A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

4
votes
2answers
76 views

Trusting the “subject” of an x509 certificate

A bit of background. Our organization is working on a document format that will be ingested by our software. We're using the CMS format to verify the integrity (by validating the signature). The CMS ...
4
votes
2answers
92 views

Good way to obtain an EV SSL certificate for personal use? [closed]

I would like to obtain some sort of digital certificate for personal use. I would like to use this for encrypting and signing e-mails, digitally signing contracts, and for providing authentication of ...
4
votes
1answer
102 views

Browsers root CA accepted, countries and checking fingerprints

This is a question derived from several others, and I can not comment on those, so it is not duplicated, please read: In some related questions some users comment that: "They wouldn't ...
4
votes
1answer
168 views

Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?

From my understanding domain validation certificate are verified by receiving an email on some special email addresses on the domain (e.g. postmaster@example.com, admin@example.com) or by sending on ...
4
votes
2answers
928 views

Will Let's Encrypt require SNI from the operators?

I'm curious if anyone knows whether the upcoming Let's Encrypt initiative would effectively require SNI. What I mean is, with the proliferation of the cloud, almost every web-site owner, even with ...
4
votes
1answer
103 views

Installing a CA only for specific domains

For many reasons, it's often convenient for organizations to have their own CA (self-signed or otherwise). As I understand it, adding the CA certificate to a OS or browser will make it trust the ...
4
votes
1answer
1k views

Different SSL states as seen by Safari, Chrome and Firefox

Today, I visited some sites of the German DHL group. While Chrome and Safari complain about an invalid certificate of Firefox accepts it. Which one is right, which one is wrong? Which decision ...
4
votes
1answer
117 views

Are there any public examples of an encrypted attribute in a Verisign-issued certificate?

This Credentica- UProve paper describes how Verisign issues (or did issue in the past) certs with encrypted attributes: "VeriSign issues certificates that contain encrypted attributes that can be ...
4
votes
2answers
221 views

How can an “alternate” or duplicate HTTPS certificate be used in an attack?

Inspired by an old question from PulpSpy, I'm trying to think of whether this is a significant weakness in the Certificate Authority system. Here are the attack methods that I think would work - ...
4
votes
3answers
2k views

Is it possible to modify a CA without having to reissue all of the derived certificates?

Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I don'...
4
votes
1answer
149 views

Issuing and managing large numbers of certificates for client authentication

I am developing an Internet of Things product and plan to use client certificate authentication, issuing each "thing" its own certificate on the production line so that it may authenticate with a ...
4
votes
2answers
94 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
4
votes
2answers
235 views

Why did browsers deprecate 1024-bit RSA, but retain SHA-1?

I was reading Mozilla's security blog Phasing out Certificates with 1024-bit RSA Keys. Effectively, some browsers are deprecating 1024-bit RSA for CAs and Subordinate CAs because the certificate must ...
4
votes
1answer
763 views

Self-signing client certificates and distributing them, is the following a sound procedure?

I have a case at hand as follows: There is a number of clients in Internet (i.e. untrusted channel), initially in hundreds but growing in numbers. There is a server doing processing related to these ...
4
votes
1answer
255 views

Remove CA from trusted CAs list while trusting it older certifications

Lets say that some certificate authority changed her security policy and we don't trust her new certifications. Is there any convenient way for an organization to remove this certificate authority ...
4
votes
2answers
142 views

Using SSL Certification in Multiple Locations

I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access. The ...
4
votes
1answer
1k views

Sites are signed with an incorrect VeriSign Class 3 G5 CA

Previously today, I encountered a SSL error trying to access twitter.com in Chrome. Investigating the issue, I encountered the same error accessing discussions.apple.com. Most other HTTPS sites were ...
4
votes
1answer
420 views

Secure Connection between two mobile (Android and/or iOS) devices

I've a Device A which will communicate with multiple devices on a network (BLE and/or NFC). All the devices will be handled a Token upon authentication which somehow needs to be transferred over to ...
4
votes
2answers
189 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
4
votes
2answers
4k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
4
votes
1answer
137 views

What is the meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC from ETSI TS 102 231 V3.1.2

From Technical Spec http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC a Root Certification Authority from which a certification path can be established down to ...
3
votes
6answers
6k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...
3
votes
7answers
1k views

Which forensic techniques should I use to identify intrusion or monitoring of my computer or cellphone

If I suspect my computer or cellphone is being monitored by an unknown attacker, what tools or techniques could I use to detect or identify such monitoring?
3
votes
4answers
2k views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
3
votes
4answers
267 views

Why isn't there a Global Root for SSL?

I was just wondering why there is a file on your computer implementing the trusted root CA's instead of something similar to DNS where there is a file on root servers that computers check against to ...
3
votes
2answers
89 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
3
votes
3answers
1k views

What stops a hacker from installing it's own CA certificate?

Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following: ...Such is the case with that small company in the Netherlands, ...
3
votes
3answers
346 views

Do on-demand SSL certificates exist?

A few days ago, I visited an SSL protected website. Since Safari complained about the SSL-certificate, I did a short inspection: The certificate was issued by GoDaddy in just the minute I ...
3
votes
1answer
2k views

Why a web server HTTPS certificate can't sign its subdomain HTTPS certificates?

Why having a valid certificate for "exampe.com" I can't make a "child" certificate for "subdomain.example.com"? What insecurities will arise if browsers start allowing domain's certificates to be ...
3
votes
2answers
260 views

Is it possible for my employer to replace the root CA on my phone?

I've read about corporate MITM 'attacks' where they replace the root CA on company hardware in order to monitor traffic over SSL that takes place on their network, but is it possible for them to do ...
3
votes
3answers
2k views

From a trust perspective, is renewing a CA certificate the same as trusting a sub-CA?

I'm trying to understand the validation logic that would occur in the following hypothetical scenario An unpatched XP user who trusts a list of root CAs. Those CAs in particular have been renewed (...
3
votes
1answer
2k views

Purpose of certificates signed and trusted by CA

Another newbie question but I just don't get the purpose of certificates signed and trusted by CA. We already have public/private keys, hash functions to sign/encrypt messages so why do we need ...
3
votes
4answers
643 views

Evil certificate authority in public-key-infrastructure

Alice goes to the certificate authority (CA) and registers her public key for signature verification. She gets a certificate for this from the CA. Bob requests Alice' public signature verification key ...
3
votes
2answers
864 views

Should I customize my Root CA's thumbprint/fingerprint? (SHA1 or MD5)

My goal is to make a certificate's thumbprint "easier" to verify, and not reduce security in doing so. Given that the RSA-based Bitcoin technology has a concept called a "Vanity address" where the ...
3
votes
2answers
2k views

What to do with expired certificates as a CA?

This and this answer says that "once a certificate has expired, the CA ceases to keep track of its revocation status". I'm trying to learn how OpenSSL works as a CA. If I have a revoked expired ...
3
votes
2answers
209 views

SSL Certificate Signing by a CA

Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return. What I don't understand is what, exactly,...
3
votes
2answers
146 views

Can a CN-only certificate bypass a name constraint if the CA goes rogue?

I am trying to cross-certify an internal issuer certificate, adding a name constraint for our domain. However, it seems that an attacker could bypass this protection by putting the desired host name ...
3
votes
3answers
897 views

Why does the RFC 5280 dictate the CAs not to issue certificates with negative serial numbers?

I have tried to issue a certificate beginning with 8 to F but I have found it is impossible, mostly due to the RFC: The serial number MUST be a positive integer assigned by the CA to each ...
3
votes
1answer
242 views

Is it a good idea to generate certificate-specific CRLs? What is this technique called?

Suppose I create 3 certificates with the following CRLs Cert1 http://crl.server.com/batch1/root1.crl Cert2 http://crl.server.com/batch2/root2.crl Cert3 http://crl.server.com/batch3/root3....
3
votes
1answer
94 views

How does Let's Encrypt prevent imposters?

Because Let's Encrypt doesn't provide Entity Validation, is it true that one can, for example, generate a certificate that has "Facebook Inc." as Organization for a bogus domain faceb00k.com?
3
votes
1answer
121 views

TLS - How to know a CRL URL is not changed

If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be ...
3
votes
1answer
270 views

Check root certificates and certificate authorities on new PC

First Lenovo was caught shipping Superfish with new PCs, which included a universal self-signed certificate authority, and now Dell has been caught shipping PCs with a similar root certificate. What ...
3
votes
2answers
125 views

Is it possible to let a fake certificate appear valid by sending fake OCSP responses?

In a MITM-Attack I can exchange the server certificate by one I created on my own with tools like MITMProxy or SSLSplit. But this only works well when I have installed a fake CA cerrtificate in the ...
3
votes
1answer
226 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...
3
votes
2answers
142 views

Isn't this the same as using a certification authority?

Taken from Wikipedia, here is the pretext to my question: A certificate authority (CA) is an organization that stores public keys and their owners and every party in a communication trusts this ...
3
votes
2answers
5k views

Protecting against SSL Strip [duplicate]

I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe? Does it depend on the cert strength? Do you ...
3
votes
1answer
71 views

SSL negotiating too low a protocol?

I'm trying to diagnose a potential SSL/TLS problem between a Mac client and a Windows server. I have generated my own root cert and signed a cert for the server, and installed the root cert on the ...
3
votes
1answer
86 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
3
votes
2answers
403 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
3
votes
4answers
275 views

How safe is SSL on an untrusted computer and network?

In situations where the consumer doesn't trust/control the workstation and the network, can consumer safely do potentially sensitive activities (like making a payment or transferring confidential ...