A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

11
votes
3answers
203 views

Why is Firefox shipped with expired root certificates?

What's the purpose of shipping Firefox with expired root certs? I checked and there are two expired certs listed. In fact the company's website for the first expired cert (A-Trust) states that the ...
2
votes
1answer
129 views

How does Windows certificate manager verify a file's certificate, if the root certificate is not in the store?

I'm working on a project which requires certificate verification for executable files. I have created my own trusted root certificate store, and used openssl to perform verification. However, when I ...
2
votes
2answers
71 views

Why not to use the same subordinate issuer CA for generating certificates that will be used for different things?

Microsoft has recommended my organization to use different subordinate issuer CAs in order to issue certificates that will be used for different things. For example, they recommend to use a CA for ...
3
votes
1answer
383 views

Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?

WoSign has been in the media for offering free server and client certificates. Since one of my (free) S/MIME certificate from another CA is about to expire soon after one year and WoSign offers ...
5
votes
1answer
1k views

How can a trusted intranet certificate be issued if they are being phased out?

I've just seen this article regarding the phasing out of intranet names on SSL certificates. However, CAs such as this one claim to still issue them and it will be "Trusted by all popular browsers" ...
1
vote
1answer
212 views

Root certificate from an CA company which can be encrpyted by SoftHSM

Does anybody know a CA company which allows me to put the bought CA certificate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)? Is it hard to work with the PKCS11 ...
3
votes
1answer
103 views

Designing a PKI environment

For our company I was given the task to design a durable, structured PKI environment for mainly client authentication purposes. We need a Root CA with a couple of Intermediate CAs, like this: ...
5
votes
2answers
214 views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
6
votes
2answers
257 views

Why do Symantec not believe their customers will be affected by Google distrusting this root certificate?

So Google will be moving to distrust the “Class 3 Public Primary CA” root certificate operated by Symantec Corporation, across Chrome, Android, and Google products, because it is no longer going to ...
8
votes
2answers
600 views

How do user receive server's certificate?

Let's imagine our user's computer wants to talk to some server for the first time in history via https. The computer sends a hello message, the server sends his public key and the certificate, ...
1
vote
4answers
1k views

Do all non-CA certs have to be End Entity certs?

Still learning the differences between certs. Can someone explain? The internet has so far been surprising not lucid in describing certificates. *EDIT to clarify EE
3
votes
1answer
121 views

TLS - How to know a CRL URL is not changed

If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be ...
1
vote
2answers
106 views

Verification of client certificates

I've read a lot of articles about client certificates. Please correct me if I'm wrong: client certificates are issued using CA CA could be created by myself (self-signed) or bought client ...
2
votes
2answers
170 views

Is there any mechanism to audit which signed certificates are unrevoked?

We are currently using EasyRSA and OpenSSL to manage our user VPN certificates for OpenVPN. The process we have in place currently is: User generates a CSR on their laptop and sends it to us to sign ...
0
votes
2answers
142 views

Why can you not trust a certificate directly?

If you want to set up a service that is signed using some Certificate Authority system (SSL/TLS, certain configurations of IKE, etc), if you want to use a self-signed certificate (e.g., for testing), ...
6
votes
1answer
70 views

Why does the issuance speed of a CA depend on the number of certs they have already issued?

I have seen proprietary testing results of pummelling a CA for a long time and measuring its throughput (certs issued / second). It was found that CAs become slower to issue new certificates as the ...
4
votes
1answer
154 views

Issuing and managing large numbers of certificates for client authentication

I am developing an Internet of Things product and plan to use client certificate authentication, issuing each "thing" its own certificate on the production line so that it may authenticate with a ...
0
votes
0answers
36 views

PKI, one sub CA for each certificate type VS one for all the certificates type

I'm trying to set a PKI where I can find 3 types of certificates: A client certificate to use in HTTPS communications A web server certificate to use in HTTPS communication A VPN certificate to use ...
13
votes
4answers
1k views

How do certificate issuers become trusted?

From what I understand, the certificate scheme that TLS/SSL relies on works because your computer has trust for major CA issuers built into it. That is, your OS is installed with certificates for ...
1
vote
1answer
99 views

How to read certificate chains in OpenSSL

I'm trying to understand how to read the output of OpenSSL commands. Currently, I am trying to understand how Certificate Chains work. When I give the command (using a standard ca bundle) openssl ...
30
votes
4answers
5k views

Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?

By my admittedly limited understanding of how HTTPS/TLS works, the end user (me) initiates a connection with a remote server which signs every one of its messages with a public key. This public key ...
42
votes
7answers
5k views

Is there any legitimate reason to install yourself as a root CA?

Follow up from comments on another question. Is there any reason as to why you might install yourself as a root CA on your own network? The only reason I can think of is forcing computers in the ...
3
votes
2answers
256 views

What's the difference between Comodo Premium and Positive SSL certificates [duplicate]

I'm just about to buy a SSL certificate from Comodo, I've doing a research in many CAs, many of them have this kinda premium certificate, and another like positiveSSL, rapidSSL, and instantSSL. The ...
3
votes
1answer
275 views

Check root certificates and certificate authorities on new PC

First Lenovo was caught shipping Superfish with new PCs, which included a universal self-signed certificate authority, and now Dell has been caught shipping PCs with a similar root certificate. What ...
1
vote
0answers
56 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
4
votes
2answers
238 views

Why did browsers deprecate 1024-bit RSA, but retain SHA-1?

I was reading Mozilla's security blog Phasing out Certificates with 1024-bit RSA Keys. Effectively, some browsers are deprecating 1024-bit RSA for CAs and Subordinate CAs because the certificate must ...
0
votes
0answers
68 views

Mysql SSL handshake: symmetric key exchange with CA or server key?

I have my MySQL database set up to require server and client identify verification, with both presenting their certificates signed by the same CA (mysql user was set up with 'require X509'). ...
3
votes
1answer
80 views

Why does SSL EV certification have a range of encryption (40-128 bit)?

I would like to get SSL-EV certification for my company website. After comparing a list of providers, I am confused by their advertisements. Why do all providers say that their certifications ...
3
votes
1answer
268 views

Windows - service account default certificate store

I am writing a web app that connects to external web services. The external web services serve an intermediate certificate signed by Thawte SGC CA - G2. When I setup IIS to run the web app using ...
2
votes
1answer
9k views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
9
votes
4answers
696 views

How does “Let's Encrypt” provide authenticity?

https://en.wikipedia.org/wiki/Let's_Encrypt https://en.wikipedia.org/wiki/Information_security#Authenticity AFAIK with "Let's Encrypt", we could create HTTPS websites with only one command. ...
2
votes
1answer
65 views

Which CRL should an intermediate CA crlDistributionPoint contain?

Given a root certificate authority (CA) and an intermediate CA signed by the root: Which CRL should the crlDistributionPoints contain to for the intermediate CA? The root CA's CRL or the ...
1
vote
0answers
187 views

How to import Comodo certificates into Keystore?

I'm trying to create a Keystore. I've already generated a Private Key, generated and sent a certificate request to a CA (Comodo), and I've received a ZIP file from the CA (Comodo) containing four ...
1
vote
1answer
69 views

Self created CA root for client certificates [duplicate]

My company wants to use client certificates for clients on production. We have a HTTPS certificate. As I understand we need a CA root certificate to create client certificates. Question: is it OK if I ...
1
vote
1answer
125 views

Automate certificate signing in Linux

In a private network I wish to automate signing for new clients/servers. Something like this: New client is created (dockers & etc) The client create a new private key and a CSR The client send ...
3
votes
1answer
58 views

Two-tier PKI without OCSP?

I am currently in the planning phase of a two tier Windows PKI using this deployment guide, and I am stuck concerning the use of OCSP and the online responder role of ADCS. The guide mandates that ...
1
vote
1answer
69 views

SSL certs signed by different CA

Have a question on SSL certs signed by different CA. in the past, my web server cert is signed with CA1 and it was also imported into the web app firewall for SSL traffic monitoring. Now, I have ...
30
votes
3answers
9k views

Which CA issued certificate for https://www.google.com

I installed Kaspersky internet Security 2016 on my laptop; in Firefox and Edge the root issuer is Kaspersky Anti-Virus Personal Root Certificate. but in chrome the root issuer is GeoTrust. in my ...
4
votes
2answers
221 views

How can an “alternate” or duplicate HTTPS certificate be used in an attack?

Inspired by an old question from PulpSpy, I'm trying to think of whether this is a significant weakness in the Certificate Authority system. Here are the attack methods that I think would work - ...
8
votes
1answer
152 views

Browser blacklists & the Symantec-Google Certification Debacle

Background: As explained e.g. on this Google company blog, Google writes that: On September 14, around 19:20 GMT, Symantec’s Thawte-branded CA issued an Extended Validation (EV) pre-certificate ...
0
votes
0answers
25 views

SCEP CertRep SUCCESS: how many certs are in the response?

I am working on an SCEP implementation (both requester and authority). The project uses JScep as a library. During the communication for a PKCSReq the client receives a CertRep SUCCESS. The draft ...
2
votes
1answer
136 views

SSL Client Authentication Failure

I have a setup where the client wants to make https call to the server. The client has a certificate installed on the machine The trust chain of the cert: Root CA      |----...
9
votes
2answers
426 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
3
votes
1answer
117 views

Does client Authentication needs the server to have intermediate certificate?

I have a scenario where in the client send send a client certificate issued from trusted root. The path of the client cert is like : Trusted Root |-----Intermediate Issuer |---- ...
2
votes
2answers
63 views

How does Certificate Transparance detect fake or forked logs?

I am trying to understand Certificate Transparency. Let's say I want to snoop on somebody's email. So I go hack or bribe a CA, have them issue a certificate for google.com, and then I present it when ...
6
votes
2answers
176 views

What is the purpose of Intermediate Certification Authorities store in Windows?

Suppose I have CA1 root certificate and two intermediate CA2 and CA3 certificates issued by CA1. Would it pose any security issue if all of the intermediate certificates were installed in the root ...
0
votes
1answer
55 views

Long term trust anchor validation

Let's say someone signs a document for long term validation using a certificate issued by a trusted CA. Throughout the following years, the document is timestamped again and again by multiple trusted ...
2
votes
0answers
109 views

Client authentication using the pfx not working

I have a requirement to generate the client certificates(pfx) files from another server certificate which are provided by a CA. Firstly I tested the following based on http://www.jayway.com/2014/09/...
3
votes
2answers
71 views

Is running a DNSSEC enabled DNS service as hard as running a CA?

I think we all know that running a CA is really hard to get right. Now there's a "new" system that uses digital signatures to associate data with names: DNSSEC. DNSSEC signs the DNS records and ...
1
vote
1answer
34 views

Can I have CA with JSSE

Maybe the title isn't correct but what I am trying to understand is... I want to create a certificate for my CA which will be self-signed and then create certificates for my clients and my server. ...