Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

2
votes
2answers
221 views

What is the point of certification authorities that are not trusted by browsers (=trusted by Root CAs)?

See here: https://www.cacert.org/index.php?id=1 Chrome, Firefox and Internet Explorer warn that it is not trusted, essentially making the entire thing useless. If I want some kind of ssl certificate, ...
3
votes
2answers
207 views

Is the Common Name mandatory for digital certificates?

I'm working on a project, where we use the Common Name as a certificate's basic identifier. However, importing certificates without the Common Name fails. What's the default way to use digital ...
0
votes
1answer
622 views

Trusted Certificate Authorities - how do they work?

microsoft.com for example can use a Verisign Certificate for their domain. What are the chances that an attacker could ask verisign for a m1crosoft.com domain and get approved? It is very simillar, ...
6
votes
2answers
518 views

When you buy a certificate, does the certificate authority have (a copy of) the private key?

I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this: You generate a public and private key pair From this key pair you generate a ...
0
votes
1answer
33 views

Certificate extensions - specific constraints

I have question about extensions of certificate and what specific extension should I use in my situation. The problem is following: I have a CA and I want that CA will issue certificate only for ...
2
votes
1answer
152 views

Finding the type of SSL certificate with cURL

This is a part of curl's verbose output when connecting to the HTTPS site of Google. * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * ...
7
votes
2answers
3k views

How to detect the NSA MITM attack on SSL?

As Bruce Schneider reported here... https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html ...the NSA reportedly performed a MITM attack on a company in brazil and decrypted their SSL ...
4
votes
1answer
3k views

Certificate verified using two different paths

StartSSL has an intermediate certificate that they use to sign their EV certificates: sub.class4.server.ca.pem. This certificate's issuer is shown by openssl x509 to be /C=IL/O=StartCom ...
1
vote
0answers
97 views

Deploying software that requires X.509 certificates

I have a self-hosted WCF application, with a server application running on the server (obviously) and a client application that will be installed on the users PC. Up until this point I have been ...
0
votes
3answers
2k views

SSL Certificate for an email server

I am completely new to SSL/TLS and would appreciate any help you guys could give me. To give you some background info, our company website is hosted externally by our ISP, however our email is ...
1
vote
0answers
49 views

Does Active Directory Certificate Services support Card Verifiable Certificates?

Does Active Directory Certificate Services support accepting requests for, and generation of, Card Verifiable Certificates (TR-03110)? If so, in which version of Windows Server was the functionality ...
10
votes
1answer
271 views

Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?

According to findings by the EFF's SSL observatory, there are "tens of thousands of keys that offer effectively no security due to weak random number generation algorithm." My understanding of that ...
10
votes
4answers
4k views

What Trusted Root Certification Authorities should I trust? [duplicate]

After two recent Slashdot articles (#1 #2) about questionable Root Certificates installed on machines, I decided to take a closer look at what I have installed on my machines. (I use current versions ...
1
vote
1answer
103 views

Root certifcate from an CA company which can be encrpyted by SoftHSM

Does anybody know a CA company which allows me to put the bought CA certficate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)? Is it hard to work with the PKCS11 ...
3
votes
3answers
463 views

Why does the RFC 5280 dictate the CAs not to issue certificates with negative serial numbers?

I have tried to issue a certificate beginning with 8 to F but I have found it is impossible, mostly due to the RFC: The serial number MUST be a positive integer assigned by the CA to each ...
1
vote
0answers
55 views

Cetificate Pinning. How do we handle the situation where a website is visited for the first time?

What I essentially mean to ask is, how is the scenario where a user who visits a website for the first time (the certificate for the website is not pinned in the browser) handled ? Additionally how is ...
1
vote
1answer
46 views

In a 3 tier (or more) PKI, is it permissible that a Name Constraint only be defined on the middle tier?

I'm working with an Issuing CA that doesn't support name constraints that are defined at a higher level. Assuming that it issues certificates that are compliant with the Name Constraints that are ...
0
votes
1answer
519 views

Is it safe to accept the security certificate from AOL chat? [closed]

Is it safe to accept the security certificate from AOL chat? Did they recently change their certificates? These images are from Pidgin.
3
votes
1answer
342 views

Internal code-signing certificate on Windows

I'm looking to improve defense-in-depth on a system, primarily by closing some holes in injected DLLs. Certain applications installed on the system cause helper DLLs (e.g. shell extensions, BHOs, ...
6
votes
5answers
334 views

Why are private certificates not trusted?

When we go to websites that have generated certificates themselves you see this red screen that says do not go there!: However when it is trusted by some companies it's all good. So I have a couple ...
2
votes
2answers
216 views

Is Certificate pinning different from CA pinning?

I am trying to understand if pinning a certificate essentially means pinning the CA or if they are different how so ?
4
votes
2answers
261 views

Is authorisation with token secure?

I have a general security question: Let's say there is a client-server application with authorisation by login and password using a secure connection between server and client (https). User can have ...
0
votes
1answer
1k views

List of certificate authorities in browsers and mobile platforms [duplicate]

Is there a list of certificate authorities installed in popular browsers and mobile platforms? I am considering a few alternatives for an SSL certificate, and I would like to make sure that the one ...
1
vote
4answers
218 views

search CA for someone's public key

do CAs offer service wherein an application can request someone's public key? i am trying to do this but i am unsure if it is correct (suggestions of better ways to do it will be most appreciated): ...
3
votes
1answer
605 views

How can a trusted intranet certificate be issued if they are being phased out?

I've just seen this article regarding the phasing out of intranet names on SSL certificates. However, CAs such as this one claim to still issue them and it will be "Trusted by all popular browsers" ...
1
vote
2answers
1k views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
4
votes
1answer
925 views

Who is this strangely named Certificate Authority?

I'm researching certificate authorities, and I just have no idea what to think of the CA named x00Ax00-x00Tx00rx00ux00sx00tx00 x00Gx00ex00sx00.x00 x00fx00xFCx00rx00 ...
6
votes
1answer
13k views
2
votes
1answer
168 views

What do people mean by “top-down manner” in X.509 certificates?

What do people mean by saying that X.509 certificates work in "top-down manner"? Do they say that because CAs can do cross certifications?
2
votes
4answers
249 views

Why isn't there a Global Root for SSL?

I was just wondering why there is a file on your computer implementing the trusted root CA's instead of something similar to DNS where there is a file on root servers that computers check against to ...
1
vote
0answers
44 views

Writing Security Functionality Requirements [closed]

Is there any Guideline Doc. or Tutorials for writing Security Functionality Requirement (Common Criteria)for a product?
4
votes
3answers
497 views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
0
votes
1answer
2k views

Grey vs Green padlock in address bar - technical difference [duplicate]

What is a technical difference between "grey padlock" and "green padlock" in URL bar in browsers? As an example we can take: Green padlock: Bank of America Grey padlock: Google Search Both of ...
2
votes
2answers
249 views

Can I buy a signing-valid certificate for internal use?

So now that I have to implement "secure transport" as defined by The Direct Project (not to mention reinventing a bunch of wheels, but that's another story for SO), I find myself staring down the ...
0
votes
2answers
723 views

Security Certificate not from a valid authority

I have no real knowledge about this stuff so I figured I'd ask here for some answers. So I started to get this "Security Certificate not issued by a valid authority" error when using my email client ...
3
votes
4answers
424 views

Evil certificate authority in public-key-infrastructure

Alice goes to the certificate authority (CA) and registers her public key for signature verification. She gets a certificate for this from the CA. Bob requests Alice' public signature verification key ...
0
votes
1answer
279 views

SSL (TLS v1.2) - Can i offer fallback CAs when upgrading Certificates? (Java)

I am currently developing a product that involves two network situations. At the client side, multiple computers form a P2P network (multiple locations, multiple p2p networks), and a subset of nodes ...
16
votes
4answers
19k views

how digital signature verification process works

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
14
votes
1answer
4k views

How does OCSP stapling work?

I've been looking into OCSP stapling for HTTPS, which looks pretty interesting. From what I can tell, it's essentially a way of offloading CRLs from the CA to the server, allowing for everything to be ...
0
votes
1answer
76 views

Certificate for Email Encryption and signing

I don't understand the flow of Digital Certificate with Email Encryption and Signing. For Example, There is 2 users, Sender A and Receiver B. Is Certificate required to encryption to A or just ...
6
votes
1answer
655 views

Browsers silently adding trusted root certificates in Windows

When accessing https://internetbanking.caixa.gov.br (site of a well known bank in Brazil), the server returns a certificate signed by "Autoridade Certificadora Raiz Brasileira" (Brazilian Root ...
0
votes
1answer
154 views

Should all Server Certificates from one CA have the same CRL

I am setting up my own PKI, and I came across a question to which I couldn't find an answer. I want to specify CRLDistributionPoints in my server certificates but I am curious whether to use the same ...
0
votes
1answer
285 views

How does ssl prevent MITM attacks [duplicate]

My understanding of how it works : A victim asks for the public key of a server. The attacker just forwards this request. The server now responds with a certificate which contains the Public key. The ...
3
votes
3answers
819 views

What stops a hacker from installing it's own CA certificate?

Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following: ...Such is the case with that small company in the Netherlands, ...
1
vote
2answers
128 views

Is there any point to keeping a “Verified by X” image on the page for a page secured by SSL?

So, I saw this on a page: (The redacted part says the name of the entity that owns the domain) The page recently got SSL certs verified by GeoTrust. The image is on ...
26
votes
5answers
13k views

Where to get an SSL certificate for personal website?

I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
3
votes
4answers
305 views

Trust among the root-CAs

The system of CAs with the root-CAs and their subordinate CAs are IMHO in principle akin to the system of banks with their main sites and subsidiries. In the case of banks, a customer of a bank ...
2
votes
1answer
829 views

Different SSL states as seen by Safari, Chrome and Firefox

Today, I visited some sites of the German DHL group. While Chrome and Safari complain about an invalid certificate of Firefox accepts it. Which one is right, which one is wrong? Which decision ...
2
votes
3answers
253 views

Do on-demand SSL certificates exist?

A few days ago, I visited an SSL protected website. Since Safari complained about the SSL-certificate, I did a short inspection: The certificate was issued by GoDaddy in just the minute I ...
3
votes
2answers
977 views

Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure?

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode. I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline ...