A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
1answer
60 views

Can an end-entity certificate with SHA-1 be issued by an intermediate CA that has SHA-256?

Just curious - if I'm using an end-entity (leaf) certificate that has a SHA-1 signature, does that mean that ALL certificates in the chain also must use SHA-1?
4
votes
2answers
4k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
10
votes
1answer
14k views

Reset Windows trusted certificates store to its default

Over the time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, some other times for development and testing. Is there ...
16
votes
1answer
12k views

What is the difference between a “Thumbprint Algorithm” “Signature Algorithm” and “Signature Hash Algorithm” for a certificates?

I'm a bit confused on the differences between Signature Algorithm, Signature Hash Algorithm, and Thumbprint Algorithm that are present in SSL/TLS certificates. Can someone please elaborate?
1
vote
2answers
324 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
1
vote
1answer
94 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
-1
votes
1answer
89 views

How do server know the CSR sender is approved client?

Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The prblem is anyone can POST a CSR to the server and then ...
3
votes
2answers
384 views

S/MIME certificate expired and renewed, do my correspondents have to do anything?

My PKI certificate (Digital ID for email from Symantec, issuer is "VeriSign Client External Certification Authority - G3") expired after 1 year and so I have renewed it. Do the people I correspond ...
1
vote
2answers
477 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
1
vote
1answer
97 views

What is public key pinning [closed]

How does public key pinning work and what problem does it solve?
8
votes
4answers
886 views

Why the symmetric key is added to the message?

Yesterday in my class we learnt how to send a message from Alice to Bob with the achieved goals of confidentiality, integrity and authenticity. In order to have a better performance we use a hybrid ...
1
vote
1answer
7k views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
3
votes
2answers
419 views

Why would Comodo SSL certs have two intermediate CAs (chain length 4)?

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs. What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a ...
7
votes
2answers
2k views

Website Certificate Revocation check - Big deal? [duplicate]

As I was about to make payment for my flight ticket, I noticed something strange with the British Airways website's SSL cert. My browser (Google Chrome) was unable to check whether the certificate has ...
1
vote
1answer
1k views

Know certificate signing algorithm of a remote site using OpenSSL

I have been trying to know the "Certificate Signing Algorithm" ( SHA1 with RSA etc.) using openssl. To start with I tried to see the cerificate using following command, but it also does not show up ...
7
votes
2answers
1k views

Where are the anonymous/private domain validation SSL certs?

I have yet to find a CA that doesn't require personal information for DV certificates. Is this because all of the major browsers and operating systems have a policy to reject CAs that don't require ...
0
votes
2answers
203 views

How are “Certificate Signing” key usage certificates restricted to what domains they can sign?

Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate ...
0
votes
1answer
66 views

SSL - Main and Child servers network

There is an embedded device which acts a client. It communicates to a server via POST method whenever it has any data to be transmitted to the server. Embedded device: 1. Acts a Client 2. Does not ...
0
votes
5answers
454 views

Are most MiTM attacks done to impersonate web sites, or simply decrypt traffic?

The more I read about impersonating web sites the more I get confused. Does an attacker need the private key of the server in order to impersonate a website or does having the private key simply give ...
1
vote
1answer
275 views

Does client certificate do any encryption in https connection? [duplicate]

In Https connection asymmetric encryption (with Server certificate) is used during handshake and to create symmetric keys. Am I right that in this case client certificate does no encryption? The ...
0
votes
2answers
797 views

Self-signed certificates and internal cURL requests

I'm using an internal API for some commercial software we purchased and it recommends using SSL when utilizing the API; it uses cURL to achieve this and hence the user, pass and key will all be passed ...
4
votes
2answers
4k views

Recommended key usage for a client certificate

My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicates with the server to a path that requires a ...
0
votes
1answer
437 views

Can anyone with access to root CA private key decrypt HTTPS traffic?

Can anyone with access to root CA private key decrypt HTTPS traffic of sites using certificate signed by that CA ? and if yes do he need to be man-in-the-middle or just monitoring traffic is ...
2
votes
1answer
297 views

Why are CA's now signing root certs with SHA2?

I see that CA's are now giving the option of having the root CA cert signed with SHA2. I have been told that the hashing function in a root has no security value, and is irrelevant as far as a ...
9
votes
4answers
4k views

HTTPS self signed certficiate for personal website

I want to make my Synology NAS accessible over the internet. When I create my own certificate and import this on all my devices (PC, Laptop, Smartphone, Tablet, etc.) is this as secure as buying a ...
0
votes
1answer
832 views

Can't I forge an SSL certificate? [duplicate]

I read What's keeping a malicious man in the middle server from forging a valid certificate?, but when the client goes to verify the certificate, can't an attacker intercept that connection and say ...
1
vote
2answers
303 views

Does a self-signed certificate offer more protection than a public key?

I'm having a hard time finding the practical benefits of transmitting a self-signed certificate over simply a public key. I understand that a self-signed certificate proves the integrity of the public ...
4
votes
1answer
3k views

openssl ECDHE-RSA… cipher suite selected while using RSA server cert and ECDSA client cert

The scene: s_server using RSA certificate. s_client using ECC-ECDSA certificate. Client authentication is required (option -Verify set on s_server) Cipher-suite selected after handshake is ...
1
vote
2answers
260 views

What does 2^77.1 calls presented in a SHA1 attack mean?

Regarding the SHA 1 deprecation, I found this information here: http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx I know ...
2
votes
1answer
158 views

What does verified file in windows mean? And does it guarantee related files?

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g Microsoft) or in other case, unknown publisher. I know public key encryption can ...
0
votes
0answers
63 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
11
votes
3answers
431 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
7
votes
2answers
799 views

How do systems protect against a stolen code-signing certificate after the certificate expires?

Imagine this scenario: 1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp. 15th December 2014 - the certificate is revoked. Malware will be prevented from ...
13
votes
3answers
1k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
5
votes
2answers
3k views

What role do hashes play in TLS/SSL certificate validation?

After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
21
votes
3answers
8k views

Is SHA1 weak for SSL?

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
0
votes
1answer
189 views

Does the SSL/TLS client certificate “hash over all previous messages” step hash the entire TCP packets or just data?

We have which uses TLS client certificates as it's authentication mechanism between client and server. There is an IT department which wants to run this app through a firewall/proxy device of some ...
10
votes
2answers
5k views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...
1
vote
1answer
221 views

What is stopping me from replaying an SSL certificate?

Say I have the SSL certificate for google.com. I intercept it, edit the certificate with my own domain name and public key and use it to intercept all traffic to google.com. What mechanisms exist in ...
0
votes
1answer
320 views

Secure way to pass client certificate to the client2

Our product is comprised of two servers. We would like to authenticate one server to the main server by means of client certificate. I assume that we should ask the customers (who purchase the ...
26
votes
3answers
2k views

Is there a security issue in using the same certificate for all a company's services?

We are a small startup. One of our products is a B2B web service, accessible through its https://service.example.com canonical URL. For testing purposes, that service also runs on different ...
1
vote
2answers
136 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
0
votes
2answers
658 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
25
votes
10answers
5k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
0
votes
2answers
137 views

Why do certificate authorities often require/use multiple intermediates?

I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway. Why do most modern certificate authorities (e.g. ...
8
votes
3answers
7k views

How trustable are third party root certificates?

I recently tried to use Fiddler2 from a third-party vendor Telerik. While decrypting the HTTPS traffic of my network, it asked me to install its own root certificate in my Windows operating system: ...
-1
votes
1answer
235 views

VPN security/compromise

I want to get a VPN with one of the known providers. I don't know much about VPNs but I know they issue certificates which you download and it authenticates the connection and basically gives access. ...
2
votes
2answers
141 views

Should expired compromised certificates be taken care of if the time is always correct?

I am trying to set up a CA for my company, and issuing every employee a digital certificate and a private key. I am worrying about revocation and expiration. In my case, the root certificate of CA is ...
2
votes
1answer
2k views

Why OpenVPN is using both certificates and DH?

I am reading about OPENVPN and I am a little bit confused. In the OPENVPN howto website, there is a step by step setup guide for generating certificates and diffie-hellman (DH) params. However, I cant ...
1
vote
2answers
950 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...