A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

8
votes
3answers
644 views

Does the SSL encryption strength of a website really matter?

When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart. Immediately there seems to be 4 major ...
3
votes
1answer
525 views

What kind of certificate do I need to be able to make and sign my own digital signing certicates?

At build time for a program, I would like to generate a new key pair, and create a certificate that will be embedded (securely) into the program. The purpose of the key pair is to digitally sign an ...
2
votes
3answers
2k views

SSL verification of host name of https server

I recently found that a library I am using (specifically Apache HTTPClient) when is configured to verify the hostname of the remote server against the certificate's CN it just seems to be doing a ...
2
votes
1answer
2k views

Securing WCF service with X.509 cert [duplicate]

Possible Duplicate: What is the difference between an x.509 “client certificate” and a normal SSL certificate? I'm getting really confused with WCF and certs. I have a WCF ...
16
votes
3answers
2k views

What happens when an Intermediate CA is revoked?

Currently I'm working on a certificate manager that allows our product to securely connect to remote webservices (over TLS/SSL). For security, we use Certificate Revocation List checking (or ...
1
vote
1answer
113 views

Challenge Response across several hops

This is a follow-up question to "When should I use Message layer encryption vs transport layer encryption". I need to send a certificate from the mobile phone to the server. Regardless of all the ...
3
votes
3answers
144 views

Warn about specific CA in Firefox

Consider a setup where all HTTP/HTTPS traffic goes through a proxy. The certificate of this proxy must be trusted by all browsers (in this case, Firefox). This certificate replaces the original ...
9
votes
2answers
2k views

Secure communication between applications using SSL Certificates

I am looking for a way how to secure communication between our applications. There is a "server" application listening on some TCP port and "client" application which is communicating with the ...
10
votes
4answers
895 views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...
11
votes
3answers
53k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
6
votes
2answers
2k views

Getting self-signed SSL certificates for all https connections made from some premises

Context: I'm currently working as an expat for my company in a country where the Internet is notably untrustworthy. It made the headlines a few months ago for stealing facebook, twitter and gmail ...
6
votes
1answer
682 views

How do I learn Cryptographic/Mathematical notation

I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation. How do I learn this notation and how to convey my approach? How can I annotate this ...
8
votes
1answer
191 views

distributing files to VPN partners

suppose i've created VPN certificates for a certain VPN-RoadWarrior-Client, expressed in the files VPN-RoadWarrior-Client.key and VPN-RoadWarrior-Client.crt*, however VPN-RoadWarrior-Client is ...
12
votes
3answers
552 views

Incorrect use of HTTPS?

When I open https://java.com my browser says “untrusted connection” but when I open https://www.java.com my browser says it’s ok. But it's the same site. So my question is: Is this a security bug? ...
7
votes
2answers
550 views

security of PKI, Certificates, certificate authorities, forward secrecy

I want to understand how certificates add to the security of information exchange. Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
52
votes
7answers
26k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
13
votes
1answer
2k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
8
votes
1answer
876 views

Moving from a one tier to a two tier Microsoft Certificate Authority hierachy

Right now we have a single Microsoft Enterprise Root CA which issues certificates to our VPN users for two factor authentication. We're planning to extend use of the CA to issue certificates for RDP ...
9
votes
1answer
2k views

Renewing Microsoft Certificate Services Root Certificate

We currently have Microsoft Enterprise Certificate Server installed on a domain member machine which issues 1 year certificates to users for authenticating to VPN. We'd like to start issuing web ...
5
votes
1answer
741 views

Thunderbird - what happens if Gmail SSL cert gets spoofed?

I use a good MUA: Thunderbird [to read/reply to my emails on Gmail]. So: what happens, if i go to a place, where is public wifi, and someone tryes to sniff my password/username/emails? Questions: ...
15
votes
2answers
657 views

Encryption and the “security time decay” of prior encrypted data

This question is on the assumption that any data once encrypted, may (eventually) be decrypted through Brute force (compute power/time) Exploits in the cryptography used Theft of private keys ...
5
votes
6answers
922 views

Should the bit-strength selection of a child certificate be influenced by the CA or the chain?

All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
8
votes
3answers
5k views

What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?

I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider. Question 1 Why ...
27
votes
11answers
3k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
9
votes
3answers
427 views

Are there any smartcard/hardware-tokens for certificate-based authentication which are easily destroyed?

It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can ...
9
votes
2answers
363 views

PKI solution vendor selection

What would you look for in a (X.509-) PKI solution, and why would you look for that, given the following constraints: Available programming/sw-engineering know how is limited (ie, "OpenSSL with a ...
6
votes
3answers
227 views

Renew digital certificate

If I have deployed a digital certificate on a webserver and if it needs to be renewed then what steps do I need to follow? Will I need to generate a new longer public key private key pair? Why do ...
6
votes
3answers
518 views

Personal digital certificate how to verify

A server certificate would have its domain name at its subject field. A personal certificate would have your name as the subject field. How can you be sure that there are no two certificates with the ...
6
votes
3answers
1k views

Certificate chain

For my computer to verify the identity of a certain certificate should it have all the certificates up to the root certificate?
9
votes
2answers
3k views

SSL Certificate revocation check

In the SSL protocol I don't see where the certificate is checked for revocation status. https://developer.mozilla.org/en/Introduction_to_SSL Is the Certificate Revocation and Status Checking not ...
3
votes
2answers
3k views

What is an intermediate certificate authority?

What is meant by an "intermediate certificate authority?"
8
votes
3answers
2k views

How does an SSL server prove its identity?

This document says that a challenge response authentication proves the servers identity. But is a man in the middle attack still possible if the client does not verify domain name ? Please help me ...
5
votes
2answers
2k views

Dealing with expired or revoked signing certificates with Infopath documents

Suppose I have an Infopath form that is digitally signed today by a valid, and active user. When that user leaves the company, we disable the account and revoke the certificate. This causes a problem ...
39
votes
4answers
24k views

What is the difference between an x.509 “client certificate” and a normal SSL certificate?

I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
24
votes
8answers
4k views

Is anybody using client browser certificates?

Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
5
votes
3answers
3k views

Any good free SSL proxy on windows?

I'm looking for SSL proxy capable of dumping requests. I want to test custom browser against SSL-MITM attacks. I'm able to re-route all traffic ongoing from browser to machine with proxy. ...
21
votes
5answers
7k views

Where to get an SSL certificate for personal website?

I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
10
votes
5answers
2k views

Can Javascript/Flash verify the SSL connection to prevent “SSL Inspection”?

I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy. So some people may ask What is the point of re-validating SSL using javascript? ...