Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

66
votes
4answers
5k views

Is there anything preventing the NSA from becoming a root CA?

There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference. While there have been attempts ...
1
vote
3answers
55 views

Can any website secured using TLS can be impersonated using a rogue certificate issued by a rogue CA?

Any website secured using TLS can be impersonated using a rogue certificate issued by a rogue CA. This is irrespective of which CA issued the website’s true certificate and of any property of that ...
2
votes
6answers
3k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...
1
vote
2answers
54 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
11
votes
2answers
4k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
1
vote
2answers
68 views

Why would Comodo SSL certs have two intermediate CAs (chain length 4)?

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs. What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a ...
1
vote
1answer
249 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
0
votes
1answer
45 views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
5
votes
1answer
162 views

Where are the anonymous/private domain validation SSL certs?

I have yet to find a CA that doesn't require personal information for DV certificates. Is this because all of the major browsers and operating systems have a policy to reject CAs that don't require ...
1
vote
2answers
83 views

Certificate authorities: history and registration

CA's are a key part of the internet's infrastructure few people are aware of. SSL was mostly hacked together at Netscape in 1995. I'd like to understand more about the organizational structure of CA's ...
0
votes
2answers
67 views

is Digital Signature vulnerable on the Internet?

We all know about how Digital Signing works. I just have some questions about vulnerability risk. At first, As I know, the Signature and the Data are separated and we can split the document into two ...
11
votes
4answers
1k views

Multiple CAs signing a single Cert/CSR?

Just saw this suggested on Slashdot So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
0
votes
2answers
38 views

How are “Certificate Signing” key usage certificates restricted to what domains they can sign?

Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate ...
0
votes
2answers
55 views

Temporarily suspending a Certificate Authority's Certiticate

The PKI RFC talks about revoking or suspending certificates. It also talks about revoking CA certs. However, I could not find anything about whether a CA or a Sub CA's certificates can be revoked or ...
0
votes
1answer
2k views

Problems with intermediate ssl certificates and ssl proxy

I'm currently implementing a SSL-proxy, and have run into some problems regarding certificates. We have a offline "Company Root CA", and an online "Company intermediate CA". On the proxy I have ...
0
votes
1answer
95 views

Can anyone with access to root CA private key decrypt HTTPS traffic?

Can anyone with access to root CA private key decrypt HTTPS traffic of sites using certificate signed by that CA ? and if yes do he need to be man-in-the-middle or just monitoring traffic is ...
0
votes
1answer
70 views

Why are CA's now signing root certs with SHA2?

I see that CA's are now giving the option of having the root CA cert signed with SHA2. I have been told that the hashing function in a root has no security value, and is irrelevant as far as a ...
0
votes
2answers
45 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
0
votes
0answers
28 views

What certificate attributes can I check to verify if an issuer is correct?

Apologies if this is a duplicate question. I thought I saw this discussed earlier but couldn't find the thread when searching. What attribute can I check to verify if I have the correct ...
5
votes
3answers
201 views

Risk in buying an SSL cert from a not well-known party

Let's say I know a guy is selling an SSL cert at a very low price, assume they will generate a real and valid cert for me, since I need to submit my CSR to them and they pass to the CA, are there any ...
0
votes
0answers
9 views

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file? [migrated]

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file? Scenario: We have a few legacy certificates based on some legacy templates (2012 R2). ...
58
votes
10answers
12k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
48
votes
4answers
13k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
5
votes
1answer
214 views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...
2
votes
1answer
41 views

Is distinguished subject name at normal SSL Certificate issuance must same as generated Certificate Signing Request (CSR)?

For example: from Issued SSL Certificate: CN = abc.com.my, OU = Room, O = House, c= MY from generated CSR: CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY Questions: 1. Is it ...
2
votes
1answer
52 views

OpenVPN: Storage location and creation of keys/certificates?

I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance. It's noted that the best security policy is to keep the Certificate Authority (CA) offline ...
0
votes
2answers
114 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
7
votes
2answers
101 views

What happens when certificates further up the chain expires before mine? (Equifax/GeoTrust)

I just bought a certificate from RapidSSL. Looking up the chain, I found GeoTrust who is signed by Equifax. Then I realized that the ”Equifax Secure Certificate Authority” is due to expire on ...
5
votes
1answer
757 views

google certificates correct CA [closed]

I view certificates of https://www.google.com.ua/ So I thought, when requesting via cURL, if I point by CURLOPT_CAINFO to those certificates (GeoTrust Global CA and Google Internet Authority G2 in ...
1
vote
1answer
61 views

How to convert SSL Certificate for mobile app?

I am in the current process of renewing my SSL cert for my website. I also have a mobile app for my site. I want to use the same cert from my website in my mobile app. How can I do this? Thanks - I ...
0
votes
1answer
58 views

Why do certificate authorities often require/use multiple intermediates?

I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway. Why do most modern certificate authorities (e.g. ...
7
votes
2answers
352 views

How can we revoke all ssl certificates issued for our domain?

After having the hostmaster@domain.com email compromised, we found that someone issued a Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked. Is there ...
1
vote
3answers
282 views

How trustable is third party root certificates?

i recently tried to use fiddler2 from third party vendor telerik,while decrypting the https traffic of my network it asked me to install its own root certifcate in my windows operating system : have ...
2
votes
2answers
70 views

Should expired compromised certificates be taken care of if the time is always correct?

I am trying to set up a CA for my company, and issuing every employee a digital certificate and a private key. I am worrying about revocation and expiration. In my case, the root certificate of CA is ...
0
votes
0answers
47 views

Problems implementing Authority Information Access in a certificate

I am implementing SSL certificates for internal use in an application. Due to the nature of this app, I'm basically implementing my own CA. I have created a self-signed cert for the CA to issue ...
2
votes
1answer
44 views

Possibility of using CA as an attack point by governmental organizations under their pressure

I was always concerned about the model of trust behind CA stuff we use . Well, for most of us, it is OK to trust them, since they are reliable organizations with a bunch of solid experience. ...
2
votes
1answer
853 views

Root certificate key usage (non-self-signed end entity)

This discussion does not include self-signed end entity certificates for hosts like web servers and mail servers. OpenSSL's default configuration for a CA certificate has the following keyUsage: ...
5
votes
6answers
1k views

Should the bit-strength selection of a child certificate be influenced by the CA or the chain?

All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
0
votes
1answer
86 views

Will the recently found OpenSSL vulnerability Heartbleed affect my public site for which I obtained an SSL certificate from a CA? [duplicate]

I had generated the CSR with OpenSSL. Do I need to regenerate a new CSR with no vulnerability due to OpenSSL in order to obtain a new certificate from a CA?
0
votes
1answer
204 views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
2
votes
4answers
470 views

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
1
vote
1answer
3k views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
1
vote
1answer
83 views

Self-signing client certificates and distributing them, is the following a sound procedure?

I have a case at hand as follows: There is a number of clients in Internet (i.e. untrusted channel), initially in hundreds but growing in numbers. There is a server doing processing related to these ...
0
votes
2answers
89 views

Installing self-made cert as trusted CA on windows?

I'm looking into using mitm-proxy, but part of the process of filtering/snooping SSL is that you must generate and install a root cert as a trusted CA, so that mitm-proxy can generate and throw out ...
1
vote
0answers
137 views

If even Apple cannot properly install certificate [closed]

I've just installed a new copy of Mozilla Firefox/29.0 SeaMonkey/2.26.1 on a new Mac with OS X 10.9.4, and I'm getting an error message in place of a webpage when trying to access ...
1
vote
0answers
45 views

Open ldap start tls succesful even after CA is removed

I have one question related to how openldap and openssl handles the CA and server certificates. I have openldap client using openssl. My intention is to establish a ldaps connection to the ldap ...
0
votes
1answer
83 views

Is my understanding about how SSL works correct?

I've been reading about 2-way SSL or mutual auth recently, and here's what I've figured so far: Mutual auth is a way for the client to authenticate itself to the server, just like the server does to ...
0
votes
1answer
34 views

Does openssl store the certificate of the server after verification is done?

As per my understanding , openssl will verify the certificate of the server during ssl handshake , using the trusted CAs present in the CA certificate dir in the context. After the server certificate ...
1
vote
1answer
172 views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
0
votes
1answer
76 views

Hacked Router Faking a Certificate Authority

Does a typical computer begin with any shared secret with a certificate authority when I buy it? If not, a compromised home router could fake everything and get my credit card info when I attempt to ...