A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

66
votes
2answers
34k views

ssltest: Chain issues - Contains anchor

I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)") What does it mean? Should it be fixed? Can it be exploited?
-1
votes
1answer
154 views

XER encoded X.509 certs [closed]

Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it? Thanks!
8
votes
2answers
1k views

How is certificate forgery with cheap CA's prevented?

In order to perform a successful man in the middle attack on HTTPS, one needs to either strip SSL layer and convert it to HTTP completely or needs to have a valid certificate from a CA for the same ...
2
votes
3answers
2k views

Public key Infrastructure

Here the MD5 hash is being encrypted with the private key of the sender. But I read in a paper that private key is only used for signing and not encrypting. Is the image wrong or can private key ...
5
votes
3answers
982 views

Issuing SSL certificates for device automation software package without domain names

We are developing the automation software for Windows which communicates with the certain devices via our own private connection protocol. That software package consists of several server (including ...
5
votes
2answers
200 views

How can a certificate be valid in the Hybrid Model but not in the Chain Model?

All dates in European format! I am learning about validity models, but the solution for this assignment confuses me. Translation: The relevant data for the applicable certificates are shown ...
4
votes
3answers
1k views

How do you verify a certificate belongs to a domain?

I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to. Currently I can verify the certificate is valid using the following code $resource = fsockopen( ...
14
votes
1answer
13k views

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
1
vote
1answer
545 views

When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?

When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism? Related information on a different answer Consider using HTTP instead ...
5
votes
1answer
5k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
1
vote
2answers
299 views

Secure cookies and Path Length Constraint

Using apache 2.2.3 on oracle enterprise linux. When setting following setting in httpd.conf: Header edit Set-Cookie ^(.*)$ $1;Secure , cookie generation (which happens on our registration page) ...
6
votes
3answers
10k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
2
votes
2answers
1k views

distribution mechanisms for CRLs

From the X.509 RFC: DistributionPoint ::= SEQUENCE { distributionPoint [0] DistributionPointName OPTIONAL, reasons [1] ReasonFlags OPTIONAL, cRLIssuer ...
2
votes
2answers
11k views

How to get private key from certificate and base 64 encoded key?

Sorry for the poor question. Suppose I have a certificate of the following lines: -----BEGIN CERTIFICATE----- //22 Lines of encoded junk -----END CERTIFICATE----- And then this base64 encoded ...
2
votes
3answers
2k views

Key Exchange using PKI

I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl openssl req -x509 -nodes ...
38
votes
4answers
7k views

What alternatives are there to the existing Certificate Authority system for SSL?

Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
1
vote
2answers
257 views

Certificate security in intranet environment?

We have this topology in our company: A new rule says that each document being sent by Outlook should be encrypted. We decided using PGP. We already have a certificate (self-signed). The problem ...
1
vote
0answers
152 views

Why not buy cheap SSL certificates? [duplicate]

Possible Duplicate: Is there any technical security reason not to buy the cheapest SSL certificate you can find? The comparison in Godaddy's website, makes it clear: they're just cheaper ...
5
votes
1answer
681 views

Which attributes of a X509v3 certificate are never really used?

Are there any extensions/extended key usage attributes of a X.509Certificate that are rarely or never used in practice? Either due to never being part of an issued certificate or because they are ...
12
votes
2answers
2k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
12
votes
5answers
2k views

Why is this certificate valid for so many domains?

If you look at the (invalid) certificate for https://i.imgur.com/ it says only valid for the following names: The certificate is only valid for the following names and then a list of about 100 names. ...
3
votes
1answer
2k views

What are the Netscape Cert Type attributes? Why/when are they needed?

What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions? Example: There is the Client/Server Extended Key Usage (X.509) but there is ...
3
votes
1answer
1k views

Can Diffie-Hellman Anonymous be used as a cipher for SSL for one-way certifiate-based authentication

I want to use Diffie-Hellman anonymous cipher for SSL. I also want to use a one-way certificate for server authentication. Is this possible?
17
votes
4answers
5k views

What is the potential impact of these SSL certificate validation vulnerabilities?

I just finished reading through this paper by Georgiev et al, which demonstrates a wide range of serious security flaws in SSL certificate validation in various non-browser software, libraries and ...
4
votes
2answers
195 views

What is the state of the Windows Update certificate after Flame?

May 28, The Flame malware is discovered in Iran and by Kaspersky Labs. June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
2
votes
2answers
1k views

Revoked certificate validation using past times

I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past. Unfortunately I have problems verifying revoked ...
6
votes
2answers
1k views

ASN.1: ENUMERATED vs INTEGER

From the X.509 specs: CRLReason ::= ENUMERATED { unspecified (0), keyCompromise (1), cACompromise (2), affiliationChanged (3), ...
5
votes
2answers
3k views

What are the implications of adding a self signed certificate to the Windows Trusted Root Certification Authorities store?

I'm a budding website developer, so please bear with my ignorance. Say I had to encrypt my website with HTTPS and I got sick of having to click "Continue" every time a warning came up about an ...
2
votes
1answer
137 views

Which .CER file format is more secure for purposes of an AIA record?

What file format is most appropriate or secure for the AIA record in a PKI certificate? The options I'm aware of are: DER encoded binary X.509 (.cer) Base-64 encoded X.509 (.cer) I also have the ...
1
vote
1answer
196 views

What keys are involved in an X.509 certificate?

I'm trying to examine some instances where an X.509 certificate uses public and private keys for a paper I'm going to write. However, the only thing I have explicitly seen so far is in one of the ...
3
votes
2answers
3k views

x.509 CRLs: next update?

An X.509 certificate revocation list contains a field specifying when the next such list is expected to be issued. I'm trying to figure out the importance of this field...I know that sometimes ...
5
votes
3answers
2k views

Digital Signature and Verification?

AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it. So public key is used to decrypt ...
10
votes
2answers
10k views

How is an X509 certificate signer verified?

Lets say I create a self-signed X509 certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question ...
2
votes
1answer
171 views

How can I determine if a CA Cert can be used for DPI-SSL

I would like to know if a CA Cert I installed can be used to perform DPI-SSL decryption without my knowledge. Would there be any indication? Can you look at the cert properties to determine if it can ...
661
votes
3answers
341k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the ...
6
votes
3answers
926 views

What risks would exist in transmitting an encrypted PKCS12 via Https

I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate ...
6
votes
2answers
208 views

Using a verified certificate to sign others

This relates to PKI and certificates generally but websites more specifically. Could you get a verified certificate from a CA that is signed and fine for use, and then use it to sign your own ...
5
votes
1answer
88 views

Standards for CA cert revocation and time-constrained cryptographic algorithm parameters

I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
1
vote
1answer
2k views

SSL handshake failure [closed]

I am using shibbolet for single user authentication and it needs a ssl configuration which facilitates the user authentication process. Before it was working fine but now I am facing a SSL handshake ...
5
votes
1answer
120 views

Is it possible to have multiple key lengths in PKI?

Is it possible to have multiple key lengths in a PKI? For example, use a 1024-bit key for the issued certificate, a 2048-bit key for the intermediate certificate, and 4096-bit key for the root ...
3
votes
1answer
263 views

CMC (RFC 5272) compatible CA server

I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
2
votes
2answers
696 views

Code Signing: Change certificate attributes during renewal?

I'm quite new to code signing and could not find clear answers to the following general questions so far. It would be great if someone could clarify/explain the logic behind this and point me in the ...
4
votes
3answers
488 views

Does the following data stream look secure to you?

I understand the basic concept of SSL but maybe I am missing the point. Please could someone take a look at the following part of a test log to a server and tell me if it looks secure. My concerns are ...
3
votes
1answer
135 views

Within a CSR, is there a field to have the MS PKI server change the default cert filename

I'm not intimately familiar with MS PKI, but it was a question that came up in a discussion for an issue a coworker is having. When you input the request fields manually on a PKI server, the cert ...
9
votes
8answers
5k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
4
votes
2answers
440 views

Are Windows Updates susceptible to tampering, eg. using a MiTM attack.

My real question is how are patches and updates authenticated in general. But for example how does windows know a windows update is really a windows update, does it just trust the URL or is there some ...
4
votes
2answers
363 views

Is OpenVPN secure if both the certificate and private key, are publicly known?

My ISP is rubbish and the state of the internet in the UK seems to be heading to 1984. I've started looking at VPNs and stumbled on IPredator as a cheapy test. It gives you the option of OpenVPN and ...
3
votes
2answers
2k views

How realistic and possible is this sort of attack

I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me. Nessus rated this finding's risk as Medium. The finding was, that a service ...
6
votes
2answers
2k views

Adding custom data in X.509 certificate

I am using SSL with client authentication. I need to send some extra data while sending the client certificate? Can I send it in the certificate? Can I use the extension fields in certificate for that ...
8
votes
1answer
2k views

How do I store Diffie-Hellman parameters in a X.509 certificate?

In there paper Authentication and authenticated key exchange Diffie, van Oorschot and Wiener recommend to insert the DH parameters into the certificate of Alice. As a result an attacker can not change ...