A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

8
votes
1answer
143 views

What considerations should apply for self service Renewing, Revoking, or Unrevoking a certificate?

I need to design a self service portal for renewing, revoking, and unrevoking a certificate and have come up with the following rules*: Renewal Certificates have a short term validity and need to ...
1
vote
1answer
784 views

Questions about self-signed Certificates' Fingerprints and Client-Server Interaction through SSL

I have some questions about how the fingerprint function is performed. First of all, I have some knowledge about cryptography. However it seems to do not be good enough to understand hundreds of ...
0
votes
1answer
637 views

What is the difference between openssl and mkcert and IIS self signed certificate

What is the difference between openssl and mkcert. Which one should I prefer. I want to create an IIS hosted WCF service. Which one should I use to create an SSL certificate. Also, there is another ...
2
votes
2answers
168 views

Is there any mechanism to audit which signed certificates are unrevoked?

We are currently using EasyRSA and OpenSSL to manage our user VPN certificates for OpenVPN. The process we have in place currently is: User generates a CSR on their laptop and sends it to us to sign ...
2
votes
2answers
228 views

Client Authentication Certificate Not Expiring, but “parent” cert IS

So I have a client-authencation cert installed on client PCs, which doesn't expire for 5 more years. Unfortunately, the cert on our gateway which is used to validate the client cert, expires this ...
0
votes
1answer
565 views

Testing Digital Signature Verification

I'm testing a system which involves updating a database using files sent from external parties. These files sent from external parties are basically just large flat files to update a database. The ...
1
vote
1answer
186 views

What should a client verify after getting a client certificate?

I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String. the String is then decoded to a x509Certificate (using Bouncycastle's ...
1
vote
2answers
338 views

determine X.509 certificate class

I am very familiar with OpenPGP but don't even use X.509 / S/MIME. I know that there are several classes for certificates (from email check to personal ID check). I would like to know how you ...
0
votes
2answers
343 views

How to encode a username in PKIX certificate?

I was reading through RFC 5280, PKIX Certificate and CRL Profile, Section 4.2.1.6, Subject Alternative Name: The subject alternative name extension allows identities to be bound to the subject ...
1
vote
2answers
5k views

My certificate seems fine but my TLS fails (Cert not validated)

I set up my certificate for my mail server at https://mail.xxxx.com/ I exported my certificate as described in my mail servers documentation and pointed to it in the server settings. The certificate ...
0
votes
1answer
401 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
1
vote
3answers
130 views

Simplifying SMIME by re-using the Public & Private key across email accounts

I need to simplify (at the cost of security features) an SMIME deployment. How can I generate a CSR that reuses the same public and private key for more than one email address? In other words, I ...
0
votes
1answer
340 views

Save to setup localhost.example.com to test wildcard SSL?

I have a domain with a wildcard SSL certificate (i.e. "*.example.com"). I also develop using WAMP setups, which I would like to be able to test HTTPS on. There are several tutorials on how to setup a ...
3
votes
2answers
142 views

Isn't this the same as using a certification authority?

Taken from Wikipedia, here is the pretext to my question: A certificate authority (CA) is an organization that stores public keys and their owners and every party in a communication trusts this ...
2
votes
1answer
626 views

How do I get a third-party-signed ssl client certificate?

I've been given a requirement of providing a client certificate to authenticate between two application's web services. The other application (that I don't host) is requiring an SSL client certificate ...
4
votes
3answers
2k views

Protecting the Java keystore with a weak password, what's the risk?

From my understanding, the Java keystore contains certificate information, but this information is public (i.e. other machine certificates which you want the local machine to trust). Is there ...
3
votes
3answers
2k views

From a trust perspective, is renewing a CA certificate the same as trusting a sub-CA?

I'm trying to understand the validation logic that would occur in the following hypothetical scenario An unpatched XP user who trusts a list of root CAs. Those CAs in particular have been renewed (...
1
vote
0answers
165 views

Is a android app signing certificate unique?

The Certificates that are used to sign Android applications are generated by the user and not checked or signed by any authority. They are RSA or DSA Certificates and as i read on crypt.stackexchange....
3
votes
1answer
3k views

Is keystore file (server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I used to generate the .p7b file: I generated a .jks (java keystore) file using ...
0
votes
1answer
2k views

x509 serial number - hex or decimal

When I run the openssl command openssl x509 -noout -text -in certname on different certs, on some I get a serial number which looks like this. Serial Number: 256 (0x100) On others, I get one ...
1
vote
0answers
225 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: 0_.].[0Y0W0U..image/gif0!0.0...+......
0
votes
1answer
352 views

How to get “Policy: X509v3 Any Policy” in a certificate generated with OpenSSL?

I am trying to generate a certificate through OpenSSL which has the following line X509v3 Certificate Policies: Policy: X509v3 Any Policy But I end up getting X509v3 Certificate Policies: ...
4
votes
4answers
745 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude lower&...
1
vote
1answer
627 views

How to Delete duplicates in CA Bundle Certificate File

I do have a big CA bundle certificate file and each time if i get request to add new certificate to the existing bundle i need to make sure it is not present already. How i can validate the duplicates....
-1
votes
1answer
716 views

How does SSL client authentication work?

I read the RFC document, it mentioned that there are some kinds of client certificate type. So I don't understand what does this type mean. For a instance, one type named rsa_fixed_ecdh, it said, the ...
0
votes
1answer
92 views

Can two parties sign each other's certificate and exchange without CA?

Is possible (and practical) for two users to create their own self-signed SSL certificates, exchange these certificates (perhaps in a face-to-face meeting), and then communicate with each other ...
22
votes
5answers
3k views

Are login “certificates” more secure than standard username + password authentication?

I just opened a new bank account which comes with internet banking. Unlike the others I have used so far, this one requires a personal certificate (a .p12 file stored on my computer) + password for ...
1
vote
3answers
779 views

Multiple SSL server certificates

I am sort of new to SSL. During a SSL connection establishment, I see that the server is sending multiple certificates. Can someone help me to understand why the server is sending multiple ...
5
votes
1answer
10k views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is established.)...
1
vote
2answers
88 views

Public e-mail Encryption Certificate

I'm quite new to this, so don't be too hard on me. I'm currently using the CipherMail MTA to generate e-mail encryption certificates. I created an own CA and public and private keys for our contact ...
1
vote
0answers
45 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
2
votes
1answer
456 views

Diffie-Hellman certificate verify message

On the RFC 6101, about "Certificate Verify", I read that: "This message is used to provide explicit verification of a client certificate. This message is only sent following any client ...
2
votes
3answers
178 views

Are Extended Validation certificates any more secure than regular ones?

Or are they just an attempt to get you to pay more money to a CA because it tells your browser to show the address bar in green with your organization's name? Also, what are the technical details ...
0
votes
1answer
139 views

Is it possible to create a SMIME only PKI that *can't* be used for SSL?

Assume I have a Root CA that I want to share with hostile untrusted 3rd parties. Then constrain this root using specific EKUs at the root. OID=1.3.6.1.5.5.7.3.4 ; Secure Email Next, ...
1
vote
2answers
162 views

SSL Server Certificate optional

In RFC 6101 (Of SSLv3), In page 22 ServerHello Certificate is marked with * which means optional or situation-dependent messages that are not always sent. It means that Certificate is optional in ...
2
votes
2answers
161 views

Authentication through digital certificates plus signature

While studying X.509 certificates, I've found that authentication is safer if I associate/combine one or more certificates with each signed message (certificate + signed message). The receiver of ...
2
votes
2answers
2k views

How does the SSL connection protocol work with self-signed certificate?

I'm using the self-signed certificate, but I don't know how this protocol works. I connect two apps with a socket SSL and it works fine. The server is a Python app and the client is an Android app. I ...
1
vote
1answer
127 views

Resign root CA as SUB?

Imagine I have a Microsoft root offline ca running since half year, but suddenly I want to include it in my company hierarchy, resigning it with the company official root, But I need both continue ...
1
vote
2answers
423 views

Security risk of Microsoft AD Certificate Services?

We have an internal CA server for our domain located at http://cert_srvr.local.domain/certsrv/certrqxt.asp. This server runs Microsoft Active Directory Certificate Services. When I went to the site,...
0
votes
2answers
450 views

What is the purpose of HTTPS GET vs POST requests when certificate pinning?

I have a mobile app which uses public key pinning to make sure that I only connect to servers from my CA. This works great with https, and it makes it so that nobody can really proxy my server and ...
1
vote
1answer
651 views

Mixing green (EV) ssl certificate with non EV certificate

We have a green (EV) SSL certificate for our site and images are fetched from the same domain (https). Currently we are planning to change the images domain (for performance issues) and put them in a ...
11
votes
3answers
3k views

Creating an X.509 certificate with an invalid signature

Creating an X.509 certificate with a valid signature with OpenSSL is pretty well documented all over the Internet. There are instructions on creating certificates that are signed by themselves and ...
2
votes
1answer
338 views

Certificate pinning in a browser

I am trying to understand certificate pinning. Google started adding a whitelist of CA certs that they use for their certificates and if a cert for a google service is issued outside of this list ...
1
vote
1answer
5k views

cURL cert validation with curlopt_cainfo not working

I want to validate my SSL certificate each time I run API calls. I've been following this guide: http://artur.ejsmont.org/blog/content/how-to-properly-secure-remote-api-calls-from-php-application ...
0
votes
1answer
339 views

Updating Root/Intermediate Certificates over NDES/SCEP

In attempts to setup our first instance of NDES/SCEP in the wild on Cisco routers we have run into a concern. Currently our organization has a three tier PKI. We have an AD CS server on the third ...
2
votes
3answers
143 views

How are public key certificates updated securely?

Let's say I get a new computer that's never been connected to the internet before. The first time I connect it to the internet, is it susceptible to a mitm attack while downloading its public key ...
9
votes
1answer
15k views

SSL certificate chain verification

After reading many articles and watching many tutorials I decided to be specific because there are some things about SSL certificate chain verification and SSL cetificate verification in general that ...
4
votes
1answer
180 views

Does SSH authorized_keys violate the principle of “re-authenticate before password change”?

It is generally accepted that password change mechanisms should ask the user for their old password (e.g. OWASP) The reason being that an attacker who has temporary access to a user's session (be it ...
0
votes
1answer
434 views

SSL decryption without installing a certificate on each client

Given a proxy performing MITM SSL decryption and inspection, is it possible to install a wildcard certificate (*.domain.com) on the proxy signed by a root CA (such as VeriSign or GoDaddy) such that ...
2
votes
1answer
201 views

Why does facebook php sdk (and multiple others clients) include CA bundle with a lot of CAs?

This is what facebook ships with their API php client: https://github.com/facebook/facebook-php-sdk-v4/blob/master/src/Facebook/fb_ca_chain_bundle.crt It contains dozens (hundreds?) Root CAs. But ...