A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

8
votes
1answer
121 views

How can I protect myself against software installing insecure root certificates?

With the recent news that Dell installed a root certificate with a publicly accessible private key on their notebooks, I'm wondering how I can protect myself against this kind of incompetence. Of ...
12
votes
1answer
293 views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but ...
16
votes
4answers
2k views

Broken SSL on every website [duplicate]

One of my friends called me saying every website anyone in her family goes to has untrusted SSL certificates. From any computer in her house, HTTPS is broken and Firefox or Chrome asks to add an ...
1
vote
1answer
65 views

Is it safe to publish my development private key?

For my development environment, the following three SSL files allow me to access my application from https://localhost on my local machine. Private key: server.key Certificate signing request: ...
1
vote
2answers
40 views

Generating a Certificate Signing Request for an Apache webserver on a sub domain?

I'm reading the instructions for generating a CSR, and it reads that: "Replace yourdomain with the domain name you're securing. For example, if your domain name is coolexample.com, you would ...
13
votes
2answers
2k views

Are SHA-2 certificates considered obsolete, or current?

I read here that I should be using SHA-2 certificates to secure a HTTPS webserver. Are SHA-2 certificates considered obsolete, or current for TLS/SSL website certificates? (as of 11/20/2015). If ...
0
votes
3answers
60 views

Hostname validation for server-side certificate

I have a reverse proxy which connects to an application which presents a certificate used for PKI based validation. I was wondering if I should enforce the condition that the common name (or ...
0
votes
2answers
78 views

How to know when to install a certificate?

How do you actually know when a certificate is issued that your system doesn't recognize, whether to trust it or not? When I was setting up Outlook for Gmail I got prompted to install the following ...
1
vote
1answer
40 views

Find the Encryption Key (used for network encryption) assuming a Trust Chain is being used on Windows?

If I double click on a .crt file, in Windows, I'm presented with three tabs General, Details, and Certification Path. I'm aware that the Certification Path tells you the details of which root and ...
-1
votes
1answer
34 views

Signed E-Mail certificate invalid [closed]

I sent a valid signed e mail a few weeks ago. Now I reinstalled everything on my computer (including the OS). Is the certificate now invalid?
2
votes
2answers
202 views

OpenSSL - Generate self signed certificates with different cipher suites

I want to generate a root certificate and SSL certificate (self-signed) for communication between an embedded device and our backend servers (IIS 8.0). I used OpenSSL to generate a certificate with ...
1
vote
1answer
80 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
0
votes
2answers
57 views

Does X.509 standard claim to check client certificate's expiration date on server side?

Does the X.509 standard claim to check client certificate's expiration date on server side? Consider an expired client certificate in the trust store of web server. If some client tries to ...
6
votes
2answers
467 views

Did scammers take control of a subdomain to host phishing site?

This morning I received a text message (ostensibly) from my bank: We need to contact you. Please visit https://paymentassistance.nationwide.co.uk for more information My spidey sense immediately ...
1
vote
1answer
53 views

Self created CA root for client certificates [duplicate]

My company wants to use client certificates for clients on production. We have a HTTPS certificate. As I understand we need a CA root certificate to create client certificates. Question: is it OK if I ...
6
votes
0answers
133 views

How do Lync and SSL inspection play together?

Whitelisting all Lync hostnames is cumbersome. Globally deactivating SSL inspection is undesirable. At a place I work for, they have SSL-inspection enabled on their proxy. All traffic to the Internet ...
6
votes
2answers
548 views

Could a stolen certificate show as trusted?

I have recently started learning about PKI and have the following question/s. As far as I know a signed certificate contains the domain name of the server that the certificate will be placed upon. ...
3
votes
1answer
36 views

Connection not secure when using a proxy

I connect to the Internet using a proxy at my university residence and I noticed at some sites (like my bank and PayPal), the browser reports that: it's unable to check if the website certificate ...
1
vote
1answer
142 views

Client authentication successful when using a pfx with Java, fails using OpenSSL. Why?

I've been trying to troubleshoot issues with client authentication and am seeing different behaviour when connecting from a Java application vs OpenSSL. A third party has provided me with a pfx, I've ...
6
votes
2answers
122 views

How can I verify that a root certificate is authentic?

I have found that my home PC (Windows 10) currently has 39 root certificates installed. While scrolling though the list I have noticed: Names that look familiar (e.g. Thawte / VeriSign) Names ...
9
votes
3answers
643 views

Do client certificates need to be trusted by the client?

I'm looking for some clarification around the trust requirements (if any) of client certificates. I'm working with a third party to access their services via Mutual TLS. I generate a CSR, send it ...
-1
votes
1answer
53 views

Do certificates need to be protected at rest? [closed]

I have downloaded numerous certificates to my device. How do I ensure the confidentiality and integrity of the data at rest?
2
votes
1answer
77 views

Are the elliptical curves in ECDHE and ECDSA the same?

ECDHE is quite widely used and recommend. And it works with elliptical keys and provides forward secrecy. It's used for the key exchange. ECDSA is not widely used though, but it does also use ...
1
vote
1answer
46 views

Using Keytool to export and change password of certificate in a KeyStore

I'd like to use Keytool to export a certificate from my KeyStore. I'd also like to change the certificate password, is it possible? What I thought should be done is one of the following: 1. Changing ...
1
vote
3answers
39 views

Automatically ensure that a site's certificate (authority) has not changed

My Situation : I've setup my own certificate authority, and generated a certificate for a server used primarily internally. As I understand it, I can configure my browsers/computers to trust the ...
4
votes
2answers
112 views

Risk of self signed certificates with Android

In the OWASP top ten list for mobile, it is mentioned that self-signed certificates should never be allowed. I want to check with others why is this so ? If I have a server back end for my mobile ...
4
votes
1answer
93 views

S/MIME certificates and “information leakage”

I'm considering getting an S/MIME certificate that verifies my name and email address. I've been trying to ascertain what information "leaks" if I do. The Wikipedia page on S/MIME says: Depending ...
1
vote
1answer
73 views

Safe to store encrypted data with (password protected) pfx file

I have created a self signed certificate using Powershell's New-SelfSignedCertificate, with the intention of encrypting and storing a username / password in public. Specifically using - ...
0
votes
1answer
150 views

Creating root CA to issue certificates programatically

I have to generate a self signed root CA and use it to issue to certificates programatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
4
votes
2answers
75 views

What threats can come from an outdated Certificate in a private LAN

In our company, we use a LAN "about 1,000 users", served with internal servers including email, DNS, and many web servers. Whenever I access any of the network sites, I receive a message about an ...
6
votes
2answers
142 views

What is the best strategy to store and share pem files between team?

Our company's small tech team works with several different servers, to which we connect with pem files. What is a good way of storing the pem files so that it can be accessed by other team members if ...
6
votes
5answers
284 views

Should I accept a self-signed certificate from my university?

My university set up a new domain we (student) can access to do some things. Chrome blocks the loading of the page in question saying that the certificate is invalid: Your connection is not ...
5
votes
2answers
128 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
30
votes
3answers
6k views

Which CA issued certificate for https://www.google.com

I installed Kaspersky internet Security 2016 on my laptop; in Firefox and Edge the root issuer is Kaspersky Anti-Virus Personal Root Certificate. but in chrome the root issuer is GeoTrust. in my ...
3
votes
1answer
82 views

Need raw certificate/key to sign PDFs via Java app. But vendors seem to only sell HSMs for this. What to do?

Our organisation wants to purchase a digital signature certificate for signing financial PDF documents. We want to automate this process, so we'll be having Java code do the signing work. For that the ...
0
votes
1answer
68 views

Protecting a jar file from being used by unauthorized parties

I have a jar file that has some business critical functionality. Keeping this logic safe and preventing unauthorized usage of this jar is very important to me. To achieve this, I have obfuscated the ...
1
vote
1answer
81 views

Automate certificate signing in Linux

In a private network I wish to automate signing for new clients/servers. Something like this: New client is created (dockers & etc) The client create a new private key and a CSR The client send ...
2
votes
1answer
44 views

SSL Client Authentication Failure

I have a setup where the client wants to make https call to the server. The client has a certificate installed on the machine The trust chain of the cert: Root CA      ...
7
votes
1answer
133 views

Browser blacklists & the Symantec-Google Certification Debacle

Background: As explained e.g. on this Google company blog, Google writes that: On September 14, around 19:20 GMT, Symantec’s Thawte-branded CA issued an Extended Validation (EV) pre-certificate ...
10
votes
3answers
1k views

How does obtaining a SSL certificate work?

I have been carrying out some work on SSL certificates and found that there are some places that charge you for an SSL certificate, but, how do they obtain the rights to do so? And, how, are they ...
7
votes
2answers
230 views

Generate CSR from existing certificate

Can we generate the CSR (certificate signing request) used for certificate signing from the signed certificate? It should work with the original private key when signed again with different authority. ...
1
vote
0answers
14 views

Partially Valid PKI certificate--But still we are able to login to our Application [closed]

User having a PKI card with an invalid PKI certificate (Among the two PKI certificates – One certificate is revoked (Damaged/ officially Cancelled) and another certificate is active)and try to login ...
3
votes
1answer
65 views

Does client Authentication needs the server to have intermediate certificate?

I have a scenario where in the client send send a client certificate issued from trusted root. The path of the client cert is like : Trusted Root |-----Intermediate Issuer |---- ...
2
votes
2answers
55 views

How does Certificate Transparance detect fake or forked logs?

I am trying to understand Certificate Transparency. Let's say I want to snoop on somebody's email. So I go hack or bribe a CA, have them issue a certificate for google.com, and then I present it when ...
0
votes
0answers
23 views

Different KeySizes from Different Stores same pfx

Sorry, i'm new to all of this. I have a question as to why the KeySize of a RSACryptoServiceProvider will differ between Store Locations? I've imported the same pfx in the LocalMachine store, as ...
0
votes
1answer
74 views

Is a SSL Certificate for a static IP Address a good idea

Is it possible to acquire a SSL Certificate for a static IP address that is not registered to a domain name and is there any issues that could be encountered?
0
votes
1answer
40 views

CRL verification with renewed CA

I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed. Suppose I have the following setup: ...
7
votes
2answers
1k views

Let's Encrypt for intranet websites?

Many companies have many intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate which causes a bad habit for the users, since they get used to just ...
1
vote
1answer
38 views

If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them?

Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head: Let's say that I decide to ...
0
votes
0answers
163 views

Cannot connect to SSL site in Safari only on Windows and Mac

I am having an issue with users connecting to my site via SSL on Safari - this is both on Windows and Mac so it doesn't appear to be OS specific. When they try to connect they get an error: Safari ...