Tagged Questions

A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

20
votes
5answers
2k views

Are login “certificates” more secure than standard username + password authentication?

I just opened a new bank account which comes with internet banking. Unlike the others I have used so far, this one requires a personal certificate (a .p12 file stored on my computer) + password for ...
1
vote
3answers
132 views

Multiple SSL server certificates

I am sort of new to SSL. During a SSL connection establishment, I see that the server is sending multiple certificates. Can someone help me to understand why the server is sending multiple ...
5
votes
1answer
4k views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is ...
1
vote
2answers
72 views

Public e-mail Encryption Certificate

I'm quite new to this, so don't be too hard on me. I'm currently using the CipherMail MTA to generate e-mail encryption certificates. I created an own CA and public and private keys for our contact ...
0
votes
0answers
18 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
0
votes
1answer
84 views

Diffie-Hellman certificate verify message

On the RFC 6101, about "Certificate Verify", I read that: "This message is used to provide explicit verification of a client certificate. This message is only sent following any client ...
2
votes
3answers
72 views

Are Extended Validation certificates any more secure than regular ones?

Or are they just an attempt to get you to pay more money to a CA because it tells your browser to show the address bar in green with your organization's name? Also, what are the technical details ...
0
votes
1answer
52 views

Is it possible to create a SMIME only PKI that *can't* be used for SSL?

Assume I have a Root CA that I want to share with hostile untrusted 3rd parties. Then constrain this root using specific EKUs at the root. OID=1.3.6.1.5.5.7.3.4 ; Secure Email Next, ...
1
vote
2answers
49 views

SSL Server Certificate optional

In RFC 6101 (Of SSLv3), In page 22 ServerHello Certificate is marked with * which means optional or situation-dependent messages that are not always sent. It means that Certificate is optional in ...
1
vote
2answers
92 views

Authentication through digital certificates plus signature

While studying X.509 certificates, I've found that authentication is safer if I associate/combine one or more certificates with each signed message (certificate + signed message). The receiver of ...
2
votes
2answers
305 views

How does the SSL connection protocol work with self-signed certificate?

I'm using the self-signed certificate, but I don't know how this protocol works. I connect two apps with a socket SSL and it works fine. The server is a Python app and the client is an Android app. I ...
1
vote
1answer
52 views

Resign root CA as SUB?

Imagine I have a Microsoft root offline ca running since half year, but suddenly I want to include it in my company hierarchy, resigning it with the company official root, But I need both continue ...
1
vote
2answers
96 views

Security risk of Microsoft AD Certificate Services?

We have an internal CA server for our domain located at http://cert_srvr.local.domain/certsrv/certrqxt.asp. This server runs Microsoft Active Directory Certificate Services. When I went to the ...
0
votes
2answers
179 views

What is the purpose of HTTPS GET vs POST requests when certificate pinning?

I have a mobile app which uses public key pinning to make sure that I only connect to servers from my CA. This works great with https, and it makes it so that nobody can really proxy my server and ...
1
vote
1answer
206 views

Mixing green (EV) ssl certificate with non EV certificate

We have a green (EV) SSL certificate for our site and images are fetched from the same domain (https). Currently we are planning to change the images domain (for performance issues) and put them in a ...
8
votes
3answers
841 views

Creating an X.509 certificate with an invalid signature

Creating an X.509 certificate with a valid signature with OpenSSL is pretty well documented all over the Internet. There are instructions on creating certificates that are signed by themselves and ...
1
vote
1answer
97 views

Certificate pinning in a browser

I am trying to understand certificate pinning. Google started adding a whitelist of CA certs that they use for their certificates and if a cert for a google service is issued outside of this list ...
1
vote
1answer
656 views

cURL cert validation with curlopt_cainfo not working

I want to validate my SSL certificate each time I run API calls. I've been following this guide: http://artur.ejsmont.org/blog/content/how-to-properly-secure-remote-api-calls-from-php-application ...
0
votes
1answer
69 views

Updating Root/Intermediate Certificates over NDES/SCEP

In attempts to setup our first instance of NDES/SCEP in the wild on Cisco routers we have run into a concern. Currently our organization has a three tier PKI. We have an AD CS server on the third ...
2
votes
3answers
101 views

How are public key certificates updated securely?

Let's say I get a new computer that's never been connected to the internet before. The first time I connect it to the internet, is it susceptible to a mitm attack while downloading its public key ...
2
votes
1answer
2k views

SSL certificate chain verification

After reading many articles and watching many tutorials I decided to be specific because there are some things about SSL certificate chain verification and SSL cetificate verification in general that ...
4
votes
1answer
117 views

Does SSH authorized_keys violate the principle of “re-authenticate before password change”?

It is generally accepted that password change mechanisms should ask the user for their old password (e.g. OWASP) The reason being that an attacker who has temporary access to a user's session (be it ...
0
votes
1answer
136 views

SSL decryption without installing a certificate on each client

Given a proxy performing MITM SSL decryption and inspection, is it possible to install a wildcard certificate (*.domain.com) on the proxy signed by a root CA (such as VeriSign or GoDaddy) such that ...
2
votes
1answer
127 views

Why does facebook php sdk (and multiple others clients) include CA bundle with a lot of CAs?

This is what facebook ships with their API php client: https://github.com/facebook/facebook-php-sdk-v4/blob/master/src/Facebook/fb_ca_chain_bundle.crt It contains dozens (hundreds?) Root CAs. But ...
2
votes
2answers
213 views

Certificate authority structure - best practices

I'm working for a company that sells software products to customers some of which do not have the resources and/or know-how to build and maintain their own CA (used for the SSL communication of our ...
6
votes
1answer
655 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
2
votes
0answers
19 views

Email, Certificates and DANE

Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is jd@foo.com but mail.bar.com is the email server, ...
0
votes
2answers
635 views

“A third party is capable of monitoring your network activity” with client certificates?

I installed the CAcert root certificates on my Android device (not rooted), so that I could visit websites with server CAcert certificates without getting the "certificate not trusted" warning. But ...
0
votes
1answer
230 views

Security weaknesses in using RSA encrypted MD5 hash of certificate content

Suppose you have an Internet banking site based on a secure web server running the HTTPS protocol via port 443. The server authenticates itself to clients through an X.509 certificate signed by a ...
0
votes
1answer
2k views

RESTful web service and SSL certificate

We have a server that provides RESTful services to our application server. It runs on Amazon Elastic Beanstalk and mapped with a domain name and SSL certificate registered at GoDaddy. It ran ...
1
vote
0answers
96 views

Are any major websites offering ECDSA authentication?

At the time the Cloudflare blog post “ECDSA: The digital signature algorithm of a better internet” was authored, Cloudflare was apparently one of "fewer than fifty" users of ECDSA certificates on the ...
0
votes
1answer
1k views

Verify Certificate is revoked by CRL

I set up a CA and signed some cert request. I revoke them by: openssl ca -config config.cnf -revoke cert.pem I update CRL by: openssl ca -config config.cnf -gencrl -out crl/crl.pem ...
1
vote
2answers
65 views

Own attributes openssl

Is there a way to include my own attributes into an openssl certificate? e.g ... Country Name (2 letter code) [GB]: State or Province Name (full name) [State]: Locality Name (eg, city) [City]: ...
12
votes
5answers
2k views

Why are certificates limited in time?

If a certificate has a limited duration of, say 5 years, but it gets somehow compromised after 2 years, waiting the 3 remaining years for it to get invalid is not a real solution to the breach ...
0
votes
0answers
37 views

How to gather/verify certificate data with limited information (Issuer, Serial, CN)

I asked this question in the "programming" section, Here. However it may be a simple answer for someone familiar with the security of certificates. The basic premise is I have a large table with ...
2
votes
2answers
84 views

PKI certificate validation graphs, trees and cross signing

I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it ...
2
votes
1answer
351 views

“global” OCSP with Apache mod_ssl / Alternative to -VAfile option Openssl

Context I'm developping my own OCSP responder which signed its ocsp responses with its own self signed certificate caOcspBC.crt. You can find it here : https://github.com/Dinou/ocspResponder I want ...
0
votes
2answers
55 views

Self signed certificate secure when just client sends sensitive information?

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for ...
2
votes
2answers
145 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
2
votes
1answer
62 views

How does checking CRLs make sites less safe?

With the frantic certificate upheaval resulting from the Heartbleed fiasco [drink!], there has been lots of talk regarding certificate revocation, and in particular the policy of certificate ...
0
votes
0answers
40 views

Changing the string format of Burp generated certificates

The certificate verification in a piece of software I'm poking uses UTF-8 encoded strings to verify the certificate's host name. Certificates generated by Burp suite, however, use the custom type ...
3
votes
1answer
81 views

Windows - service account default certificate store

I am writing a web app that connects to external web services. The external web services serve an intermediate certificate signed by Thawte SGC CA - G2. When I setup IIS to run the web app using ...
3
votes
2answers
117 views

What are Implicit and Explicit Certificates in Public Key Cryptography?

A Public key is certified by a Trusted Certifying authority, to ensure the integrity of the key and authenticity of the entity who claims to have the corresponding private key. In this Public Key ...
0
votes
1answer
107 views

Certificate request - why does the requester have to create a private key?

If remember right, then before I send a CSR (Certificate signing request) to the CA, I have to create private and public keys. Then I use the public key to encrypt my personal details before I send ...
2
votes
2answers
188 views

What happens if the CA has knowledge of private keys?

In a classic PKI scenario, the certificate authority receives signing requests generated by an end-user which owns the keychain, and thus has his private key secret. Consider a scenario in which the ...
2
votes
1answer
571 views

What happens when intermediate certificates are installed in the wrong order?

I have noticed that the intermediate certificates on a web service are installed in the wrong order. What effects could I expect from this? I used the Symantec certificate checker which stated: ...
3
votes
2answers
136 views

SSL Wildcard certificate to issue anther certificates

Let's say, that I buy an *.example.com SSL certificate. I want now to generate subcertificates and include the *.example.com certificate in a trust path: host1.example.com, with an alternate name ...
11
votes
2answers
2k views

Is Apple's push notification service implementation vulnerable to a MitM attack

Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2 Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf ...
1
vote
2answers
3k views

Unrecognized leaf certificate

Every 15 minutes or so I get this message in my system.log Apr 25 22:05:36 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate Apr 25 22:20:57 Ivans-MacBook-Pro.local apsd[194]: ...
1
vote
1answer
62 views

When does S/MIME require the other party's certificate and when is their key enough?

Trying to understand S/MIME implementation, I see that sometimes you must have the other party's certificate, and sometimes its enough to just have their public key. I'm confused as to when you need ...