A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.
0
votes
0answers
35 views
What are my options in deploying an authentication certificate to iPhones and Android devices?
I need to deploy certificates to iPhone and Android devices for the purpose of Activesync and Egnnite (like Dropbox) web authentication.
Even though most access is over HTTPs via the browser, the ...
5
votes
1answer
45 views
'Trusted CA Certificates' and 'Trusted remote Certificates'
What is the difference between Trusted CA Certificates and Trusted remote Certificates?
3
votes
2answers
33 views
Change 'Key Usage' of a certificate
Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
1
vote
2answers
51 views
Force SSL/TLS client cert authentication even if server does not request it?
Usually the server specifies in the Server Hello message if a client certificate is needed/wanted.
Does anybody know if it is possible to perform an authentication via client cert if the server does ...
2
votes
1answer
37 views
Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA
I would like to ask if it is possible to use different CA for the client certificate and the web certificate?
For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
-3
votes
0answers
47 views
How to determine the sequence of ordering certificates by browser? [closed]
I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram:
----------
| ...
-4
votes
0answers
33 views
missing configuration in apache to achive mutual SSL authentcaion [closed]
After implementing a Mutual Certificate Authentication with OpenSSL and Apache Web Server on CentOS platform. I tried this scenario ( see this diagram ):
----------
...
1
vote
1answer
58 views
Certificate authentication with jQuery's ajax() function
I need to sync with my server with the client certificate abc.pfx which is generated by the server using Ajax. How do I send my certificate with Ajax object. Can I do this certificate authentication ...
-1
votes
1answer
80 views
Wireshark Decode HTTPS Root Certificate
I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
3
votes
1answer
78 views
What is the difference between Serial and Thumbprint
I have problems to understand what the difference between the Serial Number of a certificate and its SHA1 Hash is.
the MSDN says:
Serial number A number that uniquely identifies the ...
-1
votes
0answers
55 views
TLS Certificate in OSX Mail
My question hasn't been asked before here but when I googled for an answer I arrived at this thread @ macrumors.com. The question is quoted below:
I'm just curious, but in Lion's Mail there is a ...
5
votes
5answers
161 views
A standard way to manually add a digital signature to a pdf file?
I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
2
votes
1answer
75 views
How does an offline CA revoke certificates?
If an RSA private key of a root CA is stored offline, how does it revoke certificates it signs?
From looking at OpenSSL config the default_crl_days option seems to indicate that a CRL must be ...
3
votes
1answer
80 views
How does an end user differentiate between OV and DV certificates?
This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
1
vote
1answer
71 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
0
votes
1answer
64 views
Determine the Identity of Caller
Let me explain my situation.
I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
2
votes
1answer
40 views
Sending Digital Certificates
I used the makecert tool in order to create:
a self-signed certificate
a server certificate using the self-signed certificate
a client certificate using the self-signed certificate
I then ...
2
votes
1answer
64 views
Security Certificates - Tools to Generate Security Certificates
I want to create a self-signed certificate that will be installed as a trusted certificate authority.
I then want to create another two certificates which are signed using the private key of the ...
1
vote
1answer
102 views
The request was aborted: Could not create SSL/TLS secure channel Exception
Let me explain my situation.
I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC.
I then created two certificates using the self-signed ...
3
votes
1answer
85 views
Creation and deployment of self-signed certificates for a two-machine scenario
Let us assume that I have two computers:
client
server
Now, in the server computer, I set up a legacy ASMX web service which will going to be used by the client. Before the client can connect to ...
2
votes
0answers
79 views
How do I make or get computer certificates to use with IPSEC user authentication?
I am having trouble and need some direction using computer certificates with windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
2
votes
1answer
42 views
How does a function certificate work?
Say that we have a client / server solution (written in .NET). If we want to use a certificate for the TCP communication, is it enough to use one function/service certificate to encrypt communication ...
3
votes
3answers
209 views
Self signed certificates for https
Where I work, currently for internal sites, self signed certificates are being used.
In Firefox, the info regarding the certificate are displayed:
site domain: xxx.com
Owner: Site doesn't supply ...
1
vote
2answers
167 views
SSL: How to send generated client certificate from server to avoid MITM?
The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
91 views
Generate openSSL certificates from within C code using commands?
This is an openSSL command for generating a private key and a certificate,
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
The question I have is whether there is some ...
4
votes
1answer
148 views
SSL Cert Types and Key Usage
I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
2
votes
0answers
74 views
SANS Forensic Course -worth it? [closed]
I'm a Security Student at Pennsylvania State University and I am considering taking FOR408 through SANS this summer in Pittsburgh (not far from my home). I really want this to help me stand out in my ...
2
votes
2answers
92 views
Looking for general guidance on securing web API application for client applications and users
I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.
After a lot of googling ...
4
votes
2answers
71 views
Using SSL Certification in Multiple Locations
I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access.
The ...
2
votes
1answer
85 views
How do I diagnose client-side SSL errors?
Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
1
vote
1answer
79 views
x509: must the signature algorithm and public key algorithm match?
I'm having trouble getting Firefox to send an encrypted message using a certificate, and I've found that the only difference between this one and others that work fine are that this one has a DSA ...
2
votes
1answer
88 views
Would introducing client certificates for a mobile app improve security?
I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...
1
vote
1answer
86 views
Can I use any ssl certificate to sign and encrypt AS2 message?
I'm absolutely new to this topic of ssl certificates, so please be patient with me.
My task is to install an AS2 communication with some business partner. Therefore we need message signing and ...
2
votes
1answer
73 views
Certificate Chains When Importing Signed CSR Response
I'm interfacing with a secure web service, and authenticating using a client certificate. I'm confused about step #3 in the client configuration:
Generate a private key into keystore
Generate a CSR ...
0
votes
2answers
106 views
Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]
I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
0
votes
0answers
77 views
Extended validation SSL certificates [closed]
Where can i buy the cheapest EV SSL certificate?
By now the cheapest one i've found is Godaddy.
But i want know if there are a cheaper one.
2
votes
1answer
159 views
ECDHE_RSA and gmail
I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange.
Based on my understanding of TLS and Gmail, my client ...
1
vote
4answers
102 views
certificate usage for signing and encryption
I have a question for basic operating with certificates in emails and pdfs. Im familiar with public key cryptography.
The scenario:
In my scenario I want to send a confidential email to a person A ...
0
votes
1answer
105 views
How to test for OCSP
I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans / setting up OCSP responder etc. I have not found anything so far. ...
5
votes
1answer
68 views
Authentication by Signing or MAC?
I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
3
votes
2answers
91 views
Why are SSL certificates valid only from a certain date?
Each SSL certificate is valid starting from a specific date and up to the expiration date.
What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
3
votes
1answer
253 views
Choosing an SSL certificate provider
Does it make any difference which provider I get my SSL/TLS certificate from? In particular, what are the pros and cons getting an SSL certificate from Verisign vs getting one from Thawte? Which one ...
1
vote
1answer
146 views
What elliptic curves are supported by browsers?
Wireshark'ed Firefox 3 request. Their names are nowhere documented.
Elliptic curve: secp256r1 (0x0017)
Elliptic curve: secp384r1 (0x0018)
Elliptic curve: secp521r1 (0x0019)
What are the supported ...
3
votes
1answer
107 views
What are those nul bytes doing in Certificate Subject CN?
While doing some research with SSL certificates, I found some weird certificates containing nul bytes in their Subject field. One example is www.refah - bank.ir (did the Iranian government fake this ...
4
votes
1answer
138 views
How powerful are top Verisign executives?
I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a ...
2
votes
1answer
135 views
How to set “Not Before” value to past when creating certificate request
We have lots of embedded TLS clients on the field. TLS Servers must be authenticated.
Because long power cuts may reset clock of those devices, we have requirement to use certificates with validity ...
1
vote
1answer
74 views
How effective is Activesync Certificate revocation using CRL or OCSP
We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords.
One way to remedy an account lockout issue is to issue and deploy certificates ...
3
votes
1answer
267 views
Enhanced Key Usage vs. Extended Key Usage
I've seen both the terms Enhanced Key Usage and Extended Key Usage, and both were abbreviated as EKU. Do both refer to the same extension or property?
41
votes
10answers
2k views
Why do we not trust an SSL certificate that expired recently?
Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
3
votes
1answer
93 views
Certification authority only for certain domains
Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
