A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

7
votes
1answer
145 views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
1
vote
1answer
103 views

TLSv1: Reason for client not sending client certificate

Our BizTalk installation consists of two load balanced nodes B1 (10.137.10.1) and B2 (10.137.10.2) which process and route incoming SOAP messages. The processing is nothing more than: sending the ...
2
votes
1answer
310 views

Snapchat tracking over company WiFi. What can they see, save or open?

I sent a snapchat to a coworker during company time. I was not on the work wifi, but now I believe they may have been. What will my employer be able to see from the snapchat that was sent and opened ...
6
votes
3answers
2k views

Isn't HTTPS insecure over a hacked router? [duplicate]

I have heard that a hacker can become a proxy using the router your device is connected to and send his own public key to you instead of you getting the server's public key - which the browser will ...
3
votes
2answers
158 views

How to tell if a SSL cert is 128 bit or 256 bit?

My cert is: Key Length = 2048 Signature algorithm = SHA256 + RSA So is it a 256 bit SSL cert?
4
votes
1answer
50 views

When prompted to add a certificate or profile to connect to a secured WiFi network, how can I tell if it's safe to install it?

Sometimes when I connect to secured WiFi networks on my computer, such as my internet provider's WiFi hotspots around the city, I'm asked to add a certificate to my certificate store. When I'm on my ...
-2
votes
1answer
79 views

SSL Server-side certificate on client computer? [closed]

There is a server with WCF client, which periodically initiates communications over internet with many WCF services installed on our clients computers. WCF services and WCF clients are hosted in ...
3
votes
2answers
130 views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
0
votes
0answers
44 views

My school is making everyone install a SSL certificate. Will my VPN still work? [duplicate]

My public highschool is having everyone with a non-school rented device install a SSL certificate provided by Securely. Nothing has taken place yet but they threatened that personal laptops without ...
1
vote
1answer
132 views

Why is CAcert not trusted by my browser?

I am fairly new to encryption and SSL. Today I googled a bit (read some atricles about security) and encountered the site https://cacert.org. I clicked it and was surprised. Chrome showed me a "not ...
0
votes
0answers
25 views

How to check Firefox CA health?

If we have a RHEL based desktop at a workplace, how can we check the health of the Certificate Authorities trusted by Firefox? I mean: The list that which CA is allowed in the webbrowser And that ...
-3
votes
1answer
60 views

How two identical domains work on Internet when they got signed from two different CA

Let's say A and B. Considering A and B are from same location. A went to the verisign and get signed for example.com B went to the godaddy.com and get signed for same domain(example.com) Now question ...
4
votes
1answer
195 views

Why is BlueCoat proxy passing HTTPS communication to Google sites?

I have a machine behind corporate BlueCoat's proxy server. For any HTTPS site I get a certificate signed by BlueCoat's CA, for example: BlueCoat *.duckduckgo.com The only exceptions are sites ...
0
votes
1answer
62 views

SSL warnings while using Origin Certificate on my VPS

I created Origin Certificate in cloudflare and installed on my Apache on Debian VPS using the guide https://support.cloudflare.com/hc/en-us/articles/217472077. My URL is like this: https://socket....
1
vote
1answer
133 views

Firefox security certificate issues: FUD or truth?

I was doing a little reading over at gHacks, and came across this comment attributed to Joey Spinosa regarding certificates in Firefox: These certificates are installed automatically by the ...
1
vote
1answer
56 views

Securing confidential information between users

I know there are several issues about encryption, but my case is slightly different Users have confidential information stored on their device They have a RSA key pair The information must be ...
1
vote
1answer
66 views

How do websites prevent certificate forgery?

I have recently developed interest about Wireless hacking, and I have seen in many instances in videos and stuff that people are (or more correctly, were) able to perform some kind of MitM attack ...
0
votes
2answers
50 views

SSL protocol analysis

1) What is the use of Cert B in this protocol? 2) What does it prove to Alice? 3) Is it okay if we remove Cert B in this protocol? Even without Cert B, isn't the fact that Bob used his private key ...
3
votes
2answers
374 views

What is the exact problem if a website has an SHA-1 certificate?

There was a recent question about trusting (or not) a website showing an SHA-1 certificate. I would like to know whether I understand the actual issue correctly. The dangers are (a) that someone ...
2
votes
1answer
133 views

Strange CA certificate prompt

My network went down for a minute today, then this window popped up: Can someone here clarify this for me? I was using firefox. I had google, youtube and outlook open. My name isn't even close to ...
4
votes
1answer
107 views

TLS/SSL Certificate - Key usage and encryption

So I'm looking at google.com's SSL certificate and do not understand a few things: I totally get that it ensures the identity of Google's webserver, but don't understand how it proves anything ...
34
votes
5answers
5k views

Should I trust a website which uses a SHA-1 HTTPS certificate?

I am on a website where I need to pay for something. This website has the following warning in the top left: This site uses a weak security configuration (SHA-1 signatures) so your connection ...
0
votes
1answer
30 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
1
vote
1answer
46 views

Password manager login with compromised certificates

This morning I booted my work laptop as usual and logged in to Windows, then my password manager (Dashlane, if it makes a difference) as usual. Opening up Chrome and browsing to a site with HTTPS ...
2
votes
1answer
86 views

Can a DNS “route” change cause an SSL certificate error?

What I mean by "route change": As a working example, mysite.example.net is set up as: mysite.example.net. 3600 IN CNAME some-other-site.elsewhere.com. some-other-site.elsewhere....
0
votes
0answers
47 views

Certificate not showing up for signing in Outlook

I have a new ECA certificate installed on my Windows 7 machine, but when I use Outlook it is not letting me change the signing certificate to the new certificate, but it does let me change the ...
3
votes
2answers
56 views

How do I handle HTTPS certificates for a device with dynamic IP?

I'm fairly new to HTTPS and therefore risk this being a dumb question. I have a server hosted on my Raspberry Pi that allows me to configure it remotely, over a network and I'd like to convert to ...
0
votes
2answers
66 views

What is the purpose/role of the “alias” attribute in Java keystore files?

I've heard conflicting information about the purpose of the alias attribute in Java keystore files. Can someone please clarify on what exactly this attribute is, and what it should be set to when ...
0
votes
0answers
36 views

Validate Code Signing Root Certificate Offline

I am developing a library distributed as a Windows DLL to be called by 3rd party executables. I expect the calling EXE to be digitally signed and need to verify that. I have no control over the ...
0
votes
0answers
41 views

Web service authorization to specific applications: certificates, embedded secret or both?

My needs are somehow similar to this answer, but I would to be more specific. I have a set of web applications (A and B) that access to a REST service (R). A, B and R could be on the same server or ...
2
votes
1answer
50 views

Can the server detect when a client has disabled certificate pinning?

Many mobile applications enforce certificate pinning in order to make a man-in-the-middle attack difficult to accomplish. However, with a jailbroken/rooted device, it's possible to disable the ...
1
vote
1answer
120 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
-1
votes
1answer
43 views

SIM card used with smart card user certificate

Is it possible to put a smart card user certificate (Windows) on a SIM card? (SIM card already has telecom info on it). I'm using Win 2012 and have tried, but I am getting this error "smart card ...
1
vote
1answer
34 views

Multi-User-Server Public-Key-Based Authentication

So, lets say we have Alice, John, Peter and Bob. Alice, John and Bob all know Peter's public key and trust Peter. Alice wants to connect to Bob's server, so she presents her public key, which was ...
4
votes
1answer
61 views

Why is the SHA-1 hash of certificate sent in TLS “Client Certificate URL” extension?

According to RFC6066, constrained clients can send certificate URLs instead of full certificates for TLS client authentication: After negotiation of the use of client certificate URLs has been ...
0
votes
2answers
47 views

What if internal certificate details like CN, Serial Number, validity, CA etc. are shared to external parties from my intranet site?

If by mistake I have shared the details like Common Name, Serial number, etc.. of the certificate of my intranet site/server that is not exposed to the internet will it help attackers exploit the ...
6
votes
2answers
283 views

Why are certificate chains different in Firefox and Chrome?

I have a server with HTTPS, and I noticed a very strange behavior which I cannot understand. When I checked the chain in Firefox, there is this: But in Chrome I see this: So it's clear, that ...
1
vote
1answer
114 views

LetsEncrypt / Exim4 / GnuTLS / cert chaining: “The provided X.509 certificate list is not sorted” error

From what I can determine, you generate a LetsEncrypt certificate that includes the full cert chain thus: # run lets-enc the usual way # then ..: wget -O intermediate.pem https://letsencrypt.org/...
1
vote
1answer
58 views

How can I list all self-signed certificates in my stores on a Windows client?

I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
1
vote
1answer
84 views

Is or was it possible to register a wildcard certificate to third level subdomain?

The use of a null byte in a certificate cn is very well known… and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of ...
5
votes
2answers
118 views

How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?

I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the ...
0
votes
1answer
472 views

Is using “SHA-256 with RSA-2048 Encryption” a secure certificate hashing algorithm?

Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm? I don't think it is. Two examples: nsa.gov [careers site] give.wfp.org
2
votes
0answers
48 views

Why more Android applications (compared to iOS) use certificate pinning? [closed]

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...
0
votes
0answers
24 views

Securing several Servers (Certificates)

I got a Question regarding Certificates. We got a situation, where only "Server 4" and its clients are given in the picture above. That Server4 (SLES11) and its Clients are using a self signed ...
0
votes
1answer
115 views

How to verify the signature value in a SSL certificate?

According to RFC 3280 a certificate's basic syntax is Sequence := { tbsCertificate signatureAlgorithm signatureValue } In tbsCertificate, SubjectPublicKey is the public key of the ...
0
votes
1answer
100 views

Creating self-signed certificate for localhost and trusting fully

As an accompanyment to a web application we plan to have a node application running as a windows service running on the client computer. This will run a small web server which will listen on port XXXX ...
2
votes
0answers
73 views

How to enable self signed certificates in Windows 10?

I want to use a Yubikey 4 with Windows 10 Pro for Bitlocker and login with my TPM. Unfortunately, I found out I need to enable self signed certificates and all the guides on the Internet I found were ...
1
vote
0answers
15 views

How did I get a signed cert back with a wildcard common name when I submitted a csr with a specific common name? [duplicate]

Apologies if this is obvious but I'm hoping for some clarification here. I generated a CSR on an appliance of mine. This CSR had a specific common name (let's call it foo.domain.com). I then sent ...
-1
votes
1answer
60 views

Same certificate but different private keys on different servers. Does this work?

We have a SAN cert that is used on multiple servers. Is it possible to have the cert re-keyed and only use the new private key on a particular server while keeping all of our other servers using the ...
4
votes
2answers
76 views

Trusting the “subject” of an x509 certificate

A bit of background. Our organization is working on a document format that will be ingested by our software. We're using the CMS format to verify the integrity (by validating the signature). The CMS ...