Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

6
votes
5answers
276 views

Why are private certificates not trusted?

When we go to websites that have generated certificates themselves you see this red screen that says do not go there!: However when it is trusted by some companies it's all good. So I have a couple ...
6
votes
2answers
2k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
6
votes
1answer
2k views

Getting a Root CA accepted in systems and browsers

I would like to ask about the procedures for a given CA to get one of its root CAs (SSL issuance CA) to get accepted and installed as a trusted root CA in operating systems and browsers.
6
votes
2answers
3k views

How to detect the NSA MITM attack on SSL?

As Bruce Schneider reported here... https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html ...the NSA reportedly performed a MITM attack on a company in brazil and decrypted their SSL ...
6
votes
3answers
1k views

What are the risks of a localhost signed cerificate?

In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections. Suppose we use this CA to sign a key for "localhost" for use in ...
6
votes
3answers
341 views

On-line cryptographically signed date/time?

I’m looking for a source of on-line cryptographically signed date/time. I do not need a full timestamp service, as I am happy with the information « date/time was that », without a link to a ...
6
votes
4answers
673 views

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
6
votes
2answers
369 views

What kind of certificate do I need to be able to sign my own subdomain certificates?

We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...). ...
6
votes
1answer
435 views

Browsers silently adding trusted root certificates in Windows

When accessing https://internetbanking.caixa.gov.br (site of a well known bank in Brazil), the server returns a certificate signed by "Autoridade Certificadora Raiz Brasileira" (Brazilian Root ...
5
votes
6answers
1k views

Should the bit-strength selection of a child certificate be influenced by the CA or the chain?

All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
5
votes
5answers
2k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
5
votes
3answers
3k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
5
votes
4answers
2k views

Can an intermediate CA be trusted like a self-signed root CA?

Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
5
votes
3answers
158 views

Guarding against rogue certificates

There has been a lot of news recently about certificates being falsely issued (due to the issuing authority having poor system security!). Apparently the targeted users were mostly Iranians, but it's ...
5
votes
4answers
1k views

Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)

I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was: CA with RSA keys capable of signing RSA and EC CSRs CA with ...
5
votes
3answers
887 views

Why are Certificate Revocation List periodically renewed?

While studying a security course I have been asked this very question: Why are CRL periodically renewed, even if there are no new revoked certificates to add to the list? Honestly I can't find the ...
5
votes
3answers
387 views

Issuing SSL certificates for device automation software package without domain names

We are developing the automation software for Windows which communicates with the certain devices via our own private connection protocol. That software package consists of several server (including ...
5
votes
3answers
3k views

How is an X509 certificate signer verified?

Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is, ...
5
votes
2answers
626 views

Root SSL certificates and browser support

I have given three certs to be install on nginx AddTrustExternalCARoot.crt PositiveSSLCA2.crt www_example_com.crt So I concat them into a chained cert cat www_example_com.crt PositiveSSLCA2.crt ...
5
votes
3answers
475 views

Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?

Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate ...
5
votes
1answer
229 views

'Trusted CA Certificates' and 'Trusted remote Certificates'

What is the difference between Trusted CA Certificates and Trusted remote Certificates?
5
votes
1answer
370 views

Certification authority only for certain domains

Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
5
votes
2answers
2k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
5
votes
2answers
1k views

What tools exist to help me monitor OCSP certificate validation failures?

The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online ...
5
votes
1answer
176 views

Security and authentication problem

We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes. First of all, lets imagine a real world scenario: Imagine that a user ...
5
votes
3answers
253 views

What is a reasonable expiry for user authentication certificates?

This question is about a nearly decentralized P2P system with a centralized certificate authority where users can authenticate and receive a certificate on their public key and then can authenticate ...
5
votes
1answer
3k views

What damage could be done if a malicious certificate had an identical “Subject Key Identifier”?

I'm looking at the the Subject Key Identifier attribute of a CA certificate and am trying to understand the role it plays in validation and infer how validating client software could get it wrong. ...
5
votes
1answer
564 views

google certificates correct CA [closed]

I view certificates of https://www.google.com.ua/ So I thought, when requesting via cURL, if I point by CURLOPT_CAINFO to those certificates (GeoTrust Global CA and Google Internet Authority G2 in ...
5
votes
1answer
8k views

What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?

What root certificates are/are not updated when the following checkbox is checked? Additional questions If I manually remove a root certificate, will this service replace that very certificate? ...
4
votes
3answers
271 views

Are SSL certificates from a CA necessary for secure communication?

Am I right in thinking that SSL certificates from a CA are purely for identification purposes and serve no purpose in the actual encryption of data? In other words if I were to create a self signed ...
4
votes
4answers
2k views

Is it possible to create a self signed certificate authority?

Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious. To explain my question : Suppose I sign a public ...
4
votes
2answers
5k views

Internal SSL Certificates?

As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
4
votes
2answers
3k views

What is an intermediate certificate authority?

What is meant by an "intermediate certificate authority?"
4
votes
2answers
282 views

When you buy a certificate, does the certificate authority have (a copy of) the private key?

I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this: You generate a public and private key pair From this key pair you generate a ...
4
votes
1answer
371 views

Who is this strangely named Certificate Authority?

I'm researching certificate authorities, and I just have no idea what to think of the CA named x00Ax00-x00Tx00rx00ux00sx00tx00 x00Gx00ex00sx00.x00 x00fx00xFCx00rx00 ...
4
votes
1answer
722 views

OCSP: What is “hackedirl.files.wordpress.com”?

After I ticked that my browser (Firefox) must require OCSP: http://i.stack.imgur.com/UeDXh.png I got a window popped up (several times! And it still pops up.. ~randomly ~about a few 10 minutes): ...
4
votes
3answers
204 views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
4
votes
1answer
385 views

Is possible that a TLS server send more than one certificate to the client for the same site?

What I'm trying to archive is enable ECDSA and DSS ciphers in my site, but at the same time not depend just of self signed certificates, so I could sent to my client more than one certificate and them ...
4
votes
2answers
367 views

What is the severity of a fake certificate?

I'm not a security specialist, thus reading this Google Blog post about a fake *.google.com certificate, raises a lot of concerns, if anyone can impersonate a website, especially a google website, my ...
4
votes
2answers
167 views

What is the state of the Windows Update certificate after Flame?

May 28, The Flame malware is discovered in Iran and by Kaspersky Labs. June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
4
votes
3answers
140 views

From a trust perspective, is renewing a CA certificate the same as trusting a sub-CA?

I'm trying to understand the validation logic that would occur in the following hypothetical scenario An unpatched XP user who trusts a list of root CAs. Those CAs in particular have been renewed ...
4
votes
2answers
177 views

Is authorisation with token secure?

I have a general security question: Let's say there is a client-server application with authorisation by login and password using a secure connection between server and client (https). User can have ...
4
votes
2answers
604 views

How practical is a certificate's “basic constraint” property in protecting my HTTPS / SSL session?

Suppose a leaf node creates a certificate for a different domain, acting as a CA. Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be ...
4
votes
1answer
474 views

Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA

I would like to ask if it is possible to use different CA for the client certificate and the web certificate? For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
4
votes
1answer
592 views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is ...
4
votes
3answers
509 views

Why are SSL certificates valid only from a certain date?

Each SSL certificate is valid starting from a specific date and up to the expiration date. What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
4
votes
2answers
2k views

Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?

Suppose I have several independent PKIs that are used Two internal PKIs: One with SHA1 support the other with Suite B algorithms. A partner who I trust and have a policy map with. Since both my ...
4
votes
1answer
1k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...
4
votes
2answers
676 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
4
votes
1answer
370 views

Any non-commercial certificate authority issuer for web applications?

Is there any non-commercial certificate authority capable of issuing valid certificates for web applications? I mean, the certificate must be accepted by browsers, like those of commercial CAs?