Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

8
votes
1answer
506 views

How can a domain be impersonated with a fraudulent SSL certificate?

I was reading this article about the fraudulent certificates from Comodo back in 2011. It talks about domain impersonation. I understand that a fake website could be secured with the fraudulent ...
8
votes
5answers
2k views

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
8
votes
3answers
2k views

What are the risks of a localhost signed cerificate?

In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections. Suppose we use this CA to sign a key for "localhost" for use in ...
8
votes
1answer
1k views

Moving from a one tier to a two tier Microsoft Certificate Authority hierachy

Right now we have a single Microsoft Enterprise Root CA which issues certificates to our VPN users for two factor authentication. We're planning to extend use of the CA to issue certificates for RDP ...
8
votes
2answers
628 views

What happens when certificates further up the chain expires before mine? (Equifax/GeoTrust)

I just bought a certificate from RapidSSL. Looking up the chain, I found GeoTrust who is signed by Equifax. Then I realized that the ”Equifax Secure Certificate Authority” is due to expire on ...
8
votes
1answer
685 views

Force a subordinate CA cert to be signed to include a the CRL distribution point extension?

How can I attach a crlDistributionPoints parameter when signing a CSR I've generated as follows: openssl req -new -key /root/ca/private/private.key -out /root/public.csr I usually sign with: ...
7
votes
7answers
3k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
7
votes
4answers
3k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
7
votes
2answers
767 views

security of PKI, Certificates, certificate authorities, forward secrecy

I want to understand how certificates add to the security of information exchange. Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
7
votes
2answers
3k views

How to detect the NSA MITM attack on SSL?

As Bruce Schneider reported here... https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html ...the NSA reportedly performed a MITM attack on a company in brazil and decrypted their SSL ...
7
votes
2answers
438 views

How can we revoke all ssl certificates issued for our domain?

After having the hostmaster@domain.com email compromised, we found that someone issued a Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked. Is there ...
7
votes
2answers
521 views

What kind of certificate do I need to be able to sign my own subdomain certificates?

We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...). ...
7
votes
1answer
211 views

Does dnssec protect against malicious registrars?

With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked). This is especially ...
7
votes
3answers
246 views

Limiting the root certificate chain

I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
7
votes
3answers
1k views

Getting started with SmartCards; what equipment do I need, what do I need to know?

I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it. Are all SmartCard slots capable of reading and writing a blank card? Are there compatibility ...
7
votes
1answer
4k views

Do I really need all these Certificate Authorities in my browser or in my keychain?

There are lots of strange looking Certificate Authorities in my keychain as well as Firefox. I am sure they are legitimate CAs (as they are the same on my Mac and PC and other computers I checked). ...
7
votes
1answer
745 views

TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error

Late last year the CA/Browser Forum decided to limit the maximum valid term of TLS/SSL certificates issued after 1 April 2015. After this time, as the official guidelines put it.. CAs SHALL NOT ...
6
votes
7answers
5k views

What is the danger of hosting your SSL certificate yourself?

I have Active Directory Certificate Services on my server, which makes it possible for me to deliver an SSL certificate for the websites hosted on the same server. I know that normally, I need to ...
6
votes
4answers
3k views

Can an intermediate CA be trusted like a self-signed root CA?

Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
6
votes
2answers
8k views

Internal SSL Certificates?

As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
6
votes
5answers
331 views

Why are private certificates not trusted?

When we go to websites that have generated certificates themselves you see this red screen that says do not go there!: However when it is trusted by some companies it's all good. So I have a couple ...
6
votes
2answers
463 views

When you buy a certificate, does the certificate authority have (a copy of) the private key?

I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this: You generate a public and private key pair From this key pair you generate a ...
6
votes
1answer
4k views

Getting a Root CA accepted in systems and browsers

I would like to ask about the procedures for a given CA to get one of its root CAs (SSL issuance CA) to get accepted and installed as a trusted root CA in operating systems and browsers.
6
votes
4answers
2k views

Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)

I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was: CA with RSA keys capable of signing RSA and EC CSRs CA with ...
6
votes
3answers
382 views

On-line cryptographically signed date/time?

I’m looking for a source of on-line cryptographically signed date/time. I do not need a full timestamp service, as I am happy with the information « date/time was that », without a link to a ...
6
votes
3answers
5k views

How is an X509 certificate signer verified?

Lets say I create a self-signed X509 certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question ...
6
votes
2answers
4k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
6
votes
2answers
453 views

Where are the anonymous/private domain validation SSL certs?

I have yet to find a CA that doesn't require personal information for DV certificates. Is this because all of the major browsers and operating systems have a policy to reject CAs that don't require ...
6
votes
1answer
642 views

Browsers silently adding trusted root certificates in Windows

When accessing https://internetbanking.caixa.gov.br (site of a well known bank in Brazil), the server returns a certificate signed by "Autoridade Certificadora Raiz Brasileira" (Brazilian Root ...
5
votes
6answers
1k views

Should the bit-strength selection of a child certificate be influenced by the CA or the chain?

All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
5
votes
3answers
5k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
5
votes
1answer
21k views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
5
votes
3answers
160 views

Guarding against rogue certificates

There has been a lot of news recently about certificates being falsely issued (due to the issuing authority having poor system security!). Apparently the targeted users were mostly Iranians, but it's ...
5
votes
3answers
4k views

How trustable are third party root certificates?

I recently tried to use Fiddler2 from a third-party vendor Telerik. While decrypting the HTTPS traffic of my network, it asked me to install its own root certificate in my Windows operating system: ...
5
votes
3answers
304 views

Risk in buying an SSL cert from a not well-known party

Let's say I know a guy is selling an SSL cert at a very low price, assume they will generate a real and valid cert for me, since I need to submit my CSR to them and they pass to the CA, are there any ...
5
votes
1answer
12k views

How can you check the installed Certificate Authority in windows 7/8?

And know which are not default ones installed by Microsoft?
5
votes
1answer
4k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
5
votes
3answers
2k views

Why are Certificate Revocation List periodically renewed?

While studying a security course I have been asked this very question: Why are CRL periodically renewed, even if there are no new revoked certificates to add to the list? Honestly I can't find the ...
5
votes
2answers
886 views

Root SSL certificates and browser support

I have given three certs to be install on nginx AddTrustExternalCARoot.crt PositiveSSLCA2.crt www_example_com.crt So I concat them into a chained cert cat www_example_com.crt PositiveSSLCA2.crt ...
5
votes
3answers
882 views

Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?

Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate ...
5
votes
1answer
919 views

Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA

I would like to ask if it is possible to use different CA for the client certificate and the web certificate? For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
5
votes
3answers
590 views

Issuing SSL certificates for device automation software package without domain names

We are developing the automation software for Windows which communicates with the certain devices via our own private connection protocol. That software package consists of several server (including ...
5
votes
2answers
327 views

Why firefox shows some connections are not secure?

I am using internet by connecting mobile phone to my laptop using usb. From yesterday,my browser (firefox) shows for all most all website. Why this happen? How can i solve this?
5
votes
1answer
6k views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is ...
5
votes
1answer
185 views

Design of system based on HTTPS, Client Certificates and custom CA

I have the following system: 2 application servers. At the beginning is installed the first server and later is installed the second one. A client access from a browser to both servers Application ...
5
votes
1answer
356 views

'Trusted CA Certificates' and 'Trusted remote Certificates'

What is the difference between Trusted CA Certificates and Trusted remote Certificates?
5
votes
1answer
640 views

Certification authority only for certain domains

Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
5
votes
1answer
5k views

What damage could be done if a malicious certificate had an identical “Subject Key Identifier”?

I'm looking at the the Subject Key Identifier attribute of a CA certificate and am trying to understand the role it plays in validation and infer how validating client software could get it wrong. ...
5
votes
2answers
3k views

Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?

Suppose I have several independent PKIs that are used Two internal PKIs: One with SHA1 support the other with Suite B algorithms. A partner who I trust and have a policy map with. Since both my ...
5
votes
1answer
2k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...