Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

3
votes
3answers
364 views

What stops a hacker from installing it's own CA certificate?

Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following: ...Such is the case with that small company in the Netherlands, ...
1
vote
2answers
114 views

Is there any point to keeping a “Verified by X” image on the page for a page secured by SSL?

So, I saw this on a page: (The redacted part says the name of the entity that owns the domain) The page recently got SSL certs verified by GeoTrust. The image is on ...
0
votes
1answer
716 views

Problems with intermediate ssl certificates and ssl proxy

I'm currently implementing a SSL-proxy, and have run into some problems regarding certificates. We have a offline "Company Root CA", and an online "Company intermediate CA". On the proxy I have ...
2
votes
3answers
161 views

Do on-demand SSL certificates exist?

A few days ago, I visited an SSL protected website. Since Safari complained about the SSL-certificate, I did a short inspection: The certificate was issued by GoDaddy in just the minute I ...
2
votes
1answer
297 views

Different SSL states as seen by Safari, Chrome and Firefox

Today, I visited some sites of the German DHL group. While Chrome and Safari complain about an invalid certificate of Firefox accepts it. Which one is right, which one is wrong? Which decision ...
0
votes
1answer
155 views

SSL (TLS v1.2) - Can i offer fallback CAs when upgrading Certificates? (Java)

I am currently developing a product that involves two network situations. At the client side, multiple computers form a P2P network (multiple locations, multiple p2p networks), and a subset of nodes ...
4
votes
1answer
304 views

Is possible that a TLS server send more than one certificate to the client for the same site?

What I'm trying to archive is enable ECDSA and DSS ciphers in my site, but at the same time not depend just of self signed certificates, so I could sent to my client more than one certificate and them ...
10
votes
1answer
318 views

Is using a CA more secure if I'm self-signing anyway?

We have a web application that we run for clients at their booth on fairs. The communication between clients and the server was done over HTTP until recently. We're currently working on improving ...
1
vote
3answers
107 views

Where can I find all SSL CA certificates

I am working on an SSL implementation project and ofcourse I need to verify the certificate presented by the server. To do that I need CA certificates or at least root CA certificates (correct me I am ...
0
votes
1answer
91 views

SSL Auth to proxy using Certificate on Client-side

The question may need to be reworded. The server-side is set up with Squid3 acting as an Authenticating proxy by way of LDAP. I did this for testing purposes to make sure everything was working. I ...
8
votes
4answers
1k views

Are self-signed certificates actually more secure than CA signed certificates now?

Are self-signed certificates actually more secure than CA signed certificates now? I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government ...
6
votes
2answers
2k views

How to detect the NSA MITM attack on SSL?

As Bruce Schneider reported here... https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html ...the NSA reportedly performed a MITM attack on a company in brazil and decrypted their SSL ...
1
vote
2answers
93 views

SSL-certificates for overlapping domain regions?

Suppose, a server hosts https://www.master.com/ and thus is equipped with a (single domain) SSL certificate. Furthermore, suppose there are some web apps below master.com: ...
4
votes
1answer
74 views

What is the meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC from ETSI TS 102 231 V3.1.2

From Technical Spec http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC a Root Certification Authority from which a certification path can be established down to ...
3
votes
2answers
340 views

Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure?

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode. I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline ...
1
vote
5answers
1k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...
1
vote
2answers
2k views

Public Key → Certificate?

Is it possible to convert a public key to a certificate using the public key only? I've seen the following, which takes a private key to form a cert request, which can then be self-signed: openssl ...
3
votes
1answer
172 views

Remove CA from trusted CAs list while trusting it older certifications

Lets say that some certificate authority changed her security policy and we don't trust her new certifications. Is there any convenient way for an organization to remove this certificate authority ...
-1
votes
1answer
2k views

Why IE/Windows forces you to install self-signed certificates as root CA to make them work?

In old versions of IE/Windows you could install a self-signed certificate for a web site and it just worked: the warnings disappeared. In more recent versions (and with Chrome) this just didn't work. ...
5
votes
2answers
450 views

Root SSL certificates and browser support

I have given three certs to be install on nginx AddTrustExternalCARoot.crt PositiveSSLCA2.crt www_example_com.crt So I concat them into a chained cert cat www_example_com.crt PositiveSSLCA2.crt ...
1
vote
1answer
99 views

Generate CSR with 2 OU Names

I have to create an application which generates a CSR. While generating a CSR we are required to fill in several details like CN, OU, etc. The problem is that the Certifying Authority to which I have ...
3
votes
2answers
285 views

Should I customize my Root CA's thumbprint/fingerprint? (SHA1 or MD5)

My goal is to make a certificate's thumbprint "easier" to verify, and not reduce security in doing so. Given that the RSA-based Bitcoin technology has a concept called a "Vanity address" where the ...
4
votes
1answer
103 views

Are there any public examples of an encrypted attribute in a Verisign-issued certificate?

This Credentica- UProve paper describes how Verisign issues (or did issue in the past) certs with encrypted attributes: "VeriSign issues certificates that contain encrypted attributes that can be ...
6
votes
4answers
482 views

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
1
vote
1answer
973 views

Windows' default certificate store for intermediate vs trusted root certificates - my self signed root CA cert goes to 'intermediate' by default?

Is it possible to create self-signed root CA certificate that Windows will import to Trusted Root by default instead of Intemediate certificate store ? Obviously, it won't do it without the big giant ...
3
votes
3answers
319 views

Why a self-signed digital certificate (X.509) cannot be altered?

I'm not experienced in code signing but I was thinking about this: as you know, there are various tools for self-signing digital certificate generation (as makecert from Windows or OpenSSL). Now, It ...
2
votes
2answers
416 views

What to do with expired certificates as a CA?

This and this answer says that "once a certificate has expired, the CA ceases to keep track of its revocation status". I'm trying to learn how OpenSSL works as a CA. If I have a revoked expired ...
13
votes
3answers
725 views

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
3
votes
4answers
194 views

Trust among the root-CAs

The system of CAs with the root-CAs and their subordinate CAs are IMHO in principle akin to the system of banks with their main sites and subsidiries. In the case of banks, a customer of a bank ...
2
votes
3answers
502 views

Where to get/buy a CSR generated S/MIME certificate

I'm not sure if the question is eligable for this board as I ask for concrete service providers which can be kind of advertisement, but there is also technical issue involved, so I give it a try. My ...
8
votes
2answers
980 views

Obtaining an S/MIME certificate without disclosing my private key to the TTP

I would like to obtain a trusted S/MIME certificate, but all the certificate authorities I have asked so far generate the keypair on their server, sign the certificate and send me both the private key ...
-1
votes
1answer
129 views

Who can view my https browsing habbits? [closed]

I was wondering about HTTPS security and how easily is compromised. I have already read the similar threads in here, but I have some more questions: Let's say I am searching something at Google. ...
8
votes
1answer
395 views

Force a subordinate CA cert to be signed to include a the CRL distribution point extension?

How can I attach a crlDistributionPoints parameter when signing a CSR I've generated as follows: openssl req -new -key /root/ca/private/private.key -out /root/public.csr I usually sign with: ...
9
votes
4answers
331 views

How to stop/detect someone else registering a certificate for my domain

With the proliferation of low-cost automated CAs what can be done to mitigate the attack of someone doing a spear phishing attack to get a login to our webmail system, then using an automated service ...
3
votes
1answer
134 views

Design of system based on HTTPS, Client Certificates and custom CA

I have the following system: 2 application servers. At the beginning is installed the first server and later is installed the second one. A client access from a browser to both servers Application ...
10
votes
1answer
118 views

How CA ensures that a certificate request is coming from me?

To establish trusted SSL connection I need to create a certificate request. For example, if I use openSSL I can do it by the following command: openssl req -new -key privkey.pem -out cert.csr ...
5
votes
3answers
636 views

Why are Certificate Revocation List periodically renewed?

While studying a security course I have been asked this very question: Why are CRL periodically renewed, even if there are no new revoked certificates to add to the list? Honestly I can't find the ...
5
votes
3answers
349 views

Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?

Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate ...
5
votes
1answer
180 views

'Trusted CA Certificates' and 'Trusted remote Certificates'

What is the difference between Trusted CA Certificates and Trusted remote Certificates?
2
votes
1answer
258 views

Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA

I would like to ask if it is possible to use different CA for the client certificate and the web certificate? For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
6
votes
5answers
2k views

A standard way to manually add a digital signature to a pdf file?

I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
2
votes
1answer
496 views

How does an offline CA revoke certificates?

If an RSA private key of a root CA is stored offline, how does it revoke certificates it signs? From looking at OpenSSL config the default_crl_days option seems to indicate that a CRL must be ...
6
votes
3answers
909 views

What are the risks of a localhost signed cerificate?

In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections. Suppose we use this CA to sign a key for "localhost" for use in ...
2
votes
1answer
121 views

Sending Digital Certificates

I used the makecert tool in order to create: a self-signed certificate a server certificate using the self-signed certificate a client certificate using the self-signed certificate I then ...
2
votes
1answer
159 views

Security Certificates - Tools to Generate Security Certificates

I want to create a self-signed certificate that will be installed as a trusted certificate authority. I then want to create another two certificates which are signed using the private key of the ...
14
votes
1answer
5k views

Configure SSL Mutual (Two-way) Authentication

A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
1
vote
1answer
2k views

The request was aborted: Could not create SSL/TLS secure channel Exception

Let me explain my situation. I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC. I then created two certificates using the self-signed ...
1
vote
1answer
140 views

are organizations that receive certificates considered “end entities” in a PKI?

I am trying to understand the term end-entity. Does this term just mean anybody that plays a role in a PKI system that is not a CA? So if I request a certificate from A who is a CRL issuer for ...
3
votes
1answer
1k views

Creation and deployment of self-signed certificates for a two-machine scenario

Let us assume that I have two computers: client server Now, in the server computer, I set up a legacy ASMX web service which will going to be used by the client. Before the client can connect to ...
11
votes
2answers
789 views

What does having an internal two-tier PKI protect against?

There are a lot of Best Practice documents that recommend having an offline Root CA and an Enterprise Subordinate CA that is signed by the root, for an internal Microsoft AD Certificate Services ...