A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
0answers
14 views

keytool commands to replace existing SSL certificate? [migrated]

I've a linux centos server running glassfish 3.1.2 app server. The default certs coming from GlassFish install for ports 4848 and 8181 are 1024 bits. I need to replace these with 2048 bits versions. ...
2
votes
0answers
47 views

How can I restore my Windows certificate cache so I only have those from trusted CAs? [duplicate]

All this talk about Superfish and other adware crap has made me healthily paranoid that a wrong certificate can enter my certificate cache at any time. I have no reason to assume that there is a ...
0
votes
1answer
72 views

Create certificate without private key with OpenSSL

I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely ...
1
vote
2answers
120 views

How to be sure laptop's trusted certificates are safe

I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification ...
0
votes
0answers
38 views

How to associate an oAuth token with a particular user. Is this possible?

We have HTTP Rest services and SignalR (aka Web sockets, server send events, etc) for cases in which we need to push data from the server to the Web UI . We are currently using the built in tools that ...
1
vote
1answer
44 views

how to extract a valid digital certificate and put it on other program

I am working on this matter as a graduate, but I need some help. how can extract a valid digital certificate to put it on other program? can I put a digital certificate on other executables and be ...
54
votes
4answers
6k views

Why was the private key of the Superfish certificate so easily extractable?

Robert Graham detailed on the Errata Security blog how he was able to get the private key of the Superfish certificate. I understand that attackers can now use this key to generate certificates of ...
0
votes
0answers
29 views

Additional security for services hosted on a 2FA or Multi-Factor Authenticated Network

I am aiming to lock down a web service that accesses other services and has a publicly facing UI. I have a hosted service on a network that requires 2-factor authentication to access. This service's ...
1
vote
0answers
24 views

Certificate advice for deploying code-signed software as a 3rd party vendor

I am in the process of developing an application for an organization, and am looking for a sanity check on my strategy, especially given the the nature of the SuperFish nonsense that was exposed. The ...
1
vote
0answers
26 views

How can i know my security level as “ SSL 256 bit encryption” [duplicate]

I am using openssl tool to create certificate self-signed certificate I have known that [2048 bit SSL] it is the length of the public key then what about [256 bit encryption] how can i know type of ...
3
votes
1answer
37 views

Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?

If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA. The use case is that some clients have ...
1
vote
0answers
20 views

Proxpy- certificate issue

I am using proxpy, a proxy server written in Python. It comes with its certificates and after installing one of the certificates in Firefox, I got 'Connection is untrusted'. Any help in this regard ...
4
votes
3answers
180 views

What part of TLS specifies how to verify a certificate chain

I have sometimes run into a situation where I see a root CA certificate which is set to expire sooner than the intermediate CA certificate. My question is - if you were interested in keeping your ...
4
votes
2answers
87 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
0
votes
1answer
54 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
2
votes
1answer
176 views

Intercepting HTTPS Android app traffic

I'm trying to intercept Android application traffic from my Android phone....Basically what worked before was that i had simply installed fiddler proxy on my PC, exported the root certificate (and ...
3
votes
1answer
76 views

Why do Certificate Authorites cross-sign each other?

A Certificate Authority (CA) issues digital certificates to certify the ownership of a public key by the named subject of the certificate. What is the rationale for CAs cross-signing each other (i.e. ...
2
votes
2answers
122 views

How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)

I'd like to have my server APIs only accept requests from my own app, to prevent other "rogue" clients of my service. As i understand it, the way to do this would be with a "client certificate" that ...
-2
votes
2answers
100 views

How do certificates stop this man in the middle attack?

Alice and Bob are trying to set up a secure conversation, but unknown to them in the middle is Eve, who can intercept and modify all packets sent between them. The communication goes as follows: ...
8
votes
6answers
537 views

Easy explanation of SSL client certificates for a developer

I've been thinking about using client certificates for my web apps, desperately hoping for security-conscious users to put their private key on HSMs so they don't get stolen even if the machine is ...
2
votes
2answers
194 views

If your company/university requires you to install root certificates what protects you from man in the middle attacks?

Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is ...
0
votes
1answer
65 views

Is it possible for a successful domain hijacker to fraudulently use the certificate issued to the real owner of the domain name?

In other words, while visiting https://www.mybank.com, for example, can I always trust the site as long as I click the padlock in the address bar of my browser and find no problem with the ...
27
votes
4answers
2k views

Can any CA sign any domain?

Can any CA sign any cert for any domain? If the answer is yes, what prevents having two different CAs creating a valid cert for the same domain? Does that mean that the whole TLS security has the ...
0
votes
2answers
105 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
1
vote
2answers
128 views

Are there other roots of trust on my computer aside from these 46 root certificates?

I've heard many people imply that modern browsers and OSes trust a myriad of root certificates. The implication is that it is impossible to ensure the private keys of all of the root certificates ...
2
votes
1answer
76 views

Is an SSL/TLS HTTPS certificate 'fingerprinting' attack possible?

If you download a friend's site's unique HTTPS root certificate (independent of default browser-shipped ones), or you simply make a 'permanent exception' to an obscure self-signed cert, in Firefox, I ...
2
votes
2answers
87 views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a ...
2
votes
2answers
60 views

Using digital certificates in digital signatures

Please could anybody explain to me how certificates are used with digital signatures? I understand difference between certificates and signatures. It is clear. Digital certificates are used to ...
4
votes
3answers
39 views

Certificate Issuer is Network Company

I simply want to know if is this normal, abnormal, deceptive, illegal, etc... I am at work. When I bring up a certificate for most domains, I get a very standard certificate. When I bring one up for ...
4
votes
1answer
35 views

Mail Signing Certificate – What are the impacts when revocated?

Suppose I open a signed mail on 1st January 2000, signature is OK. What about this two cases : 1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
1
vote
2answers
131 views

Does Renewing SSL certificate change its thumbprint / Fingerprint

I would like to know, if renewing a SSL certificate will change my thumbprint? The certificate has expired. If it can be same then under what conditions can it remain same. Many thanks in advance.
2
votes
1answer
48 views

Is client cert authentication with a 3rd party PKI cert any safer than using self-signed?

I am working on a small M2M project (a few hundred nodes connected to a single cloud server), and want to use client certificate authentication, with each client getting its own unique cert at ...
101
votes
6answers
8k views

I can't access websites that use HTTPS, instead getting the message “your connection is not private”!

I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But ...
0
votes
2answers
62 views

Current standard of authentification

What is the current standard of authentification? I thought it is server and client authentification. But I typed for e.g. https://www.google.com/ and checked the packages in wireshark. And there ...
1
vote
1answer
53 views

Digital signatures and weak hash functions

There was this question in last year's exam. The teacher claims that answer b) (in boldface below) is correct. Attacks are constantly being performed on digital signatures which use weak hash ...
1
vote
1answer
75 views

Generating x509 PEM files for testing PEM parser

I need to test a parser of PEM formatted certificates. Thus, I need to generate many variations including variations that are invalid for various reasons. Obviously I can use openssl or a library like ...
0
votes
1answer
34 views

Obtain X.509 Certificate Fingerprint from Certificate Info

I would like to obtain the SHA1/MD5 fingerprint of an X.509 certificate in order to compare it with the one presented by a server before connecting. However, I currently don't have access to the ...
0
votes
1answer
39 views

Storage on Root CA and intermediate CA certificate on Embedded device

Regarding the storing of Root CA certificates on an Embedded device Setup Explaination: 1. An embedded device which is a CLIENT on the network 2. There is a SERVER which connects to the CLIENT on ...
2
votes
1answer
37 views

Website Implementing https site w/ self signed certs and CA

Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)? I am some what torn on how to do this - I have a number of implementaiton ...
5
votes
1answer
44 views

Protecting information in TLS client certificates

If I understood correctly, when using TLS with client authentication, the client certificate is transmitted to the server in plain text. The client certificate might include personal information, ...
2
votes
2answers
107 views

Does Ephemeral Diffie-Hellman require a certificate?

In Ephemeral Diffie-Hellman, the key pair is generated every time. In practice, does this mean I never need a certificate? Or that means I need a new cert every single time?
4
votes
2answers
108 views

Why not generate a client SSL with expiration date in very distant future?

In case of server SSL certificate it is issued by a CA which can then recall it until it expired and also the CA typically collects a fee for each certificate so it is interested in certificates ...
1
vote
2answers
169 views

haproxy with client certificate authentication signed by 'common' CA

Excuse me if I posted this here wrongly, I know the question is partly about haproxy itself. I am setting up haproxy as an SSL terminator/load balancer in front of an API that we need to expose over ...
4
votes
1answer
64 views

Wildcard SSL and EV SSL

Is it possible to mix a Wildcard SSL for subdomains and an EV SSL for the www and non-www domain? I know that an EV SSL can't have a wildcard. Example: hello.test.com -> wildcard ssl ...
1
vote
2answers
90 views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
2
votes
1answer
181 views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...
-1
votes
1answer
22 views

What if I have an address-based certificate and a domain based certificate loading HTTPs resources in the background

What if I have an address-based certificate and a domain based certificate loading HTTPs resources in the background, will this change the Lock-Logo in the Browser Address bar? Does an address based ...
0
votes
1answer
97 views

What does this mismatching SSL certificate hint at?

I'm currently visiting China, and I use a well known VPN service for both my laptop and my phone. Every now and then, I get certificate errors when using my phone when I'm connected to a VPN, but ...
0
votes
1answer
100 views

Can I create an SSL certificate on windows signed with the machine's certificate?

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a ...
2
votes
2answers
167 views

Why gpg-signed files differ every time

I signed the same file producing a separate file for the signatures, and I noticed that every file is signed with a different signature. I don't get it. Shouldn't it always be signed with the same ...