A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

8
votes
6answers
1k views

I see two different sets of certificates for Google websites when I am at work and when I am at home

I see two different sets of certificates for Google websites when I am at work and when I am at home. I mean if I save the certificates (in firefox, click on the "Google.com" block on the left of ...
8
votes
2answers
10k views

Is there any way to get Chrome 27 to trust a self-signed cert? [closed]

I'm running latest gen Chrome (27) and preparing a demo that requires using a self-signed cert to support HTTPS on a local IIS website. The cert has been created with the correct common name for the ...
8
votes
4answers
910 views

How bad it is to install another company's root certificate to your server?

Our company uses a web server with a couple of web sites on it (private and public, over HTTP and HTTPS, some low risk and some high risk including online payments or other sensitive data for ...
8
votes
4answers
2k views

Is it safe to send a CSR via email?

I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?
8
votes
4answers
1k views

HTTPS self signed certficiate for personal website

I want to make my Synology NAS accessible over the internet. When I create my own certificate and import this on all my devices (PC, Laptop, Smartphone, Tablet, etc.) is this as secure as buying a ...
8
votes
3answers
7k views

What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?

I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider. Question 1 Why ...
8
votes
4answers
764 views

Why the symmetric key is added to the message?

Yesterday in my class we learnt how to send a message from Alice to Bob with the achieved goals of confidentiality, integrity and authenticity. In order to have a better performance we use a hybrid ...
8
votes
2answers
2k views

What is the difference between SSL and X.509 Certificates?

I used openssl to create a X.509 certificate but I don't quite understand the relationship between a X.509 and a SSL certificate. Are they the same? Is a SSL certificate just a X.509 certificate that ...
8
votes
2answers
544 views

How are browsers able to find and construct an alternate trusted chain path?

We had a web server that had the wrong SSL certs installed yet the browser was able to find another trusted path to a root and supply the page properly over HTTPS. We also have proprietary software ...
8
votes
3answers
4k views

What issues arise from sharing a SSL certificate's private key?

Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website. I have ...
8
votes
3answers
1k views

Creating an X.509 certificate with an invalid signature

Creating an X.509 certificate with a valid signature with OpenSSL is pretty well documented all over the Internet. There are instructions on creating certificates that are signed by themselves and ...
8
votes
2answers
2k views

Obtaining an S/MIME certificate without disclosing my private key to the TTP

I would like to obtain a trusted S/MIME certificate, but all the certificate authorities I have asked so far generate the keypair on their server, sign the certificate and send me both the private key ...
8
votes
1answer
3k views

How does adding a random serial number improve a certificates' security?

This article says: "Finding collisions is a tricky process, since it requires you to muck with the bits of the public key embedded in the certificate (see this paper for more details). Also, ...
8
votes
1answer
257 views

Why are website certificates secure?

I understand how HTTPS connections work, and I also understand they they require a certificate to know that the secure connection you have is with the right server (and not someone pretending to be ...
8
votes
4answers
2k views

Why is it a good idea that X.509 digital certificates have an expiry date?

What is the benefit of having certificates expire at some fixed date?
8
votes
2answers
345 views

Why is there no Domain CA?

I was asked to deliver a signed SSL certificate for an IIS server for a client. I have previously done this for the same client/domain before, so it start to seem like an unnecessary expense to hold ...
8
votes
5answers
2k views

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
8
votes
3answers
762 views

Does the SSL encryption strength or validation level of a website really matter?

When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart. Immediately there seems to be 4 major ...
8
votes
2answers
554 views

How is an HTTPS login secure when pages use HTTP?

When someone go to eBay's website, they use an unencrypted connection between their PC and eBay's server. If they sign in, they are redirected to a secure site identified by its certificate and may ...
8
votes
1answer
969 views

How do I store Diffie-Hellman parameters in a X.509 certificate?

In there paper Authentication and authenticated key exchange Diffie, van Oorschot and Wiener recommend to insert the DH parameters into the certificate of Alice. As a result an attacker can not change ...
8
votes
2answers
754 views

X.509 certificate policies question

I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies. To quote from the X.509 RFC: In an end entity certificate, these ...
8
votes
1answer
262 views

distributing files to VPN partners

suppose i've created VPN certificates for a certain VPN-RoadWarrior-Client, expressed in the files VPN-RoadWarrior-Client.key and VPN-RoadWarrior-Client.crt*, however VPN-RoadWarrior-Client is ...
8
votes
2answers
2k views

Is “Fingerprint Check” enough to verify HTTPS certificates?

So I'm at place A, see this sign: and I'm writing the fingerprints to a piece of paper (this website is just an example): Ok. Then, I go to place B (other country, etc.) then I check this ...
8
votes
6answers
543 views

Easy explanation of SSL client certificates for a developer

I've been thinking about using client certificates for my web apps, desperately hoping for security-conscious users to put their private key on HSMs so they don't get stolen even if the machine is ...
8
votes
1answer
1k views

Moving from a one tier to a two tier Microsoft Certificate Authority hierachy

Right now we have a single Microsoft Enterprise Root CA which issues certificates to our VPN users for two factor authentication. We're planning to extend use of the CA to issue certificates for RDP ...
7
votes
3answers
291 views

Would using distinct IP addresses help support browsers with older SSL implementations?

We have a site with two wildcard certificates: *.foo.com and *.bar.foo.com. All of our subdomains resolve to the same IP address. Newer browsers work fine with this, but IE7, for example, does not. ...
7
votes
7answers
3k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
7
votes
4answers
1k views

How to prove Bob has received Alice message

I have read up on Digital signature and it is stated that it provides non-repudation. Assuming Alice signs the message using her private key and sends it to Bob, Bob can use Alice's public key to ...
7
votes
4answers
2k views

How to check if wifi is safe while travelling?

I'm quite a bit of a traveller. So i tend to just stay with my smartphone and sometimes notebook. I'm not a security expert but i would like to check how to know if wifi is safe to use. For example, ...
7
votes
2answers
3k views

Getting self-signed SSL certificates for all https connections made from some premises

Context: I'm currently working as an expat for my company in a country where the Internet is notably untrustworthy. It made the headlines a few months ago for stealing facebook, twitter and gmail ...
7
votes
4answers
3k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
7
votes
2answers
740 views

security of PKI, Certificates, certificate authorities, forward secrecy

I want to understand how certificates add to the security of information exchange. Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
7
votes
2answers
946 views

How is certificate forgery with cheap CA's prevented?

In order to perform a successful man in the middle attack on HTTPS, one needs to either strip SSL layer and convert it to HTTP completely or needs to have a valid certificate from a CA for the same ...
7
votes
1answer
3k views

Should I regenerate new SSL private key yearly? [duplicate]

Im' renewing my certificate every year. Since I have to make a CSR, should I also renew my key pair at the same time, or is it ok to get a new cert with the same key ? Please supply any security ...
7
votes
4answers
975 views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
7
votes
2answers
4k views

How to set “Not Before” value to past when creating certificate request

We have lots of embedded TLS clients on the field. TLS Servers must be authenticated. Because long power cuts may reset clock of those devices, we have requirement to use certificates with validity ...
7
votes
1answer
6k views

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
7
votes
2answers
506 views

What kind of certificate do I need to be able to sign my own subdomain certificates?

We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...). ...
7
votes
1answer
3k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
7
votes
1answer
2k views

Why do X.509 certificates have “Key Usage” attribute?

I can find their values and all details in the RFC, but I cannot find why it was decided to have this attribute in certificates, instead of leaving them to be multipurposes. Is there a reasoning ...
7
votes
1answer
209 views

Does dnssec protect against malicious registrars?

With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked). This is especially ...
7
votes
3answers
240 views

Limiting the root certificate chain

I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
7
votes
1answer
292 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
7
votes
1answer
246 views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
7
votes
1answer
110 views

What considerations should apply for self service Renewing, Revoking, or Unrevoking a certificate?

I need to design a self service portal for renewing, revoking, and unrevoking a certificate and have come up with the following rules*: Renewal Certificates have a short term validity and need to ...
6
votes
7answers
5k views

What is the danger of hosting your SSL certificate yourself?

I have Active Directory Certificate Services on my server, which makes it possible for me to deliver an SSL certificate for the websites hosted on the same server. I know that normally, I need to ...
6
votes
1answer
694 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
6
votes
4answers
3k views

Can an intermediate CA be trusted like a self-signed root CA?

Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
6
votes
2answers
7k views

Internal SSL Certificates?

As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
6
votes
3answers
249 views

Renew digital certificate

If I have deployed a digital certificate on a webserver and if it needs to be renewed then what steps do I need to follow? Will I need to generate a new longer public key private key pair? Why do ...