A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
3answers
1k views

RSA encryption : How to create “.arm” certificate file for Public key?

I am required to store a certificate as ".arm" file only for a public key that is intended for use in RSA Encryption. I am currently able to generate the public key as ".key" file. P.S I am new to ...
16
votes
4answers
5k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
4
votes
1answer
171 views

How does my antivirus determine which CTL is used?

I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
50
votes
9answers
11k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
2
votes
1answer
129 views

Curious about best start for autoresponding Certificate Authority (CA)

I am just getting started trying to implement some internal PKI ideas, where my app would need a cert to 'sign' messages. Since this is all completly internal, we have some degree of trust, and I ...
5
votes
1answer
39k views

Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?

I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug? I'm on a WPA2 encrypted wireless connection using Chrome ...
2
votes
3answers
306 views

Transfer Client Certificate

What, if anything, could or would be embedded into a client-side certificate that would prevent it from "working" when transferred to a new client machine on a new network? Being unfamiliar with the ...
6
votes
2answers
378 views

What kind of certificate do I need to be able to sign my own subdomain certificates?

We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...). ...
4
votes
2answers
910 views

How to create an Apple Installer Package Signing Certificate

How can we create a certificate with the following Extended Key Usage extension using OpenSSL? Extended Key Usage extension, critical, with a purpose containing Developer ID Installer Package Code ...
3
votes
1answer
368 views

Loginless Client/Server Architecture (iOS)

I'm currently in the phase of planing a project involving loginless service. Users would be identified by an unique device id created on the client (ios). What are the security concerns? sockets ...
11
votes
4answers
8k views

How are Chrome and Firefox validating SSL Certificates?

How are Chrome and Firefox validating SSL Certificates? Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?
13
votes
3answers
221 views

Domain name expiration and TLS

If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
1
vote
1answer
251 views

Signature and Timestamp for Long Term Document Archival Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity. As far as I understand, I ...
5
votes
4answers
2k views

Can an intermediate CA be trusted like a self-signed root CA?

Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
4
votes
2answers
679 views

Is it possible to modify a CA without having to reissue all of the derived certificates?

Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I ...
5
votes
1answer
243 views

SSL CipherSuite Choices

In SSL/TLS, is the CipherSuite chosen by the server or the client? Also, can the certificate in any way dictate or modify the CipherSuite?
-5
votes
4answers
283 views

Is TLS-in-TLS supported in any software? Does it make sense? [closed]

I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
3
votes
0answers
168 views

How secure is HTTP basic authentication over SSL? [duplicate]

Possible Duplicate: Is BASIC-Auth secure if done over HTTPS? I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
2
votes
2answers
95 views

Does it make sense that OCSP returns state for the signer CA itself

I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...
2
votes
1answer
2k views

SSL cert not turning green anymore

I'm running a drupal site and have asked about this issue pertaining specifically to the drupal aspect of it here. I know that the "Green" https url doesn't show up because the cert itself isn't ...
4
votes
2answers
5k views

Internal SSL Certificates?

As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
9
votes
1answer
335 views

Why can the validity of an SSL certificate exceed the registration period of a domain?

I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
4
votes
3answers
1k views

What does it mean for a digital certificate to be “signed”?

When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
1
vote
1answer
382 views

Purpose and Uses of Root SSL Certificates

I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?). When and ...
-1
votes
2answers
411 views

Request/Creating a Code Signing Certificate

I have need for a code signing certificate which is trusted by a CA in the windows domain. How do I request/create this certificate? Do I have to request a code signing certificate on the ...
7
votes
4answers
817 views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
4
votes
2answers
207 views

TLS server key: possible to sign another TLS server key?

If I have a valid (verifiable) certificate C_K_s that links the server key K_s to "www.example.com", is it possible to : use K_s to sign K_d, and let S_K_d be this signature use K_d as the TLS ...
3
votes
2answers
159 views

In practice, does crypto software accept a *.com or or even a *. certificate?

Assuming this will be done with your own PKI, and not a public trusted CA. Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
3
votes
2answers
182 views

SSL Certificate Signing by a CA

Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return. What I don't understand is what, ...
9
votes
2answers
3k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
4
votes
4answers
732 views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
3
votes
2answers
437 views

Mitigations for Windows clients that don't support OCSP Nonces

Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of ...
3
votes
1answer
411 views

Is the Netscape SMIME extension still required in a certificate?

Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image) I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
8
votes
1answer
2k views

How does adding a random serial number improve a certificates' security?

This article says: "Finding collisions is a tricky process, since it requires you to muck with the bits of the public key embedded in the certificate (see this paper for more details). Also, ...
5
votes
1answer
9k views

What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?

What root certificates are/are not updated when the following checkbox is checked? Additional questions If I manually remove a root certificate, will this service replace that very certificate? ...
1
vote
2answers
219 views

Using digital signatures to identify users

Consider the following requirement: Bob should be able to verify that a payment request came from Alice. The above is in simple terms the basic idea, however, in reality Alice would be user A of ...
1
vote
3answers
582 views

Is it possible to use same certificate on several machines by exporting it?

My bank proposes certificate. They say I will be able to use it only on one computer. I don't understand: can't I use same certificate on several machines by exporting and reimporting it ?
1
vote
1answer
343 views

What makes a secure smartcard secure? Is contactless/RFID better?

In short what security features exist that I should look for in a smart card? What physical features exist, which are important? It appears smart cards may exhibit different levels of wear and ...
0
votes
1answer
461 views

How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?

This document describes how there are 3 ways to constrain a SmartCard certificate The Enhanced Key Usage field defines one or more purposes for which the public key may be used. RFC 5280 states ...
15
votes
1answer
81k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
2
votes
2answers
102 views

Using External Certificates on a network that doesn't permit outbound HTTP/S access

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data I can guess that issues with signature validation occur ...
2
votes
1answer
3k views

Clearing IE temp files don't erase CRL history. How can this be purged?

Even after I purge all my Internet temporary files, I still see information when I type certutil -urlcache How do I purge this information?
2
votes
3answers
1k views

What is the most secure way to do OCSP signing without creating validation loops?

I'd like to enable the most secure OCSP validation that Windows 2008 SP1 and newer support. Based on the following information, am I required to implement id-pkix-ocsp-nocheck on my OCSP ...
2
votes
1answer
871 views

What are attribute certificates? Why would someone partition a certificate by reason codes?

In "How Certificate Revocation Works" a brief mention of Attribute Certificate and Reason Code partition is made: If validated by a client that supports partitioned and indirect CRLs, the IDP ...
4
votes
1answer
1k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...
1
vote
1answer
3k views

What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?

MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed. Based on this and this KB article the EKU section of the certificate should contain "Client ...
11
votes
3answers
9k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
2
votes
3answers
166 views

Whether certificates can be used for regulating access

I am thinking of a mechanism where I need to authenticate the client and control the access. I am thinking of using SSL for this purpose. I want to know whether using SSL solves my purpose. My ...
2
votes
2answers
333 views

Trust and signing: full public key or thumbprint?

Imagine a B2B service where two parties need to set up a two-way trust relationship: Alice will only accept requests from Bob, and Bob wants to know his requests are only going to Alice. When ...
1
vote
1answer
473 views

Best Practices for Storing Digital Certificate

I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...