1
vote
7answers
75 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
20
votes
1answer
2k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
1
vote
1answer
44 views

IE11 on windows 8.1 and ssl fallback

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 ...
1
vote
0answers
47 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
2
votes
1answer
67 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' bowsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
0
votes
1answer
44 views

Good reason to continue using fraudulent certificate?

A relative of mine used a favorites link to login to yahoo. The favorite link is https://de.mg40.mail.yahoo.com/neo/launch? However, this link uses a fraudulent certificate. Visiting the Yahoo ...
22
votes
1answer
2k views

Why does Firefox not trust this US government SSL certificate?

Shouldn't this be a trusted certificate considering it's a wildcard SSL certificate? That is, shouldn't *.delaware.gov cover www.corp.delaware.gov?
1
vote
2answers
60 views

Mechanisms to offer inexpensive https to all second level .wiki domains

I'm working with the registry for .wiki, a new generic top level domain set for public availability in June 2014. We're going to be giving away hosted wikis to registrants of .wiki domains and I'd ...
9
votes
2answers
230 views

Why do some certificates specifically identify a corporation and most don't?

Looking at a handful of websites that allow for/require HTTPS, I realized that the certificate for a few of them specifically identifies the owning corporation, but some (most) don't. What's the ...
0
votes
1answer
539 views

Sending Client Certificate to Server

I have a simple question. Is a web browser sends client certificate to the web server on demand(means web server is configured for client authentication and demand the client certificate) or just ...
2
votes
1answer
85 views

Does Internet Explorer handle Extended Validation properly

I'm reading about Extended Validation (EV) certificates and have a few questions. From what I understand, EV allows domain owners to pay extra for a especially trusted certificate (that the browser ...
0
votes
0answers
21 views

Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery [duplicate]

Can you tell me shortly how to fix this problem in Chrome? Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery
2
votes
3answers
161 views

Do on-demand SSL certificates exist?

A few days ago, I visited an SSL protected website. Since Safari complained about the SSL-certificate, I did a short inspection: The certificate was issued by GoDaddy in just the minute I ...
1
vote
5answers
1k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...
1
vote
1answer
251 views

generating RSA keys through the browser

HTML5 has the element that sends an SPKAC to the server (as I understand it). But how do you do it in IE? One CA's websites gives me the following prompt: This Web site is attempting to perform a ...
1
vote
2answers
8k views

Error code: sec_error_untrusted_issuer

I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
5
votes
1answer
947 views

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
3
votes
1answer
877 views

What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?

I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance. For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
1
vote
1answer
291 views

How do I verify, parse and process the results of the HTML5 keygen tag?

I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST: ...
0
votes
1answer
114 views

Can IE be made to imitate the behavior of Chrome's KeyGen element?

Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element? Assistance getting Safari to work with this optional HTML5 spec would be ...
1
vote
3answers
1k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
3
votes
1answer
222 views

How can I use certificates to secure my webservices? What is available to javascript?

I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
5
votes
1answer
29k views

Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?

I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug? I'm on a WPA2 encrypted wireless connection using Chrome ...
4
votes
4answers
568 views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
5
votes
4answers
2k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
5
votes
1answer
191 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
0
votes
2answers
778 views

Issuing browser certificates to Chrome and Firefox with Microsoft CA

Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval. Since many browsers either block or don't support ActiveX controls, how can I enroll them using a ...
3
votes
1answer
486 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: ...
11
votes
5answers
3k views

Does HTTPS Everywhere defend me against sslsniff-like attacks?

http://www.thoughtcrime.org/software/sslsniff/ If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
2
votes
2answers
98 views

How can I force certain the webclient to honor or remember certain parameters from the webserver?

HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...
4
votes
1answer
247 views

How secure is a https website? [duplicate]

Possible Duplicate: Does an established ssl connection mean a line is really secure When I visit a website -- say, https://ebanking.pick-your-bank.com -- my browser (fully patched version ...
4
votes
3answers
483 views

Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]

Recently while trying to log-in to Facebook this notification starts to appear: At first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website! I ...
3
votes
3answers
144 views

Warn about specific CA in Firefox

Consider a setup where all HTTP/HTTPS traffic goes through a proxy. The certificate of this proxy must be trusted by all browsers (in this case, Firefox). This certificate replaces the original ...
10
votes
4answers
899 views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...
24
votes
8answers
4k views

Is anybody using client browser certificates?

Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...