Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

2
votes
1answer
3k views

SSL cert not turning green anymore

I'm running a drupal site and have asked about this issue pertaining specifically to the drupal aspect of it here. I know that the "Green" https url doesn't show up because the cert itself isn't ...
2
votes
3answers
100 views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
2
votes
2answers
201 views

If your company/university requires you to install root certificates what protects you from man in the middle attacks?

Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is ...
2
votes
2answers
94 views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a ...
2
votes
2answers
178 views

Why would Comodo SSL certs have two intermediate CAs (chain length 4)?

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs. What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a ...
2
votes
1answer
405 views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
2
votes
1answer
95 views

Is there any mechanism to audit which signed certificates are unrevoked?

We are currently using EasyRSA and OpenSSL to manage our user VPN certificates for OpenVPN. The process we have in place currently is: User generates a CSR on their laptop and sends it to us to sign ...
2
votes
3answers
114 views

How are public key certificates updated securely?

Let's say I get a new computer that's never been connected to the internet before. The first time I connect it to the internet, is it susceptible to a mitm attack while downloading its public key ...
2
votes
1answer
158 views

Why does facebook php sdk (and multiple others clients) include CA bundle with a lot of CAs?

This is what facebook ships with their API php client: https://github.com/facebook/facebook-php-sdk-v4/blob/master/src/Facebook/fb_ca_chain_bundle.crt It contains dozens (hundreds?) Root CAs. But ...
2
votes
2answers
396 views

Why do public key certificate “Trust anchor”? Does this introduce a single point of failure?

When you look at currently used concept of Root CA (primarily in SSL/TLS context), you can see a single-point-of-failure vulnerability, which means, if your private key is disclosed, you automatically ...
2
votes
1answer
2k views

Root certificate key usage (non-self-signed end entity)

This discussion does not include self-signed end entity certificates for hosts like web servers and mail servers. OpenSSL's default configuration for a CA certificate has the following keyUsage: ...
2
votes
1answer
781 views

Different SSL states as seen by Safari, Chrome and Firefox

Today, I visited some sites of the German DHL group. While Chrome and Safari complain about an invalid certificate of Firefox accepts it. Which one is right, which one is wrong? Which decision ...
2
votes
2answers
5k views

Public Key → Certificate?

Is it possible to convert a public key to a certificate using the public key only? I've seen the following, which takes a private key to form a cert request, which can then be self-signed: openssl ...
2
votes
1answer
339 views

Security Certificates - Tools to Generate Security Certificates

I want to create a self-signed certificate that will be installed as a trusted certificate authority. I then want to create another two certificates which are signed using the private key of the ...
2
votes
1answer
108 views

HTTPS client certificates for server-to-server

Say you have two servers with certificates proving their domains (e.g. for use with HTTPS). Can one of these servers use their certificate as a client certificate when talking to the other, so that ...
2
votes
1answer
51 views

Possibility of using CA as an attack point by governmental organizations under their pressure

I was always concerned about the model of trust behind CA stuff we use . Well, for most of us, it is OK to trust them, since they are reliable organizations with a bunch of solid experience. ...
2
votes
2answers
89 views

What's the mitigation strategy for when a CA's private key is stolen?

I'm new to SSL/TSL and was wondering if you could walk me through the following scenario. Scenario Let's say I am one of a thousand websites that has a certificate signed by some certificate ...
2
votes
2answers
59 views

Is there a website or other resource that lists operating systems/platforms and the included root certificates?

I need to choose a certification authority (CA), to get a certificate, but I noticed that there are several of these only present in some operating systems/platforms like windows. I need to choose one ...
2
votes
2answers
301 views

Certificate authorities: history and registration

CA's are a key part of the internet's infrastructure few people are aware of. SSL was mostly hacked together at Netscape in 1995. I'd like to understand more about the organizational structure of CA's ...
2
votes
1answer
161 views

What do people mean by “top-down manner” in X.509 certificates?

What do people mean by saying that X.509 certificates work in "top-down manner"? Do they say that because CAs can do cross certifications?
2
votes
2answers
242 views

Can I buy a signing-valid certificate for internal use?

So now that I have to implement "secure transport" as defined by The Direct Project (not to mention reinventing a bunch of wheels, but that's another story for SO), I find myself staring down the ...
2
votes
3answers
377 views

Are intermediate signing certs the only secure+practical way to manage OpenVPN client certs?

My organization needs to issue (and revoke) OpenVPN client certificates for people working remotely. Our system is based on a standard OpenSSL CA setup and the easy-rsa tools, and the whole directory ...
2
votes
1answer
1k views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
2
votes
2answers
195 views

Why CAs instead of global fingerprint database?

Why do we use "too big to fail" CAs and the chain of trust instead of a global fingerprint database in a similar vein to how ssh works?
2
votes
1answer
131 views

Which .CER file format is more secure for purposes of an AIA record?

What file format is most appropriate or secure for the AIA record in a PKI certificate? The options I'm aware of are: DER encoded binary X.509 (.cer) Base-64 encoded X.509 (.cer) I also have the ...
2
votes
2answers
98 views

Does it make sense that OCSP returns state for the signer CA itself

I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...
2
votes
1answer
222 views

Any problems with UCC (multidomain) SSL certs on iOS and Windows Phones?

Are they any known issues with UCC (multidomain) SSL certs on iOS or Windows Phone? Let's say I want to have Exchange server under outlook.mycompany.com and RemoteApp Portal under ...
2
votes
3answers
197 views

What is the worse that could happen if a government wanted to interfere with a CA?

In our time of SOPA, PIPA and ACTA, I was wondering what could happen if a government wanted to remove the certificate of a website ? CA are companies, so they would have to obey to instructions from ...
2
votes
1answer
97 views

Security Structure of an API

I've been developing a web application and APIs for 8 months. I implemented OAuth 2.0 client credentials for authentication. And now I have to implement TLS to my APIs. I've been dealing with SSL/TLS ...
2
votes
2answers
27 views

Certificate Subscriber Agreement

So, I decided to get an EV SSL certificate and I'm struggling to fill in some field on the agreement. Never done this before, anyone could help me figure this out for me? Thanks in advance!
2
votes
1answer
54 views

Is client cert authentication with a 3rd party PKI cert any safer than using self-signed?

I am working on a small M2M project (a few hundred nodes connected to a single cloud server), and want to use client certificate authentication, with each client getting its own unique cert at ...
2
votes
1answer
41 views

Website Implementing https site w/ self signed certs and CA

Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)? I am some what torn on how to do this - I have a number of implementaiton ...
2
votes
2answers
67 views

Is it possible to use an open collection of default SSL certificates for my browser?

Browsers and OSes come with a set of default SSL certificates for well known organizations, such as root certificates from CAs. I understand that the trust model is as follows: I pick (actually my ...
2
votes
1answer
284 views

OpenVPN: Storage location and creation of keys/certificates?

I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance. It's noted that the best security policy is to keep the Certificate Authority (CA) offline ...
2
votes
1answer
159 views

How do I get a third-party-signed ssl client certificate?

I've been given a requirement of providing a client certificate to authenticate between two application's web services. The other application (that I don't host) is requiring an SSL client certificate ...
2
votes
2answers
382 views

Certificate authority structure - best practices

I'm working for a company that sells software products to customers some of which do not have the resources and/or know-how to build and maintain their own CA (used for the SSL communication of our ...
2
votes
1answer
303 views

What is the advantage of buying an SSL certificate from the CA rather than a reseller?

I am trying to do some research on SSL certificates, and I've come across a number of reseller sites such as GoGetSSL, which offer certificates at much lower prices than what you would pay if you ...
2
votes
1answer
571 views

How can a trusted intranet certificate be issued if they are being phased out?

I've just seen this article regarding the phasing out of intranet names on SSL certificates. However, CAs such as this one claim to still issue them and it will be "Trusted by all popular browsers" ...
2
votes
1answer
139 views

Curious about best start for autoresponding Certificate Authority (CA)

I am just getting started trying to implement some internal PKI ideas, where my app would need a cert to 'sign' messages. Since this is all completly internal, we have some degree of trust, and I ...
2
votes
1answer
1k views

What are attribute certificates? Why would someone partition a certificate by reason codes?

In "How Certificate Revocation Works" a brief mention of Attribute Certificate and Reason Code partition is made: If validated by a client that supports partitioned and indirect CRLs, the IDP ...
2
votes
1answer
42 views

Difference between Certificate pinning and public key pinning

I understand what pinning is. I had read about Certificate pinning and I appreciated it's use case. But today I learned pinning can be of two types - pin the certificate or pin the public key ...
2
votes
0answers
21 views

Is it necessary to purchase an OID for ADCS? [migrated]

I am interested in utilizing ADCS to generate trusted certificates for internal web applications. However, from my readings it appears that I need to purchase an OID, which looks pretty expensive. Is ...
2
votes
0answers
16 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
2
votes
1answer
150 views

Finding the type of SSL certificate with cURL

This is a part of curl's verbose output when connecting to the HTTPS site of Google. * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * ...
2
votes
1answer
232 views

Sending Digital Certificates

I used the makecert tool in order to create: a self-signed certificate a server certificate using the self-signed certificate a client certificate using the self-signed certificate I then ...
1
vote
2answers
528 views

Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
1
vote
3answers
869 views

Benefits to using EV certificates with a privately hosted Certificate Authority

For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate? Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the ...
1
vote
1answer
776 views

Why a web server HTTPS certificate can't sign its subdomain HTTPS certificates?

Why having a valid certificate for "exampe.com" I can't make a "child" certificate for "subdomain.example.com"? What insecurities will arise if browsers start allowing domain's certificates to be ...
1
vote
1answer
307 views

How to become an internationally recognized certificate authority (CA)?

What's the procedure a certificate authority (CA) must follow to get internationally recognized, like Verisign or GlobalSign?
1
vote
2answers
125 views

Is there any point to keeping a “Verified by X” image on the page for a page secured by SSL?

So, I saw this on a page: (The redacted part says the name of the entity that owns the domain) The page recently got SSL certs verified by GeoTrust. The image is on ...