A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

2
votes
0answers
30 views

Disadvantages of self signed and cross signed certificates? [closed]

Can anyone explain what are the disadvantages or loopholes in self signed and cross signed certificates?
1
vote
2answers
94 views

Can I move my private-key to a better token?

I recently purchased a personal signing certificate from GlobalSign - it wasn't cheap either. It arrived yesterday. GlobalSign gave me a "blank" USB security token device - a SafeNet eToken 5100. ...
1
vote
1answer
33 views

which the field represents digital signature value of CA in a certificate?

Normally CA signs the certificate with its private key and produces digital signature of it.The digital signature value will be displayed in certificate. My question is what is the field name that ...
4
votes
2answers
36 views

What is the difference between Digital certification revocation and retiring?

Certificate management tools use options called revocation and retiring digital certificates.Can someone explain what is the difference between both?
2
votes
1answer
48 views

Can I revoke a client certificate using only it's serial number (not it's crt/pem)?

I've signed and issued some client certificates with my CA. I can now revoke them like so: openssl ca -name ${CA_NAME} -revoke ${USERS_DIR}/${USERNAME}.crt -keyfile $SSL_PRIVATE_DIR/ca.key -cert ...
0
votes
1answer
62 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
7
votes
4answers
249 views

Bank website forwards to false site - formatted hard drive - still forwards

Summary: When I visit my bank's website, I get forwarded to a phishing mirror site. This has persisted through a re-format of my MacBook. Even on different browsers! Other computers on the same ...
3
votes
0answers
66 views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...
4
votes
2answers
127 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
5
votes
1answer
131 views

Prevent and/or detect installation of root certificates on Windows?

I noticed that some applications installed root certificates on my computer. Is it possible to prevent this? Or is there a firewall or such that notifies me?
0
votes
1answer
45 views

Can MITM redirect my HttpsURLConnection?

Scenario: Let's say a MITM was able to plant a faked, self-signed certificate on my client (Android app), instead of the self-signed certificate of my server. When now my app tries to connect to the ...
3
votes
1answer
85 views

How to simply check if a certificate has the OCSP must-staple attribute?

http://tools.ietf.org/html/rfc7633 https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/ How can I simple check if a certificate of a ...
1
vote
1answer
29 views

SSL certificates for a mixture of subdomains and top level domains [closed]

In order to provide https-enabled access to several (e.g. around 5) subdomains and several top level domains on different IPs. Which of the following approaches is technically feasible? a one-use ...
1
vote
2answers
64 views

understanding client certificate - pfx on the general

Today I am given a pfx and told to access a website. I have absolutely no idea what was given to me initially, so please kindly confirm my understanding on a general level 1) the pfx is a container ...
1
vote
2answers
50 views

Subdomains on a multidomain EV SSL [closed]

I have a domain https://joshmurray.eu/ which has a Standard SSL certificate. I also have two subdomains: http://one.joshmurray.eu/ and http://two.joshmurray.eu/. I wish to upgrade my SSL certificate ...
0
votes
2answers
40 views

Files related/required to a digital certificate

I am new to digital certification and I am trying to understand it as well as get my domain certified. I know this question may be broad, but can someone give me a general idea of the usage of the ...
1
vote
1answer
53 views

Subject Alt Name certs

Is it ok to specify subdomains in certificates that support SAN. For example base domain is example.com and I want a.example.com, b.example.com, and c.example.com to be included? What is the primary ...
5
votes
1answer
132 views

How To Bypass SSL pinning In SPDY protocol?

I have been trying for almost a month to intercept the traffic of an android app the uses SSL pinning. I used Android-SSL-TrustKiller and SSLUnpinning but it did not work.I also decompiled the app and ...
15
votes
5answers
3k views

How can trusting ONE certificate jeopardize everything I do online?

I am not sure I understand how TLS works correctly. To my understanding trusting a certain website's certificate is all about trusting that website or not, but the questions below suggest that ...
1
vote
2answers
59 views

What are the steps to take after adding an invalid certificat authority?

in order to pay my bills online internet , I have to go through the website for my internet provider , type the login and password then I redirect to a page your connection is not private i proceed to ...
1
vote
2answers
86 views

Certificate handling on a small network VPN

Background - I need to set up secure remote access for a small home office. I'm a bit of a noob and haven't needed to handle certificates before. I understand most of the setup but I want to ...
1
vote
0answers
28 views

Certificate transparency monitoring [closed]

Does exists monitoring for certificate transparency logs ? For example, a web service how send you an email each time a new certificate for a specific domain is seen in a CT log ?
0
votes
2answers
45 views

Local certification authority and certificate chain

I know that I can set up a local certification authority for a local network. I can issue certificates for all the devices in my network, and as long as they trust me, they can use such certificates ...
6
votes
2answers
787 views

Can I use my old SSL certificate with websites in subfolders?

We have a single domain SSL for a website that looks like this: www.website.company.com We are going to expand and do following: www.website.company.com www.website.company.com/dk ...
3
votes
2answers
173 views

Use openssl to individually verify components of a certificate chain

This is related to another question, How to verify a signature of one entity by another using OpenSSL CLI? I used openssl s_client -showcerts -connect www.google.com:443 to collect three certificates ...
3
votes
3answers
197 views

How to check if I have a rogue SSL/TLS certificate?

It's known, that if someone manages to install their certificate as a trusted certificate on your Windows computer, they can read all you SSl/TLS traffic with man-in-the-middle attack and you won't ...
1
vote
1answer
18 views

Conditions for reusing client certs in TLSv1

In my setup I am using client certs, and the client devices are iPhones running iOS 9.0. In comparing some network traces I noticed that in some cases, the server asks for the client certificate for ...
2
votes
1answer
50 views

Will browsers trust an expired self sign certificate in the Trusted Root store

I recently discovered that if Windows AD LDS services are bound to a self signed certificate, that processes will continue to trust the cert even if it's expired. My guess is this is because the cert ...
0
votes
1answer
82 views

Are Free SSL/TLS Certificates Trustworthy ? Can Cert Providers Snoop On Traffic? [duplicate]

I know nothing about encryption, SSL, TLS, certificates and have come across several companies offering free SSL/TLS certificates. How trustworthy are these offers? Why would I want to adopt this ...
-2
votes
1answer
149 views

Are VPNs for iPhones vulnerable to hacking?

I use VPNs all the time on my iPhone to get around websites being blocked and sometimes just for privacy, but are they secure? In this video the guy installed a certificate on the lady's phone that ...
3
votes
1answer
48 views

SSL negotiating too low a protocol?

I'm trying to diagnose a potential SSL/TLS problem between a Mac client and a Windows server. I have generated my own root cert and signed a cert for the server, and installed the root cert on the ...
2
votes
3answers
151 views

Why doesn't openssl s_client correctly validate google.com:443?

I try $ openssl s_client -connect www.google.com:443 but it openssl complains that the cert chain is invalid: $ openssl s_client -connect www.google.com:443 CONNECTED(00000003) depth=2 C = US, O = ...
28
votes
3answers
2k views

Does any technology prevent a CA unilaterally revoking a certificate?

As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP). In an increasingly TLS world, what current technology stops a CA shutting ...
3
votes
1answer
77 views

How to verify a signature of one entity by another using OpenSSL CLI?

I'm teaching a class about certificate chains, so I download the chain from www.google.com which has 4 certs. I want to demonstrate how the dependencies work from issuer to subject by showing that ...
5
votes
5answers
220 views

VPN with client certificate via managed PKI - where did private key come from?

$company allows Mac users to request a client certificate via Symantec PKI to connect to their SSL VPN server. This process involves going to a specific Symantec website (has some sort of ID to ...
1
vote
1answer
126 views

MITMproxy doesn't display HTTP/HTTPS traffic of Android Apps

I am using mitmproxy to analyse the https traffic of some Android Apps. A few days ago I was able to intercept all the traffic without any problem and now mitmproxy doesn't seem to work properly. ...
0
votes
1answer
55 views

Verifying that a request is internal

I've got a web app that will only output safe code. It needs to pass this to a Python backend. The logical way to pass things between JavaScript and Python is to have a Flask server running. Then, the ...
11
votes
2answers
829 views

How long can X.509 certificate chains be?

Usually, I only see certificate chains with a root CA, an intermediate one, and a third one for the particular SSL/TLS website; but can X.509 certificate chains be deeper than 3 levels? Is there a ...
4
votes
5answers
249 views

How does Blucoat Proxy allow governments to decrypt SSL?

I am asking about systems like: Bluecoat ProxySG I saw some relevant answers here: Can my company see what HTTPS sites I went to? It explains how employers can do it using root certificates, but ...
4
votes
2answers
97 views

Does SSL certification have anything to do with the website legitamacy?

Does SSL certification have anything to do with the website's legitimacy? Are those websites which has it are under some kinda monitoring? Generally speaking, can a company say they follow the law ...
1
vote
0answers
65 views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
3
votes
2answers
121 views

Can a CN-only certificate bypass a name constraint if the CA goes rogue?

I am trying to cross-certify an internal issuer certificate, adding a name constraint for our domain. However, it seems that an attacker could bypass this protection by putting the desired host name ...
1
vote
0answers
122 views

MQTT (Mosquitto) certificate SSL23_GET_CLIENT_HELLO:unknown protocol [closed]

I'm been desperately trying to get my MQTT clients to connect to my MQTT broker which is set up with a certificate from a CA. To be able to get the CA certificate, I've used the letsencrypt python ...
1
vote
2answers
108 views

Single Domain SSL Certificate vs Wildcard Certificate

Probably a rather odd question, but something that came to mind. Wildcard certificates are about 10 times more expensive than a single certificate. However with a single certificate, you can secure ...
3
votes
1answer
87 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
0
votes
3answers
113 views

What implications does the KeRanger infection have for Mac OSX security?

Recently some hackers replaced installers for a popular torrent client with an infected version. According to paloaltonetworks, they have no idea how the hackers managed to do this (let's just assume ...
0
votes
2answers
102 views

How In-House Certificate Authority works (e.g. EJBCA)

I have a simple (dumb?) question with respect to EJBCA. I have been exploring how In-house CAs work and issue certificates. However, I am not able to understand who will be trusted on the top level in ...
5
votes
2answers
147 views

Why is weakness of SHA-1 considered a threat to TLS security

If I understand correctly the role that a hashing algorithm (e.g. SHA-1) plays in TLS certificates is as follows: The hashing function is applied to a subject's public key. The CA then uses their ...
1
vote
1answer
70 views

ECDSA implicit certificate using OpenSSL

I am trying to generate implicit ECDSA certificate only for signing and verification using OpenSSL. I tried google but I am getting many research papers. I understood that A messages need to be signed ...
1
vote
2answers
39 views

Client verification with PKCS#7

When a client sends you a pkcs#7 file to communicate with you, Is this because the file has their public key(certificate) and their chain and to avoid the confusion on your side what needs to be there ...