A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

6
votes
1answer
921 views

How do I learn Cryptographic/Mathematical notation

I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation. How do I learn this notation and how to convey my approach? How can I annotate this ...
5
votes
1answer
224 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
4
votes
3answers
654 views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
3
votes
3answers
884 views

Self signed certificates for https

Where I work, currently for internal sites, self signed certificates are being used. In Firefox, the info regarding the certificate are displayed: site domain: example.com Owner: Site doesn't supply ...
2
votes
1answer
282 views

Security Certificates - Tools to Generate Security Certificates

I want to create a self-signed certificate that will be installed as a trusted certificate authority. I then want to create another two certificates which are signed using the private key of the ...
2
votes
3answers
10k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
1
vote
3answers
169 views

Where can I find all SSL CA certificates

I am working on an SSL implementation project and ofcourse I need to verify the certificate presented by the server. To do that I need CA certificates or at least root CA certificates (correct me I am ...
0
votes
1answer
61 views

Secure way to pass client certificate to the client2

Our product is comprised of two servers. We would like to authenticate one server to the main server by means of client certificate. I assume that we should ask the customers (who purchase the ...
15
votes
1answer
3k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
37
votes
4answers
30k views

What certificates are needed for multi-level subdomains?

I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy. Here's what I need to secure: ...
25
votes
5answers
11k views

Where to get an SSL certificate for personal website?

I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
21
votes
4answers
82k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
17
votes
1answer
98k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
14
votes
2answers
20k views

Advantages of client certificates for client authentication?

I'm no security expert, so please just ask in a comment if I haven't made my question clear enough for an answer. The Scenario We have a server running WCF services, and a number of clients ...
16
votes
4answers
6k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
15
votes
2answers
15k views

Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”

I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain. ...
9
votes
4answers
15k views

Recommendations for a Certificate Management tool for Linux [closed]

A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients. This creates a new challenge to manage all these certificates and ...
16
votes
3answers
2k views

What happens when an Intermediate CA is revoked?

Currently I'm working on a certificate manager that allows our product to securely connect to remote webservices (over TLS/SSL). For security, we use Certificate Revocation List checking (or ...
14
votes
3answers
233 views

Domain name expiration and TLS

If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
11
votes
2answers
2k views

Is Apple's push notification service implementation vulnerable to a MitM attack

Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2 Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf ...
17
votes
3answers
3k views

Is SHA1 weak for SSL?

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
10
votes
2answers
1k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
7
votes
4answers
889 views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
7
votes
1answer
2k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
4
votes
3answers
4k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
23
votes
1answer
2k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
14
votes
2answers
1k views

SSL fingerprint inconsistency: what does it mean?

I apologize if this is not the best place to ask my question on the stackexchange network, I couldn't figure out where to get enough attention and be relevant. Facebook provides a SSL host, it can be ...
11
votes
5answers
1k views

Why is this certificate valid for so many domains?

If you look at the (invalid) certificate for https://i.imgur.com/ it says only valid for the following names: The certificate is only valid for the following names and then a list of about 100 names. ...
8
votes
2answers
504 views

How is an HTTPS login secure when pages use HTTP?

When someone go to eBay's website, they use an unencrypted connection between their PC and eBay's server. If they sign in, they are redirected to a secure site identified by its certificate and may ...
7
votes
2answers
1k views

Is “Fingerprint Check” enough to verify HTTPS certificates?

So I'm at place A, see this sign: and I'm writing the fingerprints to a piece of paper (this website is just an example): Ok. Then, I go to place B (other country, etc.) then I check this ...
5
votes
2answers
2k views

Dealing with expired or revoked signing certificates with Infopath documents

Suppose I have an Infopath form that is digitally signed today by a valid, and active user. When that user leaves the company, we disable the account and revoke the certificate. This causes a problem ...
4
votes
4answers
2k views

Is it possible to create a self signed certificate authority?

Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious. To explain my question : Suppose I sign a public ...
4
votes
1answer
3k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
18
votes
3answers
8k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
13
votes
3answers
1k views

Multi-tenancy, SSL Certificates, and Subject Alternative Name

The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension. From the spec: The subject alternative name ...
10
votes
1answer
373 views

Why can the validity of an SSL certificate exceed the registration period of a domain?

I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
9
votes
2answers
4k views

SSL Certificate revocation check

In the SSL protocol I don't see where the certificate is checked for revocation status. https://developer.mozilla.org/en/Introduction_to_SSL Is the Certificate Revocation and Status Checking not ...
8
votes
2answers
2k views

Obtaining an S/MIME certificate without disclosing my private key to the TTP

I would like to obtain a trusted S/MIME certificate, but all the certificate authorities I have asked so far generate the keypair on their server, sign the certificate and send me both the private key ...
7
votes
1answer
5k views

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
6
votes
1answer
968 views

Choosing an SSL certificate provider

Does it make any difference which provider I get my SSL/TLS certificate from? In particular, what are the pros and cons getting an SSL certificate from Verisign vs getting one from Thawte? Which one ...
6
votes
2answers
2k views

OCSP and CRLs: Specified in CA or client certificate?

Here's an example PKI setup: * Root CA (offline) * Issuing CA * Client 1 * Client 2 I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
5
votes
2answers
779 views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
4
votes
1answer
2k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...
3
votes
2answers
2k views

How to go about an ssl certificate renewal

I've got an ssl certificate from godaddy, and it's time to renew. I ended up with a single "keystore" file, which I give to my webserver (jetty). This is the process I went through to generate the ...
3
votes
1answer
1k views

Purpose of certificates signed and trusted by CA

Another newbie question but I just don't get the purpose of certificates signed and trusted by CA. We already have public/private keys, hash functions to sign/encrypt messages so why do we need ...
1
vote
3answers
2k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
14
votes
4answers
1k views

Is my Company Tracking Me?

Every time I try to connect to a site through HTTPS from my office computer, there is a Certificate Error thrown 2-3 times before showing the login screen. Till now I use to ignore this and click ...
11
votes
1answer
2k views

Renewing Microsoft Certificate Services Root Certificate

We currently have Microsoft Enterprise Certificate Server installed on a domain member machine which issues 1 year certificates to users for authenticating to VPN. We'd like to start issuing web ...
7
votes
2answers
677 views

security of PKI, Certificates, certificate authorities, forward secrecy

I want to understand how certificates add to the security of information exchange. Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
6
votes
4answers
1k views

How to prove Bob has received Alice message

I have read up on Digital signature and it is stated that it provides non-repudation. Assuming Alice signs the message using her private key and sends it to Bob, Bob can use Alice's public key to ...