A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

5
votes
1answer
297 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
4
votes
1answer
5k views

Certificate verified using two different paths

StartSSL has an intermediate certificate that they use to sign their EV certificates: sub.class4.server.ca.pem. This certificate's issuer is shown by openssl x509 to be /C=IL/O=StartCom Ltd./OU=...
4
votes
3answers
1k views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it -...
4
votes
3answers
1k views

Steps to find out whether a SSL certificate is trustworthy

For doing business with a company I have to browse to https://www.prioenergie.de/nc/mein-prioenergie.html (German website). Firefox says the certificate is invalid, because it is not signed by a ...
3
votes
2answers
512 views

Can I buy a signing-valid certificate for internal use?

So now that I have to implement "secure transport" as defined by The Direct Project (not to mention reinventing a bunch of wheels, but that's another story for SO), I find myself staring down the ...
2
votes
1answer
531 views

Security Certificates - Tools to Generate Security Certificates

I want to create a self-signed certificate that will be installed as a trusted certificate authority. I then want to create another two certificates which are signed using the private key of the self-...
79
votes
4answers
72k views

What certificates are needed for multi-level subdomains?

I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy. Here's what I need to secure: foo....
58
votes
2answers
134k views

Difference between .pfx and .cert certificates

What is the difference between .pfx and .cert certificate files? Do we distribute .pfx or .cert for client authentication?
56
votes
5answers
180k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
16
votes
1answer
4k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
31
votes
4answers
13k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
22
votes
4answers
22k views

Provide subjectAltName to openssl directly on command line

Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line? I know it's possible via a openssl.cnf file but that's not really elegant for batch-...
24
votes
3answers
1k views

A Different Approach to PKI

After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
42
votes
7answers
5k views

Is there any legitimate reason to install yourself as a root CA?

Follow up from comments on another question. Is there any reason as to why you might install yourself as a root CA on your own network? The only reason I can think of is forcing computers in the ...
16
votes
4answers
30k views

Recommendations for a Certificate Management tool for Linux [closed]

A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients. This creates a new challenge to manage all these certificates and ...
22
votes
6answers
8k views

Possibility to sniff HTTPS traffic on devices without installing a certificate

My goal is to sniff the HTTPS traffic of some digital devices (AppleTV, game consoles, etc.), and decrypt the HTTPS packets in my local network. I cannot figure out a way by using some HTTPS ...
31
votes
3answers
27k views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
13
votes
1answer
8k views

Which properties of a X.509 certificate should be critical and which not?

RFC5280's section 4.2 states Each extension in a certificate is designated as either critical or non-critical. A certificate-using system MUST reject the certificate if it encounters ...
30
votes
4answers
5k views

Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?

By my admittedly limited understanding of how HTTPS/TLS works, the end user (me) initiates a connection with a remote server which signs every one of its messages with a public key. This public key ...
27
votes
1answer
53k views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
18
votes
2answers
20k views

Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”

I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain. https://chart.apis.google.com/chart?cht=qr&chs=100x100&chl=otpauth%3A%2F%...
17
votes
3answers
3k views

What happens when an Intermediate CA is revoked?

Currently I'm working on a certificate manager that allows our product to securely connect to remote webservices (over TLS/SSL). For security, we use Certificate Revocation List checking (or CRL-...
14
votes
3answers
283 views

Domain name expiration and TLS

If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
14
votes
2answers
7k views

Is Apple's push notification service implementation vulnerable to a MitM attack

Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2 Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf ...
13
votes
3answers
5k views

What elliptic curves are supported by browsers?

Wireshark'ed Firefox 3 request. Their names are nowhere documented. Elliptic curve: secp256r1 (0x0017) Elliptic curve: secp384r1 (0x0018) Elliptic curve: secp521r1 (0x0019) What are the supported ...
12
votes
2answers
2k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
8
votes
4answers
1k views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
7
votes
3answers
11k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
7
votes
6answers
1k views

Easy explanation of SSL client certificates for a developer

I've been thinking about using client certificates for my web apps, desperately hoping for security-conscious users to put their private key on HSMs so they don't get stolen even if the machine is ...
7
votes
1answer
4k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
29
votes
2answers
5k views

Is it safe to send SSL certificates via email?

I just ordered a cheap Comodo PositiveSSL Certificate via a UK reseller, and I was rather surprised to find that the following files were emailed to me automatically, in a zip file: Root CA ...
16
votes
3answers
2k views

Why is it more secure to use intermediate CA certificates?

I've read that using Intermediate CA certificates is more secure because this way the Root CA is offline. So, if the Intermediate is compromised it does not impact the Root CA. What I understand is ...
15
votes
5answers
3k views

How can trusting ONE certificate jeopardize everything I do online?

I am not sure I understand how TLS works correctly. To my understanding trusting a certain website's certificate is all about trusting that website or not, but the questions below suggest that ...
13
votes
1answer
3k views

PayPal encrypted with obsolete cryptography

My Chrome just complained from PayPal's security, similarly to this issue: Google Chrome "Your connection to website is encrypted with obsolete cryptography" The identity is verified, but ...
10
votes
2answers
5k views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...
10
votes
2answers
282 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...
7
votes
2answers
1k views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
6
votes
2answers
4k views

What role do hashes play in TLS/SSL certificate validation?

After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
5
votes
2answers
7k views

Extensions for SSL server certificate

I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
5
votes
1answer
1k views

How secure is TOTP key on phones?

Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
24
votes
1answer
4k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
21
votes
5answers
2k views

Who is responsible for revoking a certificate?

The CA issues certificates to clients/servers. Whenever a request is made by the client/server, the certificate is used to verify the identity. Now, if a certificate needs to be revoked then who does ...
18
votes
7answers
11k views

How do I check if a gmail/gtalk SSL certificate is valid?

Pidgin started prompting me to accept/reject new gtalk SSL certificate a few days ago and I am not able at the moment to tunnel the traffic to check if it would continue to happen or if it wouldn't (...
11
votes
2answers
6k views

SSL Certificate revocation check

In the SSL protocol I don't see where the certificate is checked for revocation status. https://developer.mozilla.org/en/Introduction_to_SSL Is the Certificate Revocation and Status Checking not ...
9
votes
2answers
937 views

How is an HTTPS login secure when pages use HTTP?

When someone go to eBay's website, they use an unencrypted connection between their PC and eBay's server. If they sign in, they are redirected to a secure site identified by its certificate and may ...
9
votes
2answers
1k views

security of PKI, Certificates, certificate authorities, forward secrecy

I want to understand how certificates add to the security of information exchange. Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
9
votes
2answers
1k views

When you buy a certificate, does the certificate authority have (a copy of) the private key?

I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this: You generate a public and private key pair From this key pair you generate a ...
8
votes
1answer
142 views

How can I protect myself against software installing insecure root certificates?

With the recent news that Dell installed a root certificate with a publicly accessible private key on their notebooks, I'm wondering how I can protect myself against this kind of incompetence. Of ...
8
votes
4answers
2k views

Why are there very expensive and cheap SSL same type certificates? [duplicate]

I am about to launch an online shopping site (currently running http) and I was thinking heavily of moving to SSL which includes a green bar, because this is very important. However, when I first ...
8
votes
4answers
2k views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...