Certificate authorities verify the owner information of certificates by signing them.
117
votes
7answers
6k views
How do certification authorities store their private root keys?
Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
41
votes
10answers
2k views
Why do we not trust an SSL certificate that expired recently?
Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
31
votes
3answers
3k views
Are all SSL Certificates equal?
After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against.
Are all SSL ...
23
votes
9answers
1k views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
22
votes
1answer
302 views
Are there security design weaknesses in the EFF Sovereign Keys proposal?
In response to SOPA and a number of high profile security breaches at certficate authourities in 2011, the EFF has released a soverign keys proposal:
...
20
votes
7answers
3k views
Where to get an SSL certificate for personal website?
I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
20
votes
7answers
2k views
Does it matter which Certificate Authority I source my SSL Certificate from?
To secure my web site with HTTPS, does it matter which company I source my SSL certificate from, or just that the browser recognizes it?
From the Area51 proposal.
19
votes
11answers
2k views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
16
votes
3answers
1k views
What happens when an Intermediate CA is revoked?
Currently I'm working on a certificate manager that allows our product to securely connect to remote webservices (over TLS/SSL).
For security, we use Certificate Revocation List checking (or ...
13
votes
4answers
1k views
Why does Facebook serve several SSL certificates?
Facebook seems to be alternately serving two SSL certificates, one from DigiCert and one from VeriSign. There are only two reasons for this that I can think of:
They're in the middle of a ...
12
votes
4answers
3k views
how digital signature verification process works
I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
11
votes
3answers
9k views
Expired SSL Certificate Implications
What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
11
votes
4answers
398 views
What alternatives are there to the existing Certificate Authority system for SSL?
Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
11
votes
3answers
702 views
What are the risks of a Certificate Authority hack for 'the average user'?
Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
10
votes
4answers
1k views
Are there technical disadvantages in using free ssl certificates?
Note this question is related, except this one is about free SSL certs.
There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
10
votes
1answer
330 views
How does OCSP stapling work?
I've been looking into OCSP stapling for HTTPS, which looks pretty interesting. From what I can tell, it's essentially a way of offloading CRLs from the CA to the server, allowing for everything to be ...
10
votes
2answers
160 views
What does having an internal two-tier PKI protect against?
There are a lot of Best Practice documents that recommend having an offline Root CA and an Enterprise Subordinate CA that is signed by the root, for an internal Microsoft AD Certificate Services ...
10
votes
3answers
157 views
Domain name expiration and TLS
If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
9
votes
3answers
400 views
Multiple CAs signing a single Cert/CSR?
Just saw this suggested on Slashdot
So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
8
votes
2answers
3k views
Checklist on building an Offline Root & Intermediate Certificate Authority (CA)
Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite.
Here is an image of the default cryptography settings ...
8
votes
1answer
172 views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
8
votes
1answer
215 views
Why can the validity of an SSL certificate exceed the registration period of a domain?
I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
7
votes
3answers
1k views
Certificate authorities for a PKI
Some people think the certificate authorities for a PKI should be the government, but others think certificate authorities should be private entities, such as banks, corporations, or schools. What are ...
7
votes
2answers
679 views
Can a wildcard SSL certificate be issued for a second level domain?
Something like *.com or *.net? How about *.edu.au?
The RFC 2818 does not say anything about this topic.
7
votes
1answer
223 views
Why are website certificates secure?
I understand how HTTPS connections work, and I also understand they they require a certificate to know that the secure connection you have is with the right server (and not someone pretending to be ...
7
votes
1answer
139 views
Does dnssec protect against malicious registrars?
With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).
This is especially ...
7
votes
1answer
958 views
Renewing Microsoft Certificate Services Root Certificate
We currently have Microsoft Enterprise Certificate Server installed on a domain member machine which issues 1 year certificates to users for authenticating to VPN.
We'd like to start issuing web ...
7
votes
1answer
541 views
Moving from a one tier to a two tier Microsoft Certificate Authority hierachy
Right now we have a single Microsoft Enterprise Root CA which issues certificates to our VPN users for two factor authentication. We're planning to extend use of the CA to issue certificates for RDP ...
6
votes
4answers
685 views
What kinds of SSL certificates are usable for encryption?
I know that Verizon SSL certificates cost close to $600.
There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
6
votes
3answers
148 views
Guarding against rogue certificates
There has been a lot of news recently about certificates being falsely issued (due to the issuing authority having poor system security!). Apparently the targeted users were mostly Iranians, but it's ...
6
votes
1answer
2k views
What is the actual value of a certificate fingerprint?
In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
6
votes
2answers
372 views
security of PKI, Certificates, certificate authorities, forward secrecy
I want to understand how certificates add to the security of information exchange.
Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
6
votes
3answers
235 views
On-line cryptographically signed date/time?
I’m looking for a source of on-line cryptographically signed date/time. I do not need a full timestamp service, as I am happy with the information « date/time was that », without a link to a ...
6
votes
2answers
151 views
Limiting the root certificate chain
I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
6
votes
3answers
349 views
Getting started with SmartCards; what equipment do I need, what do I need to know?
I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it.
Are all SmartCard slots capable of reading and writing a blank card?
Are there compatibility ...
6
votes
1answer
426 views
Do I really need all these Certificate Authorities in my browser or in my keychain?
There are lots of strange looking Certificate Authorities in my keychain as well as Firefox. I am sure they are legitimate CAs (as they are the same on my Mac and PC and other computers I checked). ...
5
votes
6answers
706 views
Should the bit-strength selection of a child certificate be influenced by the CA or the chain?
All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
5
votes
3answers
836 views
How do I check that I have a direct SSL connection to a website?
I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
5
votes
5answers
154 views
A standard way to manually add a digital signature to a pdf file?
I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
5
votes
3answers
86 views
What are the risks of a localhost signed cerificate?
In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections.
Suppose we use this CA to sign a key for "localhost" for use in ...
5
votes
1answer
43 views
'Trusted CA Certificates' and 'Trusted remote Certificates'
What is the difference between Trusted CA Certificates and Trusted remote Certificates?
5
votes
2answers
161 views
What kind of certificate do I need to be able to sign my own subdomain certificates?
We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...).
...
5
votes
2answers
789 views
What tools exist to help me monitor OCSP certificate validation failures?
The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online ...
5
votes
1answer
93 views
Security and authentication problem
We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes.
First of all, lets imagine a real world scenario:
Imagine that a user ...
5
votes
3answers
136 views
What is a reasonable expiry for user authentication certificates?
This question is about a nearly decentralized P2P system with a centralized certificate authority where users can authenticate and receive a certificate on their public key and then can authenticate ...
4
votes
7answers
890 views
What is the danger of hosting your SSL certificate yourself?
I have Active Directory Certificate Services on my server, which makes it possible for me to deliver an SSL certificate for the websites hosted on the same server.
I know that normally, I need to ...
4
votes
3answers
205 views
Are SSL certificates from a CA necessary for secure communication?
Am I right in thinking that SSL certificates from a CA are purely for identification purposes and serve no purpose in the actual encryption of data? In other words if I were to create a self signed ...
4
votes
5answers
432 views
Is Spoofing a CA signed certificate possible?
I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway.
When a communication starts with a server, during the client handshake, the ...
4
votes
1answer
523 views
OCSP: What is “hackedirl.files.wordpress.com”?
After I ticked that my browser (Firefox) must require OCSP: http://i.stack.imgur.com/UeDXh.png
I got a window popped up (several times! And it still pops up.. ~randomly ~about a few 10 minutes): ...
4
votes
2answers
680 views
How does DNSSec work? Are there known limitations or issues?
Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:
DNS spoofing, especially on wifi or shared medium
Registrars that abuse their ...
