Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

0
votes
4answers
116 views

Temporarily suspending a Certificate Authority's Certiticate

The PKI RFC talks about revoking or suspending certificates. It also talks about revoking CA certs. However, I could not find anything about whether a CA or a Sub CA's certificates can be revoked or ...
0
votes
1answer
538 views

Is it safe to accept the security certificate from AOL chat? [closed]

Is it safe to accept the security certificate from AOL chat? Did they recently change their certificates? These images are from Pidgin.
0
votes
1answer
1k views

List of certificate authorities in browsers and mobile platforms [duplicate]

Is there a list of certificate authorities installed in popular browsers and mobile platforms? I am considering a few alternatives for an SSL certificate, and I would like to make sure that the one ...
0
votes
1answer
3k views

Grey vs Green padlock in address bar - technical difference [duplicate]

What is a technical difference between "grey padlock" and "green padlock" in URL bar in browsers? As an example we can take: Green padlock: Bank of America Grey padlock: Google Search Both of ...
0
votes
2answers
757 views

Security Certificate not from a valid authority

I have no real knowledge about this stuff so I figured I'd ask here for some answers. So I started to get this "Security Certificate not issued by a valid authority" error when using my email client ...
0
votes
1answer
165 views

Should all Server Certificates from one CA have the same CRL

I am setting up my own PKI, and I came across a question to which I couldn't find an answer. I want to specify CRLDistributionPoints in my server certificates but I am curious whether to use the same ...
0
votes
1answer
307 views

How does ssl prevent MITM attacks [duplicate]

My understanding of how it works : A victim asks for the public key of a server. The attacker just forwards this request. The server now responds with a certificate which contains the Public key. The ...
0
votes
1answer
3k views

Problems with intermediate ssl certificates and ssl proxy

I'm currently implementing a SSL-proxy, and have run into some problems regarding certificates. We have a offline "Company Root CA", and an online "Company intermediate CA". On the proxy I have ...
0
votes
1answer
8k views

How to create trusted chain of certificates if I have the last certificate?

Good day. During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using) My server is: telnet xmpp.odnoklassniki.ru ...
0
votes
2answers
53 views

Is there any possibility that a trusted CA can perform a man in middle attack? [duplicate]

Is there any possibility that a trusted CA can perform a man in middle attack? Since the CA certificate is installed and trusted by the browser it will never raise a warning message. Hope my doubt ...
0
votes
1answer
113 views

How does driver install with an expired cert?

I'm working on making a silent installer of WinpkFilter driver. In my silent installation, I'm always getting a (not so silent) prompt that says "Windows can't verify the publisher of this driver ...
0
votes
2answers
67 views

Current standard of authentification

What is the current standard of authentification? I thought it is server and client authentification. But I typed for e.g. https://www.google.com/ and checked the packages in wireshark. And there ...
0
votes
1answer
178 views

Will Let's Encrypt require SNI from the operators?

I'm curious if anyone knows whether the upcoming Let's Encrypt initiative would effectively require SNI. What I mean is, with the proliferation of the cloud, almost every web-site owner, even with ...
0
votes
2answers
208 views

Security of SSL certificates bought via resellers

There are many SSL certificate resellers - some are well known enterprises with good reputation (e.g. domain name registrars) while others are small and unknown companies. It is clear that resellers ...
0
votes
2answers
69 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
0
votes
1answer
57 views

Add certificate authority to one browser only

For testing purposes, I'd like to add a "CA" to the list of trusted-CA's of one browser - and use it only for testing. I want to make sure that it won't get added to the computer's trusted CA list. ...
0
votes
1answer
1k views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
0
votes
2answers
98 views

is Digital Signature vulnerable on the Internet?

We all know about how Digital Signing works. I just have some questions about vulnerability risk. At first, As I know, the Signature and the Data are separated and we can split the document into two ...
0
votes
1answer
217 views

Why are CA's now signing root certs with SHA2?

I see that CA's are now giving the option of having the root CA cert signed with SHA2. I have been told that the hashing function in a root has no security value, and is irrelevant as far as a ...
0
votes
2answers
105 views

Why do certificate authorities often require/use multiple intermediates?

I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway. Why do most modern certificate authorities (e.g. ...
0
votes
1answer
200 views

Is my understanding about how SSL works correct?

I've been reading about 2-way SSL or mutual auth recently, and here's what I've figured so far: Mutual auth is a way for the client to authenticate itself to the server, just like the server does to ...
0
votes
1answer
123 views

Does openssl store the certificate of the server after verification is done?

As per my understanding , openssl will verify the certificate of the server during ssl handshake , using the trusted CAs present in the CA certificate dir in the context. After the server certificate ...
0
votes
1answer
61 views

Can two parties sign each other's certificate and exchange without CA?

Is possible (and practical) for two users to create their own self-signed SSL certificates, exchange these certificates (perhaps in a face-to-face meeting), and then communicate with each other ...
0
votes
1answer
90 views

Is it possible to create a SMIME only PKI that *can't* be used for SSL?

Assume I have a Root CA that I want to share with hostile untrusted 3rd parties. Then constrain this root using specific EKUs at the root. OID=1.3.6.1.5.5.7.3.4 ; Secure Email Next, ...
0
votes
1answer
691 views

Trusted Certificate Authorities - how do they work?

microsoft.com for example can use a Verisign Certificate for their domain. What are the chances that an attacker could ask verisign for a m1crosoft.com domain and get approved? It is very simillar, ...
0
votes
1answer
37 views

Certificate extensions - specific constraints

I have question about extensions of certificate and what specific extension should I use in my situation. The problem is following: I have a CA and I want that CA will issue certificate only for ...
0
votes
3answers
3k views

SSL Certificate for an email server

I am completely new to SSL/TLS and would appreciate any help you guys could give me. To give you some background info, our company website is hosted externally by our ISP, however our email is ...
0
votes
2answers
200 views

SSL can stop MiTMs … but on the long run, can it really? [duplicate]

SSL uses CAs which sign certificates for the domains after they validate that the person requesting is truly the owner and by a public/private key pair a encrypted connection is achieved which cant be ...
0
votes
1answer
291 views

SSL (TLS v1.2) - Can i offer fallback CAs when upgrading Certificates? (Java)

I am currently developing a product that involves two network situations. At the client side, multiple computers form a P2P network (multiple locations, multiple p2p networks), and a subset of nodes ...
0
votes
2answers
1k views

Issuing browser certificates to Chrome and Firefox with Microsoft CA

Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval. Since many browsers either block or don't support ActiveX controls, how can I enroll them using a ...
0
votes
0answers
23 views

Changing the signature on a cert or creating a key file from an existing cert [migrated]

I would like to create a certificate with a specific public key. I have another certificate which contains the public key I need to use, and I wish to change the signature on that certificate to a ...
0
votes
0answers
20 views

Extract the content of PKCS7 file in Java

I have a PKCS#7 signature that have the content‐type signed data and it embeds an XML document, and I have to extract the xml document from this PKCS7 file. Anyone know how to do that in java ??
0
votes
1answer
50 views

CSR signing follow up question

This is a follow up question , after getting a signed certificate from one CA. researched a lot , but no luck. After getting the CA reply, While downloading the certificate, it popped up saying ...
0
votes
0answers
99 views

Self signed certificates and SBS 2008

I have been researching certificates for the past few days and one of the things I don't understand is how certificates created by SBS (Small Business Server from Microsoft) are validated when trying ...
0
votes
1answer
89 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
0
votes
0answers
58 views

Self-signed certificates, CA and stacking

I have a server running a number of virtual hosts. I have setup as a "self-CA" and then created and signed certs for each of the virtual hosts. In running the SSL labs testing, it always complains ...
0
votes
2answers
81 views

How do certificates work in protecting against a man-in-the-middle attack? [duplicate]

As I understand it, if Alice and Bob wants to communicate securely, they must first agree on the protocols that will be used. Then they must confirm that they are indeed communicating with each other. ...
0
votes
2answers
188 views

Installing and updating a CA certificate on a client

I am trying to implement a system where a client can download application packages from a server to install/update them on the client. I suppose that the client is something like a platform on an ...
0
votes
0answers
62 views

Can't get my SSL CA to work with Apache

So I have an SSL enabled website running on Apache2. https://eamorr.com (I get a warning in my browser, as expected) I have a config file for this website at: ...
0
votes
0answers
64 views

Is ADCS overkill just to replace self-signed certs?

Several of our internal applications are either not using SSL certificates, or are using self-signed certificates. I wanted to utilize ADCS to create a trusted, internal-only root CA that our browsers ...
0
votes
0answers
26 views

Client side ssl auth by signing with server key [duplicate]

So I followed this for setting up client ssl certs using openssl: http://drumcoder.co.uk/blog/2011/oct/19/client-side-certificates-web-apps/ It basically walks through creating a new CA key, and then ...
0
votes
2answers
106 views

How are “Certificate Signing” key usage certificates restricted to what domains they can sign?

Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate ...
0
votes
0answers
77 views

What certificate attributes can I check to verify if an issuer is correct?

Apologies if this is a duplicate question. I thought I saw this discussed earlier but couldn't find the thread when searching. What attribute can I check to verify if I have the correct ...
0
votes
2answers
425 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
0
votes
0answers
126 views

Problems implementing Authority Information Access in a certificate

I am implementing SSL certificates for internal use in an application. Due to the nature of this app, I'm basically implementing my own CA. I have created a self-signed cert for the CA to issue ...
0
votes
1answer
112 views

Hacked Router Faking a Certificate Authority

Does a typical computer begin with any shared secret with a certificate authority when I buy it? If not, a compromised home router could fake everything and get my credit card info when I attempt to ...
0
votes
1answer
90 views

Will the recently found OpenSSL vulnerability Heartbleed affect my public site for which I obtained an SSL certificate from a CA? [duplicate]

I had generated the CSR with OpenSSL. Do I need to regenerate a new CSR with no vulnerability due to OpenSSL in order to obtain a new certificate from a CA?
0
votes
1answer
234 views

SSL Auth to proxy using Certificate on Client-side

The question may need to be reworded. The server-side is set up with Squid3 acting as an Authenticating proxy by way of LDAP. I did this for testing purposes to make sure everything was working. I ...
-1
votes
2answers
195 views

Installing self-made cert as trusted CA on windows?

I'm looking into using mitm-proxy, but part of the process of filtering/snooping SSL is that you must generate and install a root cert as a trusted CA, so that mitm-proxy can generate and throw out ...
-1
votes
1answer
155 views

Who can view my https browsing habbits? [closed]

I was wondering about HTTPS security and how easily is compromised. I have already read the similar threads in here, but I have some more questions: Let's say I am searching something at Google. ...