A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

3
votes
1answer
2k views

My S/MIME certificate (created with OpenSSL) does not match my email address

I created a certificate with OpenSSL and following commands: openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=hostname' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem ...
3
votes
2answers
169 views

Teaching security concepts

I think it would be nice to teach security concepts by giving practical examples. I am looking for some practical cases for x509 certificates, kerberos and SET. How could I know an ecommerse site ...
6
votes
1answer
5k views

Getting a Root CA accepted in systems and browsers

I would like to ask about the procedures for a given CA to get one of its root CAs (SSL issuance CA) to get accepted and installed as a trusted root CA in operating systems and browsers.
2
votes
1answer
514 views

Does client certificate authentication demand more server-side entropy?

We have a secure web service running Apache that requires client certificates for access. This service has a problem with running out of entropy. We have several other sites that use TLS that get ...
2
votes
1answer
126 views

CSR generation origin?

Platform: Windows 7 x64 Development: .NET 4 Web Server: HttpListener (IIS not installed, will not be installed :) ) Can Machine A generate a Certificate Signing Request for Machine B and have the ...
2
votes
3answers
197 views

What is the worse that could happen if a government wanted to interfere with a CA?

In our time of SOPA, PIPA and ACTA, I was wondering what could happen if a government wanted to remove the certificate of a website ? CA are companies, so they would have to obey to instructions from ...
4
votes
1answer
1k views

X.509 algorithm identifier parameters vs. extension values

From the X.509 specs: AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } ...
3
votes
1answer
1k views

Why doesn't asn1parse parse all DER encoding strings?

I have a file - crl.txt - that contains the following: MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw= It's from one of the extensions in a particular X.509 cert. Why ...
7
votes
1answer
3k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
3
votes
1answer
562 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: ...
7
votes
3answers
296 views

Would using distinct IP addresses help support browsers with older SSL implementations?

We have a site with two wildcard certificates: *.foo.com and *.bar.foo.com. All of our subdomains resolve to the same IP address. Newer browsers work fine with this, but IE7, for example, does not. ...
51
votes
4answers
45k views

What certificates are needed for multi-level subdomains?

I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy. Here's what I need to secure: ...
3
votes
1answer
1k views

parsing the id-ce-keyUsage extension in X.509 certs

I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows: ...
8
votes
2answers
2k views

OCSP and CRLs: Specified in CA or client certificate?

Here's an example PKI setup: * Root CA (offline) * Issuing CA * Client 1 * Client 2 I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
12
votes
5answers
5k views

Does HTTPS Everywhere defend me against sslsniff-like attacks?

http://www.thoughtcrime.org/software/sslsniff/ If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
5
votes
4answers
443 views

What fields in a suspicious certificate should I look at?

Looking at a certificate for a web-site (in Windows/Google Chrome) I see it lists the following fields Version Serial number Signature algorithm Issuer Valid from Valid to Subject Public Key Basic ...
7
votes
1answer
4k views

Should I regenerate new SSL private key yearly? [duplicate]

Im' renewing my certificate every year. Since I have to make a CSR, should I also renew my key pair at the same time, or is it ok to get a new cert with the same key ? Please supply any security ...
5
votes
1answer
25k views

How to use OpenSSL generated keys in Java?

I have my pair of Public and Private keys and my certificate. Those where created in OpenSSL (why? because I was asked to do it in OpenSSL). Now I want to use those things to make a Java app that ...
5
votes
3answers
8k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
5
votes
2answers
773 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
6
votes
3answers
402 views

On-line cryptographically signed date/time?

I’m looking for a source of on-line cryptographically signed date/time. I do not need a full timestamp service, as I am happy with the information « date/time was that », without a link to a ...
8
votes
1answer
259 views

Why are website certificates secure?

I understand how HTTPS connections work, and I also understand they they require a certificate to know that the secure connection you have is with the right server (and not someone pretending to be ...
3
votes
1answer
1k views

Purpose of certificates signed and trusted by CA

Another newbie question but I just don't get the purpose of certificates signed and trusted by CA. We already have public/private keys, hash functions to sign/encrypt messages so why do we need ...
6
votes
2answers
965 views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
8
votes
4answers
2k views

Why is it a good idea that X.509 digital certificates have an expiry date?

What is the benefit of having certificates expire at some fixed date?
2
votes
2answers
670 views

How to make a certificate encrypted flash drive?

I was wondering if it possible to encrypt a flash drive (or any other external medium) using certificates instead of a password. The idea is to have a number of encrypted pendrives that can be used on ...
17
votes
7answers
9k views

How do I check if a gmail/gtalk SSL certificate is valid?

Pidgin started prompting me to accept/reject new gtalk SSL certificate a few days ago and I am not able at the moment to tunnel the traffic to check if it would continue to happen or if it wouldn't ...
9
votes
2answers
365 views

Why is there no Domain CA?

I was asked to deliver a signed SSL certificate for an IIS server for a client. I have previously done this for the same client/domain before, so it start to seem like an unnecessary expense to hold ...
23
votes
2answers
3k views

Digital Certificate deployment: using two certs for each user?

At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs: One for signing documents, emails, etc. that is ...
21
votes
3answers
31k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
5
votes
3answers
308 views

Are SSL certificates from a CA necessary for secure communication?

Am I right in thinking that SSL certificates from a CA are purely for identification purposes and serve no purpose in the actual encryption of data? In other words if I were to create a self signed ...
21
votes
3answers
11k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
6
votes
3answers
2k views

How and when should I use OpenSSL for IT Security? How do I understand the output?

I'm discovering OpenSSL, and already used it to diagnose a faulty SMTP TLS connection, but I'd like to get a better / full understanding of the tool and how to use it. What resources should I use ...
52
votes
5answers
39k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
25
votes
2answers
15k views

What are the risks of self signing a certificate for SSL

Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
19
votes
4answers
22k views

how digital signature verification process works

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
7
votes
3answers
261 views

Limiting the root certificate chain

I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
4
votes
2answers
743 views

How practical is a certificate's “basic constraint” property in protecting my HTTPS / SSL session?

Suppose a leaf node creates a certificate for a different domain, acting as a CA. Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be ...
2
votes
2answers
172 views

How can I force certain the webclient to honor or remember certain parameters from the webserver?

HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...
4
votes
1answer
805 views

What is the impact of certificate validation level (or class) on deployed web applications?

Certificates can have a class level (or validation level). What is the impact of these levels on deployed web applications? More specifically: Is the certificate level included in the certificate ...
3
votes
2answers
648 views

Inspecting a TLS Certificate to determine RSA Key Usage restrictions

With regard to this answer, I have a question about Key Usage in an SSL certificate. Most SSL server certificates have a RSA key which is not restricted through a Key Usage extension, so you can ...
4
votes
1answer
356 views

How secure is a https website? [duplicate]

Possible Duplicate: Does an established ssl connection mean a line is really secure When I visit a website -- say, https://ebanking.pick-your-bank.com -- my browser (fully patched version ...
1
vote
3answers
912 views

Benefits to using EV certificates with a privately hosted Certificate Authority

For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate? Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the ...
25
votes
5answers
23k views

What ciphers should I use in my web server after I configure my SSL certificate?

There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list. ...
14
votes
4answers
1k views

Is my Company Tracking Me?

Every time I try to connect to a site through HTTPS from my office computer, there is a Certificate Error thrown 2-3 times before showing the login screen. Till now I use to ignore this and click ...
12
votes
4answers
21k views

Recommendations for a Certificate Management tool for Linux [closed]

A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients. This creates a new challenge to manage all these certificates and ...
3
votes
2answers
152 views

Need an overview of web service / web site security world, where do I start? [duplicate]

Possible Duplicate: Resources to learn about security I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and ...
6
votes
3answers
409 views

Why are CA's signing keys available on the internet

I am not very knowledgeable about CA certificates, but I thought these things mainly said "The public key for bank X is Y, and this is verified by CA Z". Once you've bought this certificate, there is ...
11
votes
4answers
2k views

Multiple CAs signing a single Cert/CSR?

Just saw this suggested on Slashdot So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
8
votes
6answers
2k views

I see two different sets of certificates for Google websites when I am at work and when I am at home

I see two different sets of certificates for Google websites when I am at work and when I am at home. I mean if I save the certificates (in firefox, click on the "Google.com" block on the left of ...