 types of certificates: A client certificate to use in HTTPS communications A web server certificate to use in HTTPS communication A VPN certificate to use ...
13
votes
1answer
1k views

How secure is “Let's Encrypt”?

I just configured and installed a free SSL certificate from Let's Encrypt. It's great, and very easy to set up. However in this post-Snowden era, I was wondering how secure this really is. For ...
13
votes
4answers
1k views

How do certificate issuers become trusted?

From what I understand, the certificate scheme that TLS/SSL relies on works because your computer has trust for major CA issuers built into it. That is, your OS is installed with certificates for ...
1
vote
1answer
93 views

How to read certificate chains in OpenSSL

I'm trying to understand how to read the output of OpenSSL commands. Currently, I am trying to understand how Certificate Chains work. When I give the command (using a standard ca bundle) openssl ...