A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

1
vote
1answer
56 views

What is Autocsr and is it secure?

I read an interesting article about something called autocsr for SSL certs. After reading I still could not figure out how it works. Doesn't generation of CSR happen on my box? The CA won't have ...
1
vote
2answers
143 views

Difference between KMS and PKI

While the PKI System deal with digital certificates life cycle and Key Management System (KMS) deal with keys life cycle. What is the the fundamental difference between them? Is it possible to ...
1
vote
3answers
117 views

Can any website secured using TLS can be impersonated using a rogue certificate issued by a rogue CA?

Any website secured using TLS can be impersonated using a rogue certificate issued by a rogue CA. This is irrespective of which CA issued the website’s true certificate and of any property of that ...
1
vote
2answers
274 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
1
vote
2answers
19k views

Error code: sec_error_untrusted_issuer

I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
1
vote
2answers
94 views

Verification of client certificates

I've read a lot of articles about client certificates. Please correct me if I'm wrong: client certificates are issued using CA CA could be created by myself (self-signed) or bought client ...
1
vote
3answers
227 views

Using self-signed certificates for your mail server

I have read multiple Q&A's on this topic from here and other SE sites. They all mention self-signed certs are not recommended due to MITM attacks. However, I haven't found anything with mention of ...
1
vote
2answers
178 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
1
vote
2answers
169 views

Will CA's still validate internal IP's in SSL certs?

Just wondering what Certificate Authority (CA) policy is nowadays on validating someone's internal IP address in a certificate? I have heard that some CA's used to do this but won't anymore.
1
vote
2answers
6k views

Unrecognized leaf certificate

Every 15 minutes or so I get this message in my system.log Apr 25 22:05:36 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate Apr 25 22:20:57 Ivans-MacBook-Pro.local apsd[194]: ...
1
vote
2answers
208 views

SSL-certificates for overlapping domain regions?

Suppose, a server hosts https://www.master.com/ and thus is equipped with a (single domain) SSL certificate. Furthermore, suppose there are some web apps below master.com: ...
1
vote
2answers
48 views

is it possible to issue a sub-CA and trust it only?

I'm currently a hobbyist trying to learn more about SSL. If I create my own CA for my virtual servers, and trust that CA on my devices, I can then issue certificates for my virtual servers, and my SSL ...
1
vote
1answer
44 views

Certificate authority has changed for personal website - but I haven't changed anything?

I have the Certificate Patrol addon (website) installed in Firefox. While I mostly ignore the (far too many) warnings, today I saw that the certificate authority for my personal website has changed. ...
1
vote
1answer
132 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
1
vote
1answer
54 views

Using a minimal set of certificate authoraties

It been known for quite a while now that SSL is more of a security-illusion than a real one. As it's not completely useless, and there's no real alternative at moment (though convergence looks ...
1
vote
2answers
411 views

Are there other roots of trust on my computer aside from these 46 root certificates?

I've heard many people imply that modern browsers and OSes trust a myriad of root certificates. The implication is that it is impossible to ensure the private keys of all of the root certificates ...
1
vote
1answer
360 views

Signature and Timestamp for Long Term Document Archival Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity. As far as I understand, I ...
1
vote
3answers
2k views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
1
vote
2answers
155 views

Does Convergence solve the problem of hacked CAs?

My question is about the Firefox AddOn Convergence. So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
1
vote
1answer
81 views

What can a trusted certificate do?

I am doing some reading about security on mobile applications because I found an article about Man in the Middle Attacks. I saw in that article and in many other places (including ...
1
vote
1answer
43 views

How to read certificate chains in OpenSSL

I'm trying to understand how to read the output of OpenSSL commands. Currently, I am trying to understand how Certificate Chains work. When I give the command (using a standard ca bundle) openssl ...
1
vote
1answer
63 views

SSL certs signed by different CA

Have a question on SSL certs signed by different CA. in the past, my web server cert is signed with CA1 and it was also imported into the web app firewall for SSL traffic monitoring. Now, I have ...
1
vote
1answer
35 views

Clarifications sought about SSL cert signing process

Currently I have a cert (signed with SHA1) expiring soon and I have extended its expiry incorporating SHA2 signing algorithm. I have done this by creating another CSR using certutil command with the ...
1
vote
1answer
584 views

How to know if certificate is self-signed

How do I find out if a certificate is self-signed or authorized by CA? Somewhere I read that self-signed subject and issuer will be same, is it correct?
1
vote
1answer
43 views

Re-Use Client Certifactes

I have a legacy web application where user are identified and authenticated with client certificates. Now, customer wants to use the same client certificate to authenticate against a newly created web ...
1
vote
2answers
88 views

Security of certificate when using DNSSEC

When setting up secure server, it is suggested not to use self-signed certs and instead to be signed by a CA. Of course, post-Snowden we now know that there may be problems with CA's that could allow ...
1
vote
1answer
5k views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
1
vote
2answers
87 views

Public e-mail Encryption Certificate

I'm quite new to this, so don't be too hard on me. I'm currently using the CipherMail MTA to generate e-mail encryption certificates. I created an own CA and public and private keys for our contact ...
1
vote
4answers
287 views

search CA for someone's public key

do CAs offer service wherein an application can request someone's public key? i am trying to do this but i am unsure if it is correct (suggestions of better ways to do it will be most appreciated): ...
1
vote
1answer
5k views

Grey vs Green padlock in address bar - technical difference [duplicate]

What is a technical difference between "grey padlock" and "green padlock" in URL bar in browsers? As an example we can take: Green padlock: Bank of America Grey padlock: Google Search Both of ...
1
vote
1answer
3k views

Windows' default certificate store for intermediate vs trusted root certificates - my self signed root CA cert goes to 'intermediate' by default?

Is it possible to create self-signed root CA certificate that Windows will import to Trusted Root by default instead of Intemediate certificate store ? Obviously, it won't do it without the big giant ...
1
vote
1answer
521 views

When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?

When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism? Related information on a different answer Consider using HTTP instead ...
1
vote
1answer
566 views

Purpose and Uses of Root SSL Certificates

I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?). When and ...
1
vote
1answer
43 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
1
vote
1answer
30 views

Can I have CA with JSSE

Maybe the title isn't correct but what I am trying to understand is... I want to create a certificate for my CA which will be self-signed and then create certificates for my clients and my server. ...
1
vote
1answer
24 views

Certificate Policies & Certificate Practice Statements - Destroying Vs. Archiving CA's Private Keys (HSMs)

Please Consider: English is my second language. Background I have been looking at different CP/CPS on the web. They all seem to roughly follow the same practices. However, two different policies ...
1
vote
1answer
395 views

Create OpenVPN/easy-rsa certificate from public key only

I have been using easyrsa to generate client certificates for my application using the method described here. The build-client-full command generates a fresh private key for each client. This is what ...
1
vote
1answer
281 views

Why are CA's now signing root certs with SHA2?

I see that CA's are now giving the option of having the root CA cert signed with SHA2. I have been told that the hashing function in a root has no security value, and is irrelevant as far as a ...
1
vote
1answer
275 views

How to convert SSL Certificate for mobile app?

I am in the current process of renewing my SSL cert for my website. I also have a mobile app for my site. I want to use the same cert from my website in my mobile app. How can I do this? Thanks - I ...
1
vote
1answer
801 views

How to safely renew user and CA certificates in a PKI

I am currently developing my own PKI where x.509-client-certificates are issued by a public server. At the moment, the CA-public key is distributed with the binary and there are no routines for ...
1
vote
2answers
254 views

determine X.509 certificate class

I am very familiar with OpenPGP but don't even use X.509 / S/MIME. I know that there are several classes for certificates (from email check to personal ID check). I would like to know how you ...
1
vote
1answer
312 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
1
vote
1answer
414 views

How to Delete duplicates in CA Bundle Certificate File

I do have a big CA bundle certificate file and each time if i get request to add new certificate to the existing bundle i need to make sure it is not present already. How i can validate the ...
1
vote
1answer
181 views

what harm can a malicious ca do?

If ca's act in the interests of an eavesdropper, what is the worst they cold do? I guess they can decrypt traffic not using perfect forward secrecy and impersonate the server. Is this the case?
1
vote
1answer
71 views

Are there other ways for a CA to have their certificates included in a browser?

From what I understand, the certificate authorities (CAs) have to get their root certificate included in the browser. What if the root certificate of a particular CA is not included in the web ...
1
vote
3answers
533 views

Where can I find all SSL CA certificates

I am working on an SSL implementation project and ofcourse I need to verify the certificate presented by the server. To do that I need CA certificates or at least root CA certificates (correct me I am ...
1
vote
1answer
838 views

Generate CSR with 2 OU Names

I have to create an application which generates a CSR. While generating a CSR we are required to fill in several details like CN, OU, etc. The problem is that the Certifying Authority to which I have ...
1
vote
1answer
836 views

are organizations that receive certificates considered “end entities” in a PKI?

I am trying to understand the term end-entity. Does this term just mean anybody that plays a role in a PKI system that is not a CA? So if I request a certificate from A who is a CRL issuer for ...
1
vote
1answer
305 views

How to have Thunderbird include a root certificate?

An eMail signed via S/MIME also contains the X.509 certificate chain containing the public key in order to directly verify the signature (assuming its issuing CA is deemed trustworthy). The chain does ...
1
vote
2answers
2k views

Self-signed certificates usage for code signing purposes

if a self-signed certificate is trusted by the client's certificate store, then it should be fine to be used, since the client trusts the issuer of the certificate as it does any other trusted CA ...