A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.
4
votes
3answers
266 views
What issues arise from sharing a SSL certificate's private key?
Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website.
I have ...
4
votes
3answers
307 views
What does it mean for a digital certificate to be “signed”?
When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
4
votes
1answer
922 views
Getting a Root CA accepted in systems and browsers
I would like to ask about the procedures for a given CA to get one of its root CAs (SSL issuance CA) to get accepted and installed as a trusted root CA in operating systems and browsers.
4
votes
2answers
167 views
How to verify certificate with very little information
Lets assume there is a server and a client and you want to connect those two.
Server has a self-signed certificate, and prior to establishing the connection for the first time (enrollment) the server ...
4
votes
2answers
220 views
How do you verify a certificate belongs to a domain?
I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to.
Currently I can verify the certificate is valid using the following code
$resource = fsockopen( ...
4
votes
1answer
148 views
Does Authenticode still work offline and with a “fake” certificate
Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
4
votes
2answers
137 views
What is the severity of a fake certificate?
I'm not a security specialist, thus reading this Google Blog post about a fake *.google.com certificate, raises a lot of concerns, if anyone can impersonate a website, especially a google website, my ...
4
votes
2answers
135 views
What is the state of the Windows Update certificate after Flame?
May 28, The Flame malware is discovered in Iran and by Kaspersky Labs.
June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
4
votes
2answers
164 views
Is it okay to just secure (using SSL) the login page, but not the rest of the site? [duplicate]
Possible Duplicate:
What are the pros and cons of site wide SSL (https)?
I'm creating a custom PHP/MySQL CMS for a client (because Wordpress is overkill for this client's particular needs). ...
4
votes
4answers
746 views
Can an intermediate CA be trusted like a self-signed root CA?
Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
4
votes
1answer
138 views
How powerful are top Verisign executives?
I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a ...
4
votes
1answer
118 views
Which properties of a X.509 certificate should be critical and which not?
RFC5280's section 4.2 states
Each extension in a
certificate is designated as either critical or non-critical. A
certificate-using system MUST reject the certificate if it encounters
...
4
votes
2answers
4k views
Advantages of client certificates for client authentication?
I'm no security expert, so please just ask in a comment if I haven't made my question clear enough for an answer.
The Scenario
We have a server running WCF services, and a number of clients ...
4
votes
2answers
235 views
How are possible uses for X.509 (SSL) certificates denoted?
X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
4
votes
1answer
142 views
SSL Cert Types and Key Usage
I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
4
votes
1answer
150 views
Why do X.509 certificates have “Key Usage” attribute?
I can find their values and all details in the RFC, but I cannot find why it was decided to have this attribute in certificates, instead of leaving them to be multipurposes.
Is there a reasoning ...
4
votes
3answers
117 views
Issuing SSL certificates for device automation software package without domain names
We are developing the automation software for Windows which communicates with the certain devices via our own private connection protocol. That software package consists of several server (including ...
4
votes
3answers
557 views
How is an X509 certificate signer verified?
Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is,
...
4
votes
3answers
317 views
Does the following data stream look secure to you?
I understand the basic concept of SSL but maybe I am missing the point. Please could someone take a look at the following part of a test log to a server and tell me if it looks secure. My concerns are ...
4
votes
2answers
151 views
TLS server key: possible to sign another TLS server key?
If I have a valid (verifiable) certificate C_K_s that links the server key K_s to "www.example.com", is it possible to :
use K_s to sign K_d, and let S_K_d be this signature
use K_d as the TLS ...
4
votes
1answer
415 views
Can a certificate have multiple chains and multiple self-signed roots?
The following MSFT document has this paragraph:
All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed
...
4
votes
4answers
321 views
Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was:
CA with RSA keys capable of signing RSA and EC CSRs
CA with ...
4
votes
2answers
437 views
Is there any research on which SSL certificate authority has the best browser compatibility
We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
4
votes
1answer
56 views
Standards for CA cert revocation and time-constrained cryptographic algorithm parameters
I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
4
votes
2answers
186 views
Is it possible to modify a CA without having to reissue all of the derived certificates?
Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I ...
4
votes
1answer
429 views
How secure is TOTP key on phones?
Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
4
votes
1answer
416 views
X.509 algorithm identifier parameters vs. extension values
From the X.509 specs:
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
...
4
votes
2answers
71 views
Using SSL Certification in Multiple Locations
I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access.
The ...
4
votes
2answers
207 views
Extensions for SSL server certificate
I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
4
votes
1answer
249 views
Which key usages are required by each key exchange method?
I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
4
votes
1answer
130 views
What issues might exist with TLS-OBC's emulation of Browser Certificates?
TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
4
votes
1answer
137 views
How does my antivirus determine which CTL is used?
I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
4
votes
2answers
516 views
What are the advantages of EV Certificate?
What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit?
I know that the ...
4
votes
1answer
2k views
What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?
What root certificates are/are not updated when the following checkbox is checked?
Additional questions
If I manually remove a root certificate, will this service replace that very certificate?
...
4
votes
1answer
307 views
Two certificates on smart card
I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?
Background:
In Sweden you can have a "citizen ...
3
votes
4answers
1k views
I had SSL certificate on my site but still it has been hacked…how to prevent this from happening?
I used SSL certificate on my site but still it has been hacked.
How do I prevent this from happening?
Do SSL certificate come with a waranty which would compensate me because my site was hacked?
3
votes
2answers
2k views
Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”
I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain.
...
3
votes
3answers
209 views
Self signed certificates for https
Where I work, currently for internal sites, self signed certificates are being used.
In Firefox, the info regarding the certificate are displayed:
site domain: xxx.com
Owner: Site doesn't supply ...
3
votes
2answers
1k views
Internal SSL Certificates?
As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
3
votes
1answer
250 views
Choosing an SSL certificate provider
Does it make any difference which provider I get my SSL/TLS certificate from? In particular, what are the pros and cons getting an SSL certificate from Verisign vs getting one from Thawte? Which one ...
3
votes
2answers
133 views
Are Windows Updates susceptible to tampering, eg. using a MiTM attack.
My real question is how are patches and updates authenticated in general. But for example how does windows know a windows update is really a windows update, does it just trust the URL or is there some ...
3
votes
2answers
243 views
How realistic and possible is this sort of attack
I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me.
Nessus rated this finding's risk as Medium. The finding was, that a service ...
3
votes
2answers
148 views
SSL Certificate Signing by a CA
Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return.
What I don't understand is what, ...
3
votes
1answer
221 views
exponent value in certificates
I have seen that in gmail, there are 3 certificates in hierarchy. I noticed that all the certificates have the same exponent(65537 with 24bits). Why is the exponent value same for all certificates and ...
3
votes
2answers
31 views
Change 'Key Usage' of a certificate
Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
3
votes
1answer
78 views
What is the difference between Serial and Thumbprint
I have problems to understand what the difference between the Serial Number of a certificate and its SHA1 Hash is.
the MSDN says:
Serial number A number that uniquely identifies the ...
3
votes
4answers
470 views
Is it possible to create a self signed certificate authority?
Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious.
To explain my question : Suppose I sign a public ...
3
votes
3answers
441 views
How to distribute client certificates without exposing private key?
I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication.
I'm ...
3
votes
2answers
415 views
x.509 CRLs: next update?
An X.509 certificate revocation list contains a field specifying when the next such list is expected to be issued. I'm trying to figure out the importance of this field...I know that sometimes ...
3
votes
2answers
133 views
In practice, does crypto software accept a *.com or or even a *. certificate?
Assuming this will be done with your own PKI, and not a public trusted CA.
Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
