A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
0answers
46 views

Certificate Errors with bad Date Time settings [migrated]

I have recently solved an issue with IE 11 where I was getting certificate errors to google.com bing.com was fine no problems I tried a number of different things till seeing a post referring to ...
3
votes
1answer
39 views

Can javascript code served by a server under HTTPS talk to another server under a subdomain with a different certificate?

Lets assume we have two servers : (1) https://adomain.com (2) https://abc.x.adomain.com The each have different certificates, (2) has a wildcard and (1) does not. If we remove https from the ...
4
votes
3answers
77 views

Steps to find out whether a SSL certificate is trustworthy

For doing business with a company I have to browse to https://www.prioenergie.de/nc/mein-prioenergie.html (German website). Firefox says the certificate is invalid, because it is not signed by a ...
2
votes
2answers
95 views

Why Google Chrome complains about mozilla.org identity?

On a "brand new" (but fully updated) Windows XP installation (an Asus EeePC that I restored to factory setting and than updated with all Microsoft's upgrades) I installed a few days ago Google Chrome. ...
0
votes
0answers
24 views

How to add basicConstraints extention to a self signed certificate

Using openssl to create a self signed certificate. The certificate needs to have the Basic Constraints value defined and showing in the cert but I can't seem to be finding the right location to modify ...
0
votes
0answers
41 views

Why is the public key extracted from the CSR different than the one extracted from the associated certificate?

I am playing around with pyopenssl. I am trying to extract the public key from a CSR and to check if it is the same than the one I find in the associated certificate. There is a small difference ...
0
votes
0answers
21 views

Encrypted alert with code 21 for connection [on hold]

I've got a device that connected to the server and successfully did the handshake and received application data, however later when client sends keep-alive requests server sends back encrypted alert ...
1
vote
1answer
75 views

How will SHA1 deprecation affect SHA1 roots in OS/Browser trust stores.

I understand the SHA1 deprecation policy applies to CA's issuing SHA2 end-entity certs and intermediates starting Jan 2017 but how will this policy affect the actual root certificates in OS/Browser ...
0
votes
1answer
258 views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
2
votes
5answers
170 views

Can we have https without certificates?

I apologize in advance if I am fundamentally misunderstanding something, but is it possible to have encrypted communication protocols (https, I suppose) without resorting to a certificate system? ...
1
vote
2answers
99 views

Will CA's still validate internal IP's in SSL certs?

Just wondering what Certificate Authority (CA) policy is nowadays on validating someone's internal IP address in a certificate? I have heard that some CA's used to do this but won't anymore.
0
votes
2answers
36 views

Why does IP address need to be listed as a DNS name in SAN/UCC certs?

I have heard that when creating a CSR that if you want to validate an IP address that you should list the IP as a "DNS" name and not "IP Address". I have actually had to re-create CSR's like this to ...
2
votes
2answers
171 views

What's the difference between X.509 and PKCS#7 Certificate?

Am I correct calling file with .p7b file extension saved as 'Cryptographic Message Syntax Standard - PKCS#7 Certificates (.P7B)' in Windows - a 'PKCS#7 certificate'? Or is it better called 'X.509 ...
1
vote
1answer
77 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
0
votes
0answers
36 views

Question regarding SSL / TLS / Certificates in general [duplicate]

for the last two days I played around a bit with nginx's SSL configuration. A question came up: I created asymmetric key using $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:4096 -keyout ...
3
votes
3answers
189 views

TLS library problem when connecting to Dovecot

I have a Comodo PositiveSSL certificate issued for mail.btcontract.com and I've set up Postfix and Dovecot to work with it in the following way: Postfix main.cf: smtpd_tls_cert_file = ...
0
votes
1answer
38 views

How to change the expiration time for the pkcs certificate?

I have an application (which I'm testing), in which I create some services. These services are accessible via libraries i.e java and python apis. In order to authenticate the api calls, the ...
3
votes
1answer
105 views

Can Fiddler decrypt HTTPS traffic when using elliptic curves + client cert authetication?

Case 1 involves TLS + client certificate authentication with both client and server using secp384 based EC certificates. In this case, when monitoring traffic via fiddler, the tunneling/handshaking as ...
6
votes
4answers
1k views

How to prove Bob has received Alice message

I have read up on Digital signature and it is stated that it provides non-repudation. Assuming Alice signs the message using her private key and sends it to Bob, Bob can use Alice's public key to ...
1
vote
2answers
66 views

To trust, or not to trust? Adding exceptions to the Trusted Certificates List in (firefox) Light

I recently installed the Light (a more compact forking of Firefox). I started getting the "This Connection is Untrusted" error, which got me wondering: when should I add an exception to the list of ...
2
votes
0answers
27 views

Why do some unrelated websites (appear to) share certificates? [duplicate]

If you browse to https://blog.stackoverflow.com/ you see a certificate error. In Chrome: This server could not prove that it is blog.stackoverflow.com; its security certificate is from ...
0
votes
2answers
126 views

How to be sure that downloaded file is correct? [duplicate]

Last week I read a lot about security. I have a basic understanding how public keys or private keys works. But I still have a lot of questions I can't find an answer. Right now I'm interested in ...
1
vote
1answer
35 views

Machine Certificate Key File Artifacts

When a new machine certificate is imported with a private key a MachineKey file is generated in "%ProgramData%\Microsoft\Crypto\RSA\MachineKeys". When using the certificate mmc snapin or removing a ...
1
vote
1answer
216 views

SSL interception with Burp Suite using Firefox - Strange behavior when intercepting twitter

I am learning Burp Suite(Free Edition v1.6). I have set it up with the default settings. The proxy listener is listening to 127.0.0.1 on port 8080 and Certificate option is set to 'Generate CA-signed ...
1
vote
2answers
174 views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
0
votes
1answer
97 views

Mac OS X : Certificates signed by company trusted CA cannot be verified

I'm trying to setup a keychain on Apache Tomcat that contains a server certificate that was signed by a custom root ca certificate. (not sure if custom is the right word here, but it's a root ...
1
vote
2answers
119 views

Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?

we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
1
vote
1answer
93 views

Forcing eap-TLS 1.2 authentication with FreeRadius and OpenSSL

Been working with TLS DHECE Certificate Based Handshake with a FreeRADIUS Server and wpa_supplicant- both running OpenSSL 1.0.1j FIPS. Afer watching the Wireshark traffic, I notice that the client ...
0
votes
1answer
55 views

How to make a decent Certificate Signing Request (CSR)?

I'd like to know how to make a decent Certificate Signing Request (CSR) to secure my website and e-mail with a wildcard SSL certificate. With recent exploits as POODLE on SSLv3 and such, I'd like to ...
3
votes
1answer
32 views

Clarification on the -h Flag for Makecert.exe

When using Microsoft's Makecert.exe to generate a certificate (and key), there is the option to allegedly "specify the maximum height of the tree below that certificate", using the -h flag (see MSDN). ...
0
votes
1answer
143 views

Isn't this a broken certificate chain?

My certificate provider responded to my CSR with four certificates, the first being "ours", and the remaining three presumably to build a chain of trust. I've never had to investigate (and prove to ...
8
votes
4answers
837 views

How bad it is to install another company's root certificate to your server?

Our company uses a web server with a couple of web sites on it (private and public, over HTTP and HTTPS, some low risk and some high risk including online payments or other sensitive data for ...
0
votes
1answer
34 views

Can an end-entity certificate with SHA-1 be issued by an intermediate CA that has SHA-256?

Just curious - if I'm using an end-entity (leaf) certificate that has a SHA-1 signature, does that mean that ALL certificates in the chain also must use SHA-1?
0
votes
1answer
35 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
3
votes
1answer
184 views

Reset Windows trusted certificates store to its default

Over the time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, some other times for development and testing. Is there ...
2
votes
1answer
215 views

What is the difference between a “Thumbprint Algorithm” “Signature Algorithm” and “Signature Hash Algorithm” for a certificates?

I'm a bit confused on the differences between Signature Algorithm, Signature Hash Algorithm, and Thumbprint Algorithm that are present in SSL/TLS certificates. Can someone please elaborate?
1
vote
2answers
89 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
1
vote
1answer
50 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
-1
votes
1answer
38 views

How do server know the CSR sender is approved client?

Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The prblem is anyone can POST a CSR to the server and then ...
1
vote
2answers
45 views

PKI expired and renewed, do my correspondents have to do anything?

My PKI certificate (Digital ID for email from Symantec, issuer is "VeriSign Client External Certification Authority - G3") expired after 1 year and so I have renewed it. Do the people I correspond ...
0
votes
0answers
35 views

Do iOS applications have access to the certificates installed?

As the title says, I'm curious if a generic iOS application can access/retrieve the certificates installed in the device (e.g., via a management profile) Thanks
1
vote
2answers
58 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
0
votes
1answer
50 views

What is public key pinning [closed]

How does public key pinning work and what problem does it solve?
8
votes
4answers
735 views

Why the symmetric key is added to the message?

Yesterday in my class we learnt how to send a message from Alice to Bob with the achieved goals of confidentiality, integrity and authenticity. In order to have a better performance we use a hybrid ...
0
votes
1answer
66 views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
1
vote
2answers
96 views

Why would Comodo SSL certs have two intermediate CAs (chain length 4)?

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs. What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a ...
0
votes
0answers
32 views

Attack Vector for Wildcard Cert

So I am looking to the security risks of WildCard Certs, in a previous post most of the questions were answered however I have one follow up question for that. In my instance I use DigiCert, so ...
5
votes
2answers
466 views

Website Certificate Revocation check - Big deal? [duplicate]

As I was about to make payment for my flight ticket, I noticed something strange with the British Airways website's SSL cert. My browser (Google Chrome) was unable to check whether the certificate has ...
1
vote
1answer
67 views

Know certificate signing algorithm of a remote site using OpenSSL

I have been trying to know the "Certificate Signing Algorithm" ( SHA1 with RSA etc.) using openssl. To start with I tried to see the cerificate using following command, but it also does not show up ...
6
votes
2answers
206 views

Where are the anonymous/private domain validation SSL certs?

I have yet to find a CA that doesn't require personal information for DV certificates. Is this because all of the major browsers and operating systems have a policy to reject CAs that don't require ...