Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

0
votes
1answer
192 views

Is my understanding about how SSL works correct?

I've been reading about 2-way SSL or mutual auth recently, and here's what I've figured so far: Mutual auth is a way for the client to authenticate itself to the server, just like the server does to ...
0
votes
1answer
106 views

Does openssl store the certificate of the server after verification is done?

As per my understanding , openssl will verify the certificate of the server during ssl handshake , using the trusted CAs present in the CA certificate dir in the context. After the server certificate ...
0
votes
1answer
107 views

Hacked Router Faking a Certificate Authority

Does a typical computer begin with any shared secret with a certificate authority when I buy it? If not, a compromised home router could fake everything and get my credit card info when I attempt to ...
0
votes
1answer
401 views

How do SSL/TLS certificates work?

I'm trying to understand how SSL/TLS certificates work, but I'm missing something. I have obtained my current understanding from this website: ...
1
vote
1answer
201 views

How to Delete duplicates in CA Bundle Certificate File

I do have a big CA bundle certificate file and each time if i get request to add new certificate to the existing bundle i need to make sure it is not present already. How i can validate the ...
1
vote
1answer
276 views

How to safely renew user and CA certificates in a PKI

I am currently developing my own PKI where x.509-client-certificates are issued by a public server. At the moment, the CA-public key is distributed with the binary and there are no routines for ...
3
votes
3answers
429 views

“Web of trust” for self-signed SSL certificates?

SSL certificates, generally speaking, use a "chain of trust" model - a trusted certificate authority (CA) gets proof that a company such as Amazon owns amazon.com and issues an SSL certificate. ...
3
votes
1answer
258 views

unexpected thumbprint when connecting via remote desktop - what now?

I have an Amazon EC2 instance in a VPC. I have not logged into it for some time, so I used the Amazon EC2 CLI with ec2-get-console-output to check what the thumbprint should be when I connect. To my ...
2
votes
1answer
100 views

Is there any mechanism to audit which signed certificates are unrevoked?

We are currently using EasyRSA and OpenSSL to manage our user VPN certificates for OpenVPN. The process we have in place currently is: User generates a CSR on their laptop and sends it to us to sign ...
48
votes
12answers
5k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
2
votes
2answers
93 views

What's the mitigation strategy for when a CA's private key is stolen?

I'm new to SSL/TSL and was wondering if you could walk me through the following scenario. Scenario Let's say I am one of a thousand websites that has a certificate signed by some certificate ...
6
votes
2answers
8k views

Internal SSL Certificates?

As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
1
vote
2answers
122 views

determine X.509 certificate class

I am very familiar with OpenPGP but don't even use X.509 / S/MIME. I know that there are several classes for certificates (from email check to personal ID check). I would like to know how you ...
3
votes
1answer
69 views

What crypto prevents & detects “invisible” CAs? (e.g. in X509v4)

For this question, I'm calling an "invisible CA" one that Is signed by a root ca and exists as a 2nd or 3rd tier Is valid, not expired or revoked Has a different Public key than one that is ...
4
votes
3answers
979 views

From a trust perspective, is renewing a CA certificate the same as trusting a sub-CA?

I'm trying to understand the validation logic that would occur in the following hypothetical scenario An unpatched XP user who trusts a list of root CAs. Those CAs in particular have been renewed ...
1
vote
1answer
178 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
7
votes
4answers
3k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
3
votes
2answers
108 views

Isn't this the same as using a certification authority?

Taken from Wikipedia, here is the pretext to my question: A certificate authority (CA) is an organization that stores public keys and their owners and every party in a communication trusts this ...
2
votes
1answer
178 views

How do I get a third-party-signed ssl client certificate?

I've been given a requirement of providing a client certificate to authenticate between two application's web services. The other application (that I don't host) is requiring an SSL client certificate ...
15
votes
5answers
3k views

Are self-signed certificates actually more secure than CA signed certificates now?

Are self-signed certificates actually more secure than CA signed certificates now? I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government ...
3
votes
4answers
381 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude ...
0
votes
1answer
57 views

Can two parties sign each other's certificate and exchange without CA?

Is possible (and practical) for two users to create their own self-signed SSL certificates, exchange these certificates (perhaps in a face-to-face meeting), and then communicate with each other ...
5
votes
1answer
6k views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is ...
1
vote
1answer
105 views

what harm can a malicious ca do?

If ca's act in the interests of an eavesdropper, what is the worst they cold do? I guess they can decrypt traffic not using perfect forward secrecy and impersonate the server. Is this the case?
1
vote
2answers
77 views

Public e-mail Encryption Certificate

I'm quite new to this, so don't be too hard on me. I'm currently using the CipherMail MTA to generate e-mail encryption certificates. I created an own CA and public and private keys for our contact ...
1
vote
0answers
38 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
2
votes
3answers
112 views

Are Extended Validation certificates any more secure than regular ones?

Or are they just an attempt to get you to pay more money to a CA because it tells your browser to show the address bar in green with your organization's name? Also, what are the technical details ...
2
votes
2answers
63 views

Is there a website or other resource that lists operating systems/platforms and the included root certificates?

I need to choose a certification authority (CA), to get a certificate, but I noticed that there are several of these only present in some operating systems/platforms like windows. I need to choose one ...
0
votes
1answer
81 views

Is it possible to create a SMIME only PKI that *can't* be used for SSL?

Assume I have a Root CA that I want to share with hostile untrusted 3rd parties. Then constrain this root using specific EKUs at the root. OID=1.3.6.1.5.5.7.3.4 ; Secure Email Next, ...
1
vote
2answers
124 views

Authentication through digital certificates plus signature

While studying X.509 certificates, I've found that authentication is safer if I associate/combine one or more certificates with each signed message (certificate + signed message). The receiver of ...
2
votes
3answers
119 views

How are public key certificates updated securely?

Let's say I get a new computer that's never been connected to the internet before. The first time I connect it to the internet, is it susceptible to a mitm attack while downloading its public key ...
1
vote
2answers
15k views

Error code: sec_error_untrusted_issuer

I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
3
votes
1answer
6k views

SSL certificate chain verification

After reading many articles and watching many tutorials I decided to be specific because there are some things about SSL certificate chain verification and SSL cetificate verification in general that ...
2
votes
2answers
405 views

Certificate authority structure - best practices

I'm working for a company that sells software products to customers some of which do not have the resources and/or know-how to build and maintain their own CA (used for the SSL communication of our ...
2
votes
1answer
165 views

Why does facebook php sdk (and multiple others clients) include CA bundle with a lot of CAs?

This is what facebook ships with their API php client: https://github.com/facebook/facebook-php-sdk-v4/blob/master/src/Facebook/fb_ca_chain_bundle.crt It contains dozens (hundreds?) Root CAs. But ...
3
votes
7answers
1k views

Which forensic techniques should I use to identify intrusion or monitoring of my computer or cellphone

If I suspect my computer or cellphone is being monitored by an unknown attacker, what tools or techniques could I use to detect or identify such monitoring?
2
votes
3answers
778 views

How can I get my SSL certificate signed by an CA for web application that runs on localhost

I have a web application that runs on localhost. I have a self-signed certificate for tomcat configured but when loading the website on firefox, I get a security exception. Can I get a CA to sign my ...
1
vote
1answer
69 views

Are there other ways for a CA to have their certificates included in a browser?

From what I understand, the certificate authorities (CAs) have to get their root certificate included in the browser. What if the root certificate of a particular CA is not included in the web ...
7
votes
3answers
251 views

Limiting the root certificate chain

I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
28
votes
6answers
4k views

Does it matter which Certificate Authority I source my SSL Certificate from?

To secure my web site with HTTPS, does it matter which company I source my SSL certificate from, or just that the browser recognizes it? From the Area51 proposal.
2
votes
1answer
325 views

What is the advantage of buying an SSL certificate from the CA rather than a reseller?

I am trying to do some research on SSL certificates, and I've come across a number of reseller sites such as GoGetSSL, which offer certificates at much lower prices than what you would pay if you ...
0
votes
4answers
241 views

Can a certification authority sign another CA's certs?

Disclaimer: I have low knowledge of X.509 and PKI, so I would appreciate an answer that is not entirely technical, i.e. by using real-life example scenarios.) I was searching for information ...
3
votes
1answer
114 views

Windows - service account default certificate store

I am writing a web app that connects to external web services. The external web services serve an intermediate certificate signed by Thawte SGC CA - G2. When I setup IIS to run the web app using ...
1
vote
1answer
328 views

How to become an internationally recognized certificate authority (CA)?

What's the procedure a certificate authority (CA) must follow to get internationally recognized, like Verisign or GlobalSign?
2
votes
2answers
195 views

What happens if the CA has knowledge of private keys?

In a classic PKI scenario, the certificate authority receives signing requests generated by an end-user which owns the keychain, and thus has his private key secret. Consider a scenario in which the ...
1
vote
2answers
4k views

Unrecognized leaf certificate

Every 15 minutes or so I get this message in my system.log Apr 25 22:05:36 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate Apr 25 22:20:57 Ivans-MacBook-Pro.local apsd[194]: ...
3
votes
2answers
186 views

SSL Wildcard certificate to issue anther certificates

Let's say, that I buy an *.example.com SSL certificate. I want now to generate subcertificates and include the *.example.com certificate in a trust path: host1.example.com, with an alternate name ...
1
vote
0answers
41 views

Is the root CA certificate required in the .crt file? [duplicate]

I am setting up SSL on Nginx with a free StartSSL certificate. Based on the instructions given on this StartSSL page I created a unified certificate containing the CA's root certificate, Intermediate ...
5
votes
3answers
914 views

Why are SSL certificates valid only from a certain date?

Each SSL certificate is valid starting from a specific date and up to the expiration date. What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
6
votes
1answer
4k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...