4
votes
1answer
119 views

How would you know a certificate/private key if you extracted it from RAM? Or would you?

Related to, of course, the heartbleed vulnerability, I've been reading the news about the worst case scenario for this attack being the extraction of the SSL private key, because, of course, this ...
0
votes
1answer
71 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
1
vote
3answers
294 views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
3
votes
2answers
285 views

Should I customize my Root CA's thumbprint/fingerprint? (SHA1 or MD5)

My goal is to make a certificate's thumbprint "easier" to verify, and not reduce security in doing so. Given that the RSA-based Bitcoin technology has a concept called a "Vanity address" where the ...
12
votes
3answers
875 views

Multi-tenancy, SSL Certificates, and Subject Alternative Name

The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension. From the spec: The subject alternative name ...
1
vote
1answer
102 views

SSL Communication and Proxy

Let us say that I have a client and a server communicating using SSL. If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
0
votes
1answer
73 views

Determine the Identity of Caller

Let me explain my situation. I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
3
votes
1answer
113 views

Clarification on Digital Certificates

I used the makecert tool to create: self-signed certificate client certificate These are the commands I used: makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
2
votes
1answer
121 views

Sending Digital Certificates

I used the makecert tool in order to create: a self-signed certificate a server certificate using the self-signed certificate a client certificate using the self-signed certificate I then ...
2
votes
1answer
159 views

Security Certificates - Tools to Generate Security Certificates

I want to create a self-signed certificate that will be installed as a trusted certificate authority. I then want to create another two certificates which are signed using the private key of the ...
1
vote
1answer
2k views

The request was aborted: Could not create SSL/TLS secure channel Exception

Let me explain my situation. I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC. I then created two certificates using the self-signed ...
2
votes
2answers
759 views

Key Exchange using PKI

I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl openssl req -x509 -nodes ...
9
votes
2answers
1k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
2
votes
2answers
632 views

Revoked certificate validation using past times

I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past. Unfortunately I have problems verifying revoked ...
4
votes
1answer
71 views

Standards for CA cert revocation and time-constrained cryptographic algorithm parameters

I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
3
votes
1answer
118 views

CMC (RFC 5272) compatible CA server

I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
4
votes
2answers
485 views

Is it possible to modify a CA without having to reissue all of the derived certificates?

Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I ...
-1
votes
2answers
376 views

Request/Creating a Code Signing Certificate

I have need for a code signing certificate which is trusted by a CA in the windows domain. How do I request/create this certificate? Do I have to request a code signing certificate on the ...
1
vote
2answers
208 views

Using digital signatures to identify users

Consider the following requirement: Bob should be able to verify that a payment request came from Alice. The above is in simple terms the basic idea, however, in reality Alice would be user A of ...
1
vote
1answer
439 views

Best Practices for Storing Digital Certificate

I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
10
votes
1answer
6k views

What is the actual value of a certificate fingerprint?

In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
5
votes
4answers
984 views

Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)

I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was: CA with RSA keys capable of signing RSA and EC CSRs CA with ...
1
vote
3answers
7k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
4
votes
1answer
748 views

How secure is TOTP key on phones?

Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
1
vote
1answer
99 views

valid intermediate certs not in browser

Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
3
votes
2answers
167 views

self-signed certs that aren't the final certificates in the path

The X.509 spec makes frequent statements like this: (b) If certificate i is self-issued and it is not the final certificate in the path, skip this step for certificate i. How can you have ...
8
votes
2answers
482 views

X.509 certificate policies question

I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies. To quote from the X.509 RFC: In an end entity certificate, these ...
2
votes
1answer
402 views

X.509 certificate policy mapping question

So I'm a little confused how X.509 certificate policy mappings work. So let's say the following depicts my cert chain: root CA ---> intermediary CA ---> client cert Would the root CA have a ...
4
votes
2answers
592 views

How long shall a certificate be valid?

See title. Are there any sources where there are recommended validity times of certificates (based on length, algo, etc)? I'm particularly interested in validity of RSA certificates...
0
votes
1answer
267 views

id-ce-cRLDistributionPoints ASN.1 / DER encoding question

I have a file - test.pem - with the following contents: -----BEGIN CERTIFICATE----- MBIwEKAOoAwwCqMIMAZhBEFCQ0Q= -----END CERTIFICATE----- openssl asn1parse -inform PEM -in test.pem -i returns the ...
2
votes
1answer
434 views

question about implicitly tags in ASN.1

From the X.509 RFC, in the "Implicitly Tagged Module" section: CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint DistributionPoint ::= SEQUENCE { distributionPoint [0] ...
4
votes
1answer
689 views

X.509 algorithm identifier parameters vs. extension values

From the X.509 specs: AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } ...
3
votes
1answer
843 views

Why doesn't asn1parse parse all DER encoding strings?

I have a file - crl.txt - that contains the following: MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw= It's from one of the extensions in a particular X.509 cert. Why ...
3
votes
1answer
875 views

parsing the id-ce-keyUsage extension in X.509 certs

I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows: ...
14
votes
3answers
6k views

What are the risks of self signing a certificate for SSL

Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
14
votes
4answers
9k views

how digital signature verification process works

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
3
votes
2answers
439 views

Inspecting a TLS Certificate to determine RSA Key Usage restrictions

With regard to this answer, I have a question about Key Usage in an SSL certificate. Most SSL server certificates have a RSA key which is not restricted through a Key Usage extension, so you can ...
21
votes
5answers
13k views

What ciphers should I use in my web server after I configure my SSL certificate?

There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list. ...
7
votes
4answers
10k views

Recommendations for a Certificate Management tool for Linux

A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients. This creates a new challenge to manage all these certificates and ...
6
votes
3answers
356 views

Why are CA's signing keys available on the internet

I am not very knowledgeable about CA certificates, but I thought these things mainly said "The public key for bank X is Y, and this is verified by CA Z". Once you've bought this certificate, there is ...
10
votes
3answers
832 views

Multiple CAs signing a single Cert/CSR?

Just saw this suggested on Slashdot So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
8
votes
3answers
645 views

Does the SSL encryption strength of a website really matter?

When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart. Immediately there seems to be 4 major ...
3
votes
1answer
526 views

What kind of certificate do I need to be able to make and sign my own digital signing certicates?

At build time for a program, I would like to generate a new key pair, and create a certificate that will be embedded (securely) into the program. The purpose of the key pair is to digitally sign an ...
16
votes
3answers
2k views

What happens when an Intermediate CA is revoked?

Currently I'm working on a certificate manager that allows our product to securely connect to remote webservices (over TLS/SSL). For security, we use Certificate Revocation List checking (or ...
10
votes
4answers
899 views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...
11
votes
3answers
53k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
6
votes
1answer
684 views

How do I learn Cryptographic/Mathematical notation

I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation. How do I learn this notation and how to convey my approach? How can I annotate this ...
7
votes
2answers
551 views

security of PKI, Certificates, certificate authorities, forward secrecy

I want to understand how certificates add to the security of information exchange. Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
52
votes
7answers
26k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
8
votes
1answer
877 views

Moving from a one tier to a two tier Microsoft Certificate Authority hierachy

Right now we have a single Microsoft Enterprise Root CA which issues certificates to our VPN users for two factor authentication. We're planning to extend use of the CA to issue certificates for RDP ...