A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

2
votes
2answers
738 views

Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
5
votes
1answer
3k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
1
vote
4answers
1k views

certificate usage for signing and encryption

I have a question for basic operating with certificates in emails and pdfs. Im familiar with public key cryptography. The scenario: In my scenario I want to send a confidential email to a person A ...
1
vote
2answers
2k views

How to test for OCSP?

I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?
5
votes
1answer
220 views

Authentication by Signing or MAC?

I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
6
votes
3answers
1k views

Why are SSL certificates valid only from a certain date?

Each SSL certificate is valid starting from a specific date and up to the expiration date. What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
18
votes
3answers
4k views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, ...
7
votes
1answer
1k views

Choosing an SSL certificate provider

Does it make any difference which provider I get my SSL/TLS certificate from? In particular, what are the pros and cons getting an SSL certificate from Verisign vs getting one from Thawte? Which one ...
11
votes
3answers
5k views

What elliptic curves are supported by browsers?

Wireshark'ed Firefox 3 request. Their names are nowhere documented. Elliptic curve: secp256r1 (0x0017) Elliptic curve: secp384r1 (0x0018) Elliptic curve: secp521r1 (0x0019) What are the supported ...
5
votes
1answer
594 views

What are those nul bytes doing in Certificate Subject CN?

While doing some research with SSL certificates, I found some weird certificates containing nul bytes in their Subject field. One example is www.refah - bank.ir (did the Iranian government fake this ...
4
votes
1answer
159 views

How powerful are top Verisign executives?

I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a ...
11
votes
2answers
7k views

How to set “Not Before” value to past when creating certificate request

We have lots of embedded TLS clients on the field. TLS Servers must be authenticated. Because long power cuts may reset clock of those devices, we have requirement to use certificates with validity ...
3
votes
1answer
611 views

Internal CA for Digital Signature Solution - PKI Based

I'm trying to set up a digital signature solution which would work with a internal PKI. We have considered Microsoft Certificate Services, but we don't want to rule out any other option to set up a ...
1
vote
1answer
472 views

How effective is Activesync Certificate revocation using CRL or OCSP

We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords. One way to remedy an account lockout issue is to issue and deploy certificates ...
4
votes
1answer
7k views

Enhanced Key Usage vs. Extended Key Usage

I've seen both the terms Enhanced Key Usage and Extended Key Usage, and both were abbreviated as EKU. Do both refer to the same extension or property?
74
votes
10answers
20k views

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
9
votes
1answer
1k views

Certification authority only for certain domains

Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
2
votes
2answers
5k views

HTTPS verification failed - get certificate information iPad/iPhone

I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
8
votes
1answer
3k views

Why do X.509 certificates have “Key Usage” attribute?

I can find their values and all details in the RFC, but I cannot find why it was decided to have this attribute in certificates, instead of leaving them to be multipurposes. Is there a reasoning ...
13
votes
1answer
7k views

Which properties of a X.509 certificate should be critical and which not?

RFC5280's section 4.2 states Each extension in a certificate is designated as either critical or non-critical. A certificate-using system MUST reject the certificate if it encounters ...
1
vote
1answer
706 views

How to troubleshoot why Thunderbird rejects a PKCS#12 certificate with “Could not verify this certificate for unknown reasons”?

After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a ...
1
vote
2answers
20k views

Error code: sec_error_untrusted_issuer

I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
1
vote
2answers
375 views

certificate based network authentication

In certificate based network authentication, is the user tied to just the system the certificate has been installed on such that if he tries to authenticate using another system access is denied?
2
votes
1answer
1k views

What is the difference between `extendedKeyUsage` and an application policy?

In some Microsoft articles like http://technet.microsoft.com/en-us/library/cc731792%28v=ws.10%29.aspx, I find some confusing statements like Application policies are sometimes called extended key ...
3
votes
2answers
5k views

Protecting against SSL Strip [duplicate]

I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe? Does it depend on the cert strength? Do you ...
0
votes
2answers
916 views

OpenID without SSL certificate

Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed? Just to make things clear, ...
3
votes
2answers
4k views

Ssl certificate rekey or revoke

I want to be sure to understand well the situation where SSL certificate is compromised. If I ask for a rekey, I suppose the old certificate will remain valid. The future communications with the new ...
2
votes
3answers
587 views

Are intermediate signing certs the only secure+practical way to manage OpenVPN client certs?

My organization needs to issue (and revoke) OpenVPN client certificates for people working remotely. Our system is based on a standard OpenSSL CA setup and the easy-rsa tools, and the whole directory ...
4
votes
1answer
169 views

How to secure a certificate internally

Say I have a certificate which I use to sign the software I ship. This happens in the (daily or more) build on the buildserver (Windows machine). Easiest solution would be to put the certificate file ...
4
votes
1answer
475 views

Cellphones IMEI public exposed?

Currently I'm in the middle of a developement process, and I have some security questions for you. I have a webservice, asp.net which is configured to run over https. The first authentication step for ...
5
votes
1answer
5k views

Which extensions to use for a S/MIME certificate?

Analogously to the SSL server certificate question, which extensions should I use for S/MIME, and should the CA be restricted somehow as well? (I'm using openssl, which at the moment creates CA and ...
137
votes
5answers
97k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
0
votes
2answers
1k views

“Premium SSL” vs “Stanard SSL” certificates - Any reason why I would want a “Premium SSL”? [duplicate]

Possible Duplicate: What are the advantages of EV Certificate? besides the green URL bar and free security scan and whatnot. Our website does NOT accept any personal info other than email ...
6
votes
4answers
4k views

Is it possible to create a self signed certificate authority?

Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious. To explain my question : Suppose I sign a public ...
54
votes
2answers
126k views

Difference between .pfx and .cert certificates

What is the difference between .pfx and .cert certificate files? Do we distribute .pfx or .cert for client authentication?
2
votes
0answers
768 views

SSL Certificate Authentication Issue 403.7 [closed]

I have been trying to configure SSL for authentication and was unable to resolve this error 403.7 on IIS 7.5 windows 2008r2 vps server. I would like to give access to few computers where client ...
1
vote
1answer
895 views

Behavior when validating an expired certificate chain

I have the following situation: A server certificate (CServ) is signed by self-signed certificate (C0) A client certificate (CCli) is signed by CServ Client's trust-store contains C0, so the client ...
4
votes
2answers
220 views

How can an “alternate” or duplicate HTTPS certificate be used in an attack?

Inspired by an old question from PulpSpy, I'm trying to think of whether this is a significant weakness in the Certificate Authority system. Here are the attack methods that I think would work - ...
8
votes
1answer
2k views

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
11
votes
2answers
13k views

Encrypting local HTTP traffic using a self-signed certificate

For the past couple of hours I've been trying to create a self-signed certificate which I'd like to use to encrypt HTTP traffic between computers and a server on my home network (because I'm paranoid ...
4
votes
2answers
227 views

How to verify certificate with very little information

Lets assume there is a server and a client and you want to connect those two. Server has a self-signed certificate, and prior to establishing the connection for the first time (enrollment) the server ...
13
votes
4answers
2k views

Can real end-to-end SSL encryption be made?

I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate. I've got a very precise question but first I need to give some background. Basically I'm very ...
53
votes
9answers
17k views

Should I change the private key when renewing a certificate?

My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
8
votes
2answers
10k views

What damage could be done if a malicious certificate had an identical “Subject Key Identifier”?

I'm looking at the the Subject Key Identifier attribute of a CA certificate and am trying to understand the role it plays in validation and infer how validating client software could get it wrong. ...
3
votes
1answer
235 views

Is it a good idea to generate certificate-specific CRLs? What is this technique called?

Suppose I create 3 certificates with the following CRLs Cert1 http://crl.server.com/batch1/root1.crl Cert2 http://crl.server.com/batch2/root2.crl Cert3 ...
3
votes
1answer
2k views

What should a CRL file name look like when “new” and “delta” CRLs are generated?

I suspect my Windows 20012 Certificate Server CRL revocation configuration is incorrect every time I generate a new CRL or a new Delta, only a maximum of 3 files are generated. When I created the ...
2
votes
1answer
5k views

What Enhanced Key Usages are required for PKI infrastructure tasks? (OIDs for OSPF and CRL signing, etc)

I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks. I understand that clients may not validate the ...
5
votes
2answers
7k views

Extensions for SSL server certificate

I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
6
votes
2answers
6k views

Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?

Suppose I have several independent PKIs that are used Two internal PKIs: One with SHA1 support the other with Suite B algorithms. A partner who I trust and have a policy map with. Since both my ...
3
votes
1answer
1k views

What happens to a certificate's Basic Constraints when a policy map is used?

One feature of a Basic Constraint when applied to a certificate (CA or end certificate) is that I can specify the maximum number of CAs that are permitted in the chain. I'm planning on having a 2 ...