A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
1answer
31 views

How is a root certificate revoked?

I know that CAs use intermediate certificates to mitigate the impact of potentially having to revoke a root CA (i.e., the need to update all browser clients on peoples computers allover the world). ...
0
votes
1answer
54 views

Do I have the private keys to CAs installed on my browser?

Could someone please help explain the following comment from Why was the private key of the Superfish certificate so easily extractable? The main issue with private key extraction is the use of ...
1
vote
0answers
15 views

Are GeoTrust SHA-256 intermediate chain and cross-root legacy support, mutually exclusive?

I have purchased a GeoTrust TrueBusiness ID SHA-256 with EV SSL Certificate. According to GeoTrust website, I must also install the corresponding intermediate certificate, which is "GeoTrust EV SSL ...
2
votes
1answer
34 views

Difference Between Web and Chain of Trust

I have a basic understanding of the "Web of Trust" used in PGP. I would like to know how the "Web of Trust" differs from the "Chain of Trust" that's used for SSL certificates?
0
votes
1answer
59 views

Who is responsible for generating public key during secure communication?

This must be easy but I am getting a little confused. Say, facebook.com, it has a certificate which is signed by an intermediary CA. Who generated that public key that I can see in facebook ...
1
vote
0answers
48 views

Do search engines verify HTTPS certificates, and if so, against which CAs?

Just out of curiosity, I'm wondering whether search engines attempt to validate certificates and what is their trust store. Do they accept everything regardless of certificate's trust/validity or do ...
0
votes
1answer
69 views

How to create a server certificate from a letsencrypt.org certificate?

I have created a letscrypt.org certificate using letsencrypt run which works fine as a SSL certificate on apache2. How can I create another server certificate signed (and thus trusted) by the ...
1
vote
2answers
44 views

Should each service running on a domain have a separate certificate?

I have a domain name with dynamic DNS (DDNS) for my home server on which I expose multiple services (web server, wikis, issue trackers, etc.) online. Some services are hosted by the same software (e.g....
4
votes
1answer
60 views

How does the client pick the correct certificate from its certificate store?

As I am able to configure my SQL Server and client to establish SSL connection, I have installed the certificate on the server as well as on the client machine (Trusted Root Certification Authorities ...
1
vote
0answers
43 views

SSL self signed certificate CER exception added to Keychain but fails in Chrome

Operating System: Mac OSX El Capitan 10.11.5 When browsing to the page I have a Privacy error, although an exception was added. I have the correct CER file so I added it to my Keychain TRUST THE ...
2
votes
3answers
73 views

What specific information is used to verify an SSL certificate?

When a CA's SSL certificate is stored in a browser, a server which presents a certificate signed by this CA can be verified by the browser. My question is: How exactly is this verification done? I ...
2
votes
0answers
18 views

Mixing Off-The-Record and classic SSL

I am developing some pubsub system on top of Node.js and Socket.io. I decided to implement Off-The-Record (OTR) encryption by default for all of data transfers between clients and server(s). Question ...
3
votes
1answer
115 views

What exactly does certificate tranparency do?

I have huge problems to understand how certificate transparency is different from mechanism like crl or ocsp which allow to get the status of a certificate by contacting the ca directly. Which ...
5
votes
1answer
119 views

Why do certificates need thumbprints?

I recently learned mechanism of certificates. But I can't understand why a "thumbprint" is included in a certificate. For intermediate and end-user certificates, it is verified by its issuer. so it ...
1
vote
1answer
42 views

Do not trust all intermediate certificates

I have a trust store containing SSL certificate chain up to Root CA certificate: Root CA -> Intermediate CA - SSL certificate According what I saw as a best practice, only Root CA certificate should ...
0
votes
1answer
33 views

Key usage extension on certificate

When I create a CSR and provide the block of encrypted text to a Root CA (e.g. Verisign, Thawte), what or who will determine the Key Usage extension attributes like: Digital Signature Non-...
1
vote
1answer
39 views

Can we provide our external certificates to a customer's SQL Server for SSL?

In designing hosted software that interfaces with a client's SQL Server over TCP/IP and we may wish to offer the option of using SSL/TLS. One architecture that seems attractive is where we generate a ...
4
votes
2answers
73 views

Can a SSL Certificate dictate protocol?

I know you can set the protocol/cipher via your web server: Nginx: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; Apache: SSLProtocol all -SSLv2 SSLCipherSuite ...
2
votes
3answers
53 views

Does a certificate authority use different private keys?

I was wondering whether a CA has different private keys to sign certificates with? Is there a risk of crypto-analysis (or something similar) when a CA signs thousands of certificates with the same ...
30
votes
5answers
2k views

Is there a risk to a business that is using a shared certificate?

I was looking at my bank website's certificate and discovered that it's issued to multiple websites, and the bank's domain name is only listed among many other domains in the 'alternative names' field....
0
votes
1answer
26 views

err_ssl_pinned_key_not_in_cert_chain

I have a question: how I can prevent this error from server side? We have a new cert, and it's valid, but users getting this error. Earlier, I've added HTTP response header Public Key Pins with 1 ...
0
votes
3answers
137 views

Can a Man In The Middle attack cause a certificate error? [closed]

I was playing around with Ettercap and I performed an ARP spoofing, MiTM attack on a friends computer as a joke. Now (about a day later) she tried to login to a website for work and it said "Your ...
0
votes
2answers
32 views

Different certificates for the same website?

When I load https://objective-see.com in Safari, it shows me a certificate with CN=objective-see.com. However, when I retrieve the certificate using echo -e | openssl s_client -connect "objective-see....
3
votes
1answer
94 views

How does Let's Encrypt prevent imposters?

Because Let's Encrypt doesn't provide Entity Validation, is it true that one can, for example, generate a certificate that has "Facebook Inc." as Organization for a bogus domain faceb00k.com?
16
votes
3answers
2k views

Why is it more secure to use intermediate CA certificates?

I've read that using Intermediate CA certificates is more secure because this way the Root CA is offline. So, if the Intermediate is compromised it does not impact the Root CA. What I understand is ...
0
votes
2answers
36 views

How to convert a SSL certificate to an authority?

How can one convert an SSL cert provided by an authority to another authority, so one can generate "valid" certs for different domains?
3
votes
2answers
89 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
2
votes
0answers
15 views

Signtool validation fails when signing and validating are done in different machines

I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
3
votes
1answer
132 views

Can we safely distribute password protected .p12 file?

I have a password protected .pfx file and I would like to know if it safe to share it on GitHub. The intention is to ensure that companies can trust a dll file of the Tweetinvi open source library. ...
0
votes
1answer
23 views

Replace certificates simultaneously on remote servers?

A third party server sends us signed messages that we verify. When its certificate is about to expire, the third party generates a new key pair and sends us the new certificate. At some point, the ...
1
vote
0answers
30 views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
1
vote
4answers
66 views

Is EV green extended validation slower than a regular SSL?

How does EV green extended validation SSL certificate affects the speed of my web site (if at all) comparing to a regular SSL? Also, my provider only allow the EV green certificates to be on the root ...
2
votes
2answers
69 views

How important is it to use a large encryption key for SSL certificate?

I'm trying to figure out which size of encryption key should I use for my SSL certificates (2k, 4k?) Is a 2k key "sufficient"? is it crackable...? and if so, is a 4k key not crackable? Also, how ...
2
votes
2answers
52 views

Is it possible to use more than one certificate on the same server at the same time? [duplicate]

Is it possible to use more than one certificate on the same sever at the same time, on the same connection? If I have a certificate from Alice Keys CA and another from Bob Security CA, is it possible ...
20
votes
5answers
2k views

Who is responsible for revoking a certificate?

The CA issues certificates to clients/servers. Whenever a request is made by the client/server, the certificate is used to verify the identity. Now, if a certificate needs to be revoked then who does ...
0
votes
0answers
44 views

SSL certificate problem: self signed certificate in certificate chain [migrated]

Behind a firewall, using chrome, I am able to access a github repository like so: https://github.com/Squirrel/Squirrel.Windows Chrome uses our certificate for this access. If I try to access the same ...
0
votes
1answer
40 views

s/mime edit an existing certificate

We are using an encryption appliance that is capable of creating S/MIME certificates for internal users. The appliance is synchronizing with AD to get the user. When the certificate is created it will ...
0
votes
1answer
52 views

Downloading a new SSL pinned certificate insecure?

I want to make a mobile app secured with SSL pinned. The problem I know I will have is if the certificate expires. My possible solution would be downloading a certificate from my server from time to ...
2
votes
2answers
55 views

CA Certificate Lifecycle

I'm planning to implement a new PKI with 2 tiers of CAs. I'll have end entity certificates with a lifetime of up to 5 years. This means my Issuing CA should be valid for 10 years, in order to be able ...
0
votes
0answers
31 views

PKCS #7 Certificate p7f format

I'm looking for information about a .p7f signature file that I need to generate for an old webservice. I don't know a lot about certificates in general, but this particular extension is bothering me. ...
2
votes
2answers
71 views

Can we restrict cipher suites using server certificate?

Can we restrict cipher suites (such as RC4) using server certificate?
1
vote
0answers
25 views

Key distribution for zeromq [closed]

We're evaluating zeromq for a publisher/subscriber model where the publisher could change after each session. The public keys have to be distributed in advance. It seems that zeromq has its own ...
0
votes
1answer
80 views

Vicious circle with certificates - how to trust the server cert?

I have a java app on Android that needs to be able to communicate with a web server over ssl using an client x509 certificate (for encryption negotiation) - the private key is in the java keystore ...
3
votes
2answers
97 views

What are the risks of still using a 1024-bit certificate in a private network?

One of our colleagues ran a Qualys scan on an internally used product and found that the product still uses 1024-bit certificates for its modules to communicate with each other. The vendor says that ...
7
votes
1answer
144 views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
1
vote
1answer
100 views

TLSv1: Reason for client not sending client certificate

Our BizTalk installation consists of two load balanced nodes B1 (10.137.10.1) and B2 (10.137.10.2) which process and route incoming SOAP messages. The processing is nothing more than: sending the ...
2
votes
1answer
283 views

Snapchat tracking over company WiFi. What can they see, save or open?

I sent a snapchat to a coworker during company time. I was not on the work wifi, but now I believe they may have been. What will my employer be able to see from the snapchat that was sent and opened ...
6
votes
3answers
2k views

Isn't HTTPS insecure over a hacked router? [duplicate]

I have heard that a hacker can become a proxy using the router your device is connected to and send his own public key to you instead of you getting the server's public key - which the browser will ...
3
votes
2answers
148 views

How to tell if a SSL cert is 128 bit or 256 bit?

My cert is: Key Length = 2048 Signature algorithm = SHA256 + RSA So is it a 256 bit SSL cert?
4
votes
1answer
50 views

When prompted to add a certificate or profile to connect to a secured WiFi network, how can I tell if it's safe to install it?

Sometimes when I connect to secured WiFi networks on my computer, such as my internet provider's WiFi hotspots around the city, I'm asked to add a certificate to my certificate store. When I'm on my ...