A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.
4
votes
1answer
145 views
Why do X.509 certificates have “Key Usage” attribute?
I can find their values and all details in the RFC, but I cannot find why it was decided to have this attribute in certificates, instead of leaving them to be multipurposes.
Is there a reasoning ...
4
votes
1answer
113 views
Which properties of a X.509 certificate should be critical and which not?
RFC5280's section 4.2 states
Each extension in a
certificate is designated as either critical or non-critical. A
certificate-using system MUST reject the certificate if it encounters
...
1
vote
1answer
110 views
How to troubleshoot why Thunderbird rejects a PKCS#12 certificate with “Could not verify this certificate for unknown reasons”?
After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a ...
1
vote
2answers
1k views
Error code: sec_error_untrusted_issuer
I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
1
vote
2answers
59 views
certificate based network authentication
In certificate based network authentication, is the user tied to just the system the certificate has been installed on such that if he tries to authenticate using another system access is denied?
1
vote
1answer
121 views
What is the difference between `extendedKeyUsage` and an application policy?
In some Microsoft articles like http://technet.microsoft.com/en-us/library/cc731792%28v=ws.10%29.aspx, I find some confusing statements like
Application policies are sometimes called extended key ...
2
votes
2answers
378 views
Protecting against SSL Strip [duplicate]
I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe?
Does it depend on the cert strength?
Do you ...
0
votes
2answers
114 views
OpenID without SSL certificate
Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed?
Just to make things clear, ...
2
votes
2answers
139 views
Ssl certificate rekey or revoke
I want to be sure to understand well the situation where SSL certificate is compromised.
If I ask for a rekey, I suppose the old certificate will remain valid.
The future communications with the new ...
2
votes
3answers
74 views
Are intermediate signing certs the only secure+practical way to manage OpenVPN client certs?
My organization needs to issue (and revoke) OpenVPN client certificates for people working remotely.
Our system is based on a standard OpenSSL CA setup and the easy-rsa tools, and the whole directory ...
3
votes
1answer
68 views
How to secure a certificate internally
Say I have a certificate which I use to sign the software I ship. This happens in the (daily or more) build on the buildserver (Windows machine). Easiest solution would be to put the certificate file ...
3
votes
1answer
141 views
Cellphones IMEI public exposed?
Currently I'm in the middle of a developement process, and I have some security questions for you. I have a webservice, asp.net which is configured to run over https. The first authentication step for ...
2
votes
1answer
142 views
Which extensions to use for a S/MIME certificate?
Analogously to the SSL server certificate question, which extensions should I use for S/MIME, and should the CA be restricted somehow as well?
(I'm using openssl, which at the moment creates CA and ...
11
votes
4answers
2k views
What is certificate pinning?
I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
0
votes
2answers
144 views
“Premium SSL” vs “Stanard SSL” certificates - Any reason why I would want a “Premium SSL”? [duplicate]
Possible Duplicate:
What are the advantages of EV Certificate?
besides the green URL bar and free security scan and whatnot.
Our website does NOT accept any personal info other than email ...
3
votes
4answers
459 views
Is it possible to create a self signed certificate authority?
Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious.
To explain my question : Suppose I sign a public ...
1
vote
0answers
121 views
SSL Certificate Authentication Issue 403.7
I have been trying to configure SSL for authentication and was unable to resolve this error 403.7 on IIS 7.5 windows 2008r2 vps server. I would like to give access to few computers where client ...
0
votes
1answer
108 views
Behavior when validating an expired certificate chain
I have the following situation:
A server certificate (CServ) is signed by self-signed certificate (C0)
A client certificate (CCli) is signed by CServ
Client's trust-store contains C0, so the client ...
3
votes
1answer
96 views
How can an “alternate” or duplicate HTTPS certificate be used in an attack?
Inspired by an old question from PulpSpy, I'm trying to think of whether this is a significant weakness in the Certificate Authority system. Here are the attack methods that I think would work - ...
1
vote
1answer
170 views
What are the benefits and drawbacks of the HTML5 Keygen element?
As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
2
votes
2answers
480 views
Encrypting local HTTP traffic using a self-signed certificate
For the past couple of hours I've been trying to create a self-signed certificate which I'd like to use to encrypt HTTP traffic between computers and a server on my home network (because I'm paranoid ...
4
votes
2answers
166 views
How to verify certificate with very little information
Lets assume there is a server and a client and you want to connect those two.
Server has a self-signed certificate, and prior to establishing the connection for the first time (enrollment) the server ...
8
votes
4answers
383 views
Can real end-to-end SSL encryption be made?
I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate.
I've got a very precise question but first I need to give some background.
Basically I'm very ...
20
votes
7answers
1k views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
2
votes
1answer
106 views
What damage could be done if a malicious certificate had an identical “Subject Key Identifier”?
I'm looking at the the Subject Key Identifier attribute of a CA certificate and am trying to understand the role it plays in validation and infer how validating client software could get it wrong.
...
2
votes
1answer
54 views
Is it a good idea to generate certificate-specific CRLs? What is this technique called?
Suppose I create 3 certificates with the following CRLs
Cert1 http://crl.server.com/batch1/root1.crl
Cert2 http://crl.server.com/batch2/root2.crl
Cert3 ...
2
votes
1answer
177 views
What should a CRL file name look like when “new” and “delta” CRLs are generated?
I suspect my Windows 20012 Certificate Server CRL revocation configuration is incorrect every time I generate a new CRL or a new Delta, only a maximum of 3 files are generated.
When I created the ...
2
votes
1answer
156 views
What Enhanced Key Usages are required for PKI infrastructure tasks? (OIDs for OSPF and CRL signing, etc)
I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks.
I understand that clients may not validate the ...
4
votes
2answers
201 views
Extensions for SSL server certificate
I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
3
votes
2answers
224 views
Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?
Suppose I have several independent PKIs that are used
Two internal PKIs: One with SHA1 support the other with Suite B algorithms.
A partner who I trust and have a policy map with.
Since both my ...
2
votes
1answer
92 views
What happens to a certificate's Basic Constraints when a policy map is used?
One feature of a Basic Constraint when applied to a certificate (CA or end certificate) is that I can specify the maximum number of CAs that are permitted in the chain.
I'm planning on having a 2 ...
2
votes
1answer
232 views
What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?
I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance.
For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
24
votes
3answers
810 views
A Different Approach to PKI
After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
4
votes
1answer
143 views
Does Authenticode still work offline and with a “fake” certificate
Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
4
votes
2answers
135 views
What is the severity of a fake certificate?
I'm not a security specialist, thus reading this Google Blog post about a fake *.google.com certificate, raises a lot of concerns, if anyone can impersonate a website, especially a google website, my ...
1
vote
2answers
89 views
How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)
I have a newer private key I have to import into an older server.
How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
1
vote
2answers
191 views
Difference between Encryption and Verification certificate
What is the difference between the Encryption certificate and Verification certificate in Outlook? When exchanging certs, it just requires a digitally-signed message to be sent. It seems as though ...
1
vote
1answer
129 views
How do I verify, parse and process the results of the HTML5 keygen tag?
I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST:
...
7
votes
7answers
205 views
Proving running code on a website is unchanged
Can it be proved to the user that the running code behind a website with security related code is the same as published?
I'm currently looking at a few new project ideas and one involves secure ...
0
votes
1answer
50 views
Can IE be made to imitate the behavior of Chrome's KeyGen element?
Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element?
Assistance getting Safari to work with this optional HTML5 spec would be ...
1
vote
3answers
311 views
Do client certificates provide protection against MITM?
I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
1
vote
2answers
188 views
Self-signed certificates usage for code signing purposes
if a self-signed certificate is trusted by the client's certificate store, then it should be fine to be used, since the client trusts the issuer of the certificate as it does any other trusted CA ...
3
votes
2answers
2k views
Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”
I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain.
...
2
votes
2answers
166 views
Forged SSL without installation of root CA, possible?
Consider visiting a secure website like Gmail. Is it possible to forge the website certificate only by having full control over the internet provider?
I mean is it practically possible for a provider ...
0
votes
1answer
261 views
X.509 certificate attack (small sha1 private key)
I've got a X.509 certificate, created by an unknown CA. The only thing I know is that the private key is very short, so I can retrive the private key.
Is there any program I can use? The used ...
3
votes
1answer
103 views
How can I use certificates to secure my webservices? What is available to javascript?
I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
-1
votes
4answers
232 views
Does a renewed certificate open old messages?
I have a digital certificate that I use to exchange messages with peers, my certificate expiration date is due next year, suppose I renew this certificate before it expires, will I be able to open the ...
2
votes
1answer
76 views
how does OpenSSL create X.509 certs from SPKACs?
The SPKAC ASN.1 description:
PublicKeyAndChallenge ::= SEQUENCE {
spki SubjectPublicKeyInfo,
challenge IA5STRING
}
SignedPublicKeyAndChallenge ::= SEQUENCE {
publicKeyAndChallenge ...
3
votes
2answers
159 views
What did the certificate authority do with my CSR?
I needed to reach a web service which is not mine.
The IT department of that web service has asked me to send them a CSR (certificate signing request).
Then, he will send me back a signed certificate ...
4
votes
3answers
261 views
What issues arise from sharing a SSL certificate's private key?
Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website.
I have ...
