A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
1answer
7 views

UTF8 and T61 strings, how do I see what my SSL cert uses?

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
1
vote
1answer
22 views

Secure Connection between two devices

I've a Device A which will communicate with multiple devices on a network (BLE and/or NFC). All the devices will be handled a Token upon authentication which somehow needs to be transferred over to ...
7
votes
1answer
438 views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
0
votes
0answers
12 views

What are alternate options for PBEWithMD5AndTripleDES with SecretKeyFactory.getInstance( ) for encrypting Image files? [on hold]

Are there any alternate options other than PBEWithMD5AndTripleDES. As we are aware MD5 is not considered secure enough a hashing method. My requirement is to implement Password Based Encryption (PBE) ...
2
votes
0answers
21 views

How to find more details on Invalid Certificates [migrated]

Setup I am following this blog post to set up ASP.net MVC5 on Linux. When I get to the part that adds the Microsoft certificates, I am warned that they are invalid. For example, this command: ...
3
votes
2answers
164 views

Is cacert.org more harmful than self-signing?

I don't understand the https security model attempted upon me by The OpenBSD Journal (undeadly.org). Instead of using self-signed certificates for https like they did in the past, they for a while ...
10
votes
3answers
2k views

Why is my Positive SSL certificate deemed insecure by Google Chrome? [duplicate]

We run a website over HTTPS with a wildcard certificate from Positive SSL. Today, when I opened Google Chrome (v. 42.0.2311.90 m) and navigated to the site, I noticed a red cross through the https ...
1
vote
2answers
50 views

Website Certificate with different public key

I've installed a ssl certificate from https://www.startssl.com/ in a server running with plesk. The website is the following: https://refood.sal-pimenta.pt/ As you can see the certificate is fine but ...
-1
votes
0answers
38 views

Your connection is not private - delete certificate/security exception? [closed]

I am trying to browse to a certain url and it gives me this error: "Your connection is not private" I understand I need an SSL certificate for that site. Well I got one for the site, but now I need ...
2
votes
1answer
94 views

Security Structure of an API

I've been developing a web application and APIs for 8 months. I implemented OAuth 2.0 client credentials for authentication. And now I have to implement TLS to my APIs. I've been dealing with SSL/TLS ...
-2
votes
1answer
69 views

Fiddler Can decrypt https traffic

So apparently, a software called fiddler is able to very easily decrypt secure https traffic with a click of a few buttons: http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/DecryptHTTPS I ...
0
votes
2answers
61 views

Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?

When accessing a HTTPS site by IP address, if the IP address is not in the alternate names field, the browser will throw an error about the certificate not matching. Would this be considered a low ...
1
vote
0answers
14 views

OpenSSL 0.9.8zc -> 0.9.8zd “broke” my certificates. [migrated]

I have a self-signed certificate (and CA) created on a Mac using OpenSSL 0.9.8zc. I use the certificate to secure connection to my svn server. With the latest OS X update, OpenSSL was updated to ...
-1
votes
1answer
26 views

Fido U2F Public keys in registration response

What is the deference between the two public keys: user public key (2nd element in Token response) user public key inside signature in U2F Token response for registration ?
0
votes
0answers
22 views

SSL Handshakes and authentication? [duplicate]

I was just wondering if someone could explain the complete process of SSL handshake with certificates, public - private keys and MAC exchange. And in which cases does the Certificate warnings arise ...
1
vote
0answers
20 views

Outlook not updating certificate [migrated]

Outlook is refusing to send an encrypted email to a recipient whose certificate recently expired. The recipient sent a signed email and I exported the certificate to a ".cer" file then updated their ...
0
votes
0answers
7 views

openssl error: Error Loading extension section server [migrated]

The system is fc21. The objective is to run the examples: http://linuxconfig.org/apache-web-server-ssl-authentication The openssl.cnf file has been created and the following command run: openssl ...
0
votes
1answer
46 views

Can I use a CA certificate for two ways (mutual) authentication

I cannot get an answer from a CA company for this question. I have to implement two ways SSL authentication between my server and my users computers. Users should access to my several API securly. I ...
1
vote
0answers
48 views

Identify the attestation certificate (X.509) in Fido U2F registration response

I'm trying to identify the attestation certificate (X.509) in Fido U2F registration response as described in fido-u2f-raw-message-formats-v1.0-rd-20141008.pdf document: An attestation certificate ...
2
votes
0answers
22 views

TLS connection to untrusted server - client reaction for dropping connection standardized?

I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
0
votes
1answer
60 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
2
votes
1answer
103 views

HTTPS client certificates for server-to-server

Say you have two servers with certificates proving their domains (e.g. for use with HTTPS). Can one of these servers use their certificate as a client certificate when talking to the other, so that ...
3
votes
1answer
131 views

A certificate site name mismatch when using preinstalled Toshiba software? (Superfish?)

On my Toshiba laptop there are a variety of different Toshiba programs that came pre-installed. Many of them are some sort of utility, optimizer, checkup, and update kind of programs that I guess are ...
2
votes
1answer
42 views

Authenticity of PDF document printed from Word

My MS Word Add-In generates PDF preview of DOCX file on client PC and uploads both files to server. I cannot generate PDF on server. Is there any way to make sure that the PDF is the printed version ...
1
vote
1answer
34 views

What exactly is meant by serverAuth and clientAuth

I'm building a network that will allow employees and customers to access the company systems. To that end I'm using a Linux 7 server as a firewall/authentication server. Initially for test purposes ...
0
votes
2answers
85 views

What is the real use of certificates on the web?

When you get a certificate from a website you visit, signed by a trusted CA, is it trust-worthy because the CA authority did a background check on them? But how does this help with spoof websites? ...
1
vote
1answer
62 views

How to generate self-signed EV SSL Certificate?

I configured XAMPP / Windows on my laptop so that this URL: https://www.supersite.com/ points to XAMPP / localhost rather look elsewhere. I basically generated a self-signing certificate, imported ...
1
vote
0answers
18 views

Can I use a self-signed certificate in Tomcat for private APIs and a commercial certificate for public pages? [migrated]

I distribute a Java desktop application that needs to communicate with some RESTful APIs served by embedded Tomcat within a Spring Boot webapp. I was planning on using a self-signed certificate for ...
11
votes
2answers
650 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
0
votes
0answers
19 views

Do I need my certificate server? [migrated]

Good afternoon. I'm getting ready to replace one of my DC's and noticed it is using the Certification Services role on it. I looked and we have about 8 outstanding certificates that have yet to ...
4
votes
1answer
57 views

Security risk: Digitally sign communications for SMB

I have a computer (Windows) on a network where an industrial process is controlled. There is an option in Local Security Policy >> Local Policies >> Security Options >> "Microsoft network client: ...
1
vote
1answer
39 views

Use appstore using trusted certificate [closed]

I connected my iPad to my laptop's localproxy. I also installed a trusted digital certificate in my iPad. I am now able to use all HTTPS networks through my iPad except appstore. If I disable proxy, I ...
0
votes
0answers
48 views

Firefox stopped working with our app after 36.0.1 [migrated]

We have a web application that works on all browsers and firefox before 36.0.1 Have done all the typical things, clearing cache, reinstalling ff, etc. Multiple different machine from different ...
0
votes
1answer
48 views

Can public certificates be password-protected?

I've only seen private key files (.pfx, .pkcs12) being password protected. Someone told me public cert files (.cer) can also be password-protected. Is that true? Is it also true to say any certificate ...
0
votes
3answers
56 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...
1
vote
0answers
59 views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
0
votes
1answer
12 views

Number of certificates in a PKCS#12 archive

Is there command to find the number of certificates in a PKCS#12 archive? I have the .pfx file sent by a client but need to find out how many certificates it contains. I don't need any of the ...
2
votes
1answer
65 views

Can I modify my certificate chain?

I've had SSL/TLS running on my site now for a while. In order to learn a bit more about general PKI, I studied Qualys' SSL test, and optimised my configuration (including the adoption of OCSP ...
2
votes
0answers
16 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
0
votes
3answers
56 views

In order to trust the digital certificate, does immediate CA cert also needs to be in trust store or root CA cert is enough?

In order to trust the digital certificate, does immediate CA certificate also needs to be in trust store or root CA certificate is enough?
0
votes
1answer
40 views

Combining wildcard and subdomain-specific SSL certificates

Not quite sure which Google terms to use to find the answer, so I thought I'd ask it here, presented as a scenario: Say you have a corporate entity (Example Co) with a wildcard SSL cert issued for ...
0
votes
1answer
89 views

Begin of Certificate/ End of Certificate dash “-----”

What significance does the dash "-" holds along with the line -----BEGIN CERTIFICATE----- or -----END CERTIFICATE-----. I checked multiple docs and linked RFC's as well but could not find the ...
1
vote
1answer
84 views

Is a self-signed SHA-1 certificate sufficient security for a company transmitting sensitive data?

We recently decided to pay an ISP (a substantial sum, mind) for a managed internet service up to and including the router in our head office. Part of the initial discussions made it clear that ...
4
votes
1answer
196 views

Did Google relax their SHA1 deprecation schedule?

In the original post on the subject they said that in Chrome 41: Sites with end-entity certificates that expire on or after 1 January 2017, and which include a SHA-1-based signature as part of the ...
5
votes
1answer
53 views

Do CA Public Audit Records increase the visibility, and risk of attack?

Does the CA feature of Public Audit Records increase the visibility of my hosts, and therefore the risk of host-specific attacks? Would the only mitigation be to only enable this for wildcard ...
1
vote
1answer
35 views

What bits of data is revoked in a CRL? Is it the hash(CSR) or hash(CSR + PKI signature)

My understanding is that a CSR contains the public key from the client, and the response is a signed version of that CSR, with certain attributes (EKU, expiration) and other attributes the CA decides ...
1
vote
1answer
36 views

Possible to change the CA that a keypair is using?

Pretend I take the same CSR and send it to two different CAs as described in the following scenario: I create a CSR on Windows I submit the CSR and edit my SAN names. Request is pending at the CA ...
0
votes
1answer
39 views

CSR signing follow up question

This is a follow up question , after getting a signed certificate from one CA. researched a lot , but no luck. After getting the CA reply, While downloading the certificate, it popped up saying ...
3
votes
3answers
95 views

SSL Cert for sub.domain.com and www.sub.domain.com

I have a wildcard cert issued by godaddy for *.domain.com. currently, https://sub.domain.com works just fine. however, https://www.sub.domain.com does not work. Do I need a separate cert for ...
0
votes
0answers
40 views

Certificate verification

I work on a desktop application which generates Security certificates. The Business use of these certificates is - they will be used as an authentication and authorization mechanism to enable users to ...