A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

6
votes
4answers
3k views

Can an intermediate CA be trusted like a self-signed root CA?

Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
4
votes
2answers
873 views

Is it possible to modify a CA without having to reissue all of the derived certificates?

Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I ...
5
votes
1answer
266 views

SSL CipherSuite Choices

In SSL/TLS, is the CipherSuite chosen by the server or the client? Also, can the certificate in any way dictate or modify the CipherSuite?
-5
votes
4answers
319 views

Is TLS-in-TLS supported in any software? Does it make sense? [closed]

I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
3
votes
0answers
178 views

How secure is HTTP basic authentication over SSL? [duplicate]

Possible Duplicate: Is BASIC-Auth secure if done over HTTPS? I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
2
votes
2answers
97 views

Does it make sense that OCSP returns state for the signer CA itself

I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...
2
votes
1answer
3k views

SSL cert not turning green anymore

I'm running a drupal site and have asked about this issue pertaining specifically to the drupal aspect of it here. I know that the "Green" https url doesn't show up because the cert itself isn't ...
5
votes
2answers
6k views

Internal SSL Certificates?

As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
10
votes
1answer
371 views

Why can the validity of an SSL certificate exceed the registration period of a domain?

I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
4
votes
3answers
2k views

What does it mean for a digital certificate to be “signed”?

When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
1
vote
1answer
430 views

Purpose and Uses of Root SSL Certificates

I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?). When and ...
-1
votes
2answers
447 views

Request/Creating a Code Signing Certificate

I have need for a code signing certificate which is trusted by a CA in the windows domain. How do I request/create this certificate? Do I have to request a code signing certificate on the ...
7
votes
4answers
883 views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
4
votes
2answers
219 views

TLS server key: possible to sign another TLS server key?

If I have a valid (verifiable) certificate C_K_s that links the server key K_s to "www.example.com", is it possible to : use K_s to sign K_d, and let S_K_d be this signature use K_d as the TLS ...
3
votes
2answers
166 views

In practice, does crypto software accept a *.com or or even a *. certificate?

Assuming this will be done with your own PKI, and not a public trusted CA. Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
3
votes
2answers
186 views

SSL Certificate Signing by a CA

Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return. What I don't understand is what, ...
11
votes
2answers
4k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
4
votes
4answers
867 views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
3
votes
2answers
463 views

Mitigations for Windows clients that don't support OCSP Nonces

Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of ...
3
votes
1answer
448 views

Is the Netscape SMIME extension still required in a certificate?

Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image) I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
8
votes
1answer
2k views

How does adding a random serial number improve a certificates' security?

This article says: "Finding collisions is a tricky process, since it requires you to muck with the bits of the public key embedded in the certificate (see this paper for more details). Also, ...
5
votes
1answer
10k views

What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?

What root certificates are/are not updated when the following checkbox is checked? Additional questions If I manually remove a root certificate, will this service replace that very certificate? ...
1
vote
2answers
231 views

Using digital signatures to identify users

Consider the following requirement: Bob should be able to verify that a payment request came from Alice. The above is in simple terms the basic idea, however, in reality Alice would be user A of ...
1
vote
3answers
701 views

Is it possible to use same certificate on several machines by exporting it?

My bank proposes certificate. They say I will be able to use it only on one computer. I don't understand: can't I use same certificate on several machines by exporting and reimporting it ?
1
vote
1answer
369 views

What makes a secure smartcard secure? Is contactless/RFID better?

In short what security features exist that I should look for in a smart card? What physical features exist, which are important? It appears smart cards may exhibit different levels of wear and ...
0
votes
1answer
497 views

How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?

This document describes how there are 3 ways to constrain a SmartCard certificate The Enhanced Key Usage field defines one or more purposes for which the public key may be used. RFC 5280 states ...
17
votes
1answer
97k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
2
votes
2answers
111 views

Using External Certificates on a network that doesn't permit outbound HTTP/S access

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data I can guess that issues with signature validation occur ...
2
votes
1answer
3k views

Clearing IE temp files don't erase CRL history. How can this be purged?

Even after I purge all my Internet temporary files, I still see information when I type certutil -urlcache How do I purge this information?
2
votes
3answers
1k views

What is the most secure way to do OCSP signing without creating validation loops?

I'd like to enable the most secure OCSP validation that Windows 2008 SP1 and newer support. Based on the following information, am I required to implement id-pkix-ocsp-nocheck on my OCSP ...
2
votes
1answer
986 views

What are attribute certificates? Why would someone partition a certificate by reason codes?

In "How Certificate Revocation Works" a brief mention of Attribute Certificate and Reason Code partition is made: If validated by a client that supports partitioned and indirect CRLs, the IDP ...
4
votes
1answer
2k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...
1
vote
1answer
4k views

What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?

MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed. Based on this and this KB article the EKU section of the certificate should contain "Client ...
11
votes
3answers
10k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
2
votes
3answers
179 views

Whether certificates can be used for regulating access

I am thinking of a mechanism where I need to authenticate the client and control the access. I am thinking of using SSL for this purpose. I want to know whether using SSL solves my purpose. My ...
2
votes
2answers
366 views

Trust and signing: full public key or thumbprint?

Imagine a B2B service where two parties need to set up a two-way trust relationship: Alice will only accept requests from Bob, and Bob wants to know his requests are only going to Alice. When ...
1
vote
1answer
517 views

Best Practices for Storing Digital Certificate

I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
2
votes
2answers
1k views

How to use 'key material' so that multiple people can access protected files?

I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
3
votes
1answer
130 views

Spurious SSL Certificates when accessing sites through enterprise network

I've noticed recently when I log on to sites like Hotmail that IE has been telling me there is something wrong with my SSL certs. When I examine the certs, the Issuer appears as "Blue Coat" from ...
3
votes
4answers
5k views

Two-factor authentication w/certificate and username & password?

Example scenario: ActiveSync Authentication method: certificate-based authentication AND Active Directory domain username-password Encrypted on device: public & private key AD username ...
8
votes
4answers
2k views

Is it safe to send a CSR via email?

I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?
5
votes
3answers
4k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
7
votes
1answer
206 views

Does dnssec protect against malicious registrars?

With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked). This is especially ...
14
votes
2answers
20k views

Advantages of client certificates for client authentication?

I'm no security expert, so please just ask in a comment if I haven't made my question clear enough for an answer. The Scenario We have a server running WCF services, and a number of clients ...
14
votes
1answer
10k views

What is the actual value of a certificate fingerprint?

In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
6
votes
4answers
1k views

Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)

I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was: CA with RSA keys capable of signing RSA and EC CSRs CA with ...
1
vote
2answers
205 views

X509 mutual authentication: is there a security flaw?

On the client side, my application accepts the server's certificate in case of the client certificate being signed by this server cert. Is this correct or may it be dangerous? Is it better to ask a ...
2
votes
3answers
10k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
0
votes
1answer
212 views

Authentication methods without trusting 3rd parties unless explicitly indicated

The plan is to have a situation in which no third parties have to be trusted unless you explicitly indicate so. For example CA's are only used when the contact explicitly added the CA as a trusted ...
0
votes
1answer
772 views

URIs in the subjAltName X.509 extension

The subjAltTag extension for X.509 certificates can take in domain names, email addresses, URIs, etc. I was playing around with an X.509 whose subjAltTag had just a URI in it doesn't seem to work. ...