Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

2
votes
3answers
79 views

Risk in buying SSL cert from non well-know party

Let say I knew a guy is selling SSL cert in a very cheap price, assume they will generate a real and valid cert for me, since I need to submit my CSR to them and they pass to th CA, are there any ...
0
votes
2answers
106 views

SSL can stop MiTMs … but on the long run, can it really? [duplicate]

SSL uses CAs which sign certificates for the domains after they validate that the person requesting is truly the owner and by a public/private key pair a encrypted connection is achieved which cant be ...
1
vote
1answer
54 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
0
votes
1answer
65 views

Will the recently found OpenSSL vulnerablity Heartbleed affect my public site for which I obtained an SSL certificate from a CA? [duplicate]

I had generated the CSR with OpenSSL. Do I need to regenerate a new CSR with no vulnerability due to OpenSSL in order to obtain a new certificate from a CA?
2
votes
2answers
99 views

What is the point of certification authorities that are not trusted by browsers (=trusted by Root CAs)?

See here: https://www.cacert.org/index.php?id=1 Chrome, Firefox and Internet Explorer warn that it is not trusted, essentially making the entire thing useless. If I want some kind of ssl certificate, ...
3
votes
2answers
50 views

Is the Common Name mandatory for digital certificates?

I'm working on a project, where we use the Common Name as a certificate's basic identifier. However, importing certificates without the Common Name fails. What's the default way to use digital ...
0
votes
1answer
83 views

Trusted Certificate Authorities - how do they work?

microsoft.com for example can use a Verisign Certificate for their domain. What are the chances that an attacker could ask verisign for a m1crosoft.com domain and get approved? It is very simillar, ...
3
votes
1answer
148 views

unexpected thumbprint when connecting via remote desktop - what now?

I have an Amazon EC2 instance in a VPC. I have not logged into it for some time, so I used the Amazon EC2 CLI with ec2-get-console-output to check what the thumbprint should be when I connect. To my ...
3
votes
2answers
235 views

When you buy a certificate, does the certificate authority have (a copy of) the private key?

I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this: You generate a public and private key pair From this key pair you generate a ...
0
votes
1answer
28 views

Certificate extensions - specific constraints

I have question about extensions of certificate and what specific extension should I use in my situation. The problem is following: I have a CA and I want that CA will issue certificate only for ...
1
vote
1answer
51 views

Active Directory - Certificate Based Authentication - Multiple certificates for user

First, I have very limited knowledge about AD. Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will ...
2
votes
1answer
55 views

Finding the type of SSL certificate with cURL

This is a part of curl's verbose output when connecting to the HTTPS site of Google. * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * ...
6
votes
2answers
2k views

How to detect the NSA MITM attack on SSL?

As Bruce Schneider reported here... https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html ...the NSA reportedly performed a MITM attack on a company in brazil and decrypted their SSL ...
27
votes
11answers
3k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
1
vote
3answers
109 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
2
votes
1answer
54 views

Certificate verified using two different paths

StartSSL has an intermediate certificate that they use to sign their EV certificates: sub.class4.server.ca.pem. This certificate's issuer is shown by openssl x509 to be /C=IL/O=StartCom ...
1
vote
0answers
21 views

Deploying software that requires X.509 certificates

I have a self-hosted WCF application, with a server application running on the server (obviously) and a client application that will be installed on the users PC. Up until this point I have been ...
0
votes
3answers
101 views

SSL Certificate for an email server

I am completely new to SSL/TLS and would appreciate any help you guys could give me. To give you some background info, our company website is hosted externally by our ISP, however our email is ...
1
vote
2answers
55 views

Why has public key certificate “Trust anchor”, why is it SPoF vulnerable?

When you look at currently used concept of Root CA (primarily in SSL/TLS context), you can see SPoF vulnerability, which means, if your private key is disclosed, you automatically lose whole chain. ...
12
votes
2answers
411 views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
4
votes
1answer
242 views

google certificates correct CA [closed]

I view certificates of https://www.google.com.ua/ So I thought, when requesting via cURL, if I point by CURLOPT_CAINFO to those certificates (GeoTrust Global CA and Google Internet Authority G2 in ...
1
vote
0answers
33 views

Does Active Directory Certificate Services support Card Verifiable Certificates?

Does Active Directory Certificate Services support accepting requests for, and generation of, Card Verifiable Certificates (TR-03110)? If so, in which version of Windows Server was the functionality ...
10
votes
1answer
140 views

Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?

According to findings by the EFF's SSL observatory, there are "tens of thousands of keys that offer effectively no security due to weak random number generation algorithm." My understanding of that ...
4
votes
4answers
234 views

What Trusted Root Certification Authorities should I trust? [duplicate]

After two recent Slashdot articles (#1 #2) about questionable Root Certificates installed on machines, I decided to take a closer look at what I have installed on my machines. (I use current versions ...
1
vote
1answer
48 views

Root certifcate from an CA company which can be encrpyted by SoftHSM

Does anybody know a CA company which allows me to put the bought CA certficate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)? Is it hard to work with the PKCS11 ...
1
vote
0answers
46 views

Certificate authorities: history and registration

CA's are a key part of the internet's infrastructure few people are aware of. SSL was mostly hacked together at Netscape in 1995. I'd like to understand more about the organizational structure of CA's ...
15
votes
3answers
18k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
3
votes
3answers
108 views

Why does the RFC 5280 dictate the CAs not to issue certificates with negative serial numbers?

I have tried to issue a certificate beginning with 8 to F but I have found it is impossible, mostly due to the RFC: The serial number MUST be a positive integer assigned by the CA to each ...
1
vote
0answers
49 views

Cetificate Pinning. How do we handle the situation where a website is visited for the first time?

What I essentially mean to ask is, how is the scenario where a user who visits a website for the first time (the certificate for the website is not pinned in the browser) handled ? Additionally how is ...
1
vote
1answer
28 views

In a 3 tier (or more) PKI, is it permissible that a Name Constraint only be defined on the middle tier?

I'm working with an Issuing CA that doesn't support name constraints that are defined at a higher level. Assuming that it issues certificates that are compliant with the Name Constraints that are ...
0
votes
1answer
121 views

Is it safe to accept the security certificate from AOL chat? [closed]

Is it safe to accept the security certificate from AOL chat? Did they recently change their certificates? These images are from Pidgin.
3
votes
1answer
54 views

Internal code-signing certificate on Windows

I'm looking to improve defense-in-depth on a system, primarily by closing some holes in injected DLLs. Certain applications installed on the system cause helper DLLs (e.g. shell extensions, BHOs, ...
6
votes
5answers
235 views

Why are private certificates not trusted?

When we go to websites that have generated certificates themselves you see this red screen that says do not go there!: However when it is trusted by some companies it's all good. So I have a couple ...
2
votes
2answers
65 views

Is Certificate pinning different from CA pinning?

I am trying to understand if pinning a certificate essentially means pinning the CA or if they are different how so ?
2
votes
1answer
171 views

Root certifcate key usage (non-self-signed end entity)

This discussion does not include self-signed end entity certificates for hosts like web servers and mail servers. OpenSSL's default configuration for a CA certificate has the following keyUsage: ...
4
votes
2answers
142 views

Is authorisation with token secure?

I have a general security question: Let's say there is a client-server application with authorisation by login and password using a secure connection between server and client (https). User can have ...
0
votes
1answer
71 views

List of certificate authorities in browsers and mobile platforms [duplicate]

Is there a list of certificate authorities installed in popular browsers and mobile platforms? I am considering a few alternatives for an SSL certificate, and I would like to make sure that the one ...
1
vote
4answers
121 views

search CA for someone's public key

do CAs offer service wherein an application can request someone's public key? i am trying to do this but i am unsure if it is correct (suggestions of better ways to do it will be most appreciated): ...
2
votes
1answer
84 views

How can a trusted intranet certificate be issued if they are being phased out?

I've just seen this article regarding the phasing out of intranet names on SSL certificates. However, CAs such as this one claim to still issue them and it will be "Trusted by all popular browsers" ...
1
vote
2answers
598 views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
2
votes
0answers
74 views

How to go about an ssl certificate renewal

I've got an ssl certificate from godaddy, and it's time to renew. I ended up with a single "keystore" file, which I give to my webserver (jetty). This is the process I went through to generate the ...
4
votes
1answer
247 views

Who is this strangely named Certificate Authority?

I'm researching certificate authorities, and I just have no idea what to think of the CA named x00Ax00-x00Tx00rx00ux00sx00tx00 x00Gx00ex00sx00.x00 x00fx00xFCx00rx00 ...
1
vote
1answer
245 views

How can you check the installed Certificate Authority in windows 7/8?

And know which are not default ones installed by Microsoft?
2
votes
1answer
72 views

What do people mean by “top-down manner” in X.509 certificates?

What do people mean by saying that X.509 certificates work in "top-down manner"? Do they say that because CAs can do cross certifications?
2
votes
4answers
197 views

Why isn't there a Global Root for SSL?

I was just wondering why there is a file on your computer implementing the trusted root CA's instead of something similar to DNS where there is a file on root servers that computers check against to ...
1
vote
0answers
26 views

Writing Security Functionality Requirements [closed]

Is there any Guideline Doc. or Tutorials for writing Security Functionality Requirement (Common Criteria)for a product?
4
votes
3answers
131 views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
0
votes
1answer
262 views

Grey vs Green padlock in address bar - technical difference [duplicate]

What is a technical difference between "grey padlock" and "green padlock" in URL bar in browsers? As an example we can take: Green padlock: Bank of America Grey padlock: Google Search Both of ...
2
votes
2answers
110 views

Can I buy a signing-valid certificate for internal use?

So now that I have to implement "secure transport" as defined by The Direct Project (not to mention reinventing a bunch of wheels, but that's another story for SO), I find myself staring down the ...
0
votes
2answers
138 views

Security Certificate not from a valid authority

I have no real knowledge about this stuff so I figured I'd ask here for some answers. So I started to get this "Security Certificate not issued by a valid authority" error when using my email client ...