A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

3
votes
1answer
89 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
0
votes
3answers
113 views

What implications does the KeRanger infection have for Mac OSX security?

Recently some hackers replaced installers for a popular torrent client with an infected version. According to paloaltonetworks, they have no idea how the hackers managed to do this (let's just assume ...
0
votes
2answers
103 views

How In-House Certificate Authority works (e.g. EJBCA)

I have a simple (dumb?) question with respect to EJBCA. I have been exploring how In-house CAs work and issue certificates. However, I am not able to understand who will be trusted on the top level in ...
5
votes
2answers
149 views

Why is weakness of SHA-1 considered a threat to TLS security

If I understand correctly the role that a hashing algorithm (e.g. SHA-1) plays in TLS certificates is as follows: The hashing function is applied to a subject's public key. The CA then uses their ...
1
vote
1answer
71 views

ECDSA implicit certificate using OpenSSL

I am trying to generate implicit ECDSA certificate only for signing and verification using OpenSSL. I tried google but I am getting many research papers. I understood that A messages need to be signed ...
1
vote
2answers
40 views

Client verification with PKCS#7

When a client sends you a pkcs#7 file to communicate with you, Is this because the file has their public key(certificate) and their chain and to avoid the confusion on your side what needs to be there ...
0
votes
1answer
100 views

CSR with only public key with openssl

So I have been doing my research and haven't found anything specific enough to my problem. As the question title states, I want to make a CSR with only the public key. What I have been able to do is ...
0
votes
1answer
62 views

What is the difference between a certificate, a signature and a thumbprint in case of windows exe/binaries?

I am trying to understand the difference between signature , thumbprint and certificate in context of windows executable and binaries. I looked up on internet before posting this question but I did ...
1
vote
2answers
70 views

Reissuing certificates with SHA-2

I recently setup my own CA, and imported the CA cert into devices across the company. I then deployed certificates to our various servers, etc.. All using SHA-1 signatures (the default in the tool I ...
3
votes
1answer
129 views

Understanding how does certificate validation work

I'm using Wireshark for better understanding how is a SSL connection established. I captured the traffic of visiting three pages: reddit, facebook and this one. All HTTPS of course. Reddit: after the ...
1
vote
1answer
92 views

TinyCA missing CRL information in root and leaf certificates

I setup a new CA using TinyCA. When creating the CA i used an internal host name for the crl url exactly as follows: http://myserver.com/crl.pem And I have exported the CRL to that location, and I ...
2
votes
0answers
26 views

Finding the EMSA-PKCS1-v1_5 DigestAlgorithm field in the x509 certificate

From the RFC - https://www.ietf.org/rfc/rfc3447.txt A.2.4 RSASSA-PKCS1-v1_5 For each OID, the parameters field associated with this OID in a value of type AlgorithmIdentifier shall have a value ...
0
votes
2answers
55 views

Using client certs issued by a third party CA

I have a site that is protected with a user name/password login. For users that want to enter a certain area of the site, there is (legacy) code that looks for a client certificate and if the email in ...
7
votes
2answers
537 views

Will Google block HMAC-SHA1 along with SHA1 signed certificates?

So, right now, there is a push for moving from SHA1 signed certificates to SHA256 signed certificates by Google. My understanding is that you cannot use SHA1 for signing certificates but HMAC-SHA1 can ...
1
vote
2answers
48 views

Using mutual authentication, should I still worry about message integrity and replay attack?

I'm trying to secure a REST API, our situation is that every client connecting to this API will also have a certificate signed by our own CA. Because of this, I think we can use the client certificate ...
1
vote
0answers
42 views

How Do I Create a Production Client Authentication Certificate for Azure Key Vault?

I am learning about Azure Key Vault, and one of the scenarios it supports is certificate authentication, which you can read about here. The samples do a great job of explaining how to make a ...
81
votes
4answers
11k views

What prevents me from buying a SSL certificate for a domain I don't control?

Can I simply build a webserver, make its hostname "google.com", create a CSR off that server, and send that to a Certificate Authority for signing? Let's say I pick the cheapest and dodgiest outfit I ...
1
vote
1answer
142 views

What does browser do when it queries xxx.example.com and it gets a certificate for yyy.example.com(top level domain is same)?

The question is actually about what level of validations browser does when it gets certificates of some other domains like case 1: Accessing abc.google.com and got def.google.com case 2: Accessing ...
3
votes
1answer
161 views

Is It OK If a Server Does Not Verify a Certificate?

I am currently learning a LOT about Azure, Azure Active Directory, and Azure Key Vault (AKV). To start with, please see this article: In particular, I am interested in this statement: When ...
3
votes
2answers
107 views

When should I renew certification authority?

What is best practice in renewing certification authorities? I mean when should I renew certification authority? For example, suppose I have the following setup: 1. Root CA with validity of 30 years ...
0
votes
0answers
33 views

How do the eduroam WPA-Enterprise 802.1X certificates look like?

As outlined in another answer, the official eduroam WiFi profiles available from https://cat.eduroam.org/ (verified for uWaterloo and uOttawa), as well as sample official instructions of the ...
1
vote
1answer
84 views

Can Passpoint X.509 certificates be used to MITM SSL connections on Passpoint networks?

Passpoint/Hotspot 2.0 public networks like LinkNYC require users to install X.509 certificates, for EAP authentication. Can these certificates be used by the provider to execute man-in-the middle ...
0
votes
1answer
100 views

Safari not showing GREEN lettering for EV SSL

I've recently installed an EV SSL cert on my server, Chrome and Firefox show a green banner and padlock denoting the EV cert is installed, but in Safari, it just shows a gray padlock... is there ...
1
vote
2answers
110 views

Why did I get a wrong IP and certificate for www.facebook.com just now? [closed]

I just navigated to www.facebook.com and my browser alerted me that an invalid certificate has been received. I checked the cert in question, and I was surprised to see that the Common Name on it was ...
2
votes
1answer
81 views

How do “certificates” hold “keys”? [duplicate]

I am new to the realm of security and keep hearing about "certificates" containing "keys". But no one has been able to actually explain to me what is actually meant by this. I assume that the ...
1
vote
1answer
119 views

What can a trusted certificate do?

I am doing some reading about security on mobile applications because I found an article about Man in the Middle Attacks. I saw in that article and in many other places (including ...
-1
votes
1answer
48 views

HTTPS - if this protocol protect against connecting to false server?

I know about SSL certificates. However it is ok to say: protocol HTTPS protects against connecting to false server ?
1
vote
1answer
18 views

Certificate Setup Over Many Remote Resources

Imagine that you have a web app that needs to talk to a central api server with its purchased certificate. This server provides a token to the web app to be used to authenticate and talk to another ...
2
votes
2answers
95 views

Why do we need certificates confirming certificates?

Why do we need certificates confirming certificates? Why create a hierarchy or tree? These questions makes me confused, could you explain it me?
1
vote
1answer
49 views

Why is it not recommend to use permanent validity of certificate for public key [duplicate]

As we know it is not recommended to provide permanent validity of certificate for public key. I don't know why. Could you give me some reasons ?
3
votes
2answers
47 views

Question about SSL certificate and third party server

I have a system which consume web-services from a public server on Internet (but the data are not public) I have to provide credentials in Basic Auth to get the data, that is why we use SSL. The ...
2
votes
0answers
79 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
2
votes
1answer
74 views

DNSCrypt-proxy: This certificate looks valid

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy. [INFO] + DNS Security Extensions are supported [INFO] - [dnscrypt.eu-dk] ...
1
vote
1answer
83 views

Server providing two different SSL certificates

When I check on browser for a site example.com, I see that site has a valid certificate, not expired, with validity till end of 2016. At the same time, When I scan for the same domain on the port 443 ...
1
vote
1answer
88 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
4
votes
1answer
59 views

What does an OpenPGP signature consist of?

I don't understand how OpenPGP signatures work. I have a picture which I want to sign, and a digital certificate which consists of my name and email address and my public key. Additionally, a digital ...
5
votes
3answers
111 views

Is it ok to have self-signed certificates in source control?

I just asked the question SSL self-signed certificates in development vs acquired cert in production? which has promptly been answered (THANKS!). Out of that, I have the following question: Is it ...
3
votes
1answer
76 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
0
votes
0answers
27 views

SpriteKit Level Data Security Handling

I have been reading many different posts, threads, etc. regarding the best practices to store level data to be used throughout a game application (level boundary data, images, characters, time, etc.). ...
0
votes
1answer
53 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
4
votes
3answers
187 views

Why are root certificate authorites allowed to issue certficates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
0
votes
2answers
41 views

How to avoid writing .pem while signing a csr?

I am using following command to sign a certificate, openssl ca \ -in client.csr \ -keyfile server.key \ -cert server.crt \ -outdir ./some_dir \ ...
0
votes
0answers
52 views

Validation client certificate for site in iis

Input: I send client certificate to client. He uses it to work with my web application which works in IIS. I installed CA certificate (which was used to create client certificate) on web server. AFAIK ...
6
votes
3answers
262 views

what do you do when an ssl certificate expires and your app uses ssl pinning?

I originally posted this question on StackOverflow, but reposted here due to lack of responses. I am trying to decide if it's a good idea to do ssl pinning in my iOS game that uses a server to ...
0
votes
0answers
42 views

Applocker rules Publisher vs hash

I'm interested in deploying application white-listing for a large scale environment by using the Windows Server built-in AppLocker mechanism. There is no Internet connection to the environment. My ...
0
votes
1answer
94 views

Where in the CSR is the public key?

I am reading http://www.akadia.com/services/ssh_test_certificate.html In step 2 openssl req -new -key server.key -out server.csr server.key is generated earlier using openssl genrsa -des3 -out ...
1
vote
0answers
51 views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...
2
votes
2answers
123 views

Self-signed cert - how it works

I am new to SSL / digital certificates / signatures. What I know is that a digital signature must be verified/decrypted using the public key. So a cert that is signed by a CA must be ...
0
votes
2answers
121 views

SSL digital certificate process - high level

I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database. In this case, I have an web server and needs to implement SSL ...
0
votes
1answer
98 views

Mutual Authentication and Authorisation with Certificates from various CAs

Edit: Having read this question and answer I have a bit more of an understanding. My question now then, is: can I use a certificate that a user has had signed by a registered CA such as VeriSign, ...