Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

3
votes
1answer
1k views

Creation and deployment of self-signed certificates for a two-machine scenario

Let us assume that I have two computers: client server Now, in the server computer, I set up a legacy ASMX web service which will going to be used by the client. Before the client can connect to ...
11
votes
2answers
987 views

What does having an internal two-tier PKI protect against?

There are a lot of Best Practice documents that recommend having an offline Root CA and an Enterprise Subordinate CA that is signed by the root, for an internal Microsoft AD Certificate Services ...
2
votes
2answers
447 views

Looking for general guidance on securing web API application for client applications and users

I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization. After a lot of googling ...
1
vote
1answer
554 views

Why a web server HTTPS certificate can't sign its subdomain HTTPS certificates?

Why having a valid certificate for "exampe.com" I can't make a "child" certificate for "subdomain.example.com"? What insecurities will arise if browsers start allowing domain's certificates to be ...
7
votes
2answers
2k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
8
votes
3answers
2k views

Certificate authorities for a PKI

Some people think the certificate authorities for a PKI should be the government, but others think certificate authorities should be private entities, such as banks, corporations, or schools. What are ...
5
votes
1answer
9k views

What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?

What root certificates are/are not updated when the following checkbox is checked? Additional questions If I manually remove a root certificate, will this service replace that very certificate? ...
1
vote
1answer
177 views

How to have Thunderbird include a root certificate?

An eMail signed via S/MIME also contains the X.509 certificate chain containing the public key in order to directly verify the signature (assuming its issuing CA is deemed trustworthy). The chain does ...
2
votes
2answers
537 views

distribution mechanisms for CRLs

From the X.509 RFC: DistributionPoint ::= SEQUENCE { distributionPoint [0] DistributionPointName OPTIONAL, reasons [1] ReasonFlags OPTIONAL, cRLIssuer ...
2
votes
1answer
2k views

Certificate Chains When Importing Signed CSR Response

I'm interfacing with a secure web service, and authenticating using a client certificate. I'm confused about step #3 in the client configuration: Generate a private key into keystore Generate a CSR ...
5
votes
1answer
185 views

Security and authentication problem

We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes. First of all, lets imagine a real world scenario: Imagine that a user ...
5
votes
2answers
2k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
5
votes
4answers
1k views

Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)

I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was: CA with RSA keys capable of signing RSA and EC CSRs CA with ...
5
votes
3answers
262 views

What is a reasonable expiry for user authentication certificates?

This question is about a nearly decentralized P2P system with a centralized certificate authority where users can authenticate and receive a certificate on their public key and then can authenticate ...
13
votes
4answers
9k views

How are Chrome and Firefox validating SSL Certificates?

How are Chrome and Firefox validating SSL Certificates? Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?
50
votes
10answers
8k views

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
5
votes
1answer
406 views

Certification authority only for certain domains

Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
2
votes
1answer
1k views

What Enhanced Key Usages are required for PKI infrastructure tasks? (OIDs for OSPF and CRL signing, etc)

I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks. I understand that clients may not validate the ...
3
votes
2answers
3k views

Protecting against SSL Strip [duplicate]

I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe? Does it depend on the cert strength? Do you ...
4
votes
1answer
338 views

For a desktop application, why use an SSL certificate from a trusted authority?

When a web browser connects to a server and downloads an SSL certificate, a third-party trusted authority ensures that the client is talking to the host that it's looking for. If the host uses a ...
0
votes
1answer
267 views

Does S/MIME provide means to propagate a certificate's revocation?

Can a revocation certificate for an old X.509 certificate be attached to an email in addition to a replacement certificate in such a way that the client user does not have to manually intervene? Or ...
2
votes
3answers
254 views

Are intermediate signing certs the only secure+practical way to manage OpenVPN client certs?

My organization needs to issue (and revoke) OpenVPN client certificates for people working remotely. Our system is based on a standard OpenSSL CA setup and the easy-rsa tools, and the whole directory ...
4
votes
4answers
2k views

Is it possible to create a self signed certificate authority?

Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious. To explain my question : Suppose I sign a public ...
1
vote
1answer
822 views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
3
votes
2answers
183 views

SSL Certificate Signing by a CA

Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return. What I don't understand is what, ...
3
votes
1answer
133 views

How can an “alternate” or duplicate HTTPS certificate be used in an attack?

Inspired by an old question from PulpSpy, I'm trying to think of whether this is a significant weakness in the Certificate Authority system. Here are the attack methods that I think would work - ...
6
votes
2answers
390 views

What kind of certificate do I need to be able to sign my own subdomain certificates?

We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...). ...
5
votes
1answer
3k views

What damage could be done if a malicious certificate had an identical “Subject Key Identifier”?

I'm looking at the the Subject Key Identifier attribute of a CA certificate and am trying to understand the role it plays in validation and infer how validating client software could get it wrong. ...
3
votes
1answer
971 views

What should a CRL file name look like when “new” and “delta” CRLs are generated?

I suspect my Windows 20012 Certificate Server CRL revocation configuration is incorrect every time I generate a new CRL or a new Delta, only a maximum of 3 files are generated. When I created the ...
3
votes
1answer
114 views

Is it a good idea to generate certificate-specific CRLs? What is this technique called?

Suppose I create 3 certificates with the following CRLs Cert1 http://crl.server.com/batch1/root1.crl Cert2 http://crl.server.com/batch2/root2.crl Cert3 ...
1
vote
2answers
123 views

Does Convergence solve the problem of hacked CAs?

My question is about the Firefox AddOn Convergence. So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
2
votes
3answers
1k views

What is the most secure way to do OCSP signing without creating validation loops?

I'd like to enable the most secure OCSP validation that Windows 2008 SP1 and newer support. Based on the following information, am I required to implement id-pkix-ocsp-nocheck on my OCSP ...
16
votes
4answers
5k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
4
votes
2answers
2k views

Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?

Suppose I have several independent PKIs that are used Two internal PKIs: One with SHA1 support the other with Suite B algorithms. A partner who I trust and have a policy map with. Since both my ...
2
votes
1answer
409 views

What happens to a certificate's Basic Constraints when a policy map is used?

One feature of a Basic Constraint when applied to a certificate (CA or end certificate) is that I can specify the maximum number of CAs that are permitted in the chain. I'm planning on having a 2 ...
3
votes
1answer
1k views

What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?

I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance. For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
4
votes
2answers
384 views

What is the severity of a fake certificate?

I'm not a security specialist, thus reading this Google Blog post about a fake *.google.com certificate, raises a lot of concerns, if anyone can impersonate a website, especially a google website, my ...
2
votes
2answers
188 views

Why CAs instead of global fingerprint database?

Why do we use "too big to fail" CAs and the chain of trust instead of a global fingerprint database in a similar vein to how ssh works?
1
vote
2answers
866 views

Self-signed certificates usage for code signing purposes

if a self-signed certificate is trusted by the client's certificate store, then it should be fine to be used, since the client trusts the issuer of the certificate as it does any other trusted CA ...
2
votes
2answers
306 views

Forged SSL without installation of root CA, possible?

Consider visiting a secure website like Gmail. Is it possible to forge the website certificate only by having full control over the internet provider? I mean is it practically possible for a provider ...
1
vote
1answer
376 views

When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?

When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism? Related information on a different answer Consider using HTTP instead ...
2
votes
3answers
427 views

Server Certificates, certificate authority, and servers

I currently have a valid wildcard certificate installed on OS X 10.8.2 server. To make sure we know what I'm talking about the cert is *.domain.com (example only) I'd love to use this to secure as ...
5
votes
3answers
408 views

Issuing SSL certificates for device automation software package without domain names

We are developing the automation software for Windows which communicates with the certain devices via our own private connection protocol. That software package consists of several server (including ...
6
votes
7answers
4k views

What is the danger of hosting your SSL certificate yourself?

I have Active Directory Certificate Services on my server, which makes it possible for me to deliver an SSL certificate for the websites hosted on the same server. I know that normally, I need to ...
0
votes
1answer
5k views

How to create trusted chain of certificates if I have the last certificate?

Good day. During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using) My server is: telnet xmpp.odnoklassniki.ru ...
1
vote
0answers
113 views

Why not buy cheap SSL certificates? [duplicate]

Possible Duplicate: Is there any technical security reason not to buy the cheapest SSL certificate you can find? The comparison in Godaddy's website, makes it clear: they're just cheaper ...
3
votes
2answers
141 views

Why firefox shows some connections are not secure?

I am using internet by connecting mobile phone to my laptop using usb. From yesterday,my browser (firefox) shows for all most all website. Why this happen? How can i solve this?
4
votes
2answers
167 views

What is the state of the Windows Update certificate after Flame?

May 28, The Flame malware is discovered in Iran and by Kaspersky Labs. June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
2
votes
1answer
121 views

Which .CER file format is more secure for purposes of an AIA record?

What file format is most appropriate or secure for the AIA record in a PKI certificate? The options I'm aware of are: DER encoded binary X.509 (.cer) Base-64 encoded X.509 (.cer) I also have the ...
2
votes
1answer
200 views

Any problems with UCC (multidomain) SSL certs on iOS and Windows Phones?

Are they any known issues with UCC (multidomain) SSL certs on iOS or Windows Phone? Let's say I want to have Exchange server under outlook.mycompany.com and RemoteApp Portal under ...