A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
1answer
104 views

How do SSL certificates become compromised after expiring [duplicate]

I'm reading into security issues surrounding SSL, and one of that has come up is certificate expiration. The general idea is that once a certificate expires, the site is insecure. What is the ...
1
vote
2answers
212 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
2
votes
2answers
12k views

This certificate has an invalid digital signature

I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. http://robbincremers.me/2011/12/27/wcf-transport-security-and-client-certificate-authentication-...
1
vote
0answers
168 views

Making the Firefox key and CSR creation process transparent

Background I was a bit surprised that several CAs do not allow anymore to send a plain old CSR in text form to them which was created in the classic fashion with OpenSSL or similar. But this would ...
5
votes
2answers
188 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
1
vote
0answers
38 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
1
vote
1answer
94 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
57
votes
4answers
7k views

Why was the private key of the Superfish certificate so easily extractable?

Robert Graham detailed on the Errata Security blog how he was able to get the private key of the Superfish certificate. I understand that attackers can now use this key to generate certificates of ...
2
votes
1answer
591 views

How do Client-specific keys and Certificates work?

I have clients that communicates with my server. Clients sends it unique id (guid) to server with its request over a secure https channel. Also to increase security I use my own private-public key ...
13
votes
1answer
826 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
2
votes
1answer
13k views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
2
votes
0answers
54 views

How can I restore my Windows certificate cache so I only have those from trusted CAs? [duplicate]

All this talk about Superfish and other adware crap has made me healthily paranoid that a wrong certificate can enter my certificate cache at any time. I have no reason to assume that there is a ...
0
votes
1answer
686 views

Create certificate without private key with OpenSSL

I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely fine,...
1
vote
2answers
271 views

How to be sure laptop's trusted certificates are safe

I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification authorities\...
28
votes
4answers
2k views

Can any CA sign any domain?

Can any CA sign any cert for any domain? If the answer is yes, what prevents having two different CAs creating a valid cert for the same domain? Does that mean that the whole TLS security has the ...
3
votes
1answer
3k views

Active Directory - Certificate Based Authentication - Multiple certificates for user

First, I have very limited knowledge about AD. Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will ...
2
votes
1answer
812 views

how to extract a valid digital certificate and put it on other program

I am working on this matter as a graduate, but I need some help. how can extract a valid digital certificate to put it on other program? can I put a digital certificate on other executables and be ...
1
vote
0answers
27 views

How can i know my security level as “ SSL 256 bit encryption” [duplicate]

I am using openssl tool to create certificate self-signed certificate I have known that [2048 bit SSL] it is the length of the public key then what about [256 bit encryption] how can i know type of ...
1
vote
0answers
68 views

Certificate advice for deploying code-signed software as a 3rd party vendor

I am in the process of developing an application for an organization, and am looking for a sanity check on my strategy, especially given the the nature of the SuperFish nonsense that was exposed. The ...
3
votes
1answer
254 views

Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?

If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA. The use case is that some clients have ...
0
votes
0answers
110 views

Proxpy- certificate issue

I am using proxpy, a proxy server written in Python. It comes with its certificates and after installing one of the certificates in Firefox, I got 'Connection is untrusted'. Any help in this regard ...
6
votes
3answers
3k views

What part of TLS specifies how to verify a certificate chain

I have sometimes run into a situation where I see a root CA certificate which is set to expire sooner than the intermediate CA certificate. My question is - if you were interested in keeping your ...
1
vote
1answer
416 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
0
votes
2answers
140 views

Why do certificate authorities often require/use multiple intermediates?

I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway. Why do most modern certificate authorities (e.g. ...
10
votes
2answers
5k views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...
2
votes
1answer
135 views

Why do Certificate Authorites cross-sign each other?

A Certificate Authority (CA) issues digital certificates to certify the ownership of a public key by the named subject of the certificate. What is the rationale for CAs cross-signing each other (i.e. ...
0
votes
1answer
67 views

Is it possible for a successful domain hijacker to fraudulently use the certificate issued to the real owner of the domain name?

In other words, while visiting https://www.mybank.com, for example, can I always trust the site as long as I click the padlock in the address bar of my browser and find no problem with the certificate?...
2
votes
2answers
513 views

Are there other roots of trust on my computer aside from these 46 root certificates?

I've heard many people imply that modern browsers and OSes trust a myriad of root certificates. The implication is that it is impossible to ensure the private keys of all of the root certificates ...
2
votes
1answer
239 views

Is an SSL/TLS HTTPS certificate 'fingerprinting' attack possible?

If you download a friend's site's unique HTTPS root certificate (independent of default browser-shipped ones), or you simply make a 'permanent exception' to an obscure self-signed cert, in Firefox, I ...
3
votes
2answers
408 views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a certificate?...
107
votes
6answers
18k views

I can't access websites that use HTTPS, instead getting the message “your connection is not private”!

I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But ...
2
votes
2answers
203 views

Using digital certificates in digital signatures

Please could anybody explain to me how certificates are used with digital signatures? I understand difference between certificates and signatures. It is clear. Digital certificates are used to ...
4
votes
1answer
46 views

Mail Signing Certificate – What are the impacts when revocated?

Suppose I open a signed mail on 1st January 2000, signature is OK. What about this two cases : 1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
4
votes
3answers
51 views

Certificate Issuer is Network Company

I simply want to know if is this normal, abnormal, deceptive, illegal, etc... I am at work. When I bring up a certificate for most domains, I get a very standard certificate. When I bring one up for ...
2
votes
3answers
451 views

Forged SSL without installation of root CA, possible?

Consider visiting a secure website like Gmail. Is it possible to forge the website certificate only by having full control over the internet provider? I mean is it practically possible for a provider ...
1
vote
2answers
2k views

Does Renewing SSL certificate change its thumbprint / Fingerprint

I would like to know, if renewing a SSL certificate will change my thumbprint? The certificate has expired. If it can be same then under what conditions can it remain same. Many thanks in advance.
3
votes
3answers
635 views

Corporate PKI - SHA1 deprecation

Here is the context. Suppose you have a corporate PKI with : AC_Root (offline in safe store - SHA1 signature) SubRootA and SubrootB (offline in safe store - SHA1 signature) SubSubRootC, SubSubRootD, ...
2
votes
1answer
89 views

Is client cert authentication with a 3rd party PKI cert any safer than using self-signed?

I am working on a small M2M project (a few hundred nodes connected to a single cloud server), and want to use client certificate authentication, with each client getting its own unique cert at ...
0
votes
2answers
72 views

Current standard of authentification

What is the current standard of authentification? I thought it is server and client authentification. But I typed for e.g. https://www.google.com/ and checked the packages in wireshark. And there ...
1
vote
1answer
134 views

Digital signatures and weak hash functions

There was this question in last year's exam. The teacher claims that answer b) (in boldface below) is correct. Attacks are constantly being performed on digital signatures which use weak hash ...
0
votes
1answer
106 views

Obtain X.509 Certificate Fingerprint from Certificate Info

I would like to obtain the SHA1/MD5 fingerprint of an X.509 certificate in order to compare it with the one presented by a server before connecting. However, I currently don't have access to the ...
2
votes
1answer
76 views

Website Implementing https site w/ self signed certs and CA

Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)? I am some what torn on how to do this - I have a number of implementaiton ...
4
votes
3answers
2k views

Is it possible to modify a CA without having to reissue all of the derived certificates?

Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I don'...
4
votes
1answer
1k views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
5
votes
1answer
75 views

Protecting information in TLS client certificates

If I understood correctly, when using TLS with client authentication, the client certificate is transmitted to the server in plain text. The client certificate might include personal information, (...
2
votes
2answers
301 views

Does Ephemeral Diffie-Hellman require a certificate?

In Ephemeral Diffie-Hellman, the key pair is generated every time. In practice, does this mean I never need a certificate? Or that means I need a new cert every single time?
5
votes
2answers
202 views

Why not generate a client SSL with expiration date in very distant future?

In case of server SSL certificate it is issued by a CA which can then recall it until it expired and also the CA typically collects a fee for each certificate so it is interested in certificates ...
4
votes
1answer
280 views

Wildcard SSL and EV SSL

Is it possible to mix a Wildcard SSL for subdomains and an EV SSL for the www and non-www domain? I know that an EV SSL can't have a wildcard. Example: hello.test.com -> wildcard ssl hello2.test....
1
vote
2answers
1k views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
2
votes
1answer
303 views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...