A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
1answer
41 views

Certificate validation Local DNS hosts file

I've a question regarding a certificate validation error I'm getting. I'm performing an https request from one machine to another (windows machines). On the destination machine I've configured a ...
0
votes
0answers
28 views

How to generate “CRL numbers” for X.509 CRL

(Context: I'm working a process to publish a CRL periodically -- eg once every day.) With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to ...
2
votes
3answers
97 views

In the context of SSL Labs where is the “trust store”?

When I'm testing a site with https://www.ssllabs.com/ssltest/ I'm getting this: Could you explain: Why are there two paths? Where do they come from, where are they configured? What is this "trust ...
-1
votes
1answer
86 views

SSL and Fake Domain

I am reading information related to SSL handshake on the Internet. It seems like in the last step the domain name is compared to the domain in the certificate. How exactly is this protecting against ...
1
vote
1answer
58 views

EC private key, RSA certificate. Is this realisable?

I was wondering if is it possible to generate EC private key: openssl ecparam -name sect571r1 -out ecparam.pem openssl ecparam -in ecparam.pem -genkey -noout -out eckey.pem then generate ...
1
vote
1answer
67 views

Extract public information from p12 without having the password

I know this question was already asked here but unfortunately there are no satisfactory answers. Please correct me if I'm wrong, but if I have a p12 file the following two situations are possible: ...
2
votes
1answer
67 views

is x509 certificate signed by ca valid?

I've got certificate 'sample cert' which is valid to '2015-12-31' but it was signed by root CA certificate. But when it was signing CA cert was valid to 2015-06-30'. So my question is, is today ...
2
votes
0answers
20 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
2
votes
0answers
43 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time ...
1
vote
1answer
117 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
1
vote
1answer
63 views

Create PKCS7 signature, signed by X.509 CA, which embeds an XML file

I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within. How to do that with OpenSSL or any other tool?
2
votes
1answer
67 views

Extract the content of PKCS7 file in Java

I have a PKCS#7 signature that have the content‐type signed data and it embeds an XML document, and I have to extract the xml document from this PKCS7 file. Anyone know how to do that in java ??
2
votes
1answer
112 views

Squid SSL Bump - getting “unknown issuer” despite having certificate, do I need CA?

I am using pfSense on the gateway of my network. I configured Squid and enabled the HTTPS filtering. I created the internal CA and configured Squid to use this internal CA for SSL Bump. Now the ...
0
votes
0answers
48 views

What is the cheapest kind of SSL cert I need for multiple sites on multiple servers? [duplicate]

Quick SSL question What is the cheapest kind of ssl cert I need? I have two servers, one windows vps with a static IP and another linux reseller with 2 domains attached and a shared IP. Ideally ...
1
vote
0answers
66 views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
2
votes
2answers
88 views

Why is it fine for Certificates above the end-entity certificate to be SHA1 based?

I have heard about the phasing out of Sha1 based certificates for end entity use, and the steps that are outlined for chrome to display progressively more aggressive warnings for Sha1 certs not ...
2
votes
2answers
58 views

Can an embedded CRL be trusted?

Embedding CRLs in a signed document will allow the signature to be validated "long term", by providing a snapshot of the signer's state the moment the document was signed. Im wondering if these ...
3
votes
1answer
48 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...
0
votes
2answers
146 views

Authenticating Hotmail's certificate and connection security

I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or ...
1
vote
1answer
57 views

sftp first connection before exchange cert

If a client connects for the first time to a server via SFTP, the first connection before receiving the server certificate is transmitted in the clear?Let me explain: it is assumed that the client ...
1
vote
1answer
52 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
0
votes
2answers
39 views

TLS Certificate domain-expectation

If I request the Cert from example.com and the server answers with the (legit) certificate from notexample.com, will the browser throw an error?
2
votes
3answers
42 views

PKI usage in a cluster; per application instance or per application?

I'm having a cluster with nodes (let's call them A and B for the sake of example) running identical micro services (1, 2 and 3 - so the application 2 running on node A is called A2). The applications ...
0
votes
3answers
255 views

What can I do to rely less on certificate authorities?

I never trusted and liked CA's and in fact I removed a lot of them from my devices. But now after this question I'm wondering if I should generate my own certificates for the sites I care (e.g, like ...
0
votes
2answers
49 views

Sniffing TLS / SSL through HSTS?

Imagine the following: Client C wants to communicate with server S. The evil attacker A is the Man-In-The-Middle. C sends a request to S, A intercepts it. A creates a self-signed certificate with ...
1
vote
2answers
44 views

Is there a PKCS certificate format that signs ASCII data?

Is there a PKCS #x already out there that was designed to sign ASCII data and protect it from manipulation? I was originally guided to PKCS #7, but based on posts here it looks like the data is not ...
5
votes
2answers
379 views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
4
votes
1answer
82 views

distributing SSL certificates?

I'm only familiar with SSL certificates in a simple-use case: I've installed them to websites, Windows servers, and a few Linux servers. I'm now faced with the task of securing every possible device ...
0
votes
1answer
98 views

Faking and injecting cryptographic certificates

Suppose as an attacker I provide a fake certificate to a user.A warning pops up on her window but she decides to continue anyways.Is my fake certificate now added in her browser's trusted certificate ...
1
vote
1answer
110 views

Create OpenVPN/easy-rsa certificate from public key only

I have been using easyrsa to generate client certificates for my application using the method described here. The build-client-full command generates a fresh private key for each client. This is what ...
2
votes
1answer
56 views

Identicon for SSL certificate

I have a few self-signed certificates that I use, and I find it tedious comparing the entire hex value of the hash when accepting it in a new location. To be honest I usually just look at the first ...
3
votes
2answers
584 views

Obsolete cryptography (SHA1) warning although certificate uses SHA256

I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message: Your connection is encrypted with obsolete cryptography. The connection is encrypted using ...
2
votes
1answer
35 views

Certificate identification that is renewal safe

We currently use some certificates in our application and we identify them by using the certificate's thumbprint. Like this: <serviceCertificate> <certificateReference ...
1
vote
1answer
96 views

Are there any security disadvantages of using production SSL certificate in non-prod environments?

My client has a wildcard certificate *.thierdomain.com that they are using for half a dozen of production web sites. For each of theses sites there are duplicates in several environments, dev, qa, ...
2
votes
2answers
71 views

Certificate chaining:Intermediate Certificate Authorities

Wikipedia says: For example, if a certificate issued to "example.com" and issued by "Intermediate CA1", and the visiting web browser trusts "Root CA", trust may be established in the following manner: ...
4
votes
2answers
123 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
4
votes
3answers
85 views

Why does Windows have a place to store intermediate SSL certificates?

As I understand the process of verifying a remote computer's SSL certificate, the remote system sends its 'leaf' certificate and any intermediate certificates, but not the root certificate. Executing ...
14
votes
1answer
2k views

PayPal encrypted with obsolete cryptography

My Chrome just complained from PayPal's security, similarly to this issue: Google Chrome "Your connection to website is encrypted with obsolete cryptography" The identity is verified, but ...
1
vote
1answer
49 views

Machine certificates for accessing a web app in IIS only from an specific PC client

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
8
votes
1answer
7k views

Firebug reports SHA-1 certificate error

For the script at the bottom of this post, Firebug reports the following error: This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that ...
1
vote
0answers
14 views

using crt for encrypting files/texts [duplicate]

I work with GPGTools under Mac where, after creating a public/private key pair for myself, I usually get .asc from other users, import it and then I'm good to go. Now, I got an actual certificate from ...
9
votes
1answer
503 views

What are the problems with creating an own CA for intranet?

In the comments to Creating my own CA for an intranet several people strongly advise against creating your own CA for an intranet. Especially: don't do it. Nope. Bad idea. Buy $10 CA signed ...
1
vote
1answer
49 views

Using a minimal set of certificate authoraties

It been known for quite a while now that SSL is more of a security-illusion than a real one. As it's not completely useless, and there's no real alternative at moment (though convergence looks ...
2
votes
1answer
90 views

Client side certificates in IIS for accessing a web app only from an specific PC

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
0
votes
0answers
18 views

Protocol for signing and timestamping documents for e-archive system

we are building system for storing PDF file for long term in database. Before we store PDF file in database we have to: - convert PDF to PDF/A - digitally sign PDF - timestamp it What we don't ...
3
votes
1answer
101 views

IoT Devices and 39 Month TLS Certificate Life

I develop IoT (Internet of Things) devices on small embedded systems, where it is very difficult to update the local certificate once they have been deployed. It really needs to be avoid if it can. ...
10
votes
2answers
955 views

How are digital certificates compared?

I have read about SSL and TLS; I know how RSA works and why digital certificates are necessary (more or less), but I am curious about how we prevent a fake digital certificate. The operating system ...
0
votes
1answer
100 views

Analyzing a TLS connection?

Suppose I want a secure TLS communication between me and myschool.edu. Which of the following should I trust to preserve confidentiality, integrity, and authenticity. Here are the options and my ...
3
votes
1answer
164 views

HSM maintenance

I have a HSM that is an asset within a information security management system and the help desk team tells me that the device is displaying a critical failure alert. So my questions are: Must I ...
1
vote
1answer
81 views

Determine private key size using public certificate [duplicate]

I have a public certificate in a PEM (.pem) file -----BEGIN CERTIFICATE----- MIICsjCCAZqgAwIBAgIJAMA1YIQ2JLXDMA0GCSqGSIb3DQEBBQUAMBExDzANBgNV ... 29V/R9RZOoSBHDzGPL84wm4qojMuwQ== ...