A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
1answer
98 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
-1
votes
1answer
34 views

SIM card used with smart card user certificate

Is it possible to put a smart card user certificate (Windows) on a SIM card? (SIM card already has telecom info on it). I'm using Win 2012 and have tried, but I am getting this error "smart card ...
1
vote
1answer
34 views

Multi-User-Server Public-Key-Based Authentication

So, lets say we have Alice, John, Peter and Bob. Alice, John and Bob all know Peter's public key and trust Peter. Alice wants to connect to Bob's server, so she presents her public key, which was ...
4
votes
1answer
58 views

Why is the SHA-1 hash of certificate sent in TLS “Client Certificate URL” extension?

According to RFC6066, constrained clients can send certificate URLs instead of full certificates for TLS client authentication: After negotiation of the use of client certificate URLs has been ...
0
votes
2answers
43 views

What if internal certificate details like CN, Serial Number, validity, CA etc. are shared to external parties from my intranet site?

If by mistake I have shared the details like Common Name, Serial number, etc.. of the certificate of my intranet site/server that is not exposed to the internet will it help attackers exploit the ...
6
votes
2answers
213 views

Why are certificate chains different in Firefox and Chrome?

I have a server with HTTPS, and I noticed a very strange behavior which I cannot understand. When I checked the chain in Firefox, there is this: But in Chrome I see this: So it's clear, that ...
1
vote
1answer
90 views

LetsEncrypt / Exim4 / GnuTLS / cert chaining: “The provided X.509 certificate list is not sorted” error

From what I can determine, you generate a LetsEncrypt certificate that includes the full cert chain thus: # run lets-enc the usual way # then ..: wget -O intermediate.pem https://letsencrypt.org/...
1
vote
1answer
48 views

How can I list all self-signed certificates in my stores on a Windows client?

I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
1
vote
1answer
83 views

Is or was it possible to register a wildcard certificate to third level subdomain?

The use of a null byte in a certificate cn is very well known… and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of ...
5
votes
2answers
105 views

How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?

I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the ...
1
vote
1answer
232 views

Is using “SHA-256 with RSA-2048 Encryption” a secure certificate hashing algorithm?

Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm? I don't think it is. Two examples: nsa.gov [careers site] give.wfp.org
2
votes
0answers
45 views

Why more Android applications (compared to iOS) use certificate pinning? [closed]

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...
0
votes
0answers
24 views

Securing several Servers (Certificates)

I got a Question regarding Certificates. We got a situation, where only "Server 4" and its clients are given in the picture above. That Server4 (SLES11) and its Clients are using a self signed ...
0
votes
1answer
101 views

How to verify the signature value in a SSL certificate?

According to RFC 3280 a certificate's basic syntax is Sequence := { tbsCertificate signatureAlgorithm signatureValue } In tbsCertificate, SubjectPublicKey is the public key of the ...
0
votes
1answer
61 views

Creating self-signed certificate for localhost and trusting fully

As an accompanyment to a web application we plan to have a node application running as a windows service running on the client computer. This will run a small web server which will listen on port XXXX ...
2
votes
0answers
52 views

How to enable self signed certificates in Windows 10?

I want to use a Yubikey 4 with Windows 10 Pro for Bitlocker and login with my TPM. Unfortunately, I found out I need to enable self signed certificates and all the guides on the Internet I found were ...
1
vote
0answers
15 views

How did I get a signed cert back with a wildcard common name when I submitted a csr with a specific common name? [duplicate]

Apologies if this is obvious but I'm hoping for some clarification here. I generated a CSR on an appliance of mine. This CSR had a specific common name (let's call it foo.domain.com). I then sent ...
-1
votes
1answer
52 views

Same certificate but different private keys on different servers. Does this work?

We have a SAN cert that is used on multiple servers. Is it possible to have the cert re-keyed and only use the new private key on a particular server while keeping all of our other servers using the ...
4
votes
2answers
73 views

Trusting the “subject” of an x509 certificate

A bit of background. Our organization is working on a document format that will be ingested by our software. We're using the CMS format to verify the integrity (by validating the signature). The CMS ...
3
votes
2answers
96 views

Best practices to implement HTTPS in embedded devices

Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...
0
votes
3answers
69 views

Same wildcard cert from two different 3rd party CA's

We have a wildcard cert that's due to expire in three months. The CA won't let us renew it until one month prior to its expiration. We're thinking about using a different CA since we've since ...
5
votes
3answers
152 views

X509 CRL suspended certificates and openssl ca comand

In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it. ...
0
votes
1answer
37 views

How secure is it to bundle unencrypted private key and a CSR into PKCS12 certificate?

I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, ...
0
votes
1answer
89 views

Securing Internal Mobile REST API

I am planning to create an internal API for mobile devices for a company. They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
1
vote
5answers
96 views

Best Option for SSL Certificate for 2 Domains + All Subdomains

I am hosting multiple websites on my Mac Mini server (latest version). For some reason OS X server does not support multiple SSL certificates well for websites, and after hours on the phone with ...
1
vote
1answer
46 views

Securely opening an insecure webserver to a single phone

I have a webserver running inside my private network and not exposed to the internet. I'd like to securely talk to this webserver from my mobile phone over the internet. However, this webserver has ...
0
votes
0answers
17 views

Does the AppId matter when self signing a cert?

We are going to start using self-signed certificates on our dev server. I went through some step-by-step instructions on how to generate the cert and set up ssl with my service. To add the cert, I ran ...
3
votes
1answer
413 views

Benefits of a wildcard vs per-subdomain certificates

As you might know, Let's Encrypt doesn't offer wildcard certificates and it won't in a short-term because you can just order as many certificates as you want for the sub-domains. This make me wonder.....
5
votes
1answer
82 views

Why are short-lived certificates so rare?

Let's encrypt recently left beta and limits the maximal life-time of certificates to 90 days and recommends 60 days. Now whenever I start talking about the issues of certificate revocation (e.g. OCSP ...
1
vote
1answer
117 views

Digitally signing a document with your public/private keypair without certificates?

I have generated a private/public key pair using gpg. Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead ...
1
vote
3answers
137 views

What SSL certificate do I need?

I have 2 domains, one where the website is hosted (lets call it www.a.com), and another (lets call it www.b.com) which has a CNAME record pointing to the first one (www.a.com). Which one should have a ...
3
votes
0answers
83 views

SSL certificate and price difference [closed]

After reading this discussion, Why are there very expensive and cheap SSL same type certificates? I surfed over the internet “Symantec Secure Site Pro with EV SSL Certificates”. I found something ...
2
votes
2answers
69 views

What advantage would someone gain by installing my root certificate?

The answer to this is probably simple, but it eludes me. Here's the scenario: At the moment, I have a server with a certificate issued to it using HTTPS that a customer POSTs responses to after ...
1
vote
2answers
26 views

Mandadory checks a client should make to verify a ssl/tls certificate [duplicate]

Let's say I have a client, not a browser, that wants to connect with https to a server. It could be a python program, an android app or a library etc. Suppose the client has a list of trusted CAs and ...
3
votes
1answer
44 views

What security impact is caused by a TLS server continuing the handshake when presented with an invalid SNI?

RFC 6066 defines Server Name Indication as an extension, whereby virtualised web servers may be given an SNI extension in order to know which certificate should be presented. It has the following to ...
31
votes
2answers
2k views

Can a SSL certificate have longer validity period than its parent in X.509 chain?

When a X.509 certificate chain is composed of X1, X2 ... Xn and Xn is root CA, Can a certificate in lower level have longer validity period than its parents? I think that lower level should be proper ...
1
vote
0answers
41 views

OCSP recording with JMeter

How can I record an application which is using OCSP security with the help of JMeter? I am not able to record the application i.e. a native app with the help of JMeter as it is using OCSP protocol ...
1
vote
1answer
67 views

How to determine effective trust chain for cert on MacOS X?

I'm seeing some curious issues with cert verification for an Issuer: Entrust - L1K cert that was issued and is in use (per inspection of the cert in Chrome and Firefox) for an internal site here. I ...
1
vote
0answers
32 views

How to provide our customers ability to self service client certificate creation?

We have an API for B2B customers to access our platform. We require each B2B customer to have a client certificate. This is not the URL SSL certificate (https). The CN of each customer's client ...
1
vote
0answers
40 views

What comes into calculation of certificate signature?

I have written my own code with openssl in order to create certificates. In order to verify this code, I tried to reconstruct an openssl commandline generated self-signed certificate ... openssl req -...
2
votes
0answers
32 views

Disadvantages of self signed and cross signed certificates? [closed]

Can anyone explain what are the disadvantages or loopholes in self signed and cross signed certificates?
1
vote
2answers
103 views

Can I move my private-key to a better token?

I recently purchased a personal signing certificate from GlobalSign - it wasn't cheap either. It arrived yesterday. GlobalSign gave me a "blank" USB security token device - a SafeNet eToken 5100. ...
1
vote
1answer
35 views

which the field represents digital signature value of CA in a certificate?

Normally CA signs the certificate with its private key and produces digital signature of it.The digital signature value will be displayed in certificate. My question is what is the field name that ...
4
votes
2answers
45 views

What is the difference between Digital certification revocation and retiring?

Certificate management tools use options called revocation and retiring digital certificates.Can someone explain what is the difference between both?
2
votes
1answer
57 views

Can I revoke a client certificate using only it's serial number (not it's crt/pem)?

I've signed and issued some client certificates with my CA. I can now revoke them like so: openssl ca -name ${CA_NAME} -revoke ${USERS_DIR}/${USERNAME}.crt -keyfile $SSL_PRIVATE_DIR/ca.key -cert $...
0
votes
1answer
93 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
7
votes
4answers
255 views

Bank website forwards to false site - formatted hard drive - still forwards

Summary: When I visit my bank's website, I get forwarded to a phishing mirror site. This has persisted through a re-format of my MacBook. Even on different browsers! Other computers on the same ...
3
votes
0answers
101 views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...
4
votes
2answers
185 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
8
votes
1answer
159 views

Prevent and/or detect installation of root certificates on Windows?

I noticed that some applications installed root certificates on my computer. Is it possible to prevent this? Or is there a firewall or such that notifies me?