A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
1answer
63 views

Verifying that a request is internal

I've got a web app that will only output safe code. It needs to pass this to a Python backend. The logical way to pass things between JavaScript and Python is to have a Flask server running. Then, the ...
11
votes
2answers
859 views

How long can X.509 certificate chains be?

Usually, I only see certificate chains with a root CA, an intermediate one, and a third one for the particular SSL/TLS website; but can X.509 certificate chains be deeper than 3 levels? Is there a ...
4
votes
5answers
265 views

How does Blucoat Proxy allow governments to decrypt SSL?

I am asking about systems like: Bluecoat ProxySG I saw some relevant answers here: Can my company see what HTTPS sites I went to? It explains how employers can do it using root certificates, but ...
4
votes
2answers
98 views

Does SSL certification have anything to do with the website legitamacy?

Does SSL certification have anything to do with the website's legitimacy? Are those websites which has it are under some kinda monitoring? Generally speaking, can a company say they follow the law ...
1
vote
0answers
98 views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
3
votes
2answers
146 views

Can a CN-only certificate bypass a name constraint if the CA goes rogue?

I am trying to cross-certify an internal issuer certificate, adding a name constraint for our domain. However, it seems that an attacker could bypass this protection by putting the desired host name ...
1
vote
0answers
176 views

MQTT (Mosquitto) certificate SSL23_GET_CLIENT_HELLO:unknown protocol [closed]

I'm been desperately trying to get my MQTT clients to connect to my MQTT broker which is set up with a certificate from a CA. To be able to get the CA certificate, I've used the letsencrypt python ...
1
vote
2answers
163 views

Single Domain SSL Certificate vs Wildcard Certificate

Probably a rather odd question, but something that came to mind. Wildcard certificates are about 10 times more expensive than a single certificate. However with a single certificate, you can secure ...
3
votes
1answer
124 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
0
votes
3answers
115 views

What implications does the KeRanger infection have for Mac OSX security?

Recently some hackers replaced installers for a popular torrent client with an infected version. According to paloaltonetworks, they have no idea how the hackers managed to do this (let's just assume ...
0
votes
2answers
133 views

How In-House Certificate Authority works (e.g. EJBCA)

I have a simple (dumb?) question with respect to EJBCA. I have been exploring how In-house CAs work and issue certificates. However, I am not able to understand who will be trusted on the top level in ...
5
votes
2answers
155 views

Why is weakness of SHA-1 considered a threat to TLS security

If I understand correctly the role that a hashing algorithm (e.g. SHA-1) plays in TLS certificates is as follows: The hashing function is applied to a subject's public key. The CA then uses their ...
1
vote
1answer
82 views

ECDSA implicit certificate using OpenSSL

I am trying to generate implicit ECDSA certificate only for signing and verification using OpenSSL. I tried google but I am getting many research papers. I understood that A messages need to be signed ...
1
vote
2answers
58 views

Client verification with PKCS#7

When a client sends you a pkcs#7 file to communicate with you, Is this because the file has their public key(certificate) and their chain and to avoid the confusion on your side what needs to be there ...
0
votes
1answer
147 views

CSR with only public key with openssl

So I have been doing my research and haven't found anything specific enough to my problem. As the question title states, I want to make a CSR with only the public key. What I have been able to do is ...
0
votes
1answer
96 views

What is the difference between a certificate, a signature and a thumbprint in case of windows exe/binaries?

I am trying to understand the difference between signature , thumbprint and certificate in context of windows executable and binaries. I looked up on internet before posting this question but I did ...
1
vote
2answers
78 views

Reissuing certificates with SHA-2

I recently setup my own CA, and imported the CA cert into devices across the company. I then deployed certificates to our various servers, etc.. All using SHA-1 signatures (the default in the tool I ...
3
votes
1answer
159 views

Understanding how does certificate validation work

I'm using Wireshark for better understanding how is a SSL connection established. I captured the traffic of visiting three pages: reddit, facebook and this one. All HTTPS of course. Reddit: after the ...
1
vote
1answer
164 views

TinyCA missing CRL information in root and leaf certificates

I setup a new CA using TinyCA. When creating the CA i used an internal host name for the crl url exactly as follows: http://myserver.com/crl.pem And I have exported the CRL to that location, and I ...
2
votes
0answers
29 views

Finding the EMSA-PKCS1-v1_5 DigestAlgorithm field in the x509 certificate

From the RFC - https://www.ietf.org/rfc/rfc3447.txt A.2.4 RSASSA-PKCS1-v1_5 For each OID, the parameters field associated with this OID in a value of type AlgorithmIdentifier shall have a value ...
0
votes
2answers
57 views

Using client certs issued by a third party CA

I have a site that is protected with a user name/password login. For users that want to enter a certain area of the site, there is (legacy) code that looks for a client certificate and if the email in ...
7
votes
2answers
545 views

Will Google block HMAC-SHA1 along with SHA1 signed certificates?

So, right now, there is a push for moving from SHA1 signed certificates to SHA256 signed certificates by Google. My understanding is that you cannot use SHA1 for signing certificates but HMAC-SHA1 can ...
1
vote
2answers
54 views

Using mutual authentication, should I still worry about message integrity and replay attack?

I'm trying to secure a REST API, our situation is that every client connecting to this API will also have a certificate signed by our own CA. Because of this, I think we can use the client certificate ...
1
vote
0answers
56 views

How Do I Create a Production Client Authentication Certificate for Azure Key Vault?

I am learning about Azure Key Vault, and one of the scenarios it supports is certificate authentication, which you can read about here. The samples do a great job of explaining how to make a self-...
83
votes
4answers
11k views

What prevents me from buying a SSL certificate for a domain I don't control?

Can I simply build a webserver, make its hostname "google.com", create a CSR off that server, and send that to a Certificate Authority for signing? Let's say I pick the cheapest and dodgiest outfit I ...
1
vote
1answer
177 views

What does browser do when it queries xxx.example.com and it gets a certificate for yyy.example.com(top level domain is same)?

The question is actually about what level of validations browser does when it gets certificates of some other domains like case 1: Accessing abc.google.com and got def.google.com case 2: Accessing *....
3
votes
1answer
179 views

Is It OK If a Server Does Not Verify a Certificate?

I am currently learning a LOT about Azure, Azure Active Directory, and Azure Key Vault (AKV). To start with, please see this article: In particular, I am interested in this statement: When ...
3
votes
2answers
136 views

When should I renew certification authority?

What is best practice in renewing certification authorities? I mean when should I renew certification authority? For example, suppose I have the following setup: 1. Root CA with validity of 30 years ...
0
votes
0answers
40 views

How do the eduroam WPA-Enterprise 802.1X certificates look like?

As outlined in another answer, the official eduroam WiFi profiles available from https://cat.eduroam.org/ (verified for uWaterloo and uOttawa), as well as sample official instructions of the ...
1
vote
1answer
110 views

Can Passpoint X.509 certificates be used to MITM SSL connections on Passpoint networks?

Passpoint/Hotspot 2.0 public networks like LinkNYC require users to install X.509 certificates, for EAP authentication. Can these certificates be used by the provider to execute man-in-the middle ...
0
votes
1answer
149 views

Safari not showing GREEN lettering for EV SSL

I've recently installed an EV SSL cert on my server, Chrome and Firefox show a green banner and padlock denoting the EV cert is installed, but in Safari, it just shows a gray padlock... is there ...
1
vote
2answers
113 views

Why did I get a wrong IP and certificate for www.facebook.com just now? [closed]

I just navigated to www.facebook.com and my browser alerted me that an invalid certificate has been received. I checked the cert in question, and I was surprised to see that the Common Name on it was ...
2
votes
1answer
81 views

How do “certificates” hold “keys”? [duplicate]

I am new to the realm of security and keep hearing about "certificates" containing "keys". But no one has been able to actually explain to me what is actually meant by this. I assume that the ...
1
vote
1answer
122 views

What can a trusted certificate do?

I am doing some reading about security on mobile applications because I found an article about Man in the Middle Attacks. I saw in that article and in many other places (including security....
-1
votes
1answer
49 views

HTTPS - if this protocol protect against connecting to false server?

I know about SSL certificates. However it is ok to say: protocol HTTPS protects against connecting to false server ?
1
vote
1answer
19 views

Certificate Setup Over Many Remote Resources

Imagine that you have a web app that needs to talk to a central api server with its purchased certificate. This server provides a token to the web app to be used to authenticate and talk to another ...
2
votes
2answers
97 views

Why do we need certificates confirming certificates?

Why do we need certificates confirming certificates? Why create a hierarchy or tree? These questions makes me confused, could you explain it me?
1
vote
1answer
59 views

Why is it not recommend to use permanent validity of certificate for public key [duplicate]

As we know it is not recommended to provide permanent validity of certificate for public key. I don't know why. Could you give me some reasons ?
3
votes
2answers
53 views

Question about SSL certificate and third party server

I have a system which consume web-services from a public server on Internet (but the data are not public) I have to provide credentials in Basic Auth to get the data, that is why we use SSL. The ...
2
votes
0answers
89 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
2
votes
1answer
85 views

DNSCrypt-proxy: This certificate looks valid

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy. [INFO] + DNS Security Extensions are supported [INFO] - [dnscrypt.eu-dk] ...
1
vote
1answer
92 views

Server providing two different SSL certificates

When I check on browser for a site example.com, I see that site has a valid certificate, not expired, with validity till end of 2016. At the same time, When I scan for the same domain on the port 443 ...
1
vote
1answer
112 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
4
votes
1answer
62 views

What does an OpenPGP signature consist of?

I don't understand how OpenPGP signatures work. I have a picture which I want to sign, and a digital certificate which consists of my name and email address and my public key. Additionally, a digital ...
5
votes
3answers
133 views

Is it ok to have self-signed certificates in source control?

I just asked the question SSL self-signed certificates in development vs acquired cert in production? which has promptly been answered (THANKS!). Out of that, I have the following question: Is it ...
3
votes
1answer
86 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
0
votes
0answers
28 views

SpriteKit Level Data Security Handling

I have been reading many different posts, threads, etc. regarding the best practices to store level data to be used throughout a game application (level boundary data, images, characters, time, etc.). ...
0
votes
1answer
67 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
4
votes
3answers
203 views

Why are root certificate authorites allowed to issue certficates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
0
votes
2answers
45 views

How to avoid writing .pem while signing a csr?

I am using following command to sign a certificate, openssl ca \ -in client.csr \ -keyfile server.key \ -cert server.crt \ -outdir ./some_dir \ ...