A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
1answer
19 views

How can I list all self-signed certificates in my stores on a Windows client?

I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
0
votes
0answers
34 views

Cannot be verified error when installing LetsEncrypt SSL certificate on Tomcat

We have a Debian 7 X64 server running Apache Tomcat on which I am trying to install a certificate from LetsEncrypt. I am partially successful as I am getting an error where certificate verification is ...
1
vote
1answer
72 views

Is or was it possible to register a wildcard certificate to third level subdomain?

The use of a null byte in a certificate cn is very well known… and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of ...
5
votes
2answers
72 views

How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?

I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the ...
1
vote
1answer
66 views

Is using “SHA-256 with RSA-2048 Encryption” a secure certificate hashing algorithm?

Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm? I don't think it is. Two examples: nsa.gov [careers site] give.wfp.org
2
votes
0answers
44 views

Why more Android applications (compared to iOS) use certificate pinning? [on hold]

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...
0
votes
0answers
18 views

Securing several Servers (Certificates)

I got a Question regarding Certificates. We got a situation, where only "Server 4" and its clients are given in the picture above. That Server4 (SLES11) and its Clients are using a self signed ...
0
votes
1answer
49 views

How to verify the signature value in a SSL certificate?

According to RFC 3280 a certificate's basic syntax is Sequence := { tbsCertificate signatureAlgorithm signatureValue } In tbsCertificate, SubjectPublicKey is the public key of the ...
0
votes
1answer
32 views

Creating self-signed certificate for localhost and trusting fully

As an accompanyment to a web application we plan to have a node application running as a windows service running on the client computer. This will run a small web server which will listen on port XXXX ...
2
votes
0answers
24 views

How to enable self signed certificates in Windows 10?

I want to use a Yubikey 4 with Windows 10 Pro for Bitlocker and login with my TPM. Unfortunately, I found out I need to enable self signed certificates and all the guides on the Internet I found were ...
1
vote
0answers
15 views

How did I get a signed cert back with a wildcard common name when I submitted a csr with a specific common name? [duplicate]

Apologies if this is obvious but I'm hoping for some clarification here. I generated a CSR on an appliance of mine. This CSR had a specific common name (let's call it foo.domain.com). I then sent ...
-1
votes
1answer
41 views

Same certificate but different private keys on different servers. Does this work?

We have a SAN cert that is used on multiple servers. Is it possible to have the cert re-keyed and only use the new private key on a particular server while keeping all of our other servers using the ...
4
votes
2answers
62 views

Trusting the “subject” of an x509 certificate

A bit of background. Our organization is working on a document format that will be ingested by our software. We're using the CMS format to verify the integrity (by validating the signature). The CMS ...
3
votes
2answers
70 views

Best practices to implement HTTPS in embedded devices

Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...
0
votes
3answers
55 views

Same wildcard cert from two different 3rd party CA's

We have a wildcard cert that's due to expire in three months. The CA won't let us renew it until one month prior to its expiration. We're thinking about using a different CA since we've since ...
5
votes
3answers
113 views

X509 CRL suspended certificates and openssl ca comand

In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it. ...
0
votes
1answer
23 views

How secure is it to bundle unencrypted private key and a CSR into PKCS12 certificate?

I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, ...
0
votes
1answer
40 views

Securing Internal Mobile REST API

I am planning to create an internal API for mobile devices for a company. They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
1
vote
5answers
83 views

Best Option for SSL Certificate for 2 Domains + All Subdomains

I am hosting multiple websites on my Mac Mini server (latest version). For some reason OS X server does not support multiple SSL certificates well for websites, and after hours on the phone with ...
1
vote
1answer
37 views

Securely opening an insecure webserver to a single phone

I have a webserver running inside my private network and not exposed to the internet. I'd like to securely talk to this webserver from my mobile phone over the internet. However, this webserver has ...
0
votes
0answers
16 views

Does the AppId matter when self signing a cert?

We are going to start using self-signed certificates on our dev server. I went through some step-by-step instructions on how to generate the cert and set up ssl with my service. To add the cert, I ran ...
3
votes
1answer
109 views

Benefits of a wildcard vs per-subdomain certificates

As you might know, Let's Encrypt doesn't offer wildcard certificates and it won't in a short-term because you can just order as many certificates as you want for the sub-domains. This make me ...
5
votes
1answer
66 views

Why are short-lived certificates so rare?

Let's encrypt recently left beta and limits the maximal life-time of certificates to 90 days and recommends 60 days. Now whenever I start talking about the issues of certificate revocation (e.g. OCSP ...
0
votes
1answer
52 views

Digitally signing a document with your public/private keypair without certificates?

I have generated a private/public key pair using gpg. Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead ...
1
vote
3answers
130 views

What SSL certificate do I need?

I have 2 domains, one where the website is hosted (lets call it www.a.com), and another (lets call it www.b.com) which has a CNAME record pointing to the first one (www.a.com). Which one should have a ...
3
votes
0answers
75 views

SSL certificate and price difference [closed]

After reading this discussion, Why are there very expensive and cheap SSL same type certificates? I surfed over the internet “Symantec Secure Site Pro with EV SSL Certificates”. I found something ...
2
votes
2answers
67 views

What advantage would someone gain by installing my root certificate?

The answer to this is probably simple, but it eludes me. Here's the scenario: At the moment, I have a server with a certificate issued to it using HTTPS that a customer POSTs responses to after ...
1
vote
2answers
25 views

Mandadory checks a client should make to verify a ssl/tls certificate [duplicate]

Let's say I have a client, not a browser, that wants to connect with https to a server. It could be a python program, an android app or a library etc. Suppose the client has a list of trusted CAs and ...
3
votes
1answer
40 views

What security impact is caused by a TLS server continuing the handshake when presented with an invalid SNI?

RFC 6066 defines Server Name Indication as an extension, whereby virtualised web servers may be given an SNI extension in order to know which certificate should be presented. It has the following to ...
31
votes
2answers
2k views

Can a SSL certificate have longer validity period than its parent in X.509 chain?

When a X.509 certificate chain is composed of X1, X2 ... Xn and Xn is root CA, Can a certificate in lower level have longer validity period than its parents? I think that lower level should be proper ...
1
vote
0answers
29 views

OCSP recording with JMeter

How can I record an application which is using OCSP security with the help of JMeter? I am not able to record the application i.e. a native app with the help of JMeter as it is using OCSP protocol ...
1
vote
1answer
50 views

How to determine effective trust chain for cert on MacOS X?

I'm seeing some curious issues with cert verification for an Issuer: Entrust - L1K cert that was issued and is in use (per inspection of the cert in Chrome and Firefox) for an internal site here. I ...
1
vote
0answers
28 views

How to provide our customers ability to self service client certificate creation?

We have an API for B2B customers to access our platform. We require each B2B customer to have a client certificate. This is not the URL SSL certificate (https). The CN of each customer's client ...
1
vote
0answers
31 views

What comes into calculation of certificate signature?

I have written my own code with openssl in order to create certificates. In order to verify this code, I tried to reconstruct an openssl commandline generated self-signed certificate ... openssl req ...
2
votes
0answers
30 views

Disadvantages of self signed and cross signed certificates? [closed]

Can anyone explain what are the disadvantages or loopholes in self signed and cross signed certificates?
1
vote
1answer
59 views

Can I move my private-key to a better token?

I recently purchased a personal signing certificate from GlobalSign - it wasn't cheap either. It arrived yesterday. GlobalSign gave me a "blank" USB security token device - a SafeNet eToken 5100. ...
1
vote
1answer
30 views

which the field represents digital signature value of CA in a certificate?

Normally CA signs the certificate with its private key and produces digital signature of it.The digital signature value will be displayed in certificate. My question is what is the field name that ...
4
votes
2answers
35 views

What is the difference between Digital certification revocation and retiring?

Certificate management tools use options called revocation and retiring digital certificates.Can someone explain what is the difference between both?
2
votes
1answer
44 views

Can I revoke a client certificate using only it's serial number (not it's crt/pem)?

I've signed and issued some client certificates with my CA. I can now revoke them like so: openssl ca -name ${CA_NAME} -revoke ${USERS_DIR}/${USERNAME}.crt -keyfile $SSL_PRIVATE_DIR/ca.key -cert ...
0
votes
1answer
53 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
7
votes
4answers
243 views

Bank website forwards to false site - formatted hard drive - still forwards

Summary: When I visit my bank's website, I get forwarded to a phishing mirror site. This has persisted through a re-format of my MacBook. Even on different browsers! Other computers on the same ...
3
votes
0answers
52 views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...
0
votes
0answers
30 views

Where are certificate private keys stored in Windows 7? [migrated]

Using the certmgr.msc utility, I can access the windows cert store, but I still can't figure out where Windows stores the private keys. For example for a given certificate, Windows tells me that ...
4
votes
2answers
96 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
4
votes
1answer
105 views

Prevent and/or detect installation of root certificates on Windows?

I noticed that some applications installed root certificates on my computer. Is it possible to prevent this? Or is there a firewall or such that notifies me?
0
votes
1answer
40 views

Can MITM redirect my HttpsURLConnection?

Scenario: Let's say a MITM was able to plant a faked, self-signed certificate on my client (Android app), instead of the self-signed certificate of my server. When now my app tries to connect to the ...
3
votes
1answer
70 views

How to simply check if a certificate has the OCSP must-staple attribute?

http://tools.ietf.org/html/rfc7633 https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/ How can I simple check if a certificate of a ...
1
vote
1answer
26 views

SSL certificates for a mixture of subdomains and top level domains [closed]

In order to provide https-enabled access to several (e.g. around 5) subdomains and several top level domains on different IPs. Which of the following approaches is technically feasible? a one-use ...
1
vote
2answers
55 views

understanding client certificate - pfx on the general

Today I am given a pfx and told to access a website. I have absolutely no idea what was given to me initially, so please kindly confirm my understanding on a general level 1) the pfx is a container ...
1
vote
2answers
41 views

Subdomains on a multidomain EV SSL [closed]

I have a domain https://joshmurray.eu/ which has a Standard SSL certificate. I also have two subdomains: http://one.joshmurray.eu/ and http://two.joshmurray.eu/. I wish to upgrade my SSL certificate ...