A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

2
votes
1answer
57 views

How do “certificates” hold “keys”? [duplicate]

I am new to the realm of security and keep hearing about "certificates" containing "keys". But no one has been able to actually explain to me what is actually meant by this. I assume that the ...
0
votes
0answers
50 views

securing a web application access [on hold]

I have to develop a web application using a JavaScript framework on the frontend and some REST services on the backend (written in Java). The Web/app server is IBM WebSphere. The users of this ...
1
vote
1answer
93 views

What can a trusted certificate do?

I am doing some reading about security on mobile applications because I found an article about Man in the Middle Attacks. I saw in that article and in many other places (including ...
-1
votes
1answer
46 views

HTTPS - if this protocol protect against connecting to false server?

I know about SSL certificates. However it is ok to say: protocol HTTPS protects against connecting to false server ?
1
vote
1answer
18 views

Certificate Setup Over Many Remote Resources

Imagine that you have a web app that needs to talk to a central api server with its purchased certificate. This server provides a token to the web app to be used to authenticate and talk to another ...
2
votes
2answers
87 views

Why do we need certificates confirming certificates?

Why do we need certificates confirming certificates? Why create a hierarchy or tree? These questions makes me confused, could you explain it me?
0
votes
1answer
27 views

Why is it not recommend to use permanent validity of certificate for public key [duplicate]

As we know it is not recommended to provide permanent validity of certificate for public key. I don't know why. Could you give me some reasons ?
3
votes
2answers
39 views

Question about SSL certificate and third party server

I have a system which consume web-services from a public server on Internet (but the data are not public) I have to provide credentials in Basic Auth to get the data, that is why we use SSL. The ...
2
votes
0answers
57 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
2
votes
1answer
40 views

DNSCrypt-proxy: This certificate looks valid

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy. [INFO] + DNS Security Extensions are supported [INFO] - [dnscrypt.eu-dk] ...
1
vote
1answer
73 views

Server providing two different SSL certificates

When I check on browser for a site example.com, I see that site has a valid certificate, not expired, with validity till end of 2016. At the same time, When I scan for the same domain on the port 443 ...
-1
votes
0answers
21 views

What prevents certificate spoofing? [duplicate]

If someone takes the information on a legitimate certificate and provides it to an illegitimate server for distribution of the certificate as if it were the illegitimate server's certificate what tips ...
1
vote
1answer
45 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
4
votes
1answer
49 views

What does an OpenPGP signature consist of?

I don't understand how OpenPGP signatures work. I have a picture which I want to sign, and a digital certificate which consists of my name and email address and my public key. Additionally, a digital ...
5
votes
3answers
85 views

Is it ok to have self-signed certificates in source control?

I just asked the question SSL self-signed certificates in development vs acquired cert in production? which has promptly been answered (THANKS!). Out of that, I have the following question: Is it ...
3
votes
1answer
51 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
0
votes
0answers
18 views

SpriteKit Level Data Security Handling

I have been reading many different posts, threads, etc. regarding the best practices to store level data to be used throughout a game application (level boundary data, images, characters, time, etc.). ...
0
votes
1answer
32 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
3
votes
3answers
158 views

Why are root certificate authorites allowed to issue certficates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
0
votes
2answers
39 views

How to avoid writing .pem while signing a csr?

I am using following command to sign a certificate, openssl ca \ -in client.csr \ -keyfile server.key \ -cert server.crt \ -outdir ./some_dir \ ...
0
votes
0answers
36 views

Validation client certificate for site in iis

Input: I send client certificate to client. He uses it to work with my web application which works in IIS. I installed CA certificate (which was used to create client certificate) on web server. AFAIK ...
0
votes
0answers
27 views

Java Client not able to establish SSL handshake with server [migrated]

I have a Java client which is using the Apache HttpClient 4.1 library to make an HTTPs request to a server which doesn't require authentication. If I call that server with my browser or curl, the ...
0
votes
3answers
87 views

what do you do when an ssl certificate expires and your app uses ssl pinning?

I originally posted this question on StackOverflow, but reposted here due to lack of responses. I am trying to decide if it's a good idea to do ssl pinning in my iOS game that uses a server to ...
0
votes
0answers
11 views

Applocker rules Publisher vs hash

I'm interested in deploying application white-listing for a large scale environment by using the Windows Server built-in AppLocker mechanism. There is no Internet connection to the environment. My ...
0
votes
1answer
69 views

Where in the CSR is the public key?

I am reading http://www.akadia.com/services/ssh_test_certificate.html In step 2 openssl req -new -key server.key -out server.csr server.key is generated earlier using openssl genrsa -des3 -out ...
1
vote
0answers
24 views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...
1
vote
2answers
78 views

Self-signed cert - how it works

I am new to SSL / digital certificates / signatures. What I know is that a digital signature must be verified/decrypted using the public key. So a cert that is signed by a CA must be ...
0
votes
2answers
92 views

SSL digital certificate process - high level

I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database. In this case, I have an web server and needs to implement SSL ...
0
votes
0answers
33 views

Mutual Authentication and Authorisation with Certificates from various CAs

Edit: Having read this question and answer I have a bit more of an understanding. My question now then, is: can I use a certificate that a user has had signed by a registered CA such as VeriSign, ...
2
votes
0answers
32 views

SSL/TLS: Policy Constraints vs. Basic Constraints

Could someone please explain the difference between Policy Constraints and Basic Constraints? It appears to me that they are either redundant, or two names for the same thing. I would love some ...
3
votes
1answer
43 views

How is validating an SSL certificate against a CRL not inefficient?

My understanding is that CRL is a list from a CA that says what certificates not to trust. Browsers will regularly download these lists from their trusted CAs and check the certificate of requested ...
3
votes
2answers
158 views

SSL Newbie : Does https client also need a certificate?

I am calling an https url through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words do I need my own certificate or is the ...
8
votes
3answers
141 views

What kind of certificate should I get If I want to secure a connection between a web server and a database?

I know people buy SSL certificates to secure their sites. What kind of certificate should I get if I want to encrypt a connection between an application server and a database? Application server may ...
1
vote
1answer
52 views

SHA2 certificate and TLS cipher suites compatablity

I have a server which is configured to use TLS 1.0, 1.1 and 1.2. The server is configured with a certificate siged by SHA-512. The server supports only these cipher suites: • ...
2
votes
1answer
103 views

How to get a green certificate bar if I'm not a company?

I'm not a company and do not represent one, but I would like to have a green bar on my website for several reasons. One of them, for example, is that I want to ensure that the information displayed in ...
1
vote
0answers
8 views

Web Scraper with client-side certs [closed]

I am building a web scraper that logs into websites, does some searches and collects results. The websites I've been logging into right now have all been pretty standard. I have been notified that ...
1
vote
1answer
28 views

Why does Windows windows suggest/have completely different (and seemingly valid) intermediate CA certs for a given leaf cert?

Is it normal for multiple intermediate CA certs to have the same Subject Key Identifier? Why does this happen? I always thought that this was a unique attribute. I have come across some odd cases ...
1
vote
0answers
42 views

Why is CertificateVerify message necessary? (Why isn't client authentication done through the KeyExchange)

Why is client authentication not done throught the KeyExchange like with the server, but through a CertificateVerify message? EDIT: To be more clear: When using RSA key exchange the client encrypts ...
1
vote
0answers
20 views

Problem using custom CryptoNG KSP on IE 11

We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for ...
3
votes
1answer
27 views

Questions regarding CRLs (producedAt and not modified)

I have two questions regarding the safety of requesting CRLs. My first question is: shouldn't CRLs contain a producedAt field just like OCSP responses? This would make sure a hacker doesn't send an ...
5
votes
1answer
32 views

Can attribute certificates be used with TLS / HTTPS?

Can attribute certificates (also known as authorization certificates) be used with HTTPS? For instance, can a HTTPS server supply an attribute certificate in addition to its ordinary SSL certificate? ...
0
votes
1answer
97 views

How does a Certificate Private Key get transferred on import / export?

I am fairly new to certificates in general and have setup my own standalone CA for testing purposes. I have noticed some interesting behavior of private keys which I'm trying to find some ...
3
votes
0answers
243 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect ...
4
votes
0answers
49 views

Bidirectional encrypted server to server communication using TLS

I have 2 Windows servers and would like to set up encrypted communication between them using TLS. I've been reading up on TLS and X.509 certificates and I think I have a reasonable plan, but would ...
9
votes
1answer
442 views

Why does GoDaddy have four different certificate chain, G2, G3, G4?

I see from Godaddy they have multiple certificate chains https://certs.godaddy.com/repository GoDaddy Certificate Chain GoDaddy Certificate Chain - G2 GoDaddy Certificate Chain - G3 GoDaddy ...
8
votes
1answer
391 views

How to use encryption on a site that only uses an IP address, no domain name?

You can use SSL/TLS certificates and etc. on sites with domain names, but I don't know if it's possible to use them for IP addresses. If this is the case, would I have to use a self-signed cert and ...
4
votes
1answer
54 views

Protect sensitive information in a password-free, shared database

I'm working on a webserver that stores resources in Redis. To make swarm-deployments as hassle-free as possible, I'm implementing an option where the server doesn't need to access the filesystem to ...
3
votes
1answer
43 views

Why do some EV certificates show the full address of the organization, but others only show the state or city?

If I go to www.comodo.com, I can see their registered office address in the EV certificate: CN = www.comodo.com OU = COMODO EV SGC SSL OU = COMODO EV SSL O = Comodo Group Inc. STREET = 1255 Broad St. ...
1
vote
2answers
121 views

Why/when would a CA make a generated public key available to the public at large?

I'm confused about this section in my CEH security exam training material: A CA is able to perform a number of roles in addition to the validation process outlined here. Some actions that a CA is ...
5
votes
1answer
113 views

Securely build a list of trusted CAs

Some distributions of the cURL bundle include a utility mk-ca-bundle.pl which compiles a ca-bundle.crt from Mozilla's root certificate store for use as a list of trusted authorities. The script prints ...