A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

0
votes
3answers
1k views

In order to trust the digital certificate, does immediate CA cert also needs to be in trust store or root CA cert is enough?

In order to trust the digital certificate, does immediate CA certificate also needs to be in trust store or root CA certificate is enough?
1
vote
2answers
38 views

Certificate Subscriber Agreement

So, I decided to get an EV SSL certificate and I'm struggling to fill in some field on the agreement. Never done this before, anyone could help me figure this out for me? Thanks in advance!
0
votes
1answer
259 views

Begin of Certificate/ End of Certificate dash “-----”

What significance does the dash "-" holds along with the line -----BEGIN CERTIFICATE----- or -----END CERTIFICATE-----. I checked multiple docs and linked RFC's as well but could not find the ...
7
votes
1answer
925 views

How can a domain be impersonated with a fraudulent SSL certificate?

I was reading this article about the fraudulent certificates from Comodo back in 2011. It talks about domain impersonation. I understand that a fake website could be secured with the fraudulent ...
0
votes
1answer
64 views

CSR signing follow up question

This is a follow up question , after getting a signed certificate from one CA. researched a lot , but no luck. After getting the CA reply, While downloading the certificate, it popped up saying "...
3
votes
2answers
120 views

CSR Signing simulation

Tried a lot get my test csr signed from root CA(trial versions option), somehow i am not getting it dues to some of their internal check. Few questions that cropped up Can i somehow signed that ...
0
votes
1answer
532 views

How does driver install with an expired cert?

I'm working on making a silent installer of WinpkFilter driver. In my silent installation, I'm always getting a (not so silent) prompt that says "Windows can't verify the publisher of this driver ...
8
votes
4answers
6k views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
1
vote
4answers
1k views

Do all non-CA certs have to be End Entity certs?

Still learning the differences between certs. Can someone explain? The internet has so far been surprising not lucid in describing certificates. *EDIT to clarify EE
9
votes
2answers
426 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
1
vote
2answers
214 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
3
votes
2answers
403 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
1
vote
0answers
174 views

Making the Firefox key and CSR creation process transparent

Background I was a bit surprised that several CAs do not allow anymore to send a plain old CSR in text form to them which was created in the classic fashion with OpenSSL or similar. But this would ...
1
vote
0answers
38 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
3
votes
1answer
191 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
3
votes
4answers
276 views

How safe is SSL on an untrusted computer and network?

In situations where the consumer doesn't trust/control the workstation and the network, can consumer safely do potentially sensitive activities (like making a payment or transferring confidential ...
6
votes
3answers
4k views

What part of TLS specifies how to verify a certificate chain

I have sometimes run into a situation where I see a root CA certificate which is set to expire sooner than the intermediate CA certificate. My question is - if you were interested in keeping your ...
1
vote
1answer
516 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
2
votes
1answer
139 views

Why do Certificate Authorites cross-sign each other?

A Certificate Authority (CA) issues digital certificates to certify the ownership of a public key by the named subject of the certificate. What is the rationale for CAs cross-signing each other (i.e. ...
4
votes
1answer
168 views

Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?

From my understanding domain validation certificate are verified by receiving an email on some special email addresses on the domain (e.g. postmaster@example.com, admin@example.com) or by sending on ...
3
votes
2answers
381 views

If your company/university requires you to install root certificates what protects you from man in the middle attacks?

Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is ...
28
votes
4answers
2k views

Can any CA sign any domain?

Can any CA sign any cert for any domain? If the answer is yes, what prevents having two different CAs creating a valid cert for the same domain? Does that mean that the whole TLS security has the ...
2
votes
2answers
536 views

Are there other roots of trust on my computer aside from these 46 root certificates?

I've heard many people imply that modern browsers and OSes trust a myriad of root certificates. The implication is that it is impossible to ensure the private keys of all of the root certificates ...
3
votes
2answers
471 views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a certificate?...
2
votes
1answer
93 views

Is client cert authentication with a 3rd party PKI cert any safer than using self-signed?

I am working on a small M2M project (a few hundred nodes connected to a single cloud server), and want to use client certificate authentication, with each client getting its own unique cert at ...
0
votes
2answers
73 views

Current standard of authentification

What is the current standard of authentification? I thought it is server and client authentification. But I typed for e.g. https://www.google.com/ and checked the packages in wireshark. And there ...
2
votes
1answer
77 views

Website Implementing https site w/ self signed certs and CA

Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)? I am some what torn on how to do this - I have a number of implementaiton ...
1
vote
2answers
107 views

Is there a Standard Verification process for Certificate Authorities to follow?

So the premise of the question is to quantify the risk of wild card certificates versus regular certificates. From my research the greatest fundamental danger of wild card certificates is the ...
0
votes
1answer
2k views

Can I create an SSL certificate on windows signed with the machine's certificate?

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a ...
1
vote
1answer
44 views

Re-Use Client Certifactes

I have a legacy web application where user are identified and authenticated with client certificates. Now, customer wants to use the same client certificate to authenticate against a newly created web ...
4
votes
2answers
932 views

Will Let's Encrypt require SNI from the operators?

I'm curious if anyone knows whether the upcoming Let's Encrypt initiative would effectively require SNI. What I mean is, with the proliferation of the cloud, almost every web-site owner, even with ...
4
votes
1answer
104 views

Installing a CA only for specific domains

For many reasons, it's often convenient for organizations to have their own CA (self-signed or otherwise). As I understand it, adding the CA certificate to a OS or browser will make it trust the ...
-1
votes
1answer
326 views

Android phone (Kitkat) lists a lot of CAs

My Android phone (Kitkat) list a LOT of CA under setting->security->Trusted credential. Does it mean that anyone who has access to any one of those private keys of those CA(s) can monitor or do "Man ...
9
votes
4answers
696 views

How does “Let's Encrypt” provide authenticity?

https://en.wikipedia.org/wiki/Let's_Encrypt https://en.wikipedia.org/wiki/Information_security#Authenticity AFAIK with "Let's Encrypt", we could create HTTPS websites with only one command. ...
0
votes
2answers
106 views

How do certificates work in protecting against a man-in-the-middle attack? [duplicate]

As I understand it, if Alice and Bob wants to communicate securely, they must first agree on the protocols that will be used. Then they must confirm that they are indeed communicating with each other. ...
1
vote
2answers
95 views

Security of certificate when using DNSSEC

When setting up secure server, it is suggested not to use self-signed certs and instead to be signed by a CA. Of course, post-Snowden we now know that there may be problems with CA's that could allow ...
2
votes
2answers
109 views

Is it possible to use an open collection of default SSL certificates for my browser?

Browsers and OSes come with a set of default SSL certificates for well known organizations, such as root certificates from CAs. I understand that the trust model is as follows: I pick (actually my ...
1
vote
0answers
98 views

Can't get my SSL CA to work with Apache

So I have an SSL enabled website running on Apache2. https://eamorr.com (I get a warning in my browser, as expected) I have a config file for this website at: /etc/apache2/sites-available/eamorr....
1
vote
0answers
72 views

Setup local Certificate Authority & integrate with SCEP

I want setup local Certificate Authority and issue X.509 certificates under my CA. In order to achieve this I am exploring following options such as: OpenSSL/OpenCA BouncyCastle Cryptographic APIs ...
3
votes
1answer
144 views

PKI - Why Root CA is in intermediate CA section?

I can't understand why, when I accept to "install" a custom self signed Root CA on IE browser, the root certificate ends up in the "intermediate CA" section, rather than in "Root CA" section in the ...
5
votes
1answer
616 views

Should I install my subordinate Certificate Authority on the domain controller? Why?

I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a ...
0
votes
2answers
787 views

Installing and updating a CA certificate on a client

I am trying to implement a system where a client can download application packages from a server to install/update them on the client. I suppose that the client is something like a platform on an ...
0
votes
2answers
255 views

Security of SSL certificates bought via resellers

There are many SSL certificate resellers - some are well known enterprises with good reputation (e.g. domain name registrars) while others are small and unknown companies. It is clear that resellers ...
1
vote
1answer
216 views

Is a SSL CA signed certificate necessary when connecting with IP Address?

I'm currently creating a socket server, and would like to encrypt communications. The thing is, the client will connect directly to the ip without any DNS. (Every user will know the Server's IP ...
53
votes
2answers
4k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
6
votes
1answer
12k views

Should the thumbprint be SHA2 in addition to the Signature Hash Algorithm?

I'm looking at a Windows PKI and see that the Thumbprint is SHA1, while the Signature is SHA2 (SHA256). Is this an acceptable configuration? Should I recommend that the client update to SHA2 for a ...
1
vote
2answers
182 views

What kind of SSL certificate do I need? [duplicate]

I am making a web site which can be considered similar to Reddit in some ways. I need to implement a sign up form so I will store informations about the users. My idea is to store the username, ...
0
votes
2answers
131 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
0
votes
1answer
206 views

MITM faking certificates

I am looking at the theory behind MITM attacks in order to see some unencrypted packets from the 3DS. From research here is what I understand so far: 3DS > Proxy > Nintendo server I am going to try ...
3
votes
3answers
658 views

Corporate PKI - SHA1 deprecation

Here is the context. Suppose you have a corporate PKI with : AC_Root (offline in safe store - SHA1 signature) SubRootA and SubrootB (offline in safe store - SHA1 signature) SubSubRootC, SubSubRootD, ...