A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

4
votes
4answers
715 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude lower&...
5
votes
1answer
91 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
4
votes
2answers
127 views

Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised?

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company ...
2
votes
1answer
175 views

Bi-directional authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the abovementioned CA. Server has its own ...
4
votes
2answers
87 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
0
votes
0answers
29 views

How to test rootCA for issue subCA certificate

Can I check rootCA for issue subCA test certificate before issue real subCA cert? If rootCA issue test certificate and revoke immediately, then all operation log is recorded. Do this compliance with ...
6
votes
3answers
1k views

What if someone steals a Certificate authority's private key? [duplicate]

What if someone could steal a Certificate authority's private key? I know this will (probably) never happen, but what would happen to the certificates that were already signed with this private key? ...
1
vote
1answer
25 views

Certificate Policies & Certificate Practice Statements - Destroying Vs. Archiving CA's Private Keys (HSMs)

Please Consider: English is my second language. Background I have been looking at different CP/CPS on the web. They all seem to roughly follow the same practices. However, two different policies ...
1
vote
0answers
286 views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: http://www....
15
votes
3answers
2k views

Why are CA-issued certificates considered so much more secure than self-signed certificates

I looked at other Stack Exchange posts explaining why self-signed certificates are not as secure as CA-issued certificates, and most of these pages say the same thing: If it's self-signed, and the ...
2
votes
0answers
40 views

Let users sign in with eIDs - do I need government authorisation? (scope: all nation-states)

I've decided to launch a crypto-basic income system. Crypto UBIs are pretty popular now. For me, it seems like an open nation-state ID should exist by now (2015). However, Mike Hearn, Bitcoin core-...
1
vote
0answers
103 views

What are the risks of adding third-party Root CA certificate into NTAuth Store?

What are the risks associated with importing a third-party Root CA certificate into the Enterprise NTAuth Store in a Windows Active Directory domain? (Except that the CA is then trusted to issue ...
1
vote
1answer
64 views

Relationship between SSL cert database and that at the CA site

Say I am using a trusted third party CA site to manage my cert. I created a new cert called CertA at the CA web interface, downloaded the signed cert and use it on my web server. Some time later I ...
3
votes
1answer
150 views

SSL certificate trust chain shows root certificate with 1024-bit public key - Is this evidence of a MITM attack?

My account at my domain name registrar was hacked and I am trying to understand how the hackers were able to steal my login credentials. Because the root certificate in the trust chain for the ssl ...
2
votes
0answers
75 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
4
votes
1answer
101 views

Browsers root CA accepted, countries and checking fingerprints

This is a question derived from several others, and I can not comment on those, so it is not duplicated, please read: In some related questions some users comment that: "They wouldn't ...
11
votes
4answers
5k views

What are the risks of a localhost signed cerificate?

In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections. Suppose we use this CA to sign a key for "localhost" for use in ...
1
vote
2answers
233 views

Should I update my SHA-1 certificates? If so, how?

Q: Should I update my SHA-1 certificates? If so, how? Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been ...
-1
votes
2answers
77 views

Does any nation-state CA (certificate authority) have a public API to verify digital signatures? [closed]

There are around 200+ nation-states on the planet. Most of these use eIDs. Do any of these nation-states have a public API to verify digital signatures? Example: Nation-state Canada issues a eID to ...
6
votes
2answers
851 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
7
votes
4answers
1k views

What Country, State and City should I choose when requesting an SSL certificate?

I am really confused about the country, state and city I should select when submitting an SSL certificate. Should I provide the location of my servers or my current home address?I can always reissue a ...
1
vote
1answer
3k views

What are these two certificates I need to install - external CA root certificate

I have to install 2 certificates on a computer and I am a little puzzled by the certificates. The first certificate has these details: Issuer: CN = AddTrust External CA Root OU = AddTrust External ...
29
votes
2answers
5k views

Is it safe to send SSL certificates via email?

I just ordered a cheap Comodo PositiveSSL Certificate via a UK reseller, and I was rather surprised to find that the following files were emailed to me automatically, in a zip file: Root CA ...
0
votes
3answers
287 views

What can I do to rely less on certificate authorities?

I never trusted and liked CA's and in fact I removed a lot of them from my devices. But now after this question I'm wondering if I should generate my own certificates for the sites I care (e.g, like ...
5
votes
2answers
113 views

How do I prepare for Certificate Authority end of business?

We are deploying a security solution which uses certificates to validate documents. These certificates are issued by our government-authorized CA. What if in a distant future, the CA who provided us ...
8
votes
4answers
1k views

Why are there very expensive and cheap SSL same type certificates? [duplicate]

I am about to launch an online shopping site (currently running http) and I was thinking heavily of moving to SSL which includes a green bar, because this is very important. However, when I first ...
7
votes
1answer
551 views

How does the OpenSSL Alternative chains certificate forgery (CVE-2015-1793) attack work?

The security advisory for the issue can be found here: https://www.openssl.org/news/secadv_20150709.txt OpenSSL Security Advisory [9 Jul 2015] Alternative chains certificate forgery (CVE-2015-...
5
votes
1answer
268 views

Is my ISP trying to impersonate google?

Everything has been well for years and today I wake up with this: A warning on EM Client (also got the same on my iPhone) that the certificate for googleapis.com isn't valid. And the certificate ...
6
votes
2answers
90 views

Issuing certificates to two departments from same ROOT CA so one does not trust the other

Scenario: We have two departments within IT; Say Department-OLD and Department-NEW. A single internal PKI environment exists and a root CA (singular) is trusted by All endpoints. Problem: ...
1
vote
1answer
35 views

Clarifications sought about SSL cert signing process

Currently I have a cert (signed with SHA1) expiring soon and I have extended its expiry incorporating SHA2 signing algorithm. I have done this by creating another CSR using certutil command with the ...
2
votes
1answer
1k views

Extract the content of PKCS7 file in Java

I have a PKCS#7 signature that have the content‐type signed data and it embeds an XML document, and I have to extract the xml document from this PKCS7 file. Anyone know how to do that in java ??
1
vote
1answer
2k views

How to know if certificate is self-signed

How do I find out if a certificate is self-signed or authorized by CA? Somewhere I read that self-signed subject and issuer will be same, is it correct?
2
votes
1answer
85 views

is x509 certificate signed by ca valid?

I've got certificate 'sample cert' which is valid to '2015-12-31' but it was signed by root CA certificate. But when it was signing CA cert was valid to 2015-06-30'. So my question is, is today (2015-...
2
votes
1answer
66 views

Digital Certificate Repository Integrity

I am trying to figure out if there is an automatic way to determine if a digital certificate repository has been tampered with. Does anyone know of a way to do so?
1
vote
1answer
47 views

Certificate authority has changed for personal website - but I haven't changed anything?

I have the Certificate Patrol addon (website) installed in Firefox. While I mostly ignore the (far too many) warnings, today I saw that the certificate authority for my personal website has changed. ...
2
votes
2answers
160 views

Why is it fine for Certificates above the end-entity certificate to be SHA1 based?

I have heard about the phasing out of Sha1 based certificates for end entity use, and the steps that are outlined for chrome to display progressively more aggressive warnings for Sha1 certs not ...
-1
votes
1answer
312 views

Android phone (Kitkat) lists a lot of CAs

My Android phone (Kitkat) list a LOT of CA under setting->security->Trusted credential. Does it mean that anyone who has access to any one of those private keys of those CA(s) can monitor or do "Man ...
12
votes
1answer
750 views

Why isn't there a certificate revocation request standard?

Say I am building a Certificate Authority software and I want to automate certificate revocation as much as possible. I know it will not be possible in some cases, like if the building where the ...
1
vote
2answers
6k views

Unrecognized leaf certificate

Every 15 minutes or so I get this message in my system.log Apr 25 22:05:36 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate Apr 25 22:20:57 Ivans-MacBook-Pro.local apsd[194]: ...
3
votes
1answer
207 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...
53
votes
2answers
3k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
1
vote
1answer
252 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
111
votes
7answers
9k views

How do I report a security vulnerability about a trusted certificate authority? [duplicate]

I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers. Specifically, I am able to get a valid signed certificate for a domain ...
0
votes
1answer
1k views

Can I create an SSL certificate on windows signed with the machine's certificate?

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a ...
4
votes
1answer
170 views

distributing SSL certificates?

I'm only familiar with SSL certificates in a simple-use case: I've installed them to websites, Windows servers, and a few Linux servers. I'm now faced with the task of securing every possible device ...
1
vote
2answers
698 views

Can a wifi provider decrypt HTTPS usind MITM without users noticing? [duplicate]

As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid. So I could MITM all https traffic, and spy on my users?
1
vote
1answer
476 views

Create OpenVPN/easy-rsa certificate from public key only

I have been using easyrsa to generate client certificates for my application using the method described here. The build-client-full command generates a fresh private key for each client. This is what ...
0
votes
2answers
362 views

Is there any use in an AIA Extension in a Certificate directly issued by a Root CA?

While most documentation I've read states that there is no requirement to have the AIA extension in a self-signed Root certificate (logical enough), I can't find anything that tells me not to do so in ...
1
vote
2answers
155 views

Does Convergence solve the problem of hacked CAs?

My question is about the Firefox AddOn Convergence. So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
4
votes
2answers
187 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...