A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
1answer
236 views

Is a self-signed SHA-1 certificate sufficient security for a company transmitting sensitive data?

We recently decided to pay an ISP (a substantial sum, mind) for a managed internet service up to and including the router in our head office. Part of the initial discussions made it clear that ...
1
vote
1answer
65 views

Possible to change the CA that a keypair is using?

Pretend I take the same CSR and send it to two different CAs as described in the following scenario: I create a CSR on Windows I submit the CSR and edit my SAN names. Request is pending at the CA ...
1
vote
2answers
1k views

Does Renewing SSL certificate change its thumbprint / Fingerprint

I would like to know, if renewing a SSL certificate will change my thumbprint? The certificate has expired. If it can be same then under what conditions can it remain same. Many thanks in advance.
1
vote
2answers
460 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
1
vote
2answers
301 views

Does a self-signed certificate offer more protection than a public key?

I'm having a hard time finding the practical benefits of transmitting a self-signed certificate over simply a public key. I understand that a self-signed certificate proves the integrity of the public ...
1
vote
2answers
174 views

SSL for only parts of a website… How does it work?

I understand that CAs issue certificates based on common names (CNs) like www.amazon.com and that certs are not based on URLs like www.amazon.com/stuff. How is it that when I go to www.amazon.com, it ...
1
vote
2answers
364 views

How do proxy servers protect their SSL certificates?

Suppose that there is a http proxy server outside the firewall of an organization hosting a web server. All client connections to the web server happen through this proxy. The client negotiates SSL ...
1
vote
2answers
102 views

Mechanisms to offer inexpensive https to all second level .wiki domains

I'm working with the registry for .wiki, a new generic top level domain set for public availability in June 2014. We're going to be giving away hosted wikis to registrants of .wiki domains and I'd ...
1
vote
3answers
362 views

Using public/private key without signed certificate

I am working on a java program and I am now working on its network security. I want to use a secure connection since it transfers a lot of sensitive information. On all security guides it is mentioned ...
1
vote
1answer
709 views

Server not requesting for certificate in SSL handshake

I have one windows service and web service trying to make a web service call over TLS. I have setup the certificates in MMC and I am able to successfully connect using the web service. However, when ...
1
vote
2answers
138 views

non-MiTM Reverse SSL

Do non-MiTM Reverse SSL Proxies exist? Or do all proxies that do SSL-SSL mappings decode and then re-encode HTTPS traffic? If this is the case and I want to map https://mypublicdomain.com -> ...
1
vote
1answer
575 views

x509: must the signature algorithm and public key algorithm match?

I'm having trouble getting Firefox to send an encrypted message using a certificate, and I've found that the only difference between this one and others that work fine are that this one has a DSA ...
1
vote
2answers
2k views

How to test for OCSP?

I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?
1
vote
2answers
369 views

certificate based network authentication

In certificate based network authentication, is the user tied to just the system the certificate has been installed on such that if he tries to authenticate using another system access is denied?
1
vote
1answer
883 views

Behavior when validating an expired certificate chain

I have the following situation: A server certificate (CServ) is signed by self-signed certificate (C0) A client certificate (CCli) is signed by CServ Client's trust-store contains C0, so the client ...
1
vote
1answer
440 views

What makes a secure smartcard secure? Is contactless/RFID better?

In short what security features exist that I should look for in a smart card? What physical features exist, which are important? It appears smart cards may exhibit different levels of wear and ...
1
vote
5answers
83 views

Best Option for SSL Certificate for 2 Domains + All Subdomains

I am hosting multiple websites on my Mac Mini server (latest version). For some reason OS X server does not support multiple SSL certificates well for websites, and after hours on the phone with ...
1
vote
2answers
25 views

Mandadory checks a client should make to verify a ssl/tls certificate [duplicate]

Let's say I have a client, not a browser, that wants to connect with https to a server. It could be a python program, an android app or a library etc. Suppose the client has a list of trusted CAs and ...
1
vote
1answer
25 views

SSL certificates for a mixture of subdomains and top level domains [closed]

In order to provide https-enabled access to several (e.g. around 5) subdomains and several top level domains on different IPs. Which of the following approaches is technically feasible? a one-use ...
1
vote
2answers
58 views

What are the steps to take after adding an invalid certificat authority?

in order to pay my bills online internet , I have to go through the website for my internet provider , type the login and password then I redirect to a page your connection is not private i proceed to ...
1
vote
1answer
16 views

Conditions for reusing client certs in TLSv1

In my setup I am using client certs, and the client devices are iPhones running iOS 9.0. In comparing some network traces I noticed that in some cases, the server asks for the client certificate for ...
1
vote
1answer
60 views

ECDSA implicit certificate using OpenSSL

I am trying to generate implicit ECDSA certificate only for signing and verification using OpenSSL. I tried google but I am getting many research papers. I understood that A messages need to be signed ...
1
vote
1answer
115 views

What can a trusted certificate do?

I am doing some reading about security on mobile applications because I found an article about Man in the Middle Attacks. I saw in that article and in many other places (including ...
1
vote
1answer
165 views

SHA2 certificate and TLS cipher suites compatablity

I have a server which is configured to use TLS 1.0, 1.1 and 1.2. The server is configured with a certificate siged by SHA-512. The server supports only these cipher suites: • ...
1
vote
2answers
83 views

Application that uses USB token to assign user on a server

I have the following situation: One user with a USB token certificate access a site and log-in using this certificate, the logging process ask for the USB token password; When the user is logged he ...
1
vote
1answer
79 views

Are fields of a root CA certificate checked?

During SSL server validation, it seems that the only fields of X509 certificates found in trust stores that are actually used are the "Common Name" and the "Public Key". I'm not talking about any ...
1
vote
1answer
36 views

Prevent credential roaming for certain accounts/certificates?

I want to use credential roaming in Windows 7, 8 and 10 for EFS certificates, so users can access their encrypted files from any computer they login to. However, some of these users will also have ...
1
vote
1answer
63 views

How to read certificate chains in OpenSSL

I'm trying to understand how to read the output of OpenSSL commands. Currently, I am trying to understand how Certificate Chains work. When I give the command (using a standard ca bundle) openssl ...
1
vote
2answers
115 views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey ...
1
vote
1answer
42 views

Find the Encryption Key (used for network encryption) assuming a Trust Chain is being used on Windows?

If I double click on a .crt file, in Windows, I'm presented with three tabs General, Details, and Certification Path. I'm aware that the Certification Path tells you the details of which root and ...
1
vote
1answer
39 views

If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them?

Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head: Let's say that I decide to ...
1
vote
2answers
142 views

Will a wildcard SSL work properly for an A record subdomain pointing to another domain/website?

Client has wildcard SSL for his domain/subdomains. The application we are building is on one of our linux servers using one of our IP addresses and is contained within an account named ...
1
vote
1answer
1k views

How to know if certificate is self-signed

How do I find out if a certificate is self-signed or authorized by CA? Somewhere I read that self-signed subject and issuer will be same, is it correct?
1
vote
1answer
197 views

Extract public information from p12 without having the password

I know this question was already asked here but unfortunately there are no satisfactory answers. Please correct me if I'm wrong, but if I have a p12 file the following two situations are possible: ...
1
vote
1answer
351 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
1
vote
1answer
554 views

Create PKCS7 signature, signed by X.509 CA, which embeds an XML file

I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within. How to do that with OpenSSL or any other tool?
1
vote
2answers
78 views

Website Certificate with different public key

I've installed a ssl certificate from https://www.startssl.com/ in a server running with plesk. The website is the following: https://refood.sal-pimenta.pt/ As you can see the certificate is fine but ...
1
vote
1answer
668 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
1
vote
2answers
261 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
1
vote
1answer
90 views

Multi-Function SSL Digital Certificate

Is there a problem with using a single SSL certificate for both SSL/TLS/HTTPS communication as well as to sign (external) digital timestamp certificates? Other than the obvious: if one key is ...
1
vote
1answer
507 views

Machine Certificate Key File Artifacts

When a new machine certificate is imported with a private key a MachineKey file is generated in "%ProgramData%\Microsoft\Crypto\RSA\MachineKeys". When using the certificate mmc snapin or removing a ...
1
vote
1answer
97 views

What is public key pinning [closed]

How does public key pinning work and what problem does it solve?
1
vote
1answer
7k views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
1
vote
1answer
261 views

Does client certificate do any encryption in https connection? [duplicate]

In Https connection asymmetric encryption (with Server certificate) is used during handshake and to create symmetric keys. Am I right that in this case client certificate does no encryption? The ...
1
vote
2answers
131 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
1
vote
2answers
896 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
1
vote
2answers
196 views

Is it Possible to use one commercial SSL Certificate to issue end user certs?

My organization is preparing to purchase some 50 "units" from Symantec, with which we can purchase Verisign SSL certificates of varying authentication levels. Our organization does not have--but ...
1
vote
1answer
720 views

Questions about self-signed Certificates' Fingerprints and Client-Server Interaction through SSL

I have some questions about how the fingerprint function is performed. First of all, I have some knowledge about cryptography. However it seems to do not be good enough to understand hundreds of ...
1
vote
1answer
179 views

What should a client verify after getting a client certificate?

I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String. the String is then decoded to a x509Certificate (using Bouncycastle's ...
1
vote
3answers
638 views

Multiple SSL server certificates

I am sort of new to SSL. During a SSL connection establishment, I see that the server is sending multiple certificates. Can someone help me to understand why the server is sending multiple ...