Tagged Questions

A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
1answer
31 views

How to make a decent Certificate Signing Request (CSR)?

I'd like to know how to make a decent Certificate Signing Request (CSR) to secure my website and e-mail with a wildcard SSL certificate. With recent exploits as POODLE on SSLv3 and such, I'd like to ...
0
votes
0answers
71 views

Example websites that have invalid certificates [on hold]

I am looking for websites that have invalid HTTPS certificates. I did a search but found few examples. I am wondering if anyone knows any HTTPS website with invalid or broken certificates, for ...
3
votes
1answer
21 views

Clarification on the -h Flag for Makecert.exe

When using Microsoft's Makecert.exe to generate a certificate (and key), there is the option to allegedly "specify the maximum height of the tree below that certificate", using the -h flag (see MSDN). ...
0
votes
1answer
89 views

Isn't this a broken certificate chain?

My certificate provider responded to my CSR with four certificates, the first being "ours", and the remaining three presumably to build a chain of trust. I've never had to investigate (and prove to ...
0
votes
0answers
16 views

Change client hello TLS version to 1.2 openssl & wpa_supplicant [on hold]

Been working for awhile with TLS DHECE Certificate Based Handshake with a RADIUS Server and wpa_supplicant- both running OpenSSL 1.0.1e FIPS. Afer watching the Wireshark traffic, I notice that the ...
8
votes
4answers
805 views

How bad it is to install another company's root certificate to your server?

Our company uses a web server with a couple of web sites on it (private and public, over HTTP and HTTPS, some low risk and some high risk including online payments or other sensitive data for ...
0
votes
1answer
28 views

Can an end-entity certificate with SHA-1 be issued by an intermediate CA that has SHA-256?

Just curious - if I'm using an end-entity (leaf) certificate that has a SHA-1 signature, does that mean that ALL certificates in the chain also must use SHA-1?
0
votes
1answer
20 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
3
votes
1answer
56 views

Reset Windows trusted certificates store to its default

Over the time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, some other times for development and testing. Is there ...
2
votes
1answer
69 views

What is the difference between a “Thumbprint Algorithm” “Signature Algorithm” and “Signature Hash Algorithm” for a certificates?

I'm a bit confused on the differences between Signature Algorithm, Signature Hash Algorithm, and Thumbprint Algorithm that are present in SSL/TLS certificates. Can someone please elaborate?
1
vote
2answers
78 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
1
vote
1answer
38 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
-2
votes
0answers
20 views

Certificate Chain validation in crypto++ [migrated]

I am wondering if and how X509 certificate chain validation can be easily done using the Crypto++ library. The only reference to X509 Certificate validation using Crypto++ that I could get is here, ...
-1
votes
1answer
31 views

How do server know the CSR sender is approved client?

Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The prblem is anyone can POST a CSR to the server and then ...
1
vote
2answers
35 views

PKI expired and renewed, do my correspondents have to do anything?

My PKI certificate (Digital ID for email from Symantec, issuer is "VeriSign Client External Certification Authority - G3") expired after 1 year and so I have renewed it. Do the people I correspond ...
0
votes
0answers
30 views

Do iOS applications have access to the certificates installed?

As the title says, I'm curious if a generic iOS application can access/retrieve the certificates installed in the device (e.g., via a management profile) Thanks
0
votes
2answers
43 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
0
votes
1answer
46 views

What is public key pinning [closed]

How does public key pinning work and what problem does it solve?
8
votes
4answers
726 views

Why the symmetric key is added to the message?

Yesterday in my class we learnt how to send a message from Alice to Bob with the achieved goals of confidentiality, integrity and authenticity. In order to have a better performance we use a hybrid ...
0
votes
1answer
50 views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
1
vote
2answers
72 views

Why would Comodo SSL certs have two intermediate CAs (chain length 4)?

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs. What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a ...
-1
votes
0answers
35 views

how to intercept SSL and enter outlook.com or gmail.com after confirmed with mobile phone

after configure config t interface FastEthernet0/21 no monitor session 2 monitor session 2 source interface FastEthernet0/21 monitor session 2 filter vlan 10 monitor session 2 destination interface ...
0
votes
0answers
30 views

Attack Vector for Wildcard Cert

So I am looking to the security risks of WildCard Certs, in a previous post most of the questions were answered however I have one follow up question for that. In my instance I use DigiCert, so ...
5
votes
2answers
425 views

Website Certificate Revocation check - Big deal? [duplicate]

As I was about to make payment for my flight ticket, I noticed something strange with the British Airways website's SSL cert. My browser (Google Chrome) was unable to check whether the certificate has ...
1
vote
1answer
43 views

Know certificate signing algorithm of a remote site using OpenSSL

I have been trying to know the "Certificate Signing Algorithm" ( SHA1 with RSA etc.) using openssl. To start with I tried to see the cerificate using following command, but it also does not show up ...
5
votes
1answer
174 views

Where are the anonymous/private domain validation SSL certs?

I have yet to find a CA that doesn't require personal information for DV certificates. Is this because all of the major browsers and operating systems have a policy to reject CAs that don't require ...
0
votes
2answers
38 views

How are “Certificate Signing” key usage certificates restricted to what domains they can sign?

Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate ...
1
vote
1answer
40 views

SSL - Main and Child servers network

There is an embedded device which acts a client. It communicates to a server via POST method whenever it has any data to be transmitted to the server. Embedded device: 1. Acts a Client 2. Does not ...
0
votes
5answers
124 views

Are most MiTM attacks done to impersonate web sites, or simply decrypt traffic?

The more I read about impersonating web sites the more I get confused. Does an attacker need the private key of the server in order to impersonate a website or does having the private key simply give ...
2
votes
1answer
50 views

Does client certificate do any encryption in https connection? [duplicate]

In Https connection asymmetric encryption (with Server certificate) is used during handshake and to create symmetric keys. Am I right that in this case client certificate does no encryption? The ...
0
votes
2answers
92 views

Self-signed certificates and internal cURL requests

I'm using an internal API for some commercial software we purchased and it recommends using SSL when utilizing the API; it uses cURL to achieve this and hence the user, pass and key will all be passed ...
1
vote
1answer
54 views

Recommended Key Usage for a client certificate

My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicate with the server to a path that requires a ...
0
votes
1answer
101 views

Can anyone with access to root CA private key decrypt HTTPS traffic?

Can anyone with access to root CA private key decrypt HTTPS traffic of sites using certificate signed by that CA ? and if yes do he need to be man-in-the-middle or just monitoring traffic is ...
0
votes
1answer
82 views

Why are CA's now signing root certs with SHA2?

I see that CA's are now giving the option of having the root CA cert signed with SHA2. I have been told that the hashing function in a root has no security value, and is irrelevant as far as a ...
8
votes
4answers
755 views

HTTPS self signed certficiate for personal website

I want to make my Synology NAS accessible over the internet. When I create my own certificate and import this on all my devices (PC, Laptop, Smartphone, Tablet, etc.) is this as secure as buying a ...
1
vote
1answer
102 views

Can't I forge an SSL certificate? [duplicate]

I read What's keeping a malicious man in the middle server from forging a valid certificate?, but when the client goes to verify the certificate, can't an attacker intercept that connection and say ...
2
votes
2answers
134 views

Does a self-signed certificate offer more protection than a public key?

I'm having a hard time finding the practical benefits of transmitting a self-signed certificate over simply a public key. I understand that a self-signed certificate proves the integrity of the public ...
2
votes
1answer
122 views

openssl ECDHE-RSA… cipher suite selected while using RSA server cert and ECDSA client cert

The scene: s_server using RSA certificate. s_client using ECC-ECDSA certificate. Client authentication is required (option -Verify set on s_server) Cipher-suite selected after handshake is ...
0
votes
2answers
182 views

What does 2^77.1 calls presented in a SHA1 attack mean?

Regarding the SHA 1 deprecation, I found this information here: http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx I know ...
2
votes
1answer
64 views

What does verified file in windows mean? And does it guarantee related files?

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g Microsoft) or in other case, unknown publisher. I know public key encryption can ...
1
vote
0answers
33 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
0
votes
0answers
29 views

What certificate attributes can I check to verify if an issuer is correct?

Apologies if this is a duplicate question. I thought I saw this discussed earlier but couldn't find the thread when searching. What attribute can I check to verify if I have the correct ...
3
votes
1answer
127 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
6
votes
1answer
108 views

How do systems protect against a stolen code-signing certificate after the certificate expires?

Imagine this scenario: 1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp. 15th December 2014 - the certificate is revoked. Malware will be prevented from ...
13
votes
3answers
1k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
3
votes
2answers
125 views

What role do hashes play in TLS/SSL certificate validation?

After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
17
votes
3answers
2k views

Is SHA1 weak for SSL?

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
1
vote
1answer
42 views

Does the SSL/TLS client certificate “hash over all previous messages” step hash the entire TCP packets or just data?

We have which uses TLS client certificates as it's authentication mechanism between client and server. There is an IT department which wants to run this app through a firewall/proxy device of some ...
0
votes
0answers
20 views

Is there any way possible that a Digital certificate is issued by admin on wireless channel?

I want that an admin who is working in a wireless environment have to issue digital certificate to the node, who wants to register itself with the network. this certificate will be used by user to ...
5
votes
1answer
287 views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...