A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

learn more… | top users | synonyms (1)

13
votes
4answers
1k views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
4
votes
1answer
59 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
4
votes
2answers
46 views

Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised?

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company ...
2
votes
4answers
503 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude ...
3
votes
1answer
51 views

Bi-directional authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the abovementioned CA. Server has its own ...
4
votes
2answers
49 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
0
votes
0answers
21 views

How to test rootCA for issue subCA certificate

Can I check rootCA for issue subCA test certificate before issue real subCA cert? If rootCA issue test certificate and revoke immediately, then all operation log is recorded. Do this compliance with ...
6
votes
3answers
836 views

What if someone steals a Certificate authority's private key? [duplicate]

What if someone could steal a Certificate authority's private key? I know this will (probably) never happen, but what would happen to the certificates that were already signed with this private key? ...
1
vote
1answer
17 views

Certificate Policies & Certificate Practice Statements - Destroying Vs. Archiving CA's Private Keys (HSMs)

Please Consider: English is my second language. Background I have been looking at different CP/CPS on the web. They all seem to roughly follow the same practices. However, two different policies ...
1
vote
0answers
28 views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: ...
15
votes
3answers
1k views

Why are CA-issued certificates considered so much more secure than self-signed certificates

I looked at other Stack Exchange posts explaining why self-signed certificates are not as secure as CA-issued certificates, and most of these pages say the same thing: If it's self-signed, and the ...
2
votes
2answers
250 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
84
votes
11answers
20k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
9
votes
1answer
7k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
2
votes
0answers
34 views

Let users sign in with eIDs - do I need government authorisation? (scope: all nation-states)

I've decided to launch a crypto-basic income system. Crypto UBIs are pretty popular now. For me, it seems like an open nation-state ID should exist by now (2015). However, Mike Hearn, Bitcoin ...
2
votes
0answers
47 views

What are the risks of adding third-party Root CA certificate into NTAuth Store?

What are the risks associated with importing a third-party Root CA certificate into the Enterprise NTAuth Store in a Windows Active Directory domain? (Except that the CA is then trusted to issue ...
1
vote
0answers
9 views

Cannot create a iser in IPA server for remote login [migrated]

I had created a new IPA IdM server in Centos 7 using script install-ipa-server. The installation was successful. After installation, I was not able to create a user using IPA user-add user, it asks ...
2
votes
1answer
178 views

Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?

WoSign has been in the media for offering free server and client certificates. Since one of my (free) S/MIME certificate from another CA is about to expire soon after one year and WoSign offers ...
0
votes
1answer
49 views

Relationship between SSL cert database and that at the CA site

Say I am using a trusted third party CA site to manage my cert. I created a new cert called CertA at the CA web interface, downloaded the signed cert and use it on my web server. Some time later I ...
23
votes
4answers
32k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
67
votes
4answers
21k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
3
votes
0answers
31 views

Is running a DNSSEC enabled DNS service as hard as running a CA?

I think we all know that running a CA is really hard to get right. Now there's a "new" system that uses digital signatures to associate data with names: DNSSEC. DNSSEC signs the DNS records and ...
4
votes
1answer
113 views

How to generate keystore for root signed certificate?

I need to create keystore and truststore with root signed certificates. I have these files (at this step they are identical for client and for server): client_cert.pem client_prv_key.pem ...
2
votes
1answer
62 views

SSL certificate trust chain shows root certificate with 1024-bit public key - Is this evidence of a MITM attack?

My account at my domain name registrar was hacked and I am trying to understand how the hackers were able to steal my login credentials. Because the root certificate in the trust chain for the ssl ...
1
vote
0answers
40 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
3
votes
1answer
73 views

Browsers root CA accepted, countries and checking fingerprints

This is a question derived from several others, and I can not comment on those, so it is not duplicated, please read: In some related questions some users comment that: "They wouldn't ...
9
votes
4answers
3k views

What are the risks of a localhost signed cerificate?

In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections. Suppose we use this CA to sign a key for "localhost" for use in ...
2
votes
2answers
174 views

Should I update my SHA-1 certificates? If so, how?

Q: Should I update my SHA-1 certificates? If so, how? Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been ...
-1
votes
2answers
68 views

Does any nation-state CA (certificate authority) have a public API to verify digital signatures? [closed]

There are around 200+ nation-states on the planet. Most of these use eIDs. Do any of these nation-states have a public API to verify digital signatures? Example: Nation-state Canada issues a eID to ...
5
votes
2answers
787 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
8
votes
4answers
540 views

What Country, State and City should I choose when requesting an SSL certificate?

I am really confused about the country, state and city I should select when submitting an SSL certificate. Should I provide the location of my servers or my current home address?I can always reissue a ...
1
vote
1answer
104 views

What are these two certificates I need to install - external CA root certificate

I have to install 2 certificates on a computer and I am a little puzzled by the certificates. The first certificate has these details: Issuer: CN = AddTrust External CA Root OU = AddTrust External ...
27
votes
2answers
3k views

Is it safe to send SSL certificates via email?

I just ordered a cheap Comodo PositiveSSL Certificate via a UK reseller, and I was rather surprised to find that the following files were emailed to me automatically, in a zip file: Root CA ...
0
votes
3answers
257 views

What can I do to rely less on certificate authorities?

I never trusted and liked CA's and in fact I removed a lot of them from my devices. But now after this question I'm wondering if I should generate my own certificates for the sites I care (e.g, like ...
5
votes
2answers
88 views

How do I prepare for Certificate Authority end of business?

We are deploying a security solution which uses certificates to validate documents. These certificates are issued by our government-authorized CA. What if in a distant future, the CA who provided us ...
4
votes
4answers
521 views

Why are there very expensive and cheap SSL same type certificates? [duplicate]

I am about to launch an online shopping site (currently running http) and I was thinking heavily of moving to SSL which includes a green bar, because this is very important. However, when I first ...
7
votes
1answer
268 views

How does the OpenSSL Alternative chains certificate forgery (CVE-2015-1793) attack work?

The security advisory for the issue can be found here: https://www.openssl.org/news/secadv_20150709.txt OpenSSL Security Advisory [9 Jul 2015] Alternative chains certificate forgery ...
5
votes
1answer
249 views

Is my ISP trying to impersonate google?

Everything has been well for years and today I wake up with this: A warning on EM Client (also got the same on my iPhone) that the certificate for googleapis.com isn't valid. And the certificate ...
6
votes
2answers
78 views

Issuing certificates to two departments from same ROOT CA so one does not trust the other

Scenario: We have two departments within IT; Say Department-OLD and Department-NEW. A single internal PKI environment exists and a root CA (singular) is trusted by All endpoints. Problem: ...
1
vote
1answer
33 views

Clarifications sought about SSL cert signing process

Currently I have a cert (signed with SHA1) expiring soon and I have extended its expiry incorporating SHA2 signing algorithm. I have done this by creating another CSR using certutil command with the ...
2
votes
1answer
97 views

Extract the content of PKCS7 file in Java

I have a PKCS#7 signature that have the content‐type signed data and it embeds an XML document, and I have to extract the xml document from this PKCS7 file. Anyone know how to do that in java ??
1
vote
1answer
65 views

How to know if certificate is self-signed

How do I find out if a certificate is self-signed or authorized by CA? Somewhere I read that self-signed subject and issuer will be same, is it correct?
2
votes
1answer
70 views

is x509 certificate signed by ca valid?

I've got certificate 'sample cert' which is valid to '2015-12-31' but it was signed by root CA certificate. But when it was signing CA cert was valid to 2015-06-30'. So my question is, is today ...
2
votes
1answer
53 views

Digital Certificate Repository Integrity

I am trying to figure out if there is an automatic way to determine if a digital certificate repository has been tampered with. Does anyone know of a way to do so?
1
vote
1answer
43 views

Certificate authority has changed for personal website - but I haven't changed anything?

I have the Certificate Patrol addon (website) installed in Firefox. While I mostly ignore the (far too many) warnings, today I saw that the certificate authority for my personal website has changed. ...
2
votes
2answers
91 views

Why is it fine for Certificates above the end-entity certificate to be SHA1 based?

I have heard about the phasing out of Sha1 based certificates for end entity use, and the steps that are outlined for chrome to display progressively more aggressive warnings for Sha1 certs not ...
-1
votes
1answer
237 views

Android phone (Kitkat) lists a lot of CAs

My Android phone (Kitkat) list a LOT of CA under setting->security->Trusted credential. Does it mean that anyone who has access to any one of those private keys of those CA(s) can monitor or do "Man ...
11
votes
1answer
686 views

Why isn't there a certificate revocation request standard?

Say I am building a Certificate Authority software and I want to automate certificate revocation as much as possible. I know it will not be possible in some cases, like if the building where the ...
1
vote
2answers
5k views

Unrecognized leaf certificate

Every 15 minutes or so I get this message in my system.log Apr 25 22:05:36 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate Apr 25 22:20:57 Ivans-MacBook-Pro.local apsd[194]: ...
3
votes
1answer
57 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...