A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
1answer
132 views

How to generate self-signed EV SSL Certificate?

I configured XAMPP / Windows on my laptop so that this URL: https://www.supersite.com/ points to XAMPP / localhost rather look elsewhere. I basically generated a self-signing certificate, imported ...
12
votes
2answers
679 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
4
votes
1answer
70 views

Security risk: Digitally sign communications for SMB

I have a computer (Windows) on a network where an industrial process is controlled. There is an option in Local Security Policy >> Local Policies >> Security Options >> "Microsoft network client: ...
1
vote
1answer
53 views

Use appstore using trusted certificate [closed]

I connected my iPad to my laptop's localproxy. I also installed a trusted digital certificate in my iPad. I am now able to use all HTTPS networks through my iPad except appstore. If I disable proxy, I ...
0
votes
1answer
68 views

Can public certificates be password-protected?

I've only seen private key files (.pfx, .pkcs12) being password protected. Someone told me public cert files (.cer) can also be password-protected. Is that true? Is it also true to say any certificate ...
0
votes
3answers
65 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...
1
vote
0answers
94 views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
0
votes
1answer
13 views

Number of certificates in a PKCS#12 archive

Is there command to find the number of certificates in a PKCS#12 archive? I have the .pfx file sent by a client but need to find out how many certificates it contains. I don't need any of the ...
2
votes
1answer
75 views

Can I modify my certificate chain?

I've had SSL/TLS running on my site now for a while. In order to learn a bit more about general PKI, I studied Qualys' SSL test, and optimised my configuration (including the adoption of OCSP ...
2
votes
0answers
16 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
0
votes
3answers
63 views

In order to trust the digital certificate, does immediate CA cert also needs to be in trust store or root CA cert is enough?

In order to trust the digital certificate, does immediate CA certificate also needs to be in trust store or root CA certificate is enough?
0
votes
1answer
46 views

Combining wildcard and subdomain-specific SSL certificates

Not quite sure which Google terms to use to find the answer, so I thought I'd ask it here, presented as a scenario: Say you have a corporate entity (Example Co) with a wildcard SSL cert issued for ...
0
votes
1answer
101 views

Begin of Certificate/ End of Certificate dash “-----”

What significance does the dash "-" holds along with the line -----BEGIN CERTIFICATE----- or -----END CERTIFICATE-----. I checked multiple docs and linked RFC's as well but could not find the ...
1
vote
1answer
103 views

Is a self-signed SHA-1 certificate sufficient security for a company transmitting sensitive data?

We recently decided to pay an ISP (a substantial sum, mind) for a managed internet service up to and including the router in our head office. Part of the initial discussions made it clear that ...
4
votes
1answer
235 views

Did Google relax their SHA1 deprecation schedule?

In the original post on the subject they said that in Chrome 41: Sites with end-entity certificates that expire on or after 1 January 2017, and which include a SHA-1-based signature as part of the ...
5
votes
1answer
58 views

Do CA Public Audit Records increase the visibility, and risk of attack?

Does the CA feature of Public Audit Records increase the visibility of my hosts, and therefore the risk of host-specific attacks? Would the only mitigation be to only enable this for wildcard ...
1
vote
1answer
37 views

What bits of data is revoked in a CRL? Is it the hash(CSR) or hash(CSR + PKI signature)

My understanding is that a CSR contains the public key from the client, and the response is a signed version of that CSR, with certain attributes (EKU, expiration) and other attributes the CA decides ...
1
vote
1answer
41 views

Possible to change the CA that a keypair is using?

Pretend I take the same CSR and send it to two different CAs as described in the following scenario: I create a CSR on Windows I submit the CSR and edit my SAN names. Request is pending at the CA ...
0
votes
1answer
44 views

CSR signing follow up question

This is a follow up question , after getting a signed certificate from one CA. researched a lot , but no luck. After getting the CA reply, While downloading the certificate, it popped up saying ...
3
votes
3answers
123 views

SSL Cert for sub.domain.com and www.sub.domain.com

I have a wildcard cert issued by godaddy for *.domain.com. currently, https://sub.domain.com works just fine. however, https://www.sub.domain.com does not work. Do I need a separate cert for ...
0
votes
0answers
40 views

Certificate verification

I work on a desktop application which generates Security certificates. The Business use of these certificates is - they will be used as an authentication and authorization mechanism to enable users to ...
3
votes
2answers
79 views

CSR Signing simulation

Tried a lot get my test csr signed from root CA(trial versions option), somehow i am not getting it dues to some of their internal check. Few questions that cropped up Can i somehow signed that ...
23
votes
6answers
3k views

Possibility to sniff HTTPS traffic on devices without installing a certificate

My goal is to sniff the HTTPS traffic of some digital devices (AppleTV, game consoles, etc.), and decrypt the HTTPS packets in my local network. I cannot figure out a way by using some HTTPS ...
1
vote
1answer
75 views

Why deploy a .p12 client certificate bundled with a root CA?

I have been asked to connect to a government agency secure site that uses client certificates to authenticate its clients. I received by email an encrypted client certificate as a PKCS#12 file and by ...
0
votes
1answer
102 views

How does driver install with an expired cert?

I'm working on making a silent installer of WinpkFilter driver. In my silent installation, I'm always getting a (not so silent) prompt that says "Windows can't verify the publisher of this driver ...
1
vote
1answer
655 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
2
votes
3answers
181 views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
3
votes
1answer
74 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
0
votes
3answers
87 views

Do all non-CA certs have to be End Entity certs?

Still learning the differences between certs. Can someone explain? The internet has so far been surprising not lucid in describing certificates. *EDIT to clarify EE
1
vote
1answer
41 views

Protecting the root ca bundle

Applications (e.g. Firefox) often include a root ca bundle file containing trusted certificates. How can I protect those files from malicious agents trying to modify them? I think signing is not an ...
0
votes
1answer
60 views

How do SSL certificates become compromised after expiring [duplicate]

I'm reading into security issues surrounding SSL, and one of that has come up is certificate expiration. The general idea is that once a certificate expires, the site is insecure. What is the ...
1
vote
2answers
66 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
0
votes
0answers
27 views

What is the minimum acceptable time for “Freshest CRL” to be updated?

I'm working with MSFT CA, and not sure if this behavior is the same across all CAs, but when I run certutil -CRL, the base revocation cert is updated weekly, and the Freshest CRL (the differential) ...
22
votes
3answers
2k views

Superfish vs. Corporate MITM

I work for a consulting company, and I have been implementing a tool from a security vendor, which is a cloud proxy for all user traffic. It will perform malware scanning and filtering of all web ...
1
vote
0answers
42 views

Making the Firefox key and CSR creation process transparent

Background I was a bit surprised that several CAs do not allow anymore to send a plain old CSR in text form to them which was created in the classic fashion with OpenSSL or similar. But this would ...
1
vote
0answers
37 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password ...
1
vote
0answers
23 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
1
vote
1answer
83 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
2
votes
1answer
419 views

SSL communication between a C# Server and an Android Client App

I'm using a C# server and a C# tcp client example I extracted from the MSDN and I have created a self signed certificate using makecert.exe. I have got this to communicate with one another and it ...
3
votes
1answer
97 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
0
votes
0answers
98 views

Getting Certificate KeyContainerName to initialize CspParameters

How can I get the name of a Key Container that's in a smart card required for initialization of CspParameters? CspParameters^ cspa = gcnew CspParameters(ProviderType, ProviderName, keyContainerName, ...
2
votes
1answer
66 views

How do Client-specific keys and Certificates work?

I have clients that communicates with my server. Clients sends it unique id (guid) to server with its request over a secure https channel. Also to increase security I use my own private-public key ...
9
votes
1answer
408 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
2
votes
0answers
48 views

How can I restore my Windows certificate cache so I only have those from trusted CAs? [duplicate]

All this talk about Superfish and other adware crap has made me healthily paranoid that a wrong certificate can enter my certificate cache at any time. I have no reason to assume that there is a ...
0
votes
1answer
97 views

Create certificate without private key with OpenSSL

I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely ...
1
vote
2answers
139 views

How to be sure laptop's trusted certificates are safe

I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification ...
0
votes
0answers
65 views

How to associate an oAuth token with a particular user. Is this possible?

We have HTTP Rest services and SignalR (aka Web sockets, server send events, etc) for cases in which we need to push data from the server to the Web UI . We are currently using the built in tools that ...
1
vote
1answer
80 views

how to extract a valid digital certificate and put it on other program

I am working on this matter as a graduate, but I need some help. how can extract a valid digital certificate to put it on other program? can I put a digital certificate on other executables and be ...
54
votes
4answers
7k views

Why was the private key of the Superfish certificate so easily extractable?

Robert Graham detailed on the Errata Security blog how he was able to get the private key of the Superfish certificate. I understand that attackers can now use this key to generate certificates of ...
0
votes
0answers
37 views

Additional security for services hosted on a 2FA or Multi-Factor Authenticated Network

I am aiming to lock down a web service that accesses other services and has a publicly facing UI. I have a hosted service on a network that requires 2-factor authentication to access. This service's ...