Certificate authorities verify the owner information of certificates by signing them.
2
votes
1answer
244 views
What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?
I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance.
For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
2
votes
1answer
81 views
Which .CER file format is more secure for purposes of an AIA record?
What file format is most appropriate or secure for the AIA record in a PKI certificate?
The options I'm aware of are:
DER encoded binary X.509 (.cer)
Base-64 encoded X.509 (.cer)
I also have the ...
2
votes
1answer
97 views
Curious about best start for autoresponding Certificate Authority (CA)
I am just getting started trying to implement some internal PKI ideas, where my app would need a cert to 'sign' messages. Since this is all completly internal, we have some degree of trust, and I ...
2
votes
2answers
82 views
Does it make sense that OCSP returns state for the signer CA itself
I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...
2
votes
1answer
238 views
How does DCOM authentication compare to RPC based authentication/auth?
The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM
A CA running Windows Server 2003, Enterprise Edition, ...
2
votes
1answer
256 views
Inspecting a TLS Certificate to determine RSA Key Usage restrictions
With regard to this answer, I have a question about Key Usage in an SSL certificate.
Most SSL server certificates have a RSA key which is not restricted
through a Key Usage extension, so you can ...
2
votes
1answer
40 views
Sending Digital Certificates
I used the makecert tool in order to create:
a self-signed certificate
a server certificate using the self-signed certificate
a client certificate using the self-signed certificate
I then ...
1
vote
3answers
208 views
Server Certificates, certificate authority, and servers
I currently have a valid wildcard certificate installed on OS X 10.8.2 server. To make sure we know what I'm talking about the cert is *.domain.com (example only) I'd love to use this to secure as ...
1
vote
3answers
361 views
Benefits to using EV certificates with a privately hosted Certificate Authority
For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate?
Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the ...
1
vote
1answer
108 views
Why a web server HTTPS certificate can't sign its subdomain HTTPS certificates?
Why having a valid certificate for "exampe.com" I can't make a "child" certificate for "subdomain.example.com"?
What insecurities will arise if browsers start allowing domain's certificates to be ...
1
vote
1answer
368 views
Purpose of certificates signed and trusted by CA
Another newbie question but I just don't get the purpose of certificates signed and trusted by CA. We already have public/private keys, hash functions to sign/encrypt messages so why do we need ...
1
vote
2answers
2k views
Error code: sec_error_untrusted_issuer
I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
1
vote
1answer
155 views
Signature and Timestamp for Long Term Document Archival Question
I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.
As far as I understand, I ...
1
vote
3answers
435 views
What is the most secure way to do OCSP signing without creating validation loops?
I'd like to enable the most secure OCSP validation that Windows 2008 SP1 and newer support.
Based on the following information, am I required to implement id-pkix-ocsp-nocheck on my OCSP ...
1
vote
2answers
302 views
How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?
Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
1
vote
1answer
181 views
How does a developer interact with Microsoft Certificate *Web Services*
Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
1
vote
1answer
191 views
When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?
When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism?
Related information on a different answer
Consider using HTTP instead ...
1
vote
2answers
106 views
Does Convergence solve the problem of hacked CAs?
My question is about the Firefox AddOn Convergence.
So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
1
vote
1answer
66 views
How to have Thunderbird include a root certificate?
An eMail signed via S/MIME also contains the X.509 certificate chain containing the public key in order to directly verify the signature (assuming its issuing CA is deemed trustworthy). The chain does ...
1
vote
2answers
199 views
Self-signed certificates usage for code signing purposes
if a self-signed certificate is trusted by the client's certificate store, then it should be fine to be used, since the client trusts the issuer of the certificate as it does any other trusted CA ...
1
vote
1answer
59 views
For SSL certs, is some sort of connection to the issuing CA (or other network resource) required for the SSL connection to be established?
I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL".
Background:
I am deploying ...
1
vote
1answer
414 views
How do I use OpenSSL with the Java Keytool?
I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
1
vote
1answer
305 views
What are attribute certificates? Why would someone partition a certificate by reason codes?
In "How Certificate Revocation Works" a brief mention of Attribute Certificate and Reason Code partition is made:
If validated by a client that supports partitioned and indirect CRLs,
the IDP ...
1
vote
2answers
154 views
SSL/TLS Certificate Authority supply policy
I would like to ask for recommendations regarding the following issue:
As a company with a number of customers worldwide we supply our product to many different sites. We need to shape our policy ...
1
vote
1answer
103 views
The request was aborted: Could not create SSL/TLS secure channel Exception
Let me explain my situation.
I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC.
I then created two certificates using the self-signed ...
1
vote
0answers
81 views
Why not buy cheap SSL certificates? [duplicate]
Possible Duplicate:
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
The comparison in Godaddy's website, makes it clear: they're just cheaper ...
0
votes
2answers
107 views
Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]
I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
0
votes
2answers
176 views
Create a certificate signing request [closed]
can someone please tell me a few tools that can be used to create a CSR ?
0
votes
1answer
70 views
Does S/MIME provide means to propagate a certificate's revocation?
Can a revocation certificate for an old X.509 certificate be attached to an email in addition to a replacement certificate in such a way that the client user does not have to manually intervene? Or ...
0
votes
1answer
524 views
How to create trusted chain of certificates if I have the last certificate?
Good day.
During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using)
My server is:
telnet xmpp.odnoklassniki.ru ...
0
votes
1answer
180 views
Purpose and Uses of Root SSL Certificates
I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?).
When and ...
0
votes
2answers
473 views
Issuing browser certificates to Chrome and Firefox with Microsoft CA
Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval.
Since many browsers either block or don't support ActiveX controls, how can I enroll them using a ...
-1
votes
2answers
227 views
Request/Creating a Code Signing Certificate
I have need for a code signing certificate which is trusted by a CA in the windows domain. How do I request/create this certificate?
Do I have to request a code signing certificate on the ...
-6
votes
4answers
200 views
Is TLS-in-TLS supported in any software? Does it make sense? [closed]
I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
