A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.
7
votes
7answers
206 views
Proving running code on a website is unchanged
Can it be proved to the user that the running code behind a website with security related code is the same as published?
I'm currently looking at a few new project ideas and one involves secure ...
7
votes
1answer
237 views
Why is there no Domain CA?
I was asked to deliver a signed SSL certificate for an IIS server for a client.
I have previously done this for the same client/domain before, so it start to seem like
an unnecessary expense to hold ...
7
votes
1answer
852 views
Should I regenerate new SSL private key yearly?
Im' renewing my certificate every year. Since I have to make a CSR, should I also renew my key pair at the same time, or is it ok to get a new cert with the same key ?
Please supply any security ...
7
votes
4answers
1k views
Can Javascript/Flash verify the SSL connection to prevent “SSL Inspection”?
I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy.
So some people may ask
What is the point of re-validating SSL using javascript?
...
7
votes
1answer
140 views
Does dnssec protect against malicious registrars?
With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).
This is especially ...
7
votes
2answers
282 views
X.509 certificate policies question
I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies.
To quote from the X.509 RFC:
In an end entity certificate, these ...
7
votes
1answer
150 views
distributing files to VPN partners
suppose i've created VPN certificates for a certain VPN-RoadWarrior-Client, expressed in the files VPN-RoadWarrior-Client.key and VPN-RoadWarrior-Client.crt*, however VPN-RoadWarrior-Client is ...
7
votes
1answer
253 views
How do i store Diffie-Hellman parameters in a X.509?
In there paper Authentication and authenticated key exchange Diffie, van Oorschot and Wiener recommend to insert the DH parameters into the certificate of Alice. As a result an attacker can not change ...
6
votes
2answers
790 views
Getting self-signed SSL certificates for all https connections made from some premises
Context:
I'm currently working as an expat for my company in a country where the Internet is notably untrustworthy. It made the headlines a few months ago for stealing facebook, twitter and gmail ...
6
votes
3answers
188 views
Renew digital certificate
If I have deployed a digital certificate on a webserver and if it needs to be renewed then what steps do I need to follow? Will I need to generate a new longer public key private key pair? Why do ...
6
votes
3answers
424 views
Personal digital certificate how to verify
A server certificate would have its domain name at its subject field. A personal certificate would have your name as the subject field. How can you be sure that there are no two certificates with the ...
6
votes
4answers
3k views
What certificates are needed for multi-level subdomains?
I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy.
Here's what I need to secure:
...
6
votes
3answers
315 views
Why are CA's signing keys available on the internet
I am not very knowledgeable about CA certificates, but I thought these things mainly said
"The public key for bank X is Y, and this is verified by CA Z".
Once you've bought this certificate, there is ...
6
votes
1answer
2k views
What is the actual value of a certificate fingerprint?
In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
6
votes
2answers
372 views
security of PKI, Certificates, certificate authorities, forward secrecy
I want to understand how certificates add to the security of information exchange.
Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
6
votes
3answers
923 views
Certificate chain
For my computer to verify the identity of a certain certificate should it have all the certificates up to the root certificate?
6
votes
2answers
678 views
How is certificate forgery with cheap CA's prevented?
In order to perform a successful man in the middle attack on HTTPS, one needs to either strip SSL layer and convert it to HTTP completely or needs to have a valid certificate from a CA for the same ...
6
votes
3answers
175 views
What risks would exist in transmitting an encrypted PKCS12 via Https
I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate ...
6
votes
3answers
236 views
On-line cryptographically signed date/time?
I’m looking for a source of on-line cryptographically signed date/time. I do not need a full timestamp service, as I am happy with the information « date/time was that », without a link to a ...
6
votes
1answer
1k views
How does adding a random serial number improve a certificates' security?
This article says:
"Finding collisions is a tricky process, since it requires you to muck
with the bits of the public key embedded in the certificate (see this
paper for more details). Also, ...
6
votes
4answers
416 views
Alternative to “web of trust”
Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
6
votes
2answers
151 views
Limiting the root certificate chain
I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
6
votes
1answer
420 views
How do I learn Cryptographic/Mathematical notation
I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation.
How do I learn this notation and how to convey my approach?
How can I annotate this ...
5
votes
6answers
708 views
Should the bit-strength selection of a child certificate be influenced by the CA or the chain?
All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
5
votes
3answers
3k views
What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?
I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider.
Question 1 Why ...
5
votes
3answers
2k views
Any good free SSL proxy on windows?
I'm looking for SSL proxy capable of dumping requests.
I want to test custom browser against SSL-MITM attacks.
I'm able to re-route all traffic ongoing from browser to machine with proxy.
...
5
votes
3answers
847 views
How do I check that I have a direct SSL connection to a website?
I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
5
votes
5answers
159 views
A standard way to manually add a digital signature to a pdf file?
I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
5
votes
3answers
237 views
Digital Signature and Verification?
AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it.
So public key is used to decrypt ...
5
votes
4answers
232 views
What fields in a suspicious certificate should I look at?
Looking at a certificate for a web-site (in Windows/Google Chrome) I see it lists the following fields
Version
Serial number
Signature algorithm
Issuer
Valid from
Valid to
Subject
Public Key
Basic ...
5
votes
1answer
152 views
SSL CipherSuite Choices
In SSL/TLS, is the CipherSuite chosen by the server or the client? Also, can the certificate in any way dictate or modify the CipherSuite?
5
votes
4answers
442 views
Is it safe to send a CSR via email?
I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?
5
votes
1answer
70 views
Is it possible to have multiple key lengths in PKI?
Is it possible to have multiple key lengths in a PKI? For example, use a 1024-bit key for the issued certificate, a 2048-bit key for the intermediate certificate, and 4096-bit key for the root ...
5
votes
1answer
179 views
Which attributes of a X509v3 certificate are never really used?
Are there any extensions/extended key usage attributes of a X.509Certificate that are rarely or never used in practice?
Either due to never being part of an issued certificate or because they are ...
5
votes
4answers
4k views
Recommendations for a Certificate Management tool for Linux
A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients.
This creates a new challenge to manage all these certificates and ...
5
votes
1answer
15k views
How do I clear cached credentials from my Windows Profile?
Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data.
How can I backup and purge this data?
5
votes
3answers
256 views
Why is it a good idea that X.509 digital certificates have an expiry date?
What is the benefit of having certificates expire at some fixed date?
5
votes
1answer
192 views
How protective should we be of an SSL client certificate?
We've got an application where the database connection requires an SSL client certificate. How protective do we need to be of this certificate? What are the implications if someone else gets it?
I ...
5
votes
1answer
44 views
'Trusted CA Certificates' and 'Trusted remote Certificates'
What is the difference between Trusted CA Certificates and Trusted remote Certificates?
5
votes
2answers
143 views
ASN.1: ENUMERATED vs INTEGER
From the X.509 specs:
CRLReason ::= ENUMERATED {
unspecified (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
...
5
votes
1answer
3k views
Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?
I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug?
I'm on a WPA2 encrypted wireless connection using Chrome ...
5
votes
2answers
161 views
What kind of certificate do I need to be able to sign my own subdomain certificates?
We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...).
...
5
votes
2answers
1k views
Dealing with expired or revoked signing certificates with Infopath documents
Suppose I have an Infopath form that is digitally signed today by a valid, and active user.
When that user leaves the company, we disable the account and revoke the certificate. This causes a problem ...
5
votes
2answers
226 views
Adding custom data in X.509 certificate
I am using SSL with client authentication. I need to send some extra data while sending the client certificate? Can I send it in the certificate? Can I use the extension fields in certificate for that ...
5
votes
1answer
68 views
Authentication by Signing or MAC?
I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
5
votes
1answer
211 views
PKI solution vendor selection
What would you look for in a (X.509-) PKI solution, and why would you look for that, given the following constraints:
Available programming/sw-engineering know how is limited (ie, "OpenSSL with a ...
4
votes
7answers
897 views
What is the danger of hosting your SSL certificate yourself?
I have Active Directory Certificate Services on my server, which makes it possible for me to deliver an SSL certificate for the websites hosted on the same server.
I know that normally, I need to ...
4
votes
3answers
206 views
Are SSL certificates from a CA necessary for secure communication?
Am I right in thinking that SSL certificates from a CA are purely for identification purposes and serve no purpose in the actual encryption of data? In other words if I were to create a self signed ...
4
votes
5answers
440 views
Is Spoofing a CA signed certificate possible?
I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway.
When a communication starts with a server, during the client handshake, the ...
4
votes
3answers
216 views
System time and certificates
Recently I accidentally changed the system time to a different month, and then I surfed to a secure site. I got a warning from Google Chrome that mentioned my system time and said the certificate ...
