A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

4
votes
1answer
3k views

Which extensions to use for a S/MIME certificate?

Analogously to the SSL server certificate question, which extensions should I use for S/MIME, and should the CA be restricted somehow as well? (I'm using openssl, which at the moment creates CA and ...
3
votes
1answer
1k views

What are the Netscape Cert Type attributes? Why/when are they needed?

What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions? Example: There is the Client/Server Extended Key Usage (X.509) but there is ...
6
votes
1answer
1k views

How do I learn Cryptographic/Mathematical notation

I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation. How do I learn this notation and how to convey my approach? How can I annotate this ...
5
votes
1answer
235 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
4
votes
3answers
928 views

Self signed certificates for https

Where I work, currently for internal sites, self signed certificates are being used. In Firefox, the info regarding the certificate are displayed: site domain: example.com Owner: Site doesn't supply ...
4
votes
3answers
693 views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
2
votes
1answer
311 views

Security Certificates - Tools to Generate Security Certificates

I want to create a self-signed certificate that will be installed as a trusted certificate authority. I then want to create another two certificates which are signed using the private key of the ...
2
votes
3answers
11k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
1
vote
3answers
206 views

Where can I find all SSL CA certificates

I am working on an SSL implementation project and ofcourse I need to verify the certificate presented by the server. To do that I need CA certificates or at least root CA certificates (correct me I am ...
15
votes
1answer
3k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
40
votes
4answers
34k views

What certificates are needed for multi-level subdomains?

I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy. Here's what I need to secure: ...
17
votes
1answer
108k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
25
votes
5answers
12k views

Where to get an SSL certificate for personal website?

I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
21
votes
4answers
92k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
54
votes
4answers
6k views

Why was the private key of the Superfish certificate so easily extractable?

Robert Graham detailed on the Errata Security blog how he was able to get the private key of the Superfish certificate. I understand that attackers can now use this key to generate certificates of ...
16
votes
2answers
22k views

Advantages of client certificates for client authentication?

I'm no security expert, so please just ask in a comment if I haven't made my question clear enough for an answer. The Scenario We have a server running WCF services, and a number of clients ...
15
votes
2answers
16k views

Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”

I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain. ...
19
votes
4answers
6k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
10
votes
4answers
17k views

Recommendations for a Certificate Management tool for Linux [closed]

A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients. This creates a new challenge to manage all these certificates and ...
16
votes
3answers
2k views

What happens when an Intermediate CA is revoked?

Currently I'm working on a certificate manager that allows our product to securely connect to remote webservices (over TLS/SSL). For security, we use Certificate Revocation List checking (or ...
14
votes
3answers
237 views

Domain name expiration and TLS

If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
12
votes
2answers
3k views

Is Apple's push notification service implementation vulnerable to a MitM attack

Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2 Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf ...
17
votes
3answers
3k views

Is SHA1 weak for SSL?

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
10
votes
2answers
1k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
7
votes
4answers
955 views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
7
votes
1answer
2k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
4
votes
3answers
5k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
23
votes
1answer
3k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
14
votes
2answers
1k views

SSL fingerprint inconsistency: what does it mean?

I apologize if this is not the best place to ask my question on the stackexchange network, I couldn't figure out where to get enough attention and be relevant. Facebook provides a SSL host, it can be ...
11
votes
5answers
1k views

Why is this certificate valid for so many domains?

If you look at the (invalid) certificate for https://i.imgur.com/ it says only valid for the following names: The certificate is only valid for the following names and then a list of about 100 names. ...
8
votes
2answers
1k views

Is “Fingerprint Check” enough to verify HTTPS certificates?

So I'm at place A, see this sign: and I'm writing the fingerprints to a piece of paper (this website is just an example): Ok. Then, I go to place B (other country, etc.) then I check this ...
8
votes
2answers
533 views

How is an HTTPS login secure when pages use HTTP?

When someone go to eBay's website, they use an unencrypted connection between their PC and eBay's server. If they sign in, they are redirected to a secure site identified by its certificate and may ...
6
votes
2answers
834 views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
5
votes
1answer
3k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
5
votes
2answers
3k views

Dealing with expired or revoked signing certificates with Infopath documents

Suppose I have an Infopath form that is digitally signed today by a valid, and active user. When that user leaves the company, we disable the account and revoke the certificate. This causes a problem ...
4
votes
4answers
3k views

Is it possible to create a self signed certificate authority?

Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious. To explain my question : Suppose I sign a public ...
19
votes
3answers
8k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
14
votes
3answers
2k views

Multi-tenancy, SSL Certificates, and Subject Alternative Name

The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension. From the spec: The subject alternative name ...
10
votes
1answer
384 views

Why can the validity of an SSL certificate exceed the registration period of a domain?

I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
9
votes
1answer
269 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
9
votes
2answers
4k views

SSL Certificate revocation check

In the SSL protocol I don't see where the certificate is checked for revocation status. https://developer.mozilla.org/en/Introduction_to_SSL Is the Certificate Revocation and Status Checking not ...
8
votes
2answers
2k views

Obtaining an S/MIME certificate without disclosing my private key to the TTP

I would like to obtain a trusted S/MIME certificate, but all the certificate authorities I have asked so far generate the keypair on their server, sign the certificate and send me both the private key ...
7
votes
1answer
6k views

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
7
votes
2answers
719 views

security of PKI, Certificates, certificate authorities, forward secrecy

I want to understand how certificates add to the security of information exchange. Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
6
votes
1answer
1k views

Choosing an SSL certificate provider

Does it make any difference which provider I get my SSL/TLS certificate from? In particular, what are the pros and cons getting an SSL certificate from Verisign vs getting one from Thawte? Which one ...
6
votes
2answers
2k views

OCSP and CRLs: Specified in CA or client certificate?

Here's an example PKI setup: * Root CA (offline) * Issuing CA * Client 1 * Client 2 I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
4
votes
1answer
2k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
4
votes
1answer
2k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...
3
votes
0answers
21 views

How do I request a certificate from CEP / CES on a Microsoft CA on OSX or Linux? [migrated]

This article describes how to request a certificate from AD CS (Active Directory Certificate Services) from a non-domain joined windows computer. I would think the same principals apply to non ...
3
votes
2answers
3k views

How to go about an ssl certificate renewal

I've got an ssl certificate from godaddy, and it's time to renew. I ended up with a single "keystore" file, which I give to my webserver (jetty). This is the process I went through to generate the ...