A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

3
votes
1answer
95 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
3
votes
2answers
108 views

Isn't this the same as using a certification authority?

Taken from Wikipedia, here is the pretext to my question: A certificate authority (CA) is an organization that stores public keys and their owners and every party in a communication trusts this ...
3
votes
4answers
378 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude ...
3
votes
1answer
409 views

generating RSA keys through the browser

HTML5 has the element that sends an SPKAC to the server (as I understand it). But how do you do it in IE? One CA's websites gives me the following prompt: This Web site is attempting to perform a ...
3
votes
1answer
167 views

Is it a good idea to generate certificate-specific CRLs? What is this technique called?

Suppose I create 3 certificates with the following CRLs Cert1 http://crl.server.com/batch1/root1.crl Cert2 http://crl.server.com/batch2/root2.crl Cert3 ...
3
votes
1answer
622 views

What happens to a certificate's Basic Constraints when a policy map is used?

One feature of a Basic Constraint when applied to a certificate (CA or end certificate) is that I can specify the maximum number of CAs that are permitted in the chain. I'm planning on having a 2 ...
3
votes
2answers
200 views

SSL Certificate Signing by a CA

Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return. What I don't understand is what, ...
2
votes
3answers
226 views

How can I know when a certificate was created?

I want to know whether my various providers changed their certificate because of Heartbleed, or they are using an old vulnerable certificate. How can I know that? Is the "valid from" date also the ...
2
votes
4answers
973 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
2
votes
2answers
249 views

Can I buy a signing-valid certificate for internal use?

So now that I have to implement "secure transport" as defined by The Direct Project (not to mention reinventing a bunch of wheels, but that's another story for SO), I find myself staring down the ...
2
votes
2answers
5k views

OpenSSL, x509: what's the significance of CN (Common Name)?

With regard to these three items Certificate Authorities (CA) Gateway certificates End-point Certificates (client-cert) What is the significance of the Common Name CN with regard to the a VPN? ...
2
votes
2answers
1k views

How to use 'key material' so that multiple people can access protected files?

I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
1
vote
1answer
53 views

Private CA and client server authentication

I have a private application - that has one server and many clients and I want to use two way authentication(AKA client auth) I use Tomcat server and java keytool to create TLS certificates. If I ...
1
vote
1answer
40 views

Possible to change the CA that a keypair is using?

Pretend I take the same CSR and send it to two different CAs as described in the following scenario: I create a CSR on Windows I submit the CSR and edit my SAN names. Request is pending at the CA ...
1
vote
0answers
256 views

If even Apple cannot properly install certificate [closed]

I've just installed a new copy of Mozilla Firefox/29.0 SeaMonkey/2.26.1 on a new Mac with OS X 10.9.4, and I'm getting an error message in place of a webpage when trying to access ...
1
vote
2answers
144 views

Should every SAML identity provider provide a unique public certificate to the service provider?

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
1
vote
1answer
348 views

Risks associated with distributing encrypted private key with our software?

Our software contains two executables that need to serve data over SSL (and several that need to do requests over HTTPS)). I notice that it is distributed with some .PEM files created with OpenSSL. ...
1
vote
1answer
453 views

Generate CSR with 2 OU Names

I have to create an application which generates a CSR. While generating a CSR we are required to fill in several details like CN, OU, etc. The problem is that the Certifying Authority to which I have ...
1
vote
1answer
486 views

are organizations that receive certificates considered “end entities” in a PKI?

I am trying to understand the term end-entity. Does this term just mean anybody that plays a role in a PKI system that is not a CA? So if I request a certificate from A who is a CRL issuer for ...
1
vote
1answer
565 views

How to troubleshoot why Thunderbird rejects a PKCS#12 certificate with “Could not verify this certificate for unknown reasons”?

After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a ...
1
vote
4answers
2k views

Does a renewed certificate open old messages?

I have a digital certificate that I use to exchange messages with peers, my certificate expiration date is due next year, suppose I renew this certificate before it expires, will I be able to open the ...
1
vote
1answer
302 views

Signature and Timestamp for Long Term Document Archival Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity. As far as I understand, I ...
1
vote
1answer
5k views

What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?

MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed. Based on this and this KB article the EKU section of the certificate should contain "Client ...
0
votes
1answer
44 views

CSR signing follow up question

This is a follow up question , after getting a signed certificate from one CA. researched a lot , but no luck. After getting the CA reply, While downloading the certificate, it popped up saying ...
0
votes
2answers
61 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
0
votes
1answer
164 views

Can IE be made to imitate the behavior of Chrome's KeyGen element?

Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element? Assistance getting Safari to work with this optional HTML5 spec would be ...
0
votes
1answer
225 views

Authentication methods without trusting 3rd parties unless explicitly indicated

The plan is to have a situation in which no third parties have to be trusted unless you explicitly indicate so. For example CA's are only used when the contact explicitly added the CA as a trusted ...
-1
votes
1answer
255 views

How does SSL client authentication work?

I read the RFC document, it mentioned that there are some kinds of client certificate type. So I don't understand what does this type mean. For a instance, one type named rsa_fixed_ecdh, it said, the ...
-7
votes
4answers
385 views

Is TLS-in-TLS supported in any software? Does it make sense? [closed]

I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...