A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
1answer
195 views

Secure way to pass client certificate to the client2

Our product is comprised of two servers. We would like to authenticate one server to the main server by means of client certificate. I assume that we should ask the customers (who purchase the ...
0
votes
1answer
320 views

What is the difference between openssl and mkcert and IIS self signed certificate

What is the difference between openssl and mkcert. Which one should I prefer. I want to create an IIS hosted WCF service. Which one should I use to create an SSL certificate. Also, there is another ...
0
votes
2answers
889 views

Modifying SSL Certificate once created, Multi domain

We're developing an application that has the ability to run across multiple top level domains, each with its own sub domain. (www.foo.com, www.bar.com, would each point to the same application on the ...
0
votes
1answer
78 views

Certificate for Email Encryption and signing

I don't understand the flow of Digital Certificate with Email Encryption and Signing. For Example, There is 2 users, Sender A and Receiver B. Is Certificate required to encryption to A or just ...
0
votes
2answers
2k views

Digital Certificate “Signature and Fingerprint”

What's the difference between Digital certificate's signature and fingerprint (thumbprint) ? I know that Signature: The actual signature to verify that it came from the issuer. and Thumbprint ...
0
votes
1answer
49 views

Relationship between SSL cert database and that at the CA site

Say I am using a trusted third party CA site to manage my cert. I created a new cert called CertA at the CA web interface, downloaded the signed cert and use it on my web server. Some time later I ...
0
votes
1answer
111 views

What to do in case of a weak certificate on my bank's website?

My bank's website, while always having had a 'green lock' in the address bar doesn't have this anymore. I then called the bank with a phone number I found on the same website, and asked that the ...
0
votes
3answers
116 views

Conflict between cipher-suite and certificate

When capturing my SSL session (using Chrome) I have noticed that the server chose TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) as the cipher-suite and the certificate signedcertificate signature ...
0
votes
2answers
62 views

How to identify which root CA does the client certificate use?

How can we identify which root CA client used when there are multiple root CAs on the server? We can compare the public keys of the client certificate and the root certificate but if we have many ...
0
votes
2answers
59 views

Sniffing TLS / SSL through HSTS?

Imagine the following: Client C wants to communicate with server S. The evil attacker A is the Man-In-The-Middle. C sends a request to S, A intercepts it. A creates a self-signed certificate with ...
0
votes
1answer
86 views

“Transferring” SSL certificate to another person [closed]

Last year, I did a lot of work on a site as a freelancer. We wanted to put the whole thing behind HTTPS, so, for reasons I can't recall but probably expediency-related, I purchased a cert for it under ...
0
votes
3answers
129 views

In order to trust the digital certificate, does immediate CA cert also needs to be in trust store or root CA cert is enough?

In order to trust the digital certificate, does immediate CA certificate also needs to be in trust store or root CA certificate is enough?
0
votes
1answer
133 views

What does this mismatching SSL certificate hint at?

I'm currently visiting China, and I use a well known VPN service for both my laptop and my phone. Every now and then, I get certificate errors when using my phone when I'm connected to a VPN, but ...
0
votes
1answer
56 views

generate certificate at runtime and validate

I have a project that require client application to register and then use the services. I would like to do the following: A client app sends a request with IP, domain name, etc. to my REST service ...
0
votes
1answer
262 views

How to make a decent Certificate Signing Request (CSR)?

I'd like to know how to make a decent Certificate Signing Request (CSR) to secure my website and e-mail with a wildcard SSL certificate. With recent exploits as POODLE on SSLv3 and such, I'd like to ...
0
votes
1answer
404 views

Isn't this a broken certificate chain?

My certificate provider responded to my CSR with four certificates, the first being "ours", and the remaining three presumably to build a chain of trust. I've never had to investigate (and prove to ...
0
votes
1answer
51 views

Can an end-entity certificate with SHA-1 be issued by an intermediate CA that has SHA-256?

Just curious - if I'm using an end-entity (leaf) certificate that has a SHA-1 signature, does that mean that ALL certificates in the chain also must use SHA-1?
0
votes
1answer
604 views

PDF Digital Signature [closed]

I got free certificate from Comodo and installed on my Windows. Now I'm trying to sign PDF document using this certificate, but get message: "signature validity is unknown": Why is this? How I can ...
0
votes
2answers
165 views

How to encode a username in PKIX certificate?

I was reading through RFC 5280, PKIX Certificate and CRL Profile, Section 4.2.1.6, Subject Alternative Name: The subject alternative name extension allows identities to be bound to the subject ...
0
votes
1answer
1k views

x509 serial number - hex or decimal

When I run the openssl command openssl x509 -noout -text -in certname on different certs, on some I get a serial number which looks like this. Serial Number: 256 (0x100) On others, I get one ...
0
votes
2answers
287 views

What is the purpose of HTTPS GET vs POST requests when certificate pinning?

I have a mobile app which uses public key pinning to make sure that I only connect to servers from my CA. This works great with https, and it makes it so that nobody can really proxy my server and ...
0
votes
2answers
3k views

PHP encrypt and decrypt with certificate

I am trying to think of the best way to encrypt and decrypt a message between two servers. I have found a lot of examples where people simply use a secret and PHP's mcrypt... ...
0
votes
1answer
3k views

Why IE/Windows forces you to install self-signed certificates as root CA to make them work?

In old versions of IE/Windows you could install a self-signed certificate for a web site and it just worked: the warnings disappeared. In more recent versions (and with Chrome) this just didn't work. ...
0
votes
2answers
730 views

OpenID without SSL certificate

Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed? Just to make things clear, ...
0
votes
1answer
53 views

Certificate validation Local DNS hosts file

I've a question regarding a certificate validation error I'm getting. I'm performing an https request from one machine to another (windows machines). On the destination machine I've configured a ...
0
votes
1answer
105 views

Analyzing a TLS connection?

Suppose I want a secure TLS communication between me and myschool.edu. Which of the following should I trust to preserve confidentiality, integrity, and authenticity. Here are the options and my ...
0
votes
1answer
107 views

Can I use a CA certificate for two ways (mutual) authentication

I cannot get an answer from a CA company for this question. I have to implement two ways SSL authentication between my server and my users computers. Users should access to my several API securly. I ...
0
votes
1answer
230 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
0
votes
1answer
377 views

How to generate self-signed EV SSL Certificate?

I configured XAMPP / Windows on my laptop so that this URL: https://www.supersite.com/ points to XAMPP / localhost rather look elsewhere. I basically generated a self-signing certificate, imported ...
0
votes
3answers
92 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...
0
votes
1answer
147 views

Begin of Certificate/ End of Certificate dash “-----”

What significance does the dash "-" holds along with the line -----BEGIN CERTIFICATE----- or -----END CERTIFICATE-----. I checked multiple docs and linked RFC's as well but could not find the ...
0
votes
3answers
178 views

Do all non-CA certs have to be End Entity certs?

Still learning the differences between certs. Can someone explain? The internet has so far been surprising not lucid in describing certificates. *EDIT to clarify EE
0
votes
1answer
92 views

Is digital certificate with 'issued to' field as *.example.com valid?

Came across a Digital Certificate which has issued to field *.example.com Is this a valid certificate?
0
votes
1answer
149 views

MITM faking certificates

I am looking at the theory behind MITM attacks in order to see some unencrypted packets from the 3DS. From research here is what I understand so far: 3DS > Proxy > Nintendo server I am going to try ...
0
votes
2answers
112 views

Why does IP address need to be listed as a DNS name in SAN/UCC certs?

I have heard that when creating a CSR that if you want to validate an IP address that you should list the IP as a "DNS" name and not "IP Address". I have actually had to re-create CSR's like this to ...
0
votes
1answer
84 views

What is public key pinning [closed]

How does public key pinning work and what problem does it solve?
0
votes
1answer
287 views

Can anyone with access to root CA private key decrypt HTTPS traffic?

Can anyone with access to root CA private key decrypt HTTPS traffic of sites using certificate signed by that CA ? and if yes do he need to be man-in-the-middle or just monitoring traffic is ...
0
votes
1answer
145 views

What would cause a server to only send over 1 SSL certificate to a client? [closed]

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
0
votes
1answer
283 views

Reverse proxy sharing one certificate for multiple servers using Subject Alternative Name

The following is a scenario for an attack where one website can impersonate another. I am told (including by this answer) that it's impossible, but I would like to understand exactly what prevents it. ...
0
votes
1answer
132 views

Windows - Revoked Binaries

I find it hard to believe that the majority of Windows system files aren't signed. I don't know whether my disbelief comes from naivety, or because Windows is used within secure environments worldwide ...
0
votes
1answer
201 views

Save to setup localhost.example.com to test wildcard SSL?

I have a domain with a wildcard SSL certificate (i.e. "*.example.com"). I also develop using WAMP setups, which I would like to be able to test HTTPS on. There are several tutorials on how to setup a ...
0
votes
1answer
642 views

Security weaknesses in using RSA encrypted MD5 hash of certificate content

Suppose you have an Internet banking site based on a secure web server running the HTTPS protocol via port 443. The server authenticates itself to clients through an X.509 certificate signed by a ...
0
votes
1answer
4k views

RESTful web service and SSL certificate

We have a server that provides RESTful services to our application server. It runs on Amazon Elastic Beanstalk and mapped with a domain name and SSL certificate registered at GoDaddy. It ran ...
0
votes
1answer
3k views

Verify Certificate is revoked by CRL

I set up a CA and signed some cert request. I revoke them by: openssl ca -config config.cnf -revoke cert.pem I update CRL by: openssl ca -config config.cnf -gencrl -out crl/crl.pem ...
0
votes
1answer
198 views

Certificate request - why does the requester have to create a private key?

If remember right, then before I send a CSR (Certificate signing request) to the CA, I have to create private and public keys. Then I use the public key to encrypt my personal details before I send ...
0
votes
1answer
74 views

Downloading list of pinned certificates

I'm thinking about implementing certificate pinning in a mobile app. The app will need to connect to several secure sites. Rather than having to update the app every time one of their certificates ...
0
votes
1answer
423 views

Accepting an untrusted security certificate?

What is the risk of accepting an untrusted site security certificate in your browser if you're not entering any data, but merely browsing the site?
0
votes
1answer
565 views

Is it safe to accept the security certificate from AOL chat? [closed]

Is it safe to accept the security certificate from AOL chat? Did they recently change their certificates? These images are from Pidgin.
0
votes
1answer
118 views

Different certificate information for the same website?

Apologies for the funny title, I'll try to give a better explanation here :) I have just noticed something weird with regards to a website certificate: if I go to https://www.anobii.com/login using ...
0
votes
1answer
323 views

Advantage Mutual authentication over PSK [duplicate]

I have a client - server setup with TLS communication. I want to be sure of mutual authentication. The safety that certificates can offer assumes that the private key that links to the certificate ...