A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

4
votes
2answers
144 views

Can the client certificate authentication process treated as a user digitally signed the content(and then get verified on the server)?

The authentication was triggered by certain event (like approving button) on the form. In the process of client certificate authentication (in IIS), user was asked to use their PIN (private key) and ...
3
votes
2answers
151 views

Requirements for qualified certificates in DIRECTIVE 1999/93/EC

DIRECTIVE 1999/93/EC at ANNEX I Requirements for qualified certificates states that one requirement for qualified certificates is (a) an indication that the certificate is issued as a qualified ...
4
votes
1answer
74 views

What is the meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC from ETSI TS 102 231 V3.1.2

From Technical Spec http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC a Root Certification Authority from which a certification path can be established down to ...
1
vote
1answer
226 views

How to authenticate to racoon with a certificate chain if only the root CA is known

I'm trying to setup IPsec using x509 certificates on Linux. I'm using racoon for that task. I've come to the point where the authentication works fine if I keep every link of the certificate chain on ...
0
votes
3answers
5k views

How to prevent man-in-the-middle attacks beside of SSL?

I would like to discuss this scenario: There is a HTTPS service which responds with signed keys to an authenticated client. These signed keys can be used for another service to return very sensible ...
1
vote
3answers
2k views

Is it possible to use wildcard certificates on multiple devices?

I have a server that I want to use a wildcard cert on. It runs multiple services. I purchase a wildcard cert so that I can protect mail.something.dom, www.something.dom, im.something.dom, ...
1
vote
5answers
1k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...
1
vote
2answers
2k views

Public Key → Certificate?

Is it possible to convert a public key to a certificate using the public key only? I've seen the following, which takes a private key to form a cert request, which can then be self-signed: openssl ...
3
votes
1answer
78 views

Why is the issuer name field signed in X.509?

In the X.509 specification it sais that the issuer name is to be signed. Since we verify the certificate with the authenticated issuer's public key, it seems infeasible to forge the issuer name ...
2
votes
2answers
263 views

Wildcard SSL Certificates & SAAS

From what I have read, using a wildcard SSL/TLS certificate is not advisable, how do you do certifcate issuing & management in your SAAS application(linux) where each client has a user selected ...
2
votes
4answers
169 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
-1
votes
1answer
2k views

Why IE/Windows forces you to install self-signed certificates as root CA to make them work?

In old versions of IE/Windows you could install a self-signed certificate for a web site and it just worked: the warnings disappeared. In more recent versions (and with Chrome) this just didn't work. ...
5
votes
2answers
5k views

Is there an SSL Certificate state-cache on Windows, IE, and Outlook and how it it managed?

Today I changed the SSL certificate that 3,000+ Outlook clients are using. In doing this I changed the certificate to an "older" one that had the same subject name, expiration and everything else. ...
3
votes
2answers
2k views

Import Public Private key pair to a Keystore

I have created a public private key pair using the KeyPairGenerator class in Java. From this key pair I have generated the CSR request using the PKCS10 class which has been sent to a CA for ...
1
vote
2answers
162 views

OpenSSL, x509: what is the correct way to picture signing authorities?

For the purposes of creating a VPN, I can't find a logical explanation of OpenSSL's/x509 scheme. I'm royally confused about these three terms, Certificate Authorities Gateway certificates End-point ...
1
vote
2answers
2k views

OpenSSL, x509: what's the significance of CN (Common Name)?

With regard to these three items Certificate Authorities (CA) Gateway certificates End-point Certificates (client-cert) What is the significance of the Common Name CN with regard to the a VPN? ...
2
votes
4answers
7k views

SSL Client Certificate authentication

Is it possible to make a program which uses client certificate authentication with only public and private key (I have not generated any certificate, I have only public and private key). Simply, I ...
5
votes
2answers
459 views

Root SSL certificates and browser support

I have given three certs to be install on nginx AddTrustExternalCARoot.crt PositiveSSLCA2.crt www_example_com.crt So I concat them into a chained cert cat www_example_com.crt PositiveSSLCA2.crt ...
5
votes
2answers
249 views

Avoiding MITM attacks when using HTTPS over mobile

There are a variety of other questions that address elements of this security issue, but none that seem (to a non-expert) to address the substantial core of the issues raised in this article: ...
1
vote
1answer
99 views

Generate CSR with 2 OU Names

I have to create an application which generates a CSR. While generating a CSR we are required to fill in several details like CN, OU, etc. The problem is that the Certifying Authority to which I have ...
2
votes
2answers
147 views

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
5
votes
1answer
385 views

Retrieving client certificate using Tcpdump results in zero length certificate

I am trying to proxy a mobile app (with Fiddler), which sends a client certificate to the server it connects to. I would think that capturing traffic with Tcpdump, retrieving the client certificate ...
-4
votes
3answers
263 views

PHP web application security [closed]

I am building a PHP web application, that needs enhanced security, due to the fact that it contains very sensitive information (in a database). I think that I want to use self-signed SSL ...
3
votes
2answers
290 views

Should I customize my Root CA's thumbprint/fingerprint? (SHA1 or MD5)

My goal is to make a certificate's thumbprint "easier" to verify, and not reduce security in doing so. Given that the RSA-based Bitcoin technology has a concept called a "Vanity address" where the ...
1
vote
1answer
144 views

Generate Keytool Object from CSR

I have to develop an application which uses another application for generating a CSR. After generating the CSR I have to provide this CSR along with a SHA256 hash of the public key to a CA. The ...
4
votes
1answer
104 views

Are there any public examples of an encrypted attribute in a Verisign-issued certificate?

This Credentica- UProve paper describes how Verisign issues (or did issue in the past) certs with encrypted attributes: "VeriSign issues certificates that contain encrypted attributes that can be ...
2
votes
2answers
71 views

Which signing strategy?

I have a device which should lock and unlock something after receiving a signed server response. So in the best case a loop would lock like this: User locks device User wants to unlock device User ...
6
votes
4answers
492 views

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
1
vote
1answer
980 views

Windows' default certificate store for intermediate vs trusted root certificates - my self signed root CA cert goes to 'intermediate' by default?

Is it possible to create self-signed root CA certificate that Windows will import to Trusted Root by default instead of Intemediate certificate store ? Obviously, it won't do it without the big giant ...
1
vote
2answers
272 views

Why is malwarebytes.org's SSL certificate from someone else?

I tried downloading and updating malwarebytes from https://www.malwarebytes.org but their certificate seems to be incorrect. This is the warning: This is probably not the site you are looking for! ...
3
votes
4answers
194 views

Trust among the root-CAs

The system of CAs with the root-CAs and their subordinate CAs are IMHO in principle akin to the system of banks with their main sites and subsidiries. In the case of banks, a customer of a bank ...
2
votes
3answers
507 views

Where to get/buy a CSR generated S/MIME certificate

I'm not sure if the question is eligable for this board as I ask for concrete service providers which can be kind of advertisement, but there is also technical issue involved, so I give it a try. My ...
23
votes
2answers
613 views

Why aren't infinite-depth wildcard certificates allowed?

As far as I can tell, an SSL certificate for *.example.com is good for foo.example.com and bar.example.com, but not foo.bar.example.com. Wildcards certificates cannot have *.*.example.com as their ...
6
votes
2answers
372 views

Why do embedded systems store server's public certificate in ROM?

In the home automation scenario, smart gateway can bridge the many smart devices with Internet. In many cases, a server's public certificate is stored in the embedded system's ROM during ...
8
votes
2answers
6k views

Is there any way to get Chrome 27 to trust a self-signed cert? [closed]

I'm running latest gen Chrome (27) and preparing a demo that requires using a self-signed cert to support HTTPS on a local IIS website. The cert has been created with the correct common name for the ...
1
vote
1answer
122 views

Dangers of client & server package, communication over HTTPS using user's own self-signed certificate?

I want to create a client & server package with the option of an encrypted connection. From my limited understanding, to get HTTPS connections working, the user needs their own certificate ...
1
vote
1answer
452 views

how to make socat ignore client certificate?

I'm trying to set up a listener to check if an application checks the server's certificate (I'm strongly assuming it is not). So I've created a self-signed certificate fake.pem for a listener and am ...
8
votes
2answers
994 views

Obtaining an S/MIME certificate without disclosing my private key to the TTP

I would like to obtain a trusted S/MIME certificate, but all the certificate authorities I have asked so far generate the keypair on their server, sign the certificate and send me both the private key ...
12
votes
3answers
889 views

Multi-tenancy, SSL Certificates, and Subject Alternative Name

The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension. From the spec: The subject alternative name ...
4
votes
4answers
5k views

Adding self signed certificate to trusted store

I have been reading about certificates and often is said that self signed certificate should not be added to the trusted authority store and even if you did, remove it after usage immediately. MSDN ...
9
votes
4answers
334 views

How to stop/detect someone else registering a certificate for my domain

With the proliferation of low-cost automated CAs what can be done to mitigate the attack of someone doing a spear phishing attack to get a login to our webmail system, then using an automated service ...
3
votes
1answer
136 views

Design of system based on HTTPS, Client Certificates and custom CA

I have the following system: 2 application servers. At the beginning is installed the first server and later is installed the second one. A client access from a browser to both servers Application ...
10
votes
1answer
118 views

How CA ensures that a certificate request is coming from me?

To establish trusted SSL connection I need to create a certificate request. For example, if I use openSSL I can do it by the following command: openssl req -new -key privkey.pem -out cert.csr ...
6
votes
2answers
441 views

Is “Fingerprint Check” enough to verify HTTPS certificates?

So I'm at place A, see this sign: and I'm writing the fingerprints to a piece of paper (this website is just an example): Ok. Then, I go to place B (other country, etc.) then I check this ...
5
votes
3answers
664 views

Why are Certificate Revocation List periodically renewed?

While studying a security course I have been asked this very question: Why are CRL periodically renewed, even if there are no new revoked certificates to add to the list? Honestly I can't find the ...
8
votes
2answers
349 views

How is an HTTPS login secure when pages use HTTP?

When someone go to eBay's website, they use an unencrypted connection between their PC and eBay's server. If they sign in, they are redirected to a secure site identified by its certificate and may ...
5
votes
3answers
356 views

Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?

Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate ...
5
votes
1answer
184 views

'Trusted CA Certificates' and 'Trusted remote Certificates'

What is the difference between Trusted CA Certificates and Trusted remote Certificates?
3
votes
2answers
491 views

Change 'Key Usage' of a certificate

Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
2
votes
2answers
813 views

Force SSL/TLS client cert authentication even if server does not request it?

Usually the server specifies in the Server Hello message if a client certificate is needed/wanted. Does anybody know if it is possible to perform an authentication via client cert if the server does ...