A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
1answer
3k views

Grey vs Green padlock in address bar - technical difference [duplicate]

What is a technical difference between "grey padlock" and "green padlock" in URL bar in browsers? As an example we can take: Green padlock: Bank of America Grey padlock: Google Search Both of ...
1
vote
3answers
1k views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
1
vote
2answers
317 views

Choosing the right X.509 certificate infrastructure for securing LAN communications between a PC and a device

Edit: seems like I was quite hasty when typing in my question at first, so here is an updated version of it. I am developing an application that runs on PCs which are on the same LAN as other ...
1
vote
1answer
434 views

How to authenticate to racoon with a certificate chain if only the root CA is known

I'm trying to setup IPsec using x509 certificates on Linux. I'm using racoon for that task. I've come to the point where the authentication works fine if I keep every link of the certificate chain on ...
1
vote
1answer
2k views

Windows' default certificate store for intermediate vs trusted root certificates - my self signed root CA cert goes to 'intermediate' by default?

Is it possible to create self-signed root CA certificate that Windows will import to Trusted Root by default instead of Intemediate certificate store ? Obviously, it won't do it without the big giant ...
1
vote
2answers
695 views

Why is malwarebytes.org's SSL certificate from someone else?

I tried downloading and updating malwarebytes from https://www.malwarebytes.org but their certificate seems to be incorrect. This is the warning: This is probably not the site you are looking for! ...
1
vote
1answer
2k views

Certificate authentication with jQuery's ajax() function

I need to sync with my server with the client certificate abc.pfx which is generated by the server using Ajax. How do I send my certificate with Ajax object. Can I do this certificate authentication ...
1
vote
1answer
127 views

SSL Communication and Proxy

Let us say that I have a client and a server communicating using SSL. If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
1
vote
1answer
604 views

How to troubleshoot why Thunderbird rejects a PKCS#12 certificate with “Could not verify this certificate for unknown reasons”?

After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a ...
1
vote
2answers
419 views

How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)

I have a newer private key I have to import into an older server. How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
1
vote
1answer
477 views

signatureAlgorithm vs. tbsCertificate -> signature

From the X.509 RFC: Certificate ::= SEQUENCE { tbsCertificate TBSCertificate, signatureAlgorithm AlgorithmIdentifier, signature BIT STRING } TBSCertificate ::= ...
1
vote
1answer
472 views

When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?

When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism? Related information on a different answer Consider using HTTP instead ...
1
vote
2answers
202 views

Certificate security in intranet environment?

We have this topology in our company: A new rule says that each document being sent by Outlook should be encrypted. We decided using PGP. We already have a certificate (self-signed). The problem ...
1
vote
3answers
2k views

RSA encryption : How to create “.arm” certificate file for Public key?

I am required to store a certificate as ".arm" file only for a public key that is intended for use in RSA Encryption. I am currently able to generate the public key as ".key" file. P.S I am new to ...
1
vote
1answer
524 views

Purpose and Uses of Root SSL Certificates

I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?). When and ...
1
vote
2answers
316 views

Using digital signatures to identify users

Consider the following requirement: Bob should be able to verify that a payment request came from Alice. The above is in simple terms the basic idea, however, in reality Alice would be user A of ...
1
vote
1answer
5k views

What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?

MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed. Based on this and this KB article the EKU section of the certificate should contain "Client ...
1
vote
2answers
266 views

X509 mutual authentication: is there a security flaw?

On the client side, my application accepts the server's certificate in case of the client certificate being signed by this server cert. Is this correct or may it be dangerous? Is it better to ask a ...
1
vote
1answer
124 views

Viable way to authenticate certificate without a web of trust?

For SSL certificates we have a web-of-trust principle. If we are allowed to make alterations to the certificate format, are there viable ways to automatically or semi-automatically authenticate the ...
1
vote
2answers
125 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: I have been researching how trusted root authorities (such as GlobalSign or Verisign) are used ...
1
vote
1answer
66 views

Extract public information from p12 without having the password

I know this question was already asked here but unfortunately there are no satisfactory answers. Please correct me if I'm wrong, but if I have a p12 file the following two situations are possible: ...
1
vote
1answer
57 views

sftp first connection before exchange cert

If a client connects for the first time to a server via SFTP, the first connection before receiving the server certificate is transmitted in the clear?Let me explain: it is assumed that the client ...
1
vote
2answers
44 views

Is there a PKCS certificate format that signs ASCII data?

Is there a PKCS #x already out there that was designed to sign ASCII data and protect it from manipulation? I was originally guided to PKCS #7, but based on posts here it looks like the data is not ...
1
vote
1answer
105 views

Create OpenVPN/easy-rsa certificate from public key only

I have been using easyrsa to generate client certificates for my application using the method described here. The build-client-full command generates a fresh private key for each client. This is what ...
1
vote
1answer
49 views

Machine certificates for accessing a web app in IIS only from an specific PC client

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
1
vote
1answer
77 views

Determine private key size using public certificate [duplicate]

I have a public certificate in a PEM (.pem) file -----BEGIN CERTIFICATE----- MIICsjCCAZqgAwIBAgIJAMA1YIQ2JLXDMA0GCSqGSIb3DQEBBQUAMBExDzANBgNV ... 29V/R9RZOoSBHDzGPL84wm4qojMuwQ== ...
1
vote
1answer
30 views

TLS Certificates only for Clients

I'm aware that sites like StartSSL use Client-Certificates, I opened mine in Firefox and it showed me: "SSL-Client-Certificate", "E-Mail-Receiver-Certificate", "E-Mail-Signer-Certificate". Now I'm ...
1
vote
1answer
109 views

Why deploy a .p12 client certificate bundled with a root CA?

I have been asked to connect to a government agency secure site that uses client certificates to authenticate its clients. I received by email an encrypted client certificate as a PKCS#12 file and by ...
1
vote
1answer
44 views

Protecting the root ca bundle

Applications (e.g. Firefox) often include a root ca bundle file containing trusted certificates. How can I protect those files from malicious agents trying to modify them? I think signing is not an ...
1
vote
2answers
166 views

How to be sure laptop's trusted certificates are safe

I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification ...
1
vote
1answer
138 views

how to extract a valid digital certificate and put it on other program

I am working on this matter as a graduate, but I need some help. how can extract a valid digital certificate to put it on other program? can I put a digital certificate on other executables and be ...
1
vote
1answer
71 views

Digital signatures and weak hash functions

There was this question in last year's exam. The teacher claims that answer b) (in boldface below) is correct. Attacks are constantly being performed on digital signatures which use weak hash ...
1
vote
1answer
137 views

Generating x509 PEM files for testing PEM parser

I need to test a parser of PEM formatted certificates. Thus, I need to generate many variations including variations that are invalid for various reasons. Obviously I can use openssl or a library like ...
1
vote
1answer
296 views

How can I convert a Windows certificate into a PEM format, that includes the chain + root?

I need to import a certificate into a Cisco Ironport for Web SSL inspection. The only input format supported is PEM. Based on my research the PEM format does support all certificates in the chain, ...
1
vote
1answer
255 views

Import certificate into Windows key store [closed]

I am using nShield HSM for signing with MS application/pdf and my own .Net Application. My steps for your information: Create PKCS11 key pairs Create a MSCAPI container Import PKCS11 key into the ...
1
vote
1answer
63 views

Should a private key be protected by a password even if the software using it needs to know that password?

We have an embedded device running a web server. That web server uses HTTPS and so has a private certificate which is embedded on the device. Right now we are unsure if this private key should be ...
1
vote
1answer
289 views

How will SHA1 deprecation affect SHA1 roots in OS/Browser trust stores.

I understand the SHA1 deprecation policy applies to CA's issuing SHA2 end-entity certs and intermediates starting Jan 2017 but how will this policy affect the actual root certificates in OS/Browser ...
1
vote
2answers
1k views

To trust, or not to trust? Adding exceptions to the Trusted Certificates List in (firefox) Light

I recently installed the Light (a more compact forking of Firefox). I started getting the "This Connection is Untrusted" error, which got me wondering: when should I add an exception to the list of ...
1
vote
1answer
629 views

Forcing EAP-TLS 1.2 authentication with FreeRadius and OpenSSL

Been working with TLS DHECE certificate based handshake with a FreeRADIUS server and WPA_supplicant - both running OpenSSL 1.0.1j FIPS. Afer watching the Wireshark traffic, I notice that the client ...
1
vote
1answer
88 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
1
vote
1answer
494 views

Know certificate signing algorithm of a remote site using OpenSSL

I have been trying to know the "Certificate Signing Algorithm" ( SHA1 with RSA etc.) using openssl. To start with I tried to see the cerificate using following command, but it also does not show up ...
1
vote
1answer
61 views

SSL - Main and Child servers network

There is an embedded device which acts a client. It communicates to a server via POST method whenever it has any data to be transmitted to the server. Embedded device: 1. Acts a Client 2. Does not ...
1
vote
1answer
499 views

Can't I forge an SSL certificate? [duplicate]

I read What's keeping a malicious man in the middle server from forging a valid certificate?, but when the client goes to verify the certificate, can't an attacker intercept that connection and say ...
1
vote
1answer
431 views

How to safely renew user and CA certificates in a PKI

I am currently developing my own PKI where x.509-client-certificates are issued by a public server. At the moment, the CA-public key is distributed with the binary and there are no routines for ...
1
vote
1answer
472 views

Questions about self-signed Certificates' Fingerprints and Client-Server Interaction through SSL

I have some questions about how the fingerprint function is performed. First of all, I have some knowledge about cryptography. However it seems to do not be good enough to understand hundreds of ...
1
vote
2answers
163 views

determine X.509 certificate class

I am very familiar with OpenPGP but don't even use X.509 / S/MIME. I know that there are several classes for certificates (from email check to personal ID check). I would like to know how you ...
1
vote
1answer
210 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
1
vote
3answers
90 views

Simplifying SMIME by re-using the Public & Private key across email accounts

I need to simplify (at the cost of security features) an SMIME deployment. How can I generate a CSR that reuses the same public and private key for more than one email address? In other words, I ...
1
vote
1answer
253 views

How to Delete duplicates in CA Bundle Certificate File

I do have a big CA bundle certificate file and each time if i get request to add new certificate to the existing bundle i need to make sure it is not present already. How i can validate the ...
1
vote
1answer
83 views

Resign root CA as SUB?

Imagine I have a Microsoft root offline ca running since half year, but suddenly I want to include it in my company hierarchy, resigning it with the company official root, But I need both continue ...