A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

7
votes
1answer
222 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
4
votes
1answer
198 views

Certificate Revocation List

There are many fields on a certificate revocation list (CRL) like Algorithm, Parameters, Issuer Name, This update date, Next update date, user certificate serial #, etc. While I understand the purpose ...
1
vote
0answers
224 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
2answers
228 views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
0
votes
1answer
57 views

list of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
4
votes
1answer
181 views

How would you know a certificate/private key if you extracted it from RAM? Or would you?

Related to, of course, the heartbleed vulnerability, I've been reading the news about the worst case scenario for this attack being the extraction of the SSL private key, because, of course, this ...
2
votes
2answers
182 views

After heartbleed, how can you safely distribute new certs?

It's been a while since I studied key distribution, so I may have some fundamental misunderstanding.. From what I remember, man in the middle attacks can't occur during cert distribution because the ...
3
votes
2answers
754 views

How to configure Browser to detect revoked certificates?

In the context of the Heartbleed bug I would like to make sure that I can detect if someone tries to do a MITM attack with a stolen certificate, which since has been revoked. The problem is that ...
3
votes
2answers
89 views

Is the Common Name mandatory for digital certificates?

I'm working on a project, where we use the Common Name as a certificate's basic identifier. However, importing certificates without the Common Name fails. What's the default way to use digital ...
1
vote
2answers
97 views

Where to find or purchase non-SSL certificates

I hope this is the right stackexchange - if not, please advise. As to the actual question: have a system we've developed that makes heavy use of asymmetric cryptography in various different ways ...
1
vote
0answers
29 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
3
votes
0answers
159 views

Does heartbleed have any effect if OpenSSL was only used to generate the certificate [duplicate]

Edit: Please follow the above link to the original. I have a self-signed certificate which is use to sign other certificates that I issued. This is all done with an affected version of OpenSSL. ...
0
votes
1answer
131 views

Trusted Certificate Authorities - how do they work?

microsoft.com for example can use a Verisign Certificate for their domain. What are the chances that an attacker could ask verisign for a m1crosoft.com domain and get approved? It is very simillar, ...
2
votes
3answers
186 views

How can I know when a certificate was created?

I want to know whether my various providers changed their certificate because of Heartbleed, or they are using an old vulnerable certificate. How can I know that? Is the "valid from" date also the ...
1
vote
1answer
321 views

Would there be MITM attack even fix the heartbleed vulnerability? [closed]

I have read this post askbuntu, the step to fix the heartbleed vulnerability almost: 1. upgrade openssl. 2. generte new keys. 3. revoke the old certificates. Some posts say attackers may have got ...
2
votes
1answer
83 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' bowsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
1
vote
2answers
73 views

Should every SAML identity provider provide a unique public certificate to the service provider?

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
1
vote
1answer
105 views

Certificate services will not start with “server is offline” error [closed]

I have a subordinate CA. The Enterprise root service was uninstalled from the network by accident and then migrated to a new box using the same key. This new server has a different server name. It ...
4
votes
2answers
282 views

When you buy a certificate, does the certificate authority have (a copy of) the private key?

I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this: You generate a public and private key pair From this key pair you generate a ...
0
votes
1answer
30 views

Certificate extensions - specific constraints

I have question about extensions of certificate and what specific extension should I use in my situation. The problem is following: I have a CA and I want that CA will issue certificate only for ...
2
votes
1answer
396 views

Active Directory - Certificate Based Authentication - Multiple certificates for user

First, I have very limited knowledge about AD. Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will ...
2
votes
1answer
87 views

Finding the type of SSL certificate with cURL

This is a part of curl's verbose output when connecting to the HTTPS site of Google. * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * ...
2
votes
1answer
93 views

How secure is PKCS #12

I need to move user cryptographic identity between several user devices. In the operating system I have only one option: use password-protected PKCS #12 to import the identity to the OS secure store. ...
0
votes
1answer
133 views

Accepting an untrusted security certificate?

What is the risk of accepting an untrusted site security certificate in your browser if you're not entering any data, but merely browsing the site?
1
vote
3answers
245 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
1
vote
2answers
464 views

Self-signed SSL certificate on chromebook (and android)

I am having the following problem on both my android phone and on my chromebook. I'm running a website on an internal server (10.3.3.3) using nginx with a self-signed ssl certificate. Since it is just ...
2
votes
1answer
410 views

Certificate verified using two different paths

StartSSL has an intermediate certificate that they use to sign their EV certificates: sub.class4.server.ca.pem. This certificate's issuer is shown by openssl x509 to be /C=IL/O=StartCom ...
3
votes
1answer
86 views

Public keys without the certificates

There are two clients and a server. Each client generates an RSA key pair and uploads public key to the server. The server associates the public key with the user identifier that is specified during ...
1
vote
0answers
40 views

Deploying software that requires X.509 certificates

I have a self-hosted WCF application, with a server application running on the server (obviously) and a client application that will be installed on the users PC. Up until this point I have been ...
0
votes
1answer
76 views

Good reason to continue using fraudulent certificate?

A relative of mine used a favorites link to login to yahoo. The favorite link is https://de.mg40.mail.yahoo.com/neo/launch? However, this link uses a fraudulent certificate. Visiting the Yahoo ...
0
votes
3answers
234 views

SSL Certificate for an email server

I am completely new to SSL/TLS and would appreciate any help you guys could give me. To give you some background info, our company website is hosted externally by our ISP, however our email is ...
0
votes
1answer
95 views

My WCF application uses 2 way certificate message encryption - does it still need SSL?

I have a WCF service configured to use two-way certificate authentication on the messages. The server is also locked down through a firewall to only allow traffic from a single IP:Port that the ...
1
vote
3answers
146 views

Https forms on tens of domains

What is the optimal way (cost-wise, too) to secure page forms (https) on a large number of domains&subdomains? Are certificates required for all domains? Is putting all the page forms on a single ...
17
votes
2answers
2k views

How can you prevent employees of your company from creating valid ssl certs? [duplicate]

When registering for an SSL cert, I was able to validate that I "owned" the domain I was creating the cert for by having a valid @domain.com email address. If I worked for a large company, say ...
0
votes
1answer
77 views

Secure Communication Between .Net Application and Website

Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our ...
5
votes
2answers
424 views

VPNs vulnerable to MiTM because ANY certificate goes

I spoke to a sysadmin in a business center today who intended to basically perform a MiTM (as he called it) on every connection in his network because people in his office building are using VPNs and ...
5
votes
1answer
568 views

google certificates correct CA [closed]

I view certificates of https://www.google.com.ua/ So I thought, when requesting via cURL, if I point by CURLOPT_CAINFO to those certificates (GeoTrust Global CA and Google Internet Authority G2 in ...
1
vote
1answer
131 views

What's the use of certificate on Load Balancer and Keystore on Service?

Consider a scenario where my service is using a keystore made of self signed cerificate and the load balancer which is balancing traffic for service is binded with a CA approved certificate. I would ...
1
vote
0answers
43 views

Does Active Directory Certificate Services support Card Verifiable Certificates?

Does Active Directory Certificate Services support accepting requests for, and generation of, Card Verifiable Certificates (TR-03110)? If so, in which version of Windows Server was the functionality ...
1
vote
1answer
97 views

Is there any way to restrict multiple access to my server at the same time using one client certificate?

My Server is Windows 2008. Mr. X is accessing my web server using Mr. X's certificate. In that time, an outsider is also trying to access my server using Mr. X's certificate (somehow he got it). Is ...
1
vote
3answers
97 views

Howto pass overly protective corporate firewall

My Corporate Network was always being monitored, but a few days ago they started to block and censor all HTTPS traffic. Recently IT guys forged certificates for all major HTTPS web sites and acts as a ...
33
votes
2answers
6k views

What exactly does it mean when Chrome reports a certificate 'does not have public audit records'?

When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I received a message 'The identity of this website has been verified by Google Internet ...
0
votes
2answers
1k views

PHP encrypt and decrypt with certificate

I am trying to think of the best way to encrypt and decrypt a message between two servers. I have found a lot of examples where people simply use a secret and PHP's mcrypt... ...
1
vote
0answers
63 views

Certificate authorities: history and registration

CA's are a key part of the internet's infrastructure few people are aware of. SSL was mostly hacked together at Netscape in 1995. I'd like to understand more about the organizational structure of CA's ...
1
vote
2answers
77 views

How to prove the integrity of a digital file if certificates are not an option

Certificates are a fantastic way to prove the integrity of a file - provided that they have been signed from the beginning. This methodology can prove the files authenticity, in addition proving it's ...
1
vote
1answer
146 views

Risks associated with distributing encrypted private key with our software?

Our software contains two executables that need to serve data over SSL (and several that need to do requests over HTTPS)). I notice that it is distributed with some .PEM files created with OpenSSL. ...
2
votes
1answer
94 views

SSL certificate to protect spoofing of API server

I have a program written in Python that checks the validity of its license key with a remote server. Am I right that an SSL certificate would make it possible to prevent spoofing (host redirects for ...
2
votes
1answer
93 views

Does using Chrome bypass the Apple iOS gotofail bug ?

Does the recent certificate gotofail bug affect me if I'm running version 6 of iOS, but only use Chrome as my browser?
22
votes
1answer
2k views

Why does Firefox not trust this US government SSL certificate?

Shouldn't this be a trusted certificate considering it's a wildcard SSL certificate? That is, shouldn't *.delaware.gov cover www.corp.delaware.gov?
1
vote
2answers
250 views

Does Google use extended validation certificates

I just changed a password on a Google account while using the Chrome browser. After doing so, I noticed that the https connection to Google was not highlighted in green signifying that it was an ...