A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
2answers
200 views

Secure cookies and Path Length Constraint

Using apache 2.2.3 on oracle enterprise linux. When setting following setting in httpd.conf: Header edit Set-Cookie ^(.*)$ $1;Secure , cookie generation (which happens on our registration page) ...
4
votes
3answers
4k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
2
votes
2answers
591 views

distribution mechanisms for CRLs

From the X.509 RFC: DistributionPoint ::= SEQUENCE { distributionPoint [0] DistributionPointName OPTIONAL, reasons [1] ReasonFlags OPTIONAL, cRLIssuer ...
1
vote
2answers
5k views

How to get private key from certificate and base 64 encoded key?

Sorry for the poor question. Suppose I have a certificate of the following lines: -----BEGIN CERTIFICATE----- //22 Lines of encoded junk -----END CERTIFICATE----- And then this base64 encoded ...
2
votes
2answers
976 views

Key Exchange using PKI

I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl openssl req -x509 -nodes ...
25
votes
4answers
3k views

What alternatives are there to the existing Certificate Authority system for SSL?

Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
1
vote
2answers
159 views

Certificate Security in intranet Environment?

We have this topology in our company : A new rule says that each document being sent by outlook should be encrypted. we decided using PGP. We already have a certificate ( self signed). the ...
1
vote
0answers
124 views

Why not buy cheap SSL certificates? [duplicate]

Possible Duplicate: Is there any technical security reason not to buy the cheapest SSL certificate you can find? The comparison in Godaddy's website, makes it clear: they're just cheaper ...
5
votes
1answer
408 views

Which attributes of a X509v3 certificate are never really used?

Are there any extensions/extended key usage attributes of a X.509Certificate that are rarely or never used in practice? Either due to never being part of an issued certificate or because they are ...
10
votes
2answers
1k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
10
votes
5answers
1k views

Why is this certificate valid for so many domains?

If you look at the (invalid) certificate for https://i.imgur.com/ it says only valid for the following names: The certificate is only valid for the following names and then a list of about 100 names. ...
3
votes
1answer
1k views

What are the Netscape Cert Type attributes? Why/when are they needed?

What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions? Example: There is the Client/Server Extended Key Usage (X.509) but there is ...
2
votes
1answer
450 views

Can Diffie-Hellman Anonymous be used as a cipher for SSL for one-way certifiate-based authentication

I want to use Diffie-Hellman anonymous cipher for SSL. I also want to use a one-way certificate for server authentication. Is this possible?
15
votes
4answers
3k views

What is the potential impact of these SSL certificate validation vulnerabilities?

I just finished reading through this paper by Georgiev et al, which demonstrates a wide range of serious security flaws in SSL certificate validation in various non-browser software, libraries and ...
4
votes
2answers
169 views

What is the state of the Windows Update certificate after Flame?

May 28, The Flame malware is discovered in Iran and by Kaspersky Labs. June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
2
votes
2answers
808 views

Revoked certificate validation using past times

I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past. Unfortunately I have problems verifying revoked ...
6
votes
2answers
581 views

ASN.1: ENUMERATED vs INTEGER

From the X.509 specs: CRLReason ::= ENUMERATED { unspecified (0), keyCompromise (1), cACompromise (2), affiliationChanged (3), ...
3
votes
2answers
2k views

What are the implications of adding a self signed certificate to the Windows Trusted Root Certification Authorities store?

I'm a budding website developer, so please bear with my ignorance. Say I had to encrypt my website with HTTPS and I got sick of having to click "Continue" every time a warning came up about an ...
2
votes
1answer
124 views

Which .CER file format is more secure for purposes of an AIA record?

What file format is most appropriate or secure for the AIA record in a PKI certificate? The options I'm aware of are: DER encoded binary X.509 (.cer) Base-64 encoded X.509 (.cer) I also have the ...
1
vote
1answer
138 views

What keys are involved in an X.509 certificate?

I'm trying to examine some instances where an X.509 certificate uses public and private keys for a paper I'm going to write. However, the only thing I have explicitly seen so far is in one of the ...
3
votes
2answers
2k views

x.509 CRLs: next update?

An X.509 certificate revocation list contains a field specifying when the next such list is expected to be issued. I'm trying to figure out the importance of this field...I know that sometimes ...
5
votes
3answers
728 views

Digital Signature and Verification?

AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it. So public key is used to decrypt ...
5
votes
3answers
4k views

How is an X509 certificate signer verified?

Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is, ...
2
votes
1answer
133 views

How can I determine if a CA Cert can be used for DPI-SSL

I would like to know if a CA Cert I installed can be used to perform DPI-SSL decryption without my knowledge. Would there be any indication? Can you look at the cert properties to determine if it can ...
376
votes
3answers
159k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
6
votes
3answers
499 views

What risks would exist in transmitting an encrypted PKCS12 via Https

I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate ...
3
votes
2answers
143 views

Using a verified certificate to sign others

OK my Google Fu has failed me as I'm not exactly sure what I'm searching for. This relates to PKI ad certificates generally but websites more specifically. Could you get a verified certificate from ...
4
votes
1answer
77 views

Standards for CA cert revocation and time-constrained cryptographic algorithm parameters

I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
1
vote
1answer
1k views

SSL handshake failure [closed]

I am using shibbolet for single user authentication and it needs a ssl configuration which facilitates the user authentication process. Before it was working fine but now I am facing a SSL handshake ...
5
votes
1answer
101 views

Is it possible to have multiple key lengths in PKI?

Is it possible to have multiple key lengths in a PKI? For example, use a 1024-bit key for the issued certificate, a 2048-bit key for the intermediate certificate, and 4096-bit key for the root ...
3
votes
1answer
152 views

CMC (RFC 5272) compatible CA server

I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
2
votes
2answers
467 views

Code Signing: Change certificate attributes during renewal?

I'm quite new to code signing and could not find clear answers to the following general questions so far. It would be great if someone could clarify/explain the logic behind this and point me in the ...
4
votes
3answers
405 views

Does the following data stream look secure to you?

I understand the basic concept of SSL but maybe I am missing the point. Please could someone take a look at the following part of a test log to a server and tell me if it looks secure. My concerns are ...
3
votes
1answer
76 views

Within a CSR, is there a field to have the MS PKI server change the default cert filename

I'm not intimately familiar with MS PKI, but it was a question that came up in a discussion for an issue a coworker is having. When you input the request fields manually on a PKI server, the cert ...
5
votes
5answers
2k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
4
votes
2answers
223 views

Are Windows Updates susceptible to tampering, eg. using a MiTM attack.

My real question is how are patches and updates authenticated in general. But for example how does windows know a windows update is really a windows update, does it just trust the URL or is there some ...
3
votes
1answer
276 views

Is OpenVPN secure if both the certificate and private key, are publicly known?

My ISP is rubbish and the state of the internet in the UK seems to be heading to 1984. I've started looking at VPNs and stumbled on IPredator as a cheapy test. It gives you the option of OpenVPN and ...
3
votes
2answers
1k views

How realistic and possible is this sort of attack

I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me. Nessus rated this finding's risk as Medium. The finding was, that a service ...
5
votes
2answers
969 views

Adding custom data in X.509 certificate

I am using SSL with client authentication. I need to send some extra data while sending the client certificate? Can I send it in the certificate? Can I use the extension fields in certificate for that ...
7
votes
1answer
798 views

How do I store Diffie-Hellman parameters in a X.509 certificate?

In there paper Authentication and authenticated key exchange Diffie, van Oorschot and Wiener recommend to insert the DH parameters into the certificate of Alice. As a result an attacker can not change ...
4
votes
2answers
1k views

Is it okay to just secure (using SSL) the login page, but not the rest of the site? [duplicate]

Possible Duplicate: What are the pros and cons of site wide SSL (https)? I'm creating a custom PHP/MySQL CMS for a client (because Wordpress is overkill for this client's particular needs). ...
2
votes
2answers
166 views

What number of bits does a browser use to generate a key?

The question comes from the accepted answer in this thread: My understanding of how HTTPS works (gmail for example) The Gmail server sends your client a certificate. The certificate includes the ...
25
votes
3answers
48k views

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm What exactly is the difference here and why are two encryption bits ...
0
votes
1answer
292 views

How does a Web Security Gateway analyse SSL Encrypted Traffic?

Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
4
votes
2answers
628 views

What are the real-time applications of long term digital signature with timestamp

I want to know the real time applications that uses digital signatures with timestamps. Specially I am interested to know the applications where we can trust an old signed document which is now ...
2
votes
1answer
137 views

IKEv2 in remote access scenarios

Can someone explain why, in remote access scenarios, IKEv2 EAP password-based user auth combined with IKEv2 PUBKEY gateway auth is preferable over mixed IKEv2 PSK/PUBKEY auth using the same password ...
1
vote
3answers
1k views

RSA encryption : How to create “.arm” certificate file for Public key?

I am required to store a certificate as ".arm" file only for a public key that is intended for use in RSA Encryption. I am currently able to generate the public key as ".key" file. P.S I am new to ...
16
votes
4answers
5k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
4
votes
1answer
173 views

How does my antivirus determine which CTL is used?

I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
58
votes
10answers
12k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...