A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

2
votes
1answer
155 views

Does Internet Explorer handle Extended Validation properly

I'm reading about Extended Validation (EV) certificates and have a few questions. From what I understand, EV allows domain owners to pay extra for a especially trusted certificate (that the browser ...
0
votes
1answer
95 views

how does IE or chrome verifies certificate? [duplicate]

If the HTTPS webserver uses self signed certificate, the web browser warns the user as follow. http://www.sslshopper.com/assets/images/iis7/iis7-self-signed-certificate-8-certificate-not-trusted.png ...
1
vote
2answers
281 views

Choosing the right X.509 certificate infrastructure for securing LAN communications between a PC and a device

Edit: seems like I was quite hasty when typing in my question at first, so here is an updated version of it. I am developing an application that runs on PCs which are on the same LAN as other ...
18
votes
3answers
3k views

Why can SSL certificates not be free of charge?

I am a newbie in this field. I am confused with why SSL certificates cannot be free of charge. In my understanding the certificate is just a text file consisting of cryptic numbers installed on a ...
1
vote
0answers
110 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
-1
votes
2answers
100 views

user identity certificate

I want to create a new scheme for user identification, like X.509 certificates, but not X.509. Is it possible to use this new certificate over the existing Internet? and if yes, what are basic ...
1
vote
0answers
605 views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
0
votes
1answer
399 views

Invalid Certificate when adding Gmail account to Apple Mail

Trouble seemed to start after upgrading to OS X 10.9. I stopped receiving email in an account I'd set up over a year ago. I removed the account and when I attempted to add it again, I was served a ...
1
vote
1answer
864 views

Convert a DER encoded Certificate to PEM encoded Certificate

I have a p7b certificate(DER encoded) which I need to convert to a PEM encoded certificate so that I can import it into my keystore. I see that the openssl command below does the job of the ...
0
votes
0answers
21 views

Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery [duplicate]

Can you tell me shortly how to fix this problem in Chrome? Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery
1
vote
2answers
235 views

Understanding certificate security

I am reading Computer Networks by Tanenbaum and Weatherall. In chapter 8 they describe secure communication using public key exchange via certificates. They describe a situation where Alice is sending ...
2
votes
2answers
2k views

Basic self-signed certificate questions

A few basic questions around self-signed certificates Question 1 Does a self-signed certificate has to have a CA? I realize that a "real" certificate must as it otherwise can be chain validated but ...
5
votes
2answers
7k views

Openssl generate different type of self signed certificate

Does anyone know how to use openssl to generate certificate for the following public key type: 1) DSA - For DHE_DSS key exchange. 2) Diffie-Hellman - For DH_DSS and DH_RSA key exchange. 3) ECDH - For ...
3
votes
1answer
117 views

In theory, can x509 certificates use Accumulator-based revocation schemes? How do these schemes work?

On page 3 of this U-Prove document regarding toke revocation, the author says the benefit of Accumulator-based revocation schemes is A cryptographic accumulator allows the aggregation of a large ...
1
vote
1answer
592 views

Additional security for WebRTC/DTLS-SRTP with PGP?

I am having a thought experiment. Can you help me? Two clients who both use PGP. They initiate a WebRTC call using DTLS-SRTP via a 3rd party server. Is there any benefit of encrypting, via their ...
10
votes
3answers
734 views

Can we make sure that the new Lavabit certificate is not under control of the FBI?

After the Lavabit shutdown, Ladar Levison (founder of Lavabit) announced that he’s "looking into setting up a site where users can download their data". Such a site is now online: ...
0
votes
1answer
2k views

Problems with intermediate ssl certificates and ssl proxy

I'm currently implementing a SSL-proxy, and have run into some problems regarding certificates. We have a offline "Company Root CA", and an online "Company intermediate CA". On the proxy I have ...
2
votes
3answers
253 views

Do on-demand SSL certificates exist?

A few days ago, I visited an SSL protected website. Since Safari complained about the SSL-certificate, I did a short inspection: The certificate was issued by GoDaddy in just the minute I ...
1
vote
1answer
110 views

Certificate Mapping in IIS

When pasting the certificate blob in the configuration editor in IIS 7.5 for one on one authentication, is this the server certificate or the client certificate?
3
votes
1answer
171 views

FIPS compliant application based on OpenSSL

Let's say I need to write a simple application for signing/checking some data. The hard part is, that it must be FIPS 140-2 compliant. I was thinking to do it using OpenSSL FIPS Object Module 2.0 but ...
4
votes
4answers
776 views

Is it possible to detect SSL private key changes?

I wonder if it would be possible to detect a change of an SSL private key? If you change the key, then I think one must issue a new certificate, but new certificates could be issued without changing ...
4
votes
1answer
749 views

Is possible that a TLS server send more than one certificate to the client for the same site?

What I'm trying to archive is enable ECDSA and DSS ciphers in my site, but at the same time not depend just of self signed certificates, so I could sent to my client more than one certificate and them ...
1
vote
2answers
111 views

non-MiTM Reverse SSL

Do non-MiTM Reverse SSL Proxies exist? Or do all proxies that do SSL-SSL mappings decode and then re-encode HTTPS traffic? If this is the case and I want to map https://mypublicdomain.com -> ...
2
votes
1answer
1k views

Evaluate the signature of an X509 certificate in .NET

This is my scenario: A CA signs a certificate with its private key and sends it to a client via https response. From this response the client creates a X509Certificate2 class, that represents the ...
11
votes
1answer
473 views

Is using a CA more secure if I'm self-signing anyway?

We have a web application that we run for clients at their booth on fairs. The communication between clients and the server was done over HTTP until recently. We're currently working on improving ...
2
votes
1answer
121 views

What are the benefits (if any) of changing TLS certificates frequently?

As I understand it, a certificate is used only for verifying the identity of the server. Are there any security benefits for changing them frequently (once a week for example)? If this is done so ...
1
vote
3answers
297 views

Where can I find all SSL CA certificates

I am working on an SSL implementation project and ofcourse I need to verify the certificate presented by the server. To do that I need CA certificates or at least root CA certificates (correct me I am ...
15
votes
5answers
3k views

Are self-signed certificates actually more secure than CA signed certificates now?

Are self-signed certificates actually more secure than CA signed certificates now? I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government ...
1
vote
2answers
159 views

SSL-certificates for overlapping domain regions?

Suppose, a server hosts https://www.master.com/ and thus is equipped with a (single domain) SSL certificate. Furthermore, suppose there are some web apps below master.com: ...
4
votes
2answers
854 views

Single domain SSL certificates, actually support 2 subdomains?

While browsing for SSL certificates, specifically domain validation type (the cheapest), I noticed that they advertise as valid for a single domain/subdomain, but then I noticed that they are valid ...
4
votes
2answers
191 views

Can the client certificate authentication process treated as a user digitally signed the content(and then get verified on the server)?

The authentication was triggered by certain event (like approving button) on the form. In the process of client certificate authentication (in IIS), user was asked to use their PIN (private key) and ...
3
votes
2answers
301 views

Requirements for qualified certificates in DIRECTIVE 1999/93/EC

DIRECTIVE 1999/93/EC at ANNEX I Requirements for qualified certificates states that one requirement for qualified certificates is (a) an indication that the certificate is issued as a qualified ...
4
votes
1answer
96 views

What is the meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC from ETSI TS 102 231 V3.1.2

From Technical Spec http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC a Root Certification Authority from which a certification path can be established down to ...
1
vote
1answer
412 views

How to authenticate to racoon with a certificate chain if only the root CA is known

I'm trying to setup IPsec using x509 certificates on Linux. I'm using racoon for that task. I've come to the point where the authentication works fine if I keep every link of the certificate chain on ...
0
votes
3answers
10k views

How to prevent man-in-the-middle attacks beside of SSL?

I would like to discuss this scenario: There is a HTTPS service which responds with signed keys to an authenticated client. These signed keys can be used for another service to return very sensible ...
11
votes
3answers
12k views

Is it possible to use wildcard certificates on multiple devices?

I have a server that I want to use a wildcard cert on. It runs multiple services. I purchase a wildcard cert so that I can protect mail.something.dom, www.something.dom, im.something.dom, ...
2
votes
6answers
4k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...
2
votes
2answers
5k views

Public Key → Certificate?

Is it possible to convert a public key to a certificate using the public key only? I've seen the following, which takes a private key to form a cert request, which can then be self-signed: openssl ...
3
votes
1answer
180 views

Why is the issuer name field signed in X.509?

In the X.509 specification it sais that the issuer name is to be signed. Since we verify the certificate with the authenticated issuer's public key, it seems infeasible to forge the issuer name ...
2
votes
2answers
467 views

Wildcard SSL Certificates & SAAS

From what I have read, using a wildcard SSL/TLS certificate is not advisable, how do you do certifcate issuing & management in your SAAS application(linux) where each client has a user selected ...
2
votes
4answers
206 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
0
votes
1answer
3k views

Why IE/Windows forces you to install self-signed certificates as root CA to make them work?

In old versions of IE/Windows you could install a self-signed certificate for a web site and it just worked: the warnings disappeared. In more recent versions (and with Chrome) this just didn't work. ...
7
votes
2answers
19k views

Is there an SSL / TLS Certificate state-cache on Windows, IE, and Outlook and how it it managed?

Today I changed the SSL certificate that 3,000+ Outlook clients are using. In doing this I changed the certificate to an "older" one that had the same subject name, expiration and everything else. ...
3
votes
2answers
4k views

Import Public Private key pair to a Keystore

I have created a public private key pair using the KeyPairGenerator class in Java. From this key pair I have generated the CSR request using the PKCS10 class which has been sent to a CA for ...
2
votes
2answers
240 views

OpenSSL, x509: what is the correct way to picture signing authorities?

For the purposes of creating a VPN, I can't find a logical explanation of OpenSSL's/x509 scheme. I'm royally confused about these three terms, Certificate Authorities Gateway certificates End-point ...
2
votes
2answers
5k views

OpenSSL, x509: what's the significance of CN (Common Name)?

With regard to these three items Certificate Authorities (CA) Gateway certificates End-point Certificates (client-cert) What is the significance of the Common Name CN with regard to the a VPN? ...
4
votes
4answers
19k views

SSL Client Certificate authentication

Is it possible to make a program which uses client certificate authentication with only public and private key (I have not generated any certificate, I have only public and private key). Simply, I ...
6
votes
2answers
905 views

Root SSL certificates and browser support

I have given three certs to be install on nginx AddTrustExternalCARoot.crt PositiveSSLCA2.crt www_example_com.crt So I concat them into a chained cert cat www_example_com.crt PositiveSSLCA2.crt ...
5
votes
2answers
488 views

Avoiding MITM attacks when using HTTPS over mobile

There are a variety of other questions that address elements of this security issue, but none that seem (to a non-expert) to address the substantial core of the issues raised in this article: ...
1
vote
1answer
459 views

Generate CSR with 2 OU Names

I have to create an application which generates a CSR. While generating a CSR we are required to fill in several details like CN, OU, etc. The problem is that the Certifying Authority to which I have ...