Certificate authorities verify the owner information of certificates by signing them.
4
votes
2answers
135 views
What is the severity of a fake certificate?
I'm not a security specialist, thus reading this Google Blog post about a fake *.google.com certificate, raises a lot of concerns, if anyone can impersonate a website, especially a google website, my ...
4
votes
2answers
135 views
What is the state of the Windows Update certificate after Flame?
May 28, The Flame malware is discovered in Iran and by Kaspersky Labs.
June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
4
votes
4answers
734 views
Can an intermediate CA be trusted like a self-signed root CA?
Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
4
votes
3answers
116 views
Issuing SSL certificates for device automation software package without domain names
We are developing the automation software for Windows which communicates with the certain devices via our own private connection protocol. That software package consists of several server (including ...
4
votes
1answer
415 views
Can a certificate have multiple chains and multiple self-signed roots?
The following MSFT document has this paragraph:
All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed
...
4
votes
4answers
318 views
Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was:
CA with RSA keys capable of signing RSA and EC CSRs
CA with ...
4
votes
2answers
431 views
Is there any research on which SSL certificate authority has the best browser compatibility
We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
4
votes
2answers
185 views
Is it possible to modify a CA without having to reissue all of the derived certificates?
Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I ...
4
votes
2answers
71 views
Using SSL Certification in Multiple Locations
I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access.
The ...
4
votes
1answer
101 views
For a desktop application, why use an SSL certificate from a trusted authority?
When a web browser connects to a server and downloads an SSL certificate, a third-party trusted authority ensures that the client is talking to the host that it's looking for. If the host uses a ...
4
votes
1answer
462 views
AIA/CRL locations for Offline Root
I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building
It's an ...
4
votes
2answers
500 views
What are the advantages of EV Certificate?
What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit?
I know that the ...
4
votes
1answer
2k views
What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?
What root certificates are/are not updated when the following checkbox is checked?
Additional questions
If I manually remove a root certificate, will this service replace that very certificate?
...
3
votes
2answers
1k views
Internal SSL Certificates?
As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
3
votes
2answers
148 views
SSL Certificate Signing by a CA
Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return.
What I don't understand is what, ...
3
votes
4answers
455 views
Is it possible to create a self signed certificate authority?
Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious.
To explain my question : Suppose I sign a public ...
3
votes
2answers
387 views
How practical is a certificate's “basic constraint” property in protecting my HTTPS / SSL session?
Suppose a leaf node creates a certificate for a different domain, acting as a CA.
Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be ...
3
votes
1answer
92 views
Certification authority only for certain domains
Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
3
votes
2answers
113 views
Why firefox shows some connections are not secure?
I am using internet by connecting mobile phone to my laptop using usb. From yesterday,my browser (firefox) shows for all most all website. Why this happen? How can i solve this?
3
votes
2answers
224 views
Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?
Suppose I have several independent PKIs that are used
Two internal PKIs: One with SHA1 support the other with Suite B algorithms.
A partner who I trust and have a policy map with.
Since both my ...
3
votes
3answers
544 views
How is an X509 certificate signer verified?
Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is,
...
3
votes
1answer
72 views
Creation and deployment of self-signed certificates for a two-machine scenario
Let us assume that I have two computers:
client
server
Now, in the server computer, I set up a legacy ASMX web service which will going to be used by the client. Before the client can connect to ...
3
votes
2answers
89 views
Why are SSL certificates valid only from a certain date?
Each SSL certificate is valid starting from a specific date and up to the expiration date.
What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
3
votes
1answer
221 views
Any non-commercial certificate authority issuer for web applications?
Is there any non-commercial certificate authority capable of issuing valid certificates for web applications? I mean, the certificate must be accepted by browsers, like those of commercial CAs?
3
votes
1answer
142 views
Internal CA for Digital Signature Solution - PKI Based
I'm trying to set up a digital signature solution which would work with a internal PKI.
We have considered Microsoft Certificate Services, but we don't want to rule out any other option to set up a ...
3
votes
1answer
96 views
How can an “alternate” or duplicate HTTPS certificate be used in an attack?
Inspired by an old question from PulpSpy, I'm trying to think of whether this is a significant weakness in the Certificate Authority system. Here are the attack methods that I think would work - ...
3
votes
0answers
145 views
How secure is HTTP basic authentication over SSL? [duplicate]
Possible Duplicate:
Is BASIC-Auth secure if done over HTTPS?
I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
2
votes
7answers
790 views
Which forensic techniques should I use to identify intrusion or monitoring of my computer or cellphone
If I suspect my computer or cellphone is being monitored by an unknown attacker, what tools or techniques could I use to detect or identify such monitoring?
Currently I'm unable to detect the ...
2
votes
4answers
919 views
What web browsers support OCSP stapling? Are the privacy and performance features the same?
OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
2
votes
1answer
54 views
Is it a good idea to generate certificate-specific CRLs? What is this technique called?
Suppose I create 3 certificates with the following CRLs
Cert1 http://crl.server.com/batch1/root1.crl
Cert2 http://crl.server.com/batch2/root2.crl
Cert3 ...
2
votes
2answers
141 views
distribution mechanisms for CRLs
From the X.509 RFC:
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer ...
2
votes
2answers
88 views
Looking for general guidance on securing web API application for client applications and users
I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.
After a lot of googling ...
2
votes
1answer
65 views
Certificate Chains When Importing Signed CSR Response
I'm interfacing with a secure web service, and authenticating using a client certificate. I'm confused about step #3 in the client configuration:
Generate a private key into keystore
Generate a CSR ...
2
votes
2answers
372 views
Protecting against SSL Strip [duplicate]
I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe?
Does it depend on the cert strength?
Do you ...
2
votes
1answer
74 views
How does an offline CA revoke certificates?
If an RSA private key of a root CA is stored offline, how does it revoke certificates it signs?
From looking at OpenSSL config the default_crl_days option seems to indicate that a CRL must be ...
2
votes
1answer
61 views
Security Certificates - Tools to Generate Security Certificates
I want to create a self-signed certificate that will be installed as a trusted certificate authority.
I then want to create another two certificates which are signed using the private key of the ...
2
votes
2answers
166 views
Forged SSL without installation of root CA, possible?
Consider visiting a secure website like Gmail. Is it possible to forge the website certificate only by having full control over the internet provider?
I mean is it practically possible for a provider ...
2
votes
4answers
1k views
How are Chrome and Firefox validating SSL Certificates?
How are Chrome and Firefox validating SSL Certificates?
Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?
2
votes
1answer
837 views
SSL cert not turning green anymore
I'm running a drupal site and have asked about this issue pertaining specifically to the drupal aspect of it here. I know that the "Green" https url doesn't show up because the cert itself isn't ...
2
votes
3answers
73 views
Are intermediate signing certs the only secure+practical way to manage OpenVPN client certs?
My organization needs to issue (and revoke) OpenVPN client certificates for people working remotely.
Our system is based on a standard OpenSSL CA setup and the easy-rsa tools, and the whole directory ...
2
votes
1answer
92 views
What happens to a certificate's Basic Constraints when a policy map is used?
One feature of a Basic Constraint when applied to a certificate (CA or end certificate) is that I can specify the maximum number of CAs that are permitted in the chain.
I'm planning on having a 2 ...
2
votes
2answers
143 views
Why CAs instead of global fingerprint database?
Why do we use "too big to fail" CAs and the chain of trust instead of a global fingerprint database in a similar vein to how ssh works?
2
votes
1answer
130 views
Any problems with UCC (multidomain) SSL certs on iOS and Windows Phones?
Are they any known issues with UCC (multidomain) SSL certs on iOS or Windows Phone?
Let's say I want to have Exchange server under outlook.mycompany.com and RemoteApp Portal under ...
2
votes
3answers
164 views
What is the worse that could happen if a government wanted to interfere with a CA?
In our time of SOPA, PIPA and ACTA, I was wondering what could happen if a government wanted to remove the certificate of a website ?
CA are companies, so they would have to obey to instructions from ...
2
votes
1answer
105 views
What damage could be done if a malicious certificate had an identical “Subject Key Identifier”?
I'm looking at the the Subject Key Identifier attribute of a CA certificate and am trying to understand the role it plays in validation and infer how validating client software could get it wrong.
...
2
votes
1answer
177 views
What should a CRL file name look like when “new” and “delta” CRLs are generated?
I suspect my Windows 20012 Certificate Server CRL revocation configuration is incorrect every time I generate a new CRL or a new Delta, only a maximum of 3 files are generated.
When I created the ...
2
votes
1answer
154 views
What Enhanced Key Usages are required for PKI infrastructure tasks? (OIDs for OSPF and CRL signing, etc)
I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks.
I understand that clients may not validate the ...
2
votes
1answer
232 views
What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?
I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance.
For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
2
votes
1answer
77 views
Which .CER file format is more secure for purposes of an AIA record?
What file format is most appropriate or secure for the AIA record in a PKI certificate?
The options I'm aware of are:
DER encoded binary X.509 (.cer)
Base-64 encoded X.509 (.cer)
I also have the ...
2
votes
1answer
97 views
Curious about best start for autoresponding Certificate Authority (CA)
I am just getting started trying to implement some internal PKI ideas, where my app would need a cert to 'sign' messages. Since this is all completly internal, we have some degree of trust, and I ...
