Certificate authorities verify the owner information of certificates by signing them.

learn more… | top users | synonyms (1)

0
votes
2answers
31 views

What is the real use of certificates on the web?

When you get a certificate from a website you visit, signed by a trusted CA, is it trust-worthy because the CA authority did a background check on them? But how does this help with spoof websites? ...
2
votes
0answers
21 views

Is it necessary to purchase an OID for ADCS? [migrated]

I am interested in utilizing ADCS to generate trusted certificates for internal web applications. However, from my readings it appears that I need to purchase an OID, which looks pretty expensive. Is ...
11
votes
3answers
275 views

What email addresses are treated as trusted?

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider ...
1
vote
2answers
105 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
0
votes
0answers
21 views

Problem with TLS identity not verified [migrated]

I run a CA server "Microsoft CA Server Enterprise" and I generate certificates then bind the cert to my site. In all clients in my network, I add the cert with certutil -addstore ca org.cer When my ...
0
votes
3answers
46 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...
14
votes
2answers
648 views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
2
votes
0answers
15 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
0
votes
3answers
53 views

In order to trust the digital certificate, does immediate CA cert also needs to be in trust store or root CA cert is enough?

In order to trust the digital certificate, does immediate CA certificate also needs to be in trust store or root CA certificate is enough?
2
votes
2answers
25 views

Certificate Subscriber Agreement

So, I decided to get an EV SSL certificate and I'm struggling to fill in some field on the agreement. Never done this before, anyone could help me figure this out for me? Thanks in advance!
0
votes
1answer
84 views

Begin of Certificate/ End of Certificate dash “-----”

What significance does the dash "-" holds along with the line -----BEGIN CERTIFICATE----- or -----END CERTIFICATE-----. I checked multiple docs and linked RFC's as well but could not find the ...
9
votes
1answer
226 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
4
votes
2answers
151 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
7
votes
7answers
3k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
0
votes
0answers
28 views

How to create certificates for local network [migrated]

I have a local network (a intranet of about 50 to 70 computers) where is a Windows Server 2008 with a ASP.NET MVC application. To encrypt the connection with HTTPS i need a server certificate (not ...
8
votes
1answer
489 views

How can a domain be impersonated with a fraudulent SSL certificate?

I was reading this article about the fraudulent certificates from Comodo back in 2011. It talks about domain impersonation. I understand that a fake website could be secured with the fraudulent ...
0
votes
1answer
36 views

CSR signing follow up question

This is a follow up question , after getting a signed certificate from one CA. researched a lot , but no luck. After getting the CA reply, While downloading the certificate, it popped up saying ...
2
votes
4answers
834 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
4
votes
1answer
18k views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
3
votes
2answers
65 views

CSR Signing simulation

Tried a lot get my test csr signed from root CA(trial versions option), somehow i am not getting it dues to some of their internal check. Few questions that cropped up Can i somehow signed that ...
2
votes
2answers
194 views

If your company/university requires you to install root certificates what protects you from man in the middle attacks?

Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is ...
5
votes
1answer
140 views

Should I install my subordinate Certificate Authority on the domain controller? Why?

I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a ...
0
votes
0answers
59 views

How does driver install with an expired cert?

I'm working on making a silent installer of WinpkFilter driver. In my silent installation, I'm always getting a (not so silent) prompt that says "Windows can't verify the publisher of this driver ...
17
votes
4answers
11k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
0
votes
3answers
51 views

Do all non-CA certs have to be End Entity certs?

Still learning the differences between certs. Can someone explain? The internet has so far been surprising not lucid in describing certificates. *EDIT to clarify EE
2
votes
3answers
62 views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
3
votes
0answers
21 views

How do I request a certificate from CEP / CES on a Microsoft CA on OSX or Linux? [migrated]

This article describes how to request a certificate from AD CS (Active Directory Certificate Services) from a non-domain joined windows computer. I would think the same principals apply to non ...
1
vote
0answers
26 views

Imported CA certificate to Firefox Browser not working [migrated]

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
3
votes
1answer
86 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
0
votes
2answers
38 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
1
vote
0answers
31 views

Making the Firefox key and CSR creation process transparent

Background I was a bit surprised that several CAs do not allow anymore to send a plain old CSR in text form to them which was created in the classic fashion with OpenSSL or similar. But this would ...
0
votes
0answers
16 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
2
votes
1answer
3k views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
27
votes
4answers
2k views

Can any CA sign any domain?

Can any CA sign any cert for any domain? If the answer is yes, what prevents having two different CAs creating a valid cert for the same domain? Does that mean that the whole TLS security has the ...
3
votes
1answer
1k views

Active Directory - Certificate Based Authentication - Multiple certificates for user

First, I have very limited knowledge about AD. Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will ...
0
votes
0answers
69 views

Self signed certificates and SBS 2008

I have been researching certificates for the past few days and one of the things I don't understand is how certificates created by SBS (Small Business Server from Microsoft) are validated when trying ...
2
votes
4answers
143 views

How safe is SSL on an untrusted computer and network?

In situations where the consumer doesn't trust/control the workstation and the network, can consumer safely do potentially sensitive activities (like making a payment or transferring confidential ...
4
votes
3answers
181 views

What part of TLS specifies how to verify a certificate chain

I have sometimes run into a situation where I see a root CA certificate which is set to expire sooner than the intermediate CA certificate. My question is - if you were interested in keeping your ...
0
votes
1answer
54 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
0
votes
2answers
82 views

Why do certificate authorities often require/use multiple intermediates?

I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway. Why do most modern certificate authorities (e.g. ...
5
votes
2answers
2k views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...
3
votes
1answer
77 views

Why do Certificate Authorites cross-sign each other?

A Certificate Authority (CA) issues digital certificates to certify the ownership of a public key by the named subject of the certificate. What is the rationale for CAs cross-signing each other (i.e. ...
0
votes
0answers
68 views

Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?

From my understanding domain validation certificate are verified by receiving an email on some special email addresses on the domain (e.g. postmaster@example.com, admin@example.com) or by sending on ...
1
vote
2answers
129 views

Are there other roots of trust on my computer aside from these 46 root certificates?

I've heard many people imply that modern browsers and OSes trust a myriad of root certificates. The implication is that it is impossible to ensure the private keys of all of the root certificates ...
2
votes
2answers
88 views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a ...
1
vote
2answers
61 views

Security of certificate when using DNSSEC

When setting up secure server, it is suggested not to use self-signed certs and instead to be signed by a CA. Of course, post-Snowden we now know that there may be problems with CA's that could allow ...
2
votes
3answers
403 views

Forged SSL without installation of root CA, possible?

Consider visiting a secure website like Gmail. Is it possible to forge the website certificate only by having full control over the internet provider? I mean is it practically possible for a provider ...
3
votes
3answers
166 views

Corporate PKI - SHA1 deprecation

Here is the context. Suppose you have a corporate PKI with : AC_Root (offline in safe store - SHA1 signature) SubRootA and SubrootB (offline in safe store - SHA1 signature) SubSubRootC, SubSubRootD, ...
2
votes
1answer
48 views

Is client cert authentication with a 3rd party PKI cert any safer than using self-signed?

I am working on a small M2M project (a few hundred nodes connected to a single cloud server), and want to use client certificate authentication, with each client getting its own unique cert at ...
0
votes
2answers
62 views

Is there a Standard Verification process for Certificate Authorities to follow?

So the premise of the question is to quantify the risk of wild card certificates versus regular certificates. From my research the greatest fundamental danger of wild card certificates is the ...