A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
2answers
94 views

TLS or IPsec protocol for client-server communication? [duplicate]

What is the best protocol for client-server communication? TLS or IPsec? I have a public channel where users communicate with each other using a digital certificate like X.509.
7
votes
2answers
277 views

Should a wildcard ssl certificate be shared with a different organization hosting a subdomain?

We are hosting our own secure site with a wildcard certificate. However, we are working with a marketing company that provides landing pages on subdomains of our domain, on ip addresses supplied by ...
0
votes
2answers
106 views

Where are certificates used to prove identity and why aren't DNS responsible for the job?

I've been reading about how certificates are used to verify the owner of a public key in asymmetric encryption. Right now everything seems really theoretical to me and I'd like to know how this works ...
3
votes
1answer
344 views

Why is google's site identity icon a red lock?

Why does google.com have this icon (see picture) for me? What does it mean? Screenshot: Google.com. There are two lock icons. The top one is RED and the bottom one is green. Screenshot: Google.se. ...
1
vote
1answer
57 views

TLS 1.2 mutual authentication certificate based standard

I'm running an analysis on a TLS1.2 mutual authentication certificate-based client-server implementation and I'm wondering if there's a RFC or a reference document covering the handshake process when ...
1
vote
0answers
40 views

Verify request using the X509 certificate [closed]

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML. BinarySecurityToken (X509PKIPathv1 certificate) ...
-2
votes
1answer
133 views

How to dnsspoof against HTTPS

I am doing a dnsspoof PoC, but apparently it doesn't work with HTTPS because of the certificate. Please don't tell me that I have to generate a certificate or send a legitimate certificate, I want ...
2
votes
1answer
47 views

Best practice to verify data against a CA

Let's say that I have signed my public key with a trusted CA and the CA provided my with a signed certificate, and I want any client applications to verify against this certificate. The general ...
1
vote
2answers
76 views

Will a wildcard SSL work properly for an A record subdomain pointing to another domain/website?

Client has wildcard SSL for his domain/subdomains. The application we are building is on one of our linux servers using one of our IP addresses and is contained within an account named ...
3
votes
1answer
94 views

Understanding the signing and verification process through a CA

I have been researching on this topic and I need to understand the exact signing and verification process when made through a trusted CA. From what I understand, this is how it works at a very high ...
2
votes
2answers
96 views

Is it possible to let a fake certificate appear valid by sending fake OCSP responses?

In a MITM-Attack I can exchange the server certificate by one I created on my own with tools like MITMProxy or SSLSplit. But this only works well when I have installed a fake CA cerrtificate in the ...
1
vote
1answer
124 views

What are WiFi certificates used for? What are they?

Recently my university updated the certificates for authenticating on their WiFi network. I was hesitant to accept it because I wasn't sure what accepting it entailed or even what it was and what ...
1
vote
1answer
73 views

What does it mean to “sign with a certificate”? [duplicate]

As part of the SSL handshake, the server responds to the browser with 2 things - The server's public key Some metadata, like what version of SSL is being used, the cipher algorithm being used, ...
1
vote
1answer
112 views

x.690 universal class tags implementation reference

Can anyone with enough knowledge of X.690 tell me where can I find the official reference implementation for the universal class tags for X.690. (For example: For TLS we can reference RFC 5246.) When ...
2
votes
1answer
89 views

Can an Android malware install a SSL/TLS certificate into non-root devices?

Does there exist some standard API that allow an Android malware to download and install a SSL/TLS certificate as RCA, in the default keystore, in non-root devices? I think that this is a very ...
1
vote
1answer
56 views

Certificate-verification in TLS

Out of curiosity I wonder why in the Handshake Protocol of TLS there is an explicit message, i.e. CertificateVerify, that serves to verify that the client is indeed the owner of the certificate he ...
0
votes
1answer
42 views

Certificate format

Analyzing some payload I faced up to one which contains a string like this : VeriSign, Inc.10UVeriSign Trust Network1:08U1(c) 2006 VeriSign, Inc. - For authorized use only1E0CU VeriSign Class 3 ...
1
vote
0answers
69 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
2
votes
1answer
62 views

Attribute Certificates and Access Management

I recently came across Attribute Certificates (RFC 5755), which can be used as a means for authorisation. I like the idea but I have spent a lot of time searching for information how this works in a ...
0
votes
1answer
2k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: ...
1
vote
0answers
52 views

Theory behind certificate for job account

I made it work a job account protected by a certificate in a java spring application but is not that clear to me the minimal steps.(Could you believe that :) I need some theory. Here my steps: ...
0
votes
1answer
70 views

Certificate - Digital fingerprint vs Signature [duplicate]

What is the purpose of the « fingerprint » section of a x509 certificate, and is there an issue using SHA1 for it ? I understand the certificate signature section, but I can’t see the point with the ...
0
votes
1answer
77 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. Indeed, I am wondering if the code signing certificate (the “final cert”) must already ...
5
votes
2answers
350 views

Private key to PEM

I'm new to security and I'm trying to decode some SSL encrypted communication between my machine and server. I managed to obtain private and public keys as far as I understand private key is this ...
0
votes
1answer
219 views

Difference between certificates with “extension fields” and “Non Repudiation” usage

For example we have two certificate pairs: First pair: Server cert with "Non Repudiation" (sometimes called Content Commitment) usage, Client cert without any "extension fields". Second pair: ...
-3
votes
1answer
113 views

Illegal Russian Forums [closed]

I recently found this link hxxps://maza.cc:888 and it was saying No required SSL certificate was sent. How can I bypass to see the content on this site?
8
votes
1answer
275 views

What to do when Google disables SSLv3 and RC4?

I've read this article from Google's Online Security Blog, and it says that Google will disable support for SSLv3 and RC4. Here's the reason: SSLv3 has been obsolete for over 16 years and is so ...
-4
votes
2answers
56 views

Does SSL doesn't work without a secondary Symmetric/Asymmetric session key?

I keep reading that Symmetric session key is used in SSL after handshake only for faster performance but isn't true a secondary session key either Symmetric or Asymmetric key generated by the client ...
0
votes
2answers
142 views

Understanding SSL certificates [duplicate]

How does an SSL certificate prove the emitter is who he pretends to be ? If Bob (holding a certificate) and Alice wanted to establish a SSL-secured connection, wouldn't John be able to get the ...
1
vote
1answer
136 views

Cannot connect using ECDH-RSA-AES256-SHA

I try to establish an SSL connection using the ECDH-RSA-AES256-SHA cipher using OpenSSL, but it fails saying "no shared cipher": On the server, I run: $ openssl s_server -cert selfsigned_cert.pem ...
5
votes
2answers
537 views

One website - two different SSL certificates: two different CA's

I have seen multiple questions focusing on multiple certificates for a single domain (e.g.: a.com/example and a.com/example_one). However, what stops an individual from purchasing a certificate and ...
3
votes
1answer
91 views

Sign certificates using a web server certificate issued by a public CA

I have obtained a certificate from GoDaddy. It's usage and constraints are as follows: Key Usage Digital Signature, Key Encipherment (a0) Enhanced Key Usage: Server Authentication ...
5
votes
1answer
105 views

SSL certification path building

Background Some SSL certificates have two certification paths. In other words: the trust-chain can take two paths. I installed all the certificates for one path but that gave an HTTPS error on some ...
0
votes
0answers
56 views

Certificate policies extension in Root CA and Issuing CA

I am building new CA chain and PKI and I actually don't fully understand how I should include certificate policies (CP) and certificate practice statements (CPS) as extensions and how to work with it ...
4
votes
1answer
79 views

Amazon cert SHA-1 signed?

I just checked Amazon's certificate and it shows it is SHA-1 signed. But Chrome does not show any warnings, like it does (the red cross) for other websites with SHA-1 signed certificates. Am I ...
1
vote
1answer
58 views

Is it possible to issue a certificate with different attributes than in .csr?

Is it possible to issue a certificate with different attributes than in certificate siging request? I have a keypair and I generated a cert. request with extra attributes. Can the CA/RA or anybody ...
2
votes
2answers
132 views

Is encryption application credentials using certificate encryption good practice?

I'm working on a small web application. The web application needs access to a database, so the application needs access to a database username and password. The application runs in an environment ...
4
votes
2answers
76 views

Are the rules used to validate certificates in the major browsers documented anywhere?

I'm trying to get a certificate that's good for two subdomains. Essentially, the TLS equivalent of the human-level logical cert "*.*.example.com". I've tried: Name constraints: these work in the ...
2
votes
1answer
61 views

New certificate but what about the keys?

One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a ...
0
votes
1answer
21 views

How to see absolute difference between DV and OV certificates? [duplicate]

I know that browsers show no difference to the user between OV and DV certificates, but what is a sure way to find out if a certificate IS or ISNT an OV certificate? Also, are there any technical ...
6
votes
2answers
112 views

Understanding Digital Certification as as a whole starting from a normal http request

I am trying to understand the difference between digital signature and digital certification and how they work as a whole together on a high level perspective. I hope gurus here can point to me if my ...
5
votes
1answer
89 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
0
votes
2answers
155 views

Why is Facebook planning to drop support for SHA-1 encrypted sites, when they themselves use a SHA-1 certificate?

I noticed this problem when I implemented the Facebook Like Button plugin on my website, and got this error in my browser console: Hmm, I'm assuming that Firefox is talking about the last request, ...
21
votes
4answers
2k views

Cloudflare's free SSL options require trusting them; what could they do to change that?

Cloudflare offers 3 free SSL options: Flexible SSL, Full SSL, and Full Strict SSL. The article “CloudFlare’s great new features and why I won’t use them” explores the shortcomings of the Flexible and ...
1
vote
1answer
84 views

Is algorithm used to sign defined by certificate?

Using pfx certificate to sign or cypher, the algorithm used (rsa-1_5, rsa-oaep-mgf1p, etc) is defined inside pfx certificate? Certificate has information about algorithms used? Or it's totally ...
3
votes
1answer
196 views

Getting a certificate warning for one email but not another

When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private". Here are the ...
2
votes
1answer
169 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
2
votes
1answer
107 views

Why not use same certificate for webserver TLS and Signing in SAML?

I have read a bit about configuring shibboleth, and recommendations for SAML at internet2 I get the point that a certificate does not have to be signed when used for SAML, because actually only the ...
1
vote
1answer
83 views

Certificate expiry validation - in what stage?

I'm implementing certificate expiry validation for a client. I'm not sure about the following. Is there a standard/popular implementation regarding the order of validation- Check if the ...
1
vote
4answers
584 views

SHA-1 deprecation and self-signed certificates

I am confusing regarding SHA-1 deprecation. We use self-signed certificates signed with SHA1 and the expiration is after 1 January 2017. According to this blog: ...