A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

-1
votes
2answers
38 views

HTTPS - if this protocol protect against connecting to false server?

I know about SSL certificates. However it is ok to say: protocol HTTPS protects against connecting to false server ?
0
votes
1answer
13 views

Certificate Setup Over Many Remote Resources

Imagine that you have a web app that needs to talk to a central api server with its purchased certificate. This server provides a token to the web app to be used to authenticate and talk to another ...
1
vote
2answers
82 views

Why do we need certificates confirming certificates?

Why do we need certificates confirming certificates? Why create a hierarchy or tree? These questions makes me confused, could you explain it me?
0
votes
1answer
24 views

Why is it not recommend to use permanent validity of certificate for public key [duplicate]

As we know it is not recommended to provide permanent validity of certificate for public key. I don't know why. Could you give me some reasons ?
3
votes
2answers
34 views

Question about SSL certificate and third party server

I have a system which consume web-services from a public server on Internet (but the data are not public) I have to provide credentials in Basic Auth to get the data, that is why we use SSL. The ...
1
vote
0answers
51 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
1
vote
1answer
36 views

DNSCrypt-proxy: This certificate looks valid

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy. [INFO] + DNS Security Extensions are supported [INFO] - [dnscrypt.eu-dk] ...
0
votes
1answer
70 views

Server providing two different SSL certificates

When I check on browser for a site example.com, I see that site has a valid certificate, not expired, with validity till end of 2016. At the same time, When I scan for the same domain on the port 443 ...
-1
votes
0answers
21 views

What prevents certificate spoofing? [duplicate]

If someone takes the information on a legitimate certificate and provides it to an illegitimate server for distribution of the certificate as if it were the illegitimate server's certificate what tips ...
0
votes
1answer
38 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
3
votes
1answer
47 views

What does an OpenPGP signature consist of?

I don't understand how OpenPGP signatures work. I have a picture which I want to sign, and a digital certificate which consists of my name and email address and my public key. Additionally, a digital ...
4
votes
3answers
82 views

Is it ok to have self-signed certificates in source control?

I just asked the question SSL self-signed certificates in development vs acquired cert in production? which has promptly been answered (THANKS!). Out of that, I have the following question: Is it ...
3
votes
1answer
47 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
0
votes
0answers
18 views

SpriteKit Level Data Security Handling

I have been reading many different posts, threads, etc. regarding the best practices to store level data to be used throughout a game application (level boundary data, images, characters, time, etc.). ...
0
votes
1answer
30 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
3
votes
3answers
154 views

Why are root certificate authorites allowed to issue certficates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
0
votes
2answers
38 views

How to avoid writing .pem while signing a csr?

I am using following command to sign a certificate, openssl ca \ -in client.csr \ -keyfile server.key \ -cert server.crt \ -outdir ./some_dir \ ...
0
votes
0answers
35 views

Validation client certificate for site in iis

Input: I send client certificate to client. He uses it to work with my web application which works in IIS. I installed CA certificate (which was used to create client certificate) on web server. AFAIK ...
0
votes
0answers
27 views

Java Client not able to establish SSL handshake with server [migrated]

I have a Java client which is using the Apache HttpClient 4.1 library to make an HTTPs request to a server which doesn't require authentication. If I call that server with my browser or curl, the ...
0
votes
3answers
83 views

what do you do when an ssl certificate expires and your app uses ssl pinning?

I originally posted this question on StackOverflow, but reposted here due to lack of responses. I am trying to decide if it's a good idea to do ssl pinning in my iOS game that uses a server to ...
0
votes
0answers
8 views

Applocker rules Publisher vs hash

I'm interested in deploying application white-listing for a large scale environment by using the Windows Server built-in AppLocker mechanism. There is no Internet connection to the environment. My ...
0
votes
1answer
68 views

Where in the CSR is the public key?

I am reading http://www.akadia.com/services/ssh_test_certificate.html In step 2 openssl req -new -key server.key -out server.csr server.key is generated earlier using openssl genrsa -des3 -out ...
1
vote
0answers
24 views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...
1
vote
2answers
77 views

Self-signed cert - how it works

I am new to SSL / digital certificates / signatures. What I know is that a digital signature must be verified/decrypted using the public key. So a cert that is signed by a CA must be ...
0
votes
2answers
89 views

SSL digital certificate process - high level

I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database. In this case, I have an web server and needs to implement SSL ...
0
votes
0answers
31 views

Mutual Authentication and Authorisation with Certificates from various CAs

Edit: Having read this question and answer I have a bit more of an understanding. My question now then, is: can I use a certificate that a user has had signed by a registered CA such as VeriSign, ...
2
votes
0answers
30 views

SSL/TLS: Policy Constraints vs. Basic Constraints

Could someone please explain the difference between Policy Constraints and Basic Constraints? It appears to me that they are either redundant, or two names for the same thing. I would love some ...
3
votes
1answer
43 views

How is validating an SSL certificate against a CRL not inefficient?

My understanding is that CRL is a list from a CA that says what certificates not to trust. Browsers will regularly download these lists from their trusted CAs and check the certificate of requested ...
3
votes
2answers
158 views

SSL Newbie : Does https client also need a certificate?

I am calling an https url through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words do I need my own certificate or is the ...
8
votes
3answers
141 views

What kind of certificate should I get If I want to secure a connection between a web server and a database?

I know people buy SSL certificates to secure their sites. What kind of certificate should I get if I want to encrypt a connection between an application server and a database? Application server may ...
1
vote
1answer
50 views

SHA2 certificate and TLS cipher suites compatablity

I have a server which is configured to use TLS 1.0, 1.1 and 1.2. The server is configured with a certificate siged by SHA-512. The server supports only these cipher suites: • ...
1
vote
1answer
102 views

How to get a green certificate bar if I'm not a company?

I'm not a company and do not represent one, but I would like to have a green bar on my website for several reasons. One of them, for example, is that I want to ensure that the information displayed in ...
1
vote
0answers
8 views

Web Scraper with client-side certs [closed]

I am building a web scraper that logs into websites, does some searches and collects results. The websites I've been logging into right now have all been pretty standard. I have been notified that ...
1
vote
1answer
28 views

Why does Windows windows suggest/have completely different (and seemingly valid) intermediate CA certs for a given leaf cert?

Is it normal for multiple intermediate CA certs to have the same Subject Key Identifier? Why does this happen? I always thought that this was a unique attribute. I have come across some odd cases ...
1
vote
0answers
42 views

Why is CertificateVerify message necessary? (Why isn't client authentication done through the KeyExchange)

Why is client authentication not done throught the KeyExchange like with the server, but through a CertificateVerify message? EDIT: To be more clear: When using RSA key exchange the client encrypts ...
1
vote
0answers
18 views

Problem using custom CryptoNG KSP on IE 11

We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for ...
-1
votes
0answers
21 views

Is it a wise idea to issue self-signed certificates to our customers? [duplicate]

In the following system which we have set up, what are the risks of issuing a self-signed certificate to our customers to put on their office machines? On our side we have a number of servers. Due to ...
3
votes
1answer
27 views

Questions regarding CRLs (producedAt and not modified)

I have two questions regarding the safety of requesting CRLs. My first question is: shouldn't CRLs contain a producedAt field just like OCSP responses? This would make sure a hacker doesn't send an ...
5
votes
1answer
30 views

Can attribute certificates be used with TLS / HTTPS?

Can attribute certificates (also known as authorization certificates) be used with HTTPS? For instance, can a HTTPS server supply an attribute certificate in addition to its ordinary SSL certificate? ...
0
votes
0answers
70 views

How does a Certicate Private Key gets transferred on import / export?

I am fairly new to certificates in general and have setup my own standalone CA for testing purposes. I have noticed some interesting behavior of private keys which I'm trying to find some ...
3
votes
0answers
240 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect ...
4
votes
0answers
46 views

Bidirectional encrypted server to server communication using TLS

I have 2 Windows servers and would like to set up encrypted communication between them using TLS. I've been reading up on TLS and X.509 certificates and I think I have a reasonable plan, but would ...
9
votes
1answer
438 views

Why does GoDaddy have four different certificate chain, G2, G3, G4?

I see from Godaddy they have multiple certificate chains https://certs.godaddy.com/repository GoDaddy Certificate Chain GoDaddy Certificate Chain - G2 GoDaddy Certificate Chain - G3 GoDaddy ...
8
votes
1answer
389 views

How to use encryption on a site that only uses an IP address, no domain name?

You can use SSL/TLS certificates and etc. on sites with domain names, but I don't know if it's possible to use them for IP addresses. If this is the case, would I have to use a self-signed cert and ...
4
votes
1answer
54 views

Protect sensitive information in a password-free, shared database

I'm working on a webserver that stores resources in Redis. To make swarm-deployments as hassle-free as possible, I'm implementing an option where the server doesn't need to access the filesystem to ...
3
votes
1answer
42 views

Why do some EV certificates show the full address of the organization, but others only show the state or city?

If I go to www.comodo.com, I can see their registered office address in the EV certificate: CN = www.comodo.com OU = COMODO EV SGC SSL OU = COMODO EV SSL O = Comodo Group Inc. STREET = 1255 Broad St. ...
1
vote
2answers
120 views

Why/when would a CA make a generated public key available to the public at large?

I'm confused about this section in my CEH security exam training material: A CA is able to perform a number of roles in addition to the validation process outlined here. Some actions that a CA is ...
5
votes
1answer
113 views

Securely build a list of trusted CAs

Some distributions of the cURL bundle include a utility mk-ca-bundle.pl which compiles a ca-bundle.crt from Mozilla's root certificate store for use as a list of trusted authorities. The script prints ...
2
votes
1answer
54 views

How does Windows certificate manager verify a file's certificate, if the root certificate is not in the store?

I'm working on a project which requires certificate verification for executable files. I have created my own trusted root certificate store, and used openssl to perform verification. However, when I ...
0
votes
0answers
24 views

Is there any extra validation that Firefox perform to certificates serial number

I open a secured site in my computer. for my reasons, I created new certificate every 15 minutes. I noticed that, sometimes, Firefox "doesn't like" my certificate. after little investigation, I ...