A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
0answers
21 views

What does 2^77.1 calls presented in a SHA1 attack mean?

Regarding the SHA 1 deprecation, I found this information here: http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx I know ...
2
votes
1answer
51 views

What does verified file in windows mean? And does it guarantee related files?

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g Microsoft) or in other case, unknown publisher. I know public key encryption can ...
1
vote
0answers
19 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
0
votes
0answers
14 views

What certificate attributes can I check to verify if an issuer is correct?

Apologies if this is a duplicate question. I thought I saw this discussed earlier but couldn't find the thread when searching. What attribute can I check to verify if I have the correct ...
2
votes
0answers
33 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
5
votes
1answer
40 views

How do systems protect against a stolen code-signing certificate after the certificate expires?

Imagine this scenario: 1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp. 15th December 2014 - the certificate is revoked. Malware will be prevented from ...
0
votes
0answers
9 views

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file? [migrated]

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file? Scenario: We have a few legacy certificates based on some legacy templates (2012 R2). ...
13
votes
3answers
1k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
3
votes
2answers
67 views

What role do hashes play in TLS/SSL certificate validation?

After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
17
votes
3answers
2k views

Is SHA1 weak for SSL?

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
0
votes
1answer
32 views

Does the SSL/TLS client certificate “hash over all previous messages” step hash the entire TCP packets or just data?

We have which uses TLS client certificates as it's authentication mechanism between client and server. There is an IT department which wants to run this app through a firewall/proxy device of some ...
0
votes
0answers
17 views

Is there any way possible that a Digital certificate is issued by admin on wireless channel?

I want that an admin who is working in a wireless environment have to issue digital certificate to the node, who wants to register itself with the network. this certificate will be used by user to ...
5
votes
1answer
96 views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...
1
vote
1answer
121 views

What is stopping me from replaying an SSL certificate?

Say I have the SSL certificate for google.com. I intercept it, edit the certificate with my own domain name and public key and use it to intercept all traffic to google.com. What mechanisms exist in ...
0
votes
1answer
47 views

Secure way to pass client certificate to the client2

Our product is comprised of two servers. We would like to authenticate one server to the main server by means of client certificate. I assume that we should ask the customers (who purchase the ...
-1
votes
0answers
48 views

Secure way to pass client certificate to the client [duplicate]

Our product is comprised of two servers. We would like to authenticate one server to the main server by means of client certificate. I assume that we should ask the customers (who purchase the ...
26
votes
3answers
2k views

Is there a security issue in using the same certificate for all a company's services?

We are a small startup. One of our products is a B2B web service, accessible through its https://service.example.com canonical URL. For testing purposes, that service also runs on different ...
0
votes
0answers
9 views

How to create .pfx file containing only one of private/public key [migrated]

As far as I know .pfx files are not required to contain both public and private key. However, I could not find a way how to create a file that contains only one of them. I need this because I am ...
0
votes
0answers
14 views

Installer digital signature timestamp inconsistency

I just noticed that the digital signature on an old installer EXE is expired (it's LibreOffice from May 2013, and I'm pretty sure it was valid when I installed it). Investigating further, the time ...
1
vote
2answers
45 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
0
votes
2answers
90 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
0
votes
0answers
40 views

CA Flag in SSL certificate [migrated]

I have an web portal running as a POC purpose, and then i have a mobile apps to access this web portal. Since it's a POC, I just generate a self-signed SSL cert and load it inside the Web and my ...
23
votes
9answers
4k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
0
votes
1answer
52 views

Why do certificate authorities often require/use multiple intermediates?

I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway. Why do most modern certificate authorities (e.g. ...
0
votes
0answers
19 views

Certificate Errors on Network and Desktop Icons Freeze

What causes a screen on all devices on the same network to temporarily lock up and display certificate errors? After accessing Facebook; I have received a certificate error on both the student laptop ...
0
votes
1answer
60 views

CEH training courses requirements

What are the requirements for studying CEH? Is there any requirements for the programming background? And can anyone apply for it or does he has to have a recommendation for both studying and taking ...
0
votes
0answers
26 views

RSA and ECDSA Certificate Sizes [migrated]

Is there a table (or a whitepaper from official sources) that compares the size of X509 certificates generated with RSA (starting from 1024 bits) and ECDSA (starting from 160 bits) ? Thanks for the ...
1
vote
3answers
112 views

How trustable is third party root certificates?

i recently tried to use fiddler2 from third party vendor telerik,while decrypting the https traffic of my network it asked me to install its own root certifcate in my windows operating system : have ...
-1
votes
1answer
80 views

VPN security/compromise

I want to get a VPN with one of the known providers. I don't know much about VPNs but I know they issue certificates which you download and it authenticates the connection and basically gives access. ...
0
votes
0answers
22 views

Problems implementing Authority Information Access in a certificate

I am implementing SSL certificates for internal use in an application. Due to the nature of this app, I'm basically implementing my own CA. I have created a self-signed cert for the CA to issue ...
2
votes
2answers
68 views

Should expired compromised certificates be taken care of if the time is always correct?

I am trying to set up a CA for my company, and issuing every employee a digital certificate and a private key. I am worrying about revocation and expiration. In my case, the root certificate of CA is ...
1
vote
1answer
78 views

Why OpenVPN is using both certificates and DH?

I am reading about OPENVPN and I am a little bit confused. In the OPENVPN howto website, there is a step by step setup guide for generating certificates and diffie-hellman (DH) params. However, I cant ...
0
votes
2answers
61 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
2
votes
1answer
41 views

Possibility of using CA as an attack point by governmental organizations under their pressure

I was always concerned about the model of trust behind CA stuff we use . Well, for most of us, it is OK to trust them, since they are reliable organizations with a bunch of solid experience. ...
2
votes
3answers
166 views

Free second-level domain SSL certificate [closed]

With CAcert.org losing trust in browsers and OSs and StartSSL providing only top-level domain certificates, are there any free SSL certificates providers for second-level domains?
0
votes
2answers
99 views

What would cause a server to only send over 1 SSL certificate to a client?

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
9
votes
1answer
180 views

How should I store and secure self-signed certificates?

I'm fairly certain I shouldn't commit certificates into source control. Even if the repository is private and only authenticated coworkers (for example) have access to it. That would allow for ...
3
votes
2answers
516 views

What is the difference between EV-SSL certificates and Normal SSL certificates? [duplicate]

Recently while looking at several banking URLs I can see the domain name with security certificate at address bar and normal locker security certificate at address bar. Have a look at the screenshots: ...
1
vote
1answer
46 views

ECDSA/RSA certifcates and cipher selection

In this image can someone tell me if a standard RSA certificate can support the EC*_RSA ciphers listed? If so do you create the typical RSA keys when you are creating the CSR? Also I am fairly ...
0
votes
1answer
337 views

This certificate has an invalid digital signature

I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. ...
0
votes
1answer
96 views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
-1
votes
1answer
23 views

Choosing right way to secure access to server access via socket

I have an application running on a server, that has an exposed socket to the Internet to communicate with client that is/are application(s) on a phone. How would one go about properly securing the ...
2
votes
4answers
210 views

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
3
votes
2answers
155 views

How does iOS prevent unauthorised code from running?

I'm just wondering. How does iOS prevent someone from executing code on their device that isn't from Apple or downloaded from the App Store? Also what exactly, does a Jailbreak do to allow ...
3
votes
2answers
303 views

Why is a CSR hashed?

What are the use cases for defining something other than the default SHA1 hash in a CSR? Is it to protect the digital signature, public/private keys? What is it protecting exactly?
-1
votes
1answer
314 views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
1
vote
1answer
55 views

Would it be possible to use cookie to store SSL Client Certificate?

Lately, I was reading that article about SSL client certificate. Why is nobody using SSL Client Certificate? The answer was to that question was : In the current state, this excellent idea is ...
3
votes
2answers
268 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
0
votes
1answer
253 views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
1
vote
2answers
56 views

Is it Possible to use one commercial SSL Certificate to issue end user certs?

My organization is preparing to purchase some 50 "units" from Symantec, with which we can purchase Verisign SSL certificates of varying authentication levels. Our organization does not have--but ...