A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

2
votes
2answers
110 views

Can I buy a signing-valid certificate for internal use?

So now that I have to implement "secure transport" as defined by The Direct Project (not to mention reinventing a bunch of wheels, but that's another story for SO), I find myself staring down the ...
4
votes
3answers
131 views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
1
vote
3answers
248 views

Does HTTPS encryption work when there is invalid or there is no certificate?

When I have a website run on https and there is no certificate, there is wrong certificate or out of date like here does encryption still work or not?
3
votes
2answers
210 views

How To Recover EFS Cert From Backup?

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access ...
0
votes
1answer
136 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
9
votes
2answers
230 views

Why do some certificates specifically identify a corporation and most don't?

Looking at a handful of websites that allow for/require HTTPS, I realized that the certificate for a few of them specifically identifies the owning corporation, but some (most) don't. What's the ...
0
votes
1answer
57 views

Certificate for Email Encryption and signing

I don't understand the flow of Digital Certificate with Email Encryption and Signing. For Example, There is 2 users, Sender A and Receiver B. Is Certificate required to encryption to A or just ...
2
votes
1answer
4k views

OpenVPN Tap vs Tun Mode [closed]

I would like to know practical difference between TAP and TUN mode when use with OpenVPN. When to use TAP and When to use TUN ? What types of traffic will pass with both mode ?
0
votes
2answers
137 views

How to detect authenticity Of Client and Server Certificate?

How its possible to detect authenticity Of Client and Server Certificate. For example, If server A has certificate and someone C stolen its certificate and send it to B then How we decide that it's ...
0
votes
2answers
366 views

Digital Certificate “Signature and Fingerprint”

What's the difference between Digital certificate's signature and fingerprint (thumbprint) ? I know that Signature: The actual signature to verify that it came from the issuer. and Thumbprint ...
0
votes
1answer
378 views

OpenSSL get key length of all certs [closed]

I am trying to ensure that all certificates in a chain for a host have a key length of 2048 bits. Using openssl s_client, only the key length for that host's cert is given, is there a simple way to ...
0
votes
1answer
539 views

Sending Client Certificate to Server

I have a simple question. Is a web browser sends client certificate to the web server on demand(means web server is configured for client authentication and demand the client certificate) or just ...
0
votes
2answers
334 views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
1
vote
1answer
491 views

SSLv3 or SSL Certificate Version 2?

Below is the SSLScan output, what does it mean with SSL Cerficate Version 2? Aren't SSLv3 and SSL Certificate Version 2 the same? ...
1
vote
2answers
232 views

Windows certificate store suddenly changed security level of one of my certificates

I use Windows 8.1 Pro 64 bit and IE11. I have two personal certificates (with private key) of mine in the system certificate store. They are both set to require a password before they can be used. ...
0
votes
1answer
99 views

How does ssl prevent MITM attacks [duplicate]

My understanding of how it works : A victim asks for the public key of a server. The attacker just forwards this request. The server now responds with a certificate which contains the Public key. The ...
1
vote
1answer
193 views

Trying to verify my X509 certificate “could not verify this certificate for unknown reasons”

I have created my own X509 certificate with my own CA. I am able to import the CA certificate into Firefox, but when I try to import the user's certificates i get the following: "Could not verify ...
2
votes
1answer
85 views

Does Internet Explorer handle Extended Validation properly

I'm reading about Extended Validation (EV) certificates and have a few questions. From what I understand, EV allows domain owners to pay extra for a especially trusted certificate (that the browser ...
0
votes
1answer
68 views

how does IE or chrome verifies certificate? [duplicate]

If the HTTPS webserver uses self signed certificate, the web browser warns the user as follow. http://www.sslshopper.com/assets/images/iis7/iis7-self-signed-certificate-8-certificate-not-trusted.png ...
1
vote
2answers
155 views

Choosing the right X.509 certificate infrastructure for securing LAN communications between a PC and a device

Edit: seems like I was quite hasty when typing in my question at first, so here is an updated version of it. I am developing an application that runs on PCs which are on the same LAN as other ...
11
votes
3answers
981 views

Why can SSL certificates not be free of charge?

I am a newbie in this field. I am confused with why SSL certificates cannot be free of charge. In my understanding the certificate is just a text file consisting of cryptic numbers installed on a ...
1
vote
0answers
83 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
-1
votes
2answers
68 views

user identity certificate

I want to create a new scheme for user identification, like X.509 certificates, but not X.509. Is it possible to use this new certificate over the existing Internet? and if yes, what are basic ...
1
vote
0answers
183 views

Safe communication via rest api between two known servers

i would like to have some advice on the following scenario: I'm using kinvey as backend but because it doesn't provide the ability to run custom code i have set up another server. So basically when x ...
0
votes
1answer
148 views

Invalid Certificate when adding Gmail account to Apple Mail

Trouble seemed to start after upgrading to OS X 10.9. I stopped receiving email in an account I'd set up over a year ago. I removed the account and when I attempted to add it again, I was served a ...
1
vote
1answer
392 views

Convert a DER encoded Certificate to PEM encoded Certificate

I have a p7b certificate(DER encoded) which I need to convert to a PEM encoded certificate so that I can import it into my keystore. I see that the openssl command below does the job of the ...
0
votes
0answers
21 views

Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery [duplicate]

Can you tell me shortly how to fix this problem in Chrome? Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery
1
vote
2answers
160 views

Understanding certificate security

I am reading Computer Networks by Tanenbaum and Weatherall. In chapter 8 they describe secure communication using public key exchange via certificates. They describe a situation where Alice is sending ...
1
vote
2answers
740 views

Basic self-signed certificate questions

A few basic questions around self-signed certificates Question 1 Does a self-signed certificate has to have a CA? I realize that a "real" certificate must as it otherwise can be chain validated but ...
3
votes
1answer
76 views

In theory, can x509 certificates use Accumulator-based revocation schemes? How do these schemes work?

On page 3 of this U-Prove document regarding toke revocation, the author says the benefit of Accumulator-based revocation schemes is A cryptographic accumulator allows the aggregation of a large ...
1
vote
1answer
351 views

Additional security for WebRTC/DTLS-SRTP with PGP?

I am having a thought experiment. Can you help me? Two clients who both use PGP. They initiate a WebRTC call using DTLS-SRTP via a 3rd party server. Is there any benefit of encrypting, via their ...
10
votes
3answers
710 views

Can we make sure that the new Lavabit certificate is not under control of the FBI?

After the Lavabit shutdown, Ladar Levison (founder of Lavabit) announced that he’s "looking into setting up a site where users can download their data". Such a site is now online: ...
0
votes
1answer
720 views

Problems with intermediate ssl certificates and ssl proxy

I'm currently implementing a SSL-proxy, and have run into some problems regarding certificates. We have a offline "Company Root CA", and an online "Company intermediate CA". On the proxy I have ...
2
votes
3answers
161 views

Do on-demand SSL certificates exist?

A few days ago, I visited an SSL protected website. Since Safari complained about the SSL-certificate, I did a short inspection: The certificate was issued by GoDaddy in just the minute I ...
1
vote
1answer
75 views

Certificate Mapping in IIS

When pasting the certificate blob in the configuration editor in IIS 7.5 for one on one authentication, is this the server certificate or the client certificate?
3
votes
1answer
103 views

FIPS compliant application based on OpenSSL

Let's say I need to write a simple application for signing/checking some data. The hard part is, that it must be FIPS 140-2 compliant. I was thinking to do it using OpenSSL FIPS Object Module 2.0 but ...
3
votes
4answers
400 views

Is it possible to detect SSL private key changes?

I wonder if it would be possible to detect a change of an SSL private key? If you change the key, then I think one must issue a new certificate, but new certificates could be issued without changing ...
4
votes
1answer
304 views

Is possible that a TLS server send more than one certificate to the client for the same site?

What I'm trying to archive is enable ECDSA and DSS ciphers in my site, but at the same time not depend just of self signed certificates, so I could sent to my client more than one certificate and them ...
1
vote
2answers
90 views

non-MiTM Reverse SSL

Do non-MiTM Reverse SSL Proxies exist? Or do all proxies that do SSL-SSL mappings decode and then re-encode HTTPS traffic? If this is the case and I want to map https://mypublicdomain.com -> ...
2
votes
1answer
332 views

Evaluate the signature of an X509 certificate in .NET

This is my scenario: A CA signs a certificate with its private key and sends it to a client via https response. From this response the client creates a X509Certificate2 class, that represents the ...
10
votes
1answer
318 views

Is using a CA more secure if I'm self-signing anyway?

We have a web application that we run for clients at their booth on fairs. The communication between clients and the server was done over HTTP until recently. We're currently working on improving ...
2
votes
1answer
103 views

What are the benefits (if any) of changing TLS certificates frequently?

As I understand it, a certificate is used only for verifying the identity of the server. Are there any security benefits for changing them frequently (once a week for example)? If this is done so ...
1
vote
3answers
107 views

Where can I find all SSL CA certificates

I am working on an SSL implementation project and ofcourse I need to verify the certificate presented by the server. To do that I need CA certificates or at least root CA certificates (correct me I am ...
8
votes
4answers
1k views

Are self-signed certificates actually more secure than CA signed certificates now?

Are self-signed certificates actually more secure than CA signed certificates now? I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government ...
1
vote
2answers
93 views

SSL-certificates for overlapping domain regions?

Suppose, a server hosts https://www.master.com/ and thus is equipped with a (single domain) SSL certificate. Furthermore, suppose there are some web apps below master.com: ...
4
votes
2answers
417 views

Single domain SSL certificates, actually support 2 subdomains?

While browsing for SSL certificates, specifically domain validation type (the cheapest), I noticed that they advertise as valid for a single domain/subdomain, but then I noticed that they are valid ...
4
votes
2answers
141 views

Can the client certificate authentication process treated as a user digitally signed the content(and then get verified on the server)?

The authentication was triggered by certain event (like approving button) on the form. In the process of client certificate authentication (in IIS), user was asked to use their PIN (private key) and ...
3
votes
2answers
151 views

Requirements for qualified certificates in DIRECTIVE 1999/93/EC

DIRECTIVE 1999/93/EC at ANNEX I Requirements for qualified certificates states that one requirement for qualified certificates is (a) an indication that the certificate is issued as a qualified ...
4
votes
1answer
74 views

What is the meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC from ETSI TS 102 231 V3.1.2

From Technical Spec http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC a Root Certification Authority from which a certification path can be established down to ...
1
vote
1answer
222 views

How to authenticate to racoon with a certificate chain if only the root CA is known

I'm trying to setup IPsec using x509 certificates on Linux. I'm using racoon for that task. I've come to the point where the authentication works fine if I keep every link of the certificate chain on ...