A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
2answers
1k views

Does Renewing SSL certificate change its thumbprint / Fingerprint

I would like to know, if renewing a SSL certificate will change my thumbprint? The certificate has expired. If it can be same then under what conditions can it remain same. Many thanks in advance.
2
votes
1answer
86 views

Is client cert authentication with a 3rd party PKI cert any safer than using self-signed?

I am working on a small M2M project (a few hundred nodes connected to a single cloud server), and want to use client certificate authentication, with each client getting its own unique cert at ...
107
votes
6answers
16k views

I can't access websites that use HTTPS, instead getting the message “your connection is not private”!

I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But ...
0
votes
2answers
72 views

Current standard of authentification

What is the current standard of authentification? I thought it is server and client authentification. But I typed for e.g. https://www.google.com/ and checked the packages in wireshark. And there ...
1
vote
1answer
126 views

Digital signatures and weak hash functions

There was this question in last year's exam. The teacher claims that answer b) (in boldface below) is correct. Attacks are constantly being performed on digital signatures which use weak hash ...
1
vote
1answer
224 views

Generating x509 PEM files for testing PEM parser

I need to test a parser of PEM formatted certificates. Thus, I need to generate many variations including variations that are invalid for various reasons. Obviously I can use openssl or a library like ...
0
votes
1answer
106 views

Obtain X.509 Certificate Fingerprint from Certificate Info

I would like to obtain the SHA1/MD5 fingerprint of an X.509 certificate in order to compare it with the one presented by a server before connecting. However, I currently don't have access to the ...
0
votes
2answers
131 views

Storage on Root CA and intermediate CA certificate on Embedded device

Regarding the storing of Root CA certificates on an Embedded device Setup Explaination: 1. An embedded device which is a CLIENT on the network 2. There is a SERVER which connects to the CLIENT on ...
2
votes
1answer
76 views

Website Implementing https site w/ self signed certs and CA

Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)? I am some what torn on how to do this - I have a number of implementaiton ...
5
votes
1answer
73 views

Protecting information in TLS client certificates

If I understood correctly, when using TLS with client authentication, the client certificate is transmitted to the server in plain text. The client certificate might include personal information, ...
2
votes
2answers
289 views

Does Ephemeral Diffie-Hellman require a certificate?

In Ephemeral Diffie-Hellman, the key pair is generated every time. In practice, does this mean I never need a certificate? Or that means I need a new cert every single time?
4
votes
2answers
197 views

Why not generate a client SSL with expiration date in very distant future?

In case of server SSL certificate it is issued by a CA which can then recall it until it expired and also the CA typically collects a fee for each certificate so it is interested in certificates ...
3
votes
3answers
2k views

haproxy with client certificate authentication signed by 'common' CA

Excuse me if I posted this here wrongly, I know the question is partly about haproxy itself. I am setting up haproxy as an SSL terminator/load balancer in front of an API that we need to expose over ...
4
votes
1answer
259 views

Wildcard SSL and EV SSL

Is it possible to mix a Wildcard SSL for subdomains and an EV SSL for the www and non-www domain? I know that an EV SSL can't have a wildcard. Example: hello.test.com -> wildcard ssl ...
1
vote
2answers
1k views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
2
votes
1answer
281 views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...
-1
votes
1answer
32 views

What if I have an address-based certificate and a domain based certificate loading HTTPs resources in the background

What if I have an address-based certificate and a domain based certificate loading HTTPs resources in the background, will this change the Lock-Logo in the Browser Address bar? Does an address based ...
0
votes
1answer
171 views

What does this mismatching SSL certificate hint at?

I'm currently visiting China, and I use a well known VPN service for both my laptop and my phone. Every now and then, I get certificate errors when using my phone when I'm connected to a VPN, but ...
0
votes
1answer
1k views

Can I create an SSL certificate on windows signed with the machine's certificate?

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a ...
1
vote
2answers
245 views

Why gpg-signed files differ every time

I signed the same file producing a separate file for the signatures, and I noticed that every file is signed with a different signature. I don't get it. Shouldn't it always be signed with the same ...
2
votes
1answer
222 views

How does firefox know when to display a green bar?

Recently I've been working on creating a self signed CA and had some success. Now I have a working CA with valid CRL server. The root CA has been deployed to all of my devices and had no problem. ...
0
votes
2answers
200 views

Check signature when next CRL will be published after end of validity of certificate

My situation looks like this: I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revoked. But what if certificate ...
4
votes
1answer
92 views

Installing a CA only for specific domains

For many reasons, it's often convenient for organizations to have their own CA (self-signed or otherwise). As I understand it, adding the CA certificate to a OS or browser will make it trust the ...
1
vote
1answer
90 views

Multi-Function SSL Digital Certificate

Is there a problem with using a single SSL certificate for both SSL/TLS/HTTPS communication as well as to sign (external) digital timestamp certificates? Other than the obvious: if one key is ...
0
votes
2answers
102 views

How do certificates work in protecting against a man-in-the-middle attack? [duplicate]

As I understand it, if Alice and Bob wants to communicate securely, they must first agree on the protocols that will be used. Then they must confirm that they are indeed communicating with each other. ...
1
vote
0answers
26 views

Difference between SSL versions and TLS versions? [duplicate]

Can anyone tell me the different versions of SSL and TLS? Someone says that SSL 1.0 was never released or never exist and other says that SSL 3.0 = TLS 1.0? Can anyone please clarify? Actually I am ...
1
vote
1answer
212 views

Distribute S/MIME public keys and CA cert for email security

I have my own CA. I want to distribute S/MIME certificates for 10 different users. I saw S/MIME keyservers from http://wiki.cacert.org/KeyServers, but I don't want to use public servers. What is the ...
0
votes
1answer
123 views

SSL with client certificate authentication

can somebody explain to me if for example i use Server certificate, with 2048bit keys and client certificate with only 512bit strength, does this use in any way affect the security of the established ...
1
vote
1answer
683 views

How can I convert a Windows certificate into a PEM format, that includes the chain + root?

I need to import a certificate into a Cisco Ironport for Web SSL inspection. The only input format supported is PEM. Based on my research the PEM format does support all certificates in the chain, ...
0
votes
0answers
145 views

What registrars support *.onion TLD as a Subject Alternative Name, and how does validation work?

I'm interested in obtaining a .onion TLD in my SAN name from a public CA. Which Public CAs support .onion TLDs and what is the validation process like (e.g. Whois isn't available for ToR) Update: ...
2
votes
2answers
109 views

Is it possible to use an open collection of default SSL certificates for my browser?

Browsers and OSes come with a set of default SSL certificates for well known organizations, such as root certificates from CAs. I understand that the trust model is as follows: I pick (actually my ...
1
vote
0answers
97 views

Can't get my SSL CA to work with Apache

So I have an SSL enabled website running on Apache2. https://eamorr.com (I get a warning in my browser, as expected) I have a config file for this website at: ...
1
vote
0answers
70 views

Setup local Certificate Authority & integrate with SCEP

I want setup local Certificate Authority and issue X.509 certificates under my CA. In order to achieve this I am exploring following options such as: OpenSSL/OpenCA BouncyCastle Cryptographic APIs ...
3
votes
1answer
127 views

PKI - Why Root CA is in intermediate CA section?

I can't understand why, when I accept to "install" a custom self signed Root CA on IE browser, the root certificate ends up in the "intermediate CA" section, rather than in "Root CA" section in the ...
1
vote
1answer
410 views

Import certificate into Windows key store [closed]

I am using nShield HSM for signing with MS application/pdf and my own .Net Application. My steps for your information: Create PKCS11 key pairs Create a MSCAPI container Import PKCS11 key into the ...
0
votes
2answers
246 views

Security of SSL certificates bought via resellers

There are many SSL certificate resellers - some are well known enterprises with good reputation (e.g. domain name registrars) while others are small and unknown companies. It is clear that resellers ...
1
vote
0answers
266 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
4
votes
1answer
302 views

Multi Domain SSL for different ip? [closed]

i have 5 domains(example.com,example2.net...) hosted on separate servers. is possible to use one Multi domain SSL certificate for these domain ?
53
votes
2answers
3k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
11
votes
1answer
445 views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
-4
votes
2answers
309 views

Using my own encryption instead of https in app

I am writing a program that uses a webserver as a backend for communication between different users. Is it okay to use my own encryption (such as ...
1
vote
1answer
77 views

Should a private key be protected by a password even if the software using it needs to know that password?

We have an embedded device running a web server. That web server uses HTTPS and so has a private certificate which is embedded on the device. Right now we are unsure if this private key should be ...
0
votes
1answer
129 views

Is digital certificate with 'issued to' field as *.example.com valid?

Came across a Digital Certificate which has issued to field *.example.com Is this a valid certificate?
0
votes
1answer
169 views

Is my sha1 SSL cert safe if they expire before 2016?

According to the Google [1], if my SSL cert expire after 2016 and at some points they will show a warning. But, if all my cert expired before 2016, so I assume no action need to be taken to prevent ...
0
votes
1answer
59 views

generate certificate at runtime and validate

I have a project that require client application to register and then use the services. I would like to do the following: A client app sends a request with IP, domain name, etc. to my REST service ...
2
votes
1answer
677 views

certificate authentication between apps

I have a .NET MVC Application which is hosted in IIS. Users of the Application will be company only and it will be access so it will be on the intranet - app wont be exposed via internet. Within IIS I ...
6
votes
1answer
10k views

Should the thumbprint be SHA2 in addition to the Signature Hash Algorithm?

I'm looking at a Windows PKI and see that the Thumbprint is SHA1, while the Signature is SHA2 (SHA256). Is this an acceptable configuration? Should I recommend that the client update to SHA2 for a ...
1
vote
2answers
180 views

What kind of SSL certificate do I need? [duplicate]

I am making a web site which can be considered similar to Reddit in some ways. I need to implement a sign up form so I will store informations about the users. My idea is to store the username, ...
21
votes
4answers
17k views

Provide subjectAltName to openssl directly on command line

Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line? I know it's possible via a openssl.cnf file but that's not really elegant for ...
0
votes
1answer
189 views

MITM faking certificates

I am looking at the theory behind MITM attacks in order to see some unencrypted packets from the 3DS. From research here is what I understand so far: 3DS > Proxy > Nintendo server I am going to try ...