A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

3
votes
2answers
96 views

Cetificate Pinning. How do we handle the situation where a website is visited for the first time?

What I essentially mean to ask is, how is the scenario where a user who visits a website for the first time (the certificate for the website is not pinned in the browser) handled ? Additionally how is ...
0
votes
2answers
113 views

Where are certificates used to prove identity and why aren't DNS responsible for the job?

I've been reading about how certificates are used to verify the owner of a public key in asymmetric encryption. Right now everything seems really theoretical to me and I'd like to know how this works ...
5
votes
0answers
147 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
2
votes
1answer
458 views

Why is google's site identity icon a red lock?

Why does google.com have this icon (see picture) for me? What does it mean? Screenshot: Google.com. There are two lock icons. The top one is RED and the bottom one is green. Screenshot: Google.se. ...
0
votes
1answer
99 views

Reliability of Certificate Authorities and Certificates in 2015

I just happened to stumble upon this Article in Netcraft. The article claims that many of the major CAs have given out hundreds of Certificates to false organizations. Are there any truth to these ...
3
votes
2answers
260 views

Is it possible for my employer to replace the root CA on my phone?

I've read about corporate MITM 'attacks' where they replace the root CA on company hardware in order to monitor traffic over SSL that takes place on their network, but is it possible for them to do ...
-2
votes
1answer
313 views

How to dnsspoof against HTTPS

I am doing a dnsspoof PoC, but apparently it doesn't work with HTTPS because of the certificate. Please don't tell me that I have to generate a certificate or send a legitimate certificate, I want ...
3
votes
1answer
141 views

Understanding the signing and verification process through a CA

I have been researching on this topic and I need to understand the exact signing and verification process when made through a trusted CA. From what I understand, this is how it works at a very high ...
3
votes
2answers
125 views

Is it possible to let a fake certificate appear valid by sending fake OCSP responses?

In a MITM-Attack I can exchange the server certificate by one I created on my own with tools like MITMProxy or SSLSplit. But this only works well when I have installed a fake CA cerrtificate in the ...
9
votes
1answer
702 views

What are the problems with creating an own CA for intranet?

In the comments to Creating my own CA for an intranet several people strongly advise against creating your own CA for an intranet. Especially: don't do it. Nope. Bad idea. Buy $10 CA signed ...
1
vote
2answers
75 views

is it possible to issue a sub-CA and trust it only?

I'm currently a hobbyist trying to learn more about SSL. If I create my own CA for my virtual servers, and trust that CA on my devices, I can then issue certificates for my virtual servers, and my SSL ...
1
vote
1answer
71 views

What is Autocsr and is it secure?

I read an interesting article about something called autocsr for SSL certs. After reading I still could not figure out how it works. Doesn't generation of CSR happen on my box? The CA won't have ...
6
votes
3answers
5k views

Why are Certificate Revocation List periodically renewed?

While studying a security course I have been asked this very question: Why are CRL periodically renewed, even if there are no new revoked certificates to add to the list? Honestly I can't find the ...
2
votes
1answer
2k views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
0
votes
0answers
127 views

Appropriate uses for wildcard certificates

I have a client that wants to use a single Wildcard certificate purchased from a third party CA for the purpose of Server Authentication when connecting to and from AD LDS using SSL and for routing ...
3
votes
2answers
442 views

Why would Comodo SSL certs have two intermediate CAs (chain length 4)?

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs. What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a ...
12
votes
6answers
3k views

Is it possible for corporation to intercept and decrypt SSL/TLS traffic? [duplicate]

I found there are some companies claim that they offer service that can eliminate SSL/TLS blind spot, such as Blue Coat and Gigamon. Are they talking about some way of decipher the https content (...
2
votes
1answer
140 views

Can an Android malware install a SSL/TLS certificate into non-root devices?

Does there exist some standard API that allow an Android malware to download and install a SSL/TLS certificate as RCA, in the default keystore, in non-root devices? I think that this is a very ...
0
votes
1answer
43 views

Certificate format

Analyzing some payload I faced up to one which contains a string like this : VeriSign, Inc.10UVeriSign Trust Network1:08U1(c) 2006 VeriSign, Inc. - For authorized use only1E0CU VeriSign Class 3 ...
7
votes
2answers
826 views

How can CloudFlare provide a valid SSL certificate for domains not under its control?

CloudFlare provides a reverse proxy, and it offers SSL support ("flexible", "full", "strict full", and "keyless"). How does CloudFlare manage to get a valid certificate for domains it does not own? ...
9
votes
8answers
6k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
1
vote
0answers
54 views

Theory behind certificate for job account

I made it work a job account protected by a certificate in a java spring application but is not that clear to me the minimal steps.(Could you believe that :) I need some theory. Here my steps: ...
1
vote
3answers
673 views

Using self-signed certificates for your mail server

I have read multiple Q&A's on this topic from here and other SE sites. They all mention self-signed certs are not recommended due to MITM attacks. However, I haven't found anything with mention of ...
1
vote
2answers
228 views

Difference between KMS and PKI

While the PKI System deal with digital certificates life cycle and Key Management System (KMS) deal with keys life cycle. What is the the fundamental difference between them? Is it possible to ...
7
votes
2answers
1k views

One website - two different SSL certificates: two different CA's

I have seen multiple questions focusing on multiple certificates for a single domain (e.g.: a.com/example and a.com/example_one). However, what stops an individual from purchasing a certificate and ...
23
votes
5answers
5k views

Are self-signed certificates actually more secure than CA signed certificates now?

Are self-signed certificates actually more secure than CA signed certificates now? I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government ...
0
votes
0answers
94 views

Certificate policies extension in Root CA and Issuing CA

I am building new CA chain and PKI and I actually don't fully understand how I should include certificate policies (CP) and certificate practice statements (CPS) as extensions and how to work with it ...
0
votes
0answers
74 views

How to secure a service with Mutual SSL Authentication and Intermediary CA?

Given: A working SSL mutual authentication setup (a WCF service hosted in IIS) No Intermediary CA In the current setup any client in the world having a certificate signed be one of the well known ...
3
votes
1answer
69 views

New certificate but what about the keys?

One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a ...
4
votes
4answers
745 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude lower&...
5
votes
1answer
92 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
4
votes
2answers
140 views

Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised?

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company ...
2
votes
1answer
190 views

Bi-directional authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the abovementioned CA. Server has its own ...
4
votes
2answers
94 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
0
votes
0answers
29 views

How to test rootCA for issue subCA certificate

Can I check rootCA for issue subCA test certificate before issue real subCA cert? If rootCA issue test certificate and revoke immediately, then all operation log is recorded. Do this compliance with ...
6
votes
3answers
1k views

What if someone steals a Certificate authority's private key? [duplicate]

What if someone could steal a Certificate authority's private key? I know this will (probably) never happen, but what would happen to the certificates that were already signed with this private key? ...
1
vote
1answer
25 views

Certificate Policies & Certificate Practice Statements - Destroying Vs. Archiving CA's Private Keys (HSMs)

Please Consider: English is my second language. Background I have been looking at different CP/CPS on the web. They all seem to roughly follow the same practices. However, two different policies ...
1
vote
0answers
295 views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: http://www....
15
votes
3answers
2k views

Why are CA-issued certificates considered so much more secure than self-signed certificates

I looked at other Stack Exchange posts explaining why self-signed certificates are not as secure as CA-issued certificates, and most of these pages say the same thing: If it's self-signed, and the ...
1
vote
0answers
41 views

Let users sign in with eIDs - do I need government authorisation? (scope: all nation-states) [closed]

I've decided to launch a crypto-basic income system. Crypto UBIs are pretty popular now. For me, it seems like an open nation-state ID should exist by now (2015). However, Mike Hearn, Bitcoin core-...
1
vote
0answers
106 views

What are the risks of adding third-party Root CA certificate into NTAuth Store?

What are the risks associated with importing a third-party Root CA certificate into the Enterprise NTAuth Store in a Windows Active Directory domain? (Except that the CA is then trusted to issue ...
1
vote
1answer
66 views

Relationship between SSL cert database and that at the CA site

Say I am using a trusted third party CA site to manage my cert. I created a new cert called CertA at the CA web interface, downloaded the signed cert and use it on my web server. Some time later I ...
3
votes
1answer
152 views

SSL certificate trust chain shows root certificate with 1024-bit public key - Is this evidence of a MITM attack?

My account at my domain name registrar was hacked and I am trying to understand how the hackers were able to steal my login credentials. Because the root certificate in the trust chain for the ssl ...
2
votes
0answers
78 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
4
votes
1answer
102 views

Browsers root CA accepted, countries and checking fingerprints

This is a question derived from several others, and I can not comment on those, so it is not duplicated, please read: In some related questions some users comment that: "They wouldn't ...
12
votes
4answers
5k views

What are the risks of a localhost signed cerificate?

In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections. Suppose we use this CA to sign a key for "localhost" for use in ...
1
vote
2answers
234 views

Should I update my SHA-1 certificates? If so, how?

Q: Should I update my SHA-1 certificates? If so, how? Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been ...
-1
votes
2answers
78 views

Does any nation-state CA (certificate authority) have a public API to verify digital signatures? [closed]

There are around 200+ nation-states on the planet. Most of these use eIDs. Do any of these nation-states have a public API to verify digital signatures? Example: Nation-state Canada issues a eID to ...
6
votes
2answers
852 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
8
votes
4answers
1k views

What Country, State and City should I choose when requesting an SSL certificate?

I am really confused about the country, state and city I should select when submitting an SSL certificate. Should I provide the location of my servers or my current home address?I can always reissue a ...