A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
0answers
4 views

EC private key, RSA certificate. Is this realisable?

I was wondering if is it possible to generate EC private key: openssl ecparam -name sect571r1 -out ecparam.pem openssl ecparam -in ecparam.pem -genkey -noout -out eckey.pem then generate ...
1
vote
1answer
23 views

Extract public information from p12 without having the password

I know this question was already asked here but unfortunately there are no satisfactory answers. Please correct me if I'm wrong, but if I have an p12 file the following two situations are possible: ...
1
vote
0answers
12 views

is x509certificate signed by ca is valid?

I've got certificate 'sample cert' which is valid to '2015-12-31' but it was signed by root CA certificate, but when it was signing CA cert was valid to 2015-06-30'. So my question is, Is today ...
2
votes
0answers
8 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
2
votes
0answers
33 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time ...
1
vote
1answer
58 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
2
votes
0answers
15 views

Can I use different certifcates for www and Exchange? [migrated]

I have a website www.domainname.com and a published Exchange address of webmail.domainname.com The website is hosted offsite and the Exchange server is on-premises. I need extended validation for the ...
-4
votes
0answers
18 views

With regards to performance, which one is better CMPV2 or SCEP? [on hold]

Which one is better SCEP or CMPV2? And how to measure the performance of these protocols.
1
vote
1answer
35 views

Create PKCS7 signature, signed by X.509 CA, which embeds an XML file

I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within. How to do that with OpenSSL or any other tool?
0
votes
0answers
20 views

Extract the content of PKCS7 file in Java

I have a PKCS#7 signature that have the content‐type signed data and it embeds an XML document, and I have to extract the xml document from this PKCS7 file. Anyone know how to do that in java ??
2
votes
1answer
43 views

Squid SSL Bump - getting “unknown issuer” despite having certificate, do I need CA?

I am using pfSense on the gateway of my network. I configured Squid and enabled the HTTPS filtering. I created the internal CA and configured Squid to use this internal CA for SSL Bump. Now the ...
0
votes
0answers
46 views

What is the cheapest kind of SSL cert I need for multiple sites on multiple servers? [duplicate]

Quick SSL question What is the cheapest kind of ssl cert I need? I have two servers, one windows vps with a static IP and another linux reseller with 2 domains attached and a shared IP. Ideally ...
1
vote
0answers
41 views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
2
votes
2answers
79 views

Why is it fine for Certificates above the end-entity certificate to be SHA1 based?

I have heard about the phasing out of Sha1 based certificates for end entity use, and the steps that are outlined for chrome to display progressively more aggressive warnings for Sha1 certs not ...
1
vote
0answers
48 views

JSEncrypt encrypt on client and decrypt on server [migrated]

I am using JSEncrypt to encrypt user's password on the client and send to server to decrypt. I get the public key from the server which I build the RSA Key on the client with Javascript: var leafCert ...
1
vote
2answers
44 views

Can an embedded CRL be trusted?

Embedding CRLs in a signed document will allow the signature to be validated "long term", by providing a snapshot of the signer's state the moment the document was signed. Im wondering if these ...
3
votes
1answer
38 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...
0
votes
2answers
102 views

Authenticating Hotmail's certificate and connection security

I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or ...
0
votes
1answer
42 views

sftp first connection before exchange cert

If a client connects for the first time to a server via SFTP, the first connection before receiving the server certificate is transmitted in the clear?Let me explain: it is assumed that the client ...
1
vote
1answer
37 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
0
votes
2answers
34 views

TLS Certificate domain-expectation

If I request the Cert from example.com and the server answers with the (legit) certificate from notexample.com, will the browser throw an error?
2
votes
3answers
33 views

PKI usage in a cluster; per application instance or per application?

I'm having a cluster with nodes (let's call them A and B for the sake of example) running identical micro services (1, 2 and 3 - so the application 2 running on node A is called A2). The applications ...
0
votes
0answers
11 views

error code -207 during import of certificate using GnuTLS [migrated]

I try to import a certificate, to process it in my C++ code. What am I doing wrong? Here are the steps I perform in my code: I initiate with gnutls_global_init() I get a FILE-type opject into my ...
0
votes
3answers
200 views

What can i do to trust less on CA's?

I never trusted and liked CA's and in fact i remove a lot of them from my devices...but now after this question i'm wondering if i should generate my own certificates for the sites i care(e.g like my ...
0
votes
2answers
38 views

Sniffing TLS / SSL through HSTS?

Imagine the following: Client C wants to communicate with server S. The evil attacker A is the Man-In-The-Middle. C sends a request to S, A intercepts it. A creates a self-signed certificate with ...
0
votes
0answers
31 views

Update certificate in Outlook contacts [migrated]

How can I update an encryption security in Outlook contacts? I got an email signed with an updated certificate by someone who is already in my contacts with an expired certificate. If I REPLY to ...
1
vote
2answers
40 views

Is there a PKCS certificate format that signs ASCII data?

Is there a PKCS #x already out there that was designed to sign ASCII data and protect it from manipulation? I was originally guided to PKCS #7, but based on posts here it looks like the data is not ...
5
votes
2answers
317 views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
4
votes
1answer
70 views

distributing SSL certificates?

I'm only familiar with SSL certificates in a simple-use case: I've installed them to websites, Windows servers, and a few Linux servers. I'm now faced with the task of securing every possible device ...
1
vote
0answers
35 views

How get X509 certificate's full cert chain programatically? [migrated]

Imagine I have p12 container of private key and public certificate. When I export p12 public cert to separate .cer file with Java keytool I may click to .cer file and see full cert chain. How may I ...
0
votes
1answer
78 views

Faking and injecting cryptographic certificates

Suppose as an attacker I provide a fake certificate to a user.A warning pops up on her window but she decides to continue anyways.Is my fake certificate now added in her browser's trusted certificate ...
1
vote
0answers
37 views

Delete certificate from user local store using script [migrated]

I manage to delete a certificate using a script with command : certutil -delstore -v -enterprise CA "Certificate CN" But unfortunately, it only works if this certificate was first added using the ...
1
vote
1answer
49 views

Create OpenVPN/easy-rsa certificate from public key only

I have been using easyrsa to generate client certificates for my application using the method described here. The build-client-full command generates a fresh private key for each client. This is what ...
2
votes
1answer
55 views

Identicon for SSL certificate

I have a few self-signed certificates that I use, and I find it tedious comparing the entire hex value of the hash when accepting it in a new location. To be honest I usually just look at the first ...
3
votes
2answers
242 views

Obsolete cryptography (SHA1) warning although certificate uses SHA256

I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message: Your connection is encrypted with obsolete cryptography. The connection is encrypted using ...
2
votes
1answer
34 views

Certificate identification that is renewal safe

We currently use some certificates in our application and we identify them by using the certificate's thumbprint. Like this: <serviceCertificate> <certificateReference ...
1
vote
1answer
84 views

Are there any security disadvantages of using production SSL certificate in non-prod environments?

My client has a wildcard certificate *.thierdomain.com that they are using for half a dozen of production web sites. For each of theses sites there are duplicates in several environments, dev, qa, ...
2
votes
2answers
58 views

Certificate chaining:Intermediate Certificate Authorities

Wikipedia says: For example, if a certificate issued to "example.com" and issued by "Intermediate CA1", and the visiting web browser trusts "Root CA", trust may be established in the following manner: ...
4
votes
2answers
116 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
4
votes
3answers
75 views

Why does Windows have a place to store intermediate SSL certificates?

As I understand the process of verifying a remote computer's SSL certificate, the remote system sends its 'leaf' certificate and any intermediate certificates, but not the root certificate. Executing ...
14
votes
1answer
2k views

PayPal encrypted with obsolete cryptography

My Chrome just complained from PayPal's security, similarly to this issue: Google Chrome "Your connection to website is encrypted with obsolete cryptography" The identity is verified, but ...
1
vote
1answer
36 views

Machine certificates for accessing a web app in IIS only from an specific PC client

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
5
votes
1answer
4k views

Firebug reports SHA-1 certificate error

For the script at the bottom of this post, Firebug reports the following error: This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that ...
1
vote
0answers
14 views

using crt for encrypting files/texts [duplicate]

I work with GPGTools under Mac where, after creating a public/private key pair for myself, I usually get .asc from other users, import it and then I'm good to go. Now, I got an actual certificate from ...
9
votes
1answer
456 views

What are the problems with creating an own CA for intranet?

In the comments to Creating my own CA for an intranet several people strongly advise against creating your own CA for an intranet. Especially: don't do it. Nope. Bad idea. Buy $10 CA signed ...
1
vote
1answer
45 views

Using a minimal set of certificate authoraties

It been known for quite a while now that SSL is more of a security-illusion than a real one. As it's not completely useless, and there's no real alternative at moment (though convergence looks ...
2
votes
1answer
64 views

Client side certificates in IIS for accessing a web app only from an specific PC

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
0
votes
0answers
13 views

Protocol for signing and timestamping documents for e-archive system

we are building system for storing PDF file for long term in database. Before we store PDF file in database we have to: - convert PDF to PDF/A - digitally sign PDF - timestamp it What we don't ...
3
votes
1answer
88 views

IoT Devices and 39 Month TLS Certificate Life

I develop IoT (Internet of Things) devices on small embedded systems, where it is very difficult to update the local certificate once they have been deployed. It really needs to be avoid if it can. ...
10
votes
2answers
937 views

How are digital certificates compared?

I have read about SSL and TLS; I know how RSA works and why digital certificates are necessary (more or less), but I am curious about how we prevent a fake digital certificate. The operating system ...