A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
2answers
122 views

SSL digital certificate process - high level

I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database. In this case, I have an web server and needs to implement SSL ...
0
votes
1answer
99 views

Mutual Authentication and Authorisation with Certificates from various CAs

Edit: Having read this question and answer I have a bit more of an understanding. My question now then, is: can I use a certificate that a user has had signed by a registered CA such as VeriSign, ...
4
votes
1answer
94 views

SSL/TLS: Policy Constraints vs. Basic Constraints

Could someone please explain the difference between Policy Constraints and Basic Constraints? It appears to me that they are either redundant, or two names for the same thing. I would love some ...
3
votes
1answer
50 views

How is validating an SSL certificate against a CRL not inefficient?

My understanding is that CRL is a list from a CA that says what certificates not to trust. Browsers will regularly download these lists from their trusted CAs and check the certificate of requested ...
3
votes
2answers
250 views

SSL Newbie : Does https client also need a certificate?

I am calling an https url through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words do I need my own certificate or is the ...
8
votes
3answers
179 views

What kind of certificate should I get If I want to secure a connection between a web server and a database?

I know people buy SSL certificates to secure their sites. What kind of certificate should I get if I want to encrypt a connection between an application server and a database? Application server may ...
1
vote
1answer
222 views

SHA2 certificate and TLS cipher suites compatablity

I have a server which is configured to use TLS 1.0, 1.1 and 1.2. The server is configured with a certificate siged by SHA-512. The server supports only these cipher suites: • ...
2
votes
1answer
108 views

How to get a green certificate bar if I'm not a company?

I'm not a company and do not represent one, but I would like to have a green bar on my website for several reasons. One of them, for example, is that I want to ensure that the information displayed in ...
1
vote
0answers
13 views

Web Scraper with client-side certs [closed]

I am building a web scraper that logs into websites, does some searches and collects results. The websites I've been logging into right now have all been pretty standard. I have been notified that ...
1
vote
1answer
33 views

Why does Windows windows suggest/have completely different (and seemingly valid) intermediate CA certs for a given leaf cert?

Is it normal for multiple intermediate CA certs to have the same Subject Key Identifier? Why does this happen? I always thought that this was a unique attribute. I have come across some odd cases ...
1
vote
1answer
92 views

Why is CertificateVerify message necessary? (Why isn't client authentication done through the KeyExchange)

Why is client authentication not done throught the KeyExchange like with the server, but through a CertificateVerify message? EDIT: To be more clear: When using RSA key exchange the client encrypts ...
1
vote
0answers
32 views

Problem using custom CryptoNG KSP on IE 11

We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for ...
3
votes
1answer
34 views

Questions regarding CRLs (producedAt and not modified)

I have two questions regarding the safety of requesting CRLs. My first question is: shouldn't CRLs contain a producedAt field just like OCSP responses? This would make sure a hacker doesn't send an ...
5
votes
1answer
43 views

Can attribute certificates be used with TLS / HTTPS?

Can attribute certificates (also known as authorization certificates) be used with HTTPS? For instance, can a HTTPS server supply an attribute certificate in addition to its ordinary SSL certificate? ...
0
votes
1answer
232 views

How does a Certificate Private Key get transferred on import / export?

I am fairly new to certificates in general and have setup my own standalone CA for testing purposes. I have noticed some interesting behavior of private keys which I'm trying to find some ...
3
votes
0answers
265 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect ...
4
votes
1answer
128 views

Bidirectional encrypted server to server communication using TLS

I have 2 Windows servers and would like to set up encrypted communication between them using TLS. I've been reading up on TLS and X.509 certificates and I think I have a reasonable plan, but would ...
9
votes
1answer
545 views

Why does GoDaddy have four different certificate chain, G2, G3, G4?

I see from Godaddy they have multiple certificate chains https://certs.godaddy.com/repository GoDaddy Certificate Chain GoDaddy Certificate Chain - G2 GoDaddy Certificate Chain - G3 GoDaddy ...
8
votes
1answer
407 views

How to use encryption on a site that only uses an IP address, no domain name?

You can use SSL/TLS certificates and etc. on sites with domain names, but I don't know if it's possible to use them for IP addresses. If this is the case, would I have to use a self-signed cert and ...
4
votes
1answer
59 views

Protect sensitive information in a password-free, shared database

I'm working on a webserver that stores resources in Redis. To make swarm-deployments as hassle-free as possible, I'm implementing an option where the server doesn't need to access the filesystem to ...
3
votes
1answer
97 views

Why do some EV certificates show the full address of the organization, but others only show the state or city?

If I go to www.comodo.com, I can see their registered office address in the EV certificate: CN = www.comodo.com OU = COMODO EV SGC SSL OU = COMODO EV SSL O = Comodo Group Inc. STREET = 1255 Broad St. ...
1
vote
2answers
133 views

Why/when would a CA make a generated public key available to the public at large?

I'm confused about this section in my CEH security exam training material: A CA is able to perform a number of roles in addition to the validation process outlined here. Some actions that a CA is ...
5
votes
1answer
114 views

Securely build a list of trusted CAs

Some distributions of the cURL bundle include a utility mk-ca-bundle.pl which compiles a ca-bundle.crt from Mozilla's root certificate store for use as a list of trusted authorities. The script prints ...
2
votes
1answer
103 views

How does Windows certificate manager verify a file's certificate, if the root certificate is not in the store?

I'm working on a project which requires certificate verification for executable files. I have created my own trusted root certificate store, and used openssl to perform verification. However, when I ...
0
votes
0answers
25 views

Is there any extra validation that Firefox perform to certificates serial number

I open a secured site in my computer. for my reasons, I created new certificate every 15 minutes. I noticed that, sometimes, Firefox "doesn't like" my certificate. after little investigation, I ...
2
votes
2answers
61 views

Why not to use the same subordinate issuer CA for generating certificates that will be used for different things?

Microsoft has recommended my organization to use different subordinate issuer CAs in order to issue certificates that will be used for different things. For example, they recommend to use a CA for ...
5
votes
2answers
127 views

Why do so many browsers show sites with revoked certificates?

Everyone seems to agree that it is REALLY important to protect private keys so the encrypted Internet can remain just that (see for example at How do certification authorities store their private root ...
11
votes
3answers
198 views

Why is Firefox shipped with expired root certificates?

What's the purpose of shipping Firefox with expired root certs? I checked and there are two expired certs listed. In fact the company's website for the first expired cert (A-Trust) states that the ...
6
votes
3answers
263 views

Why should my certificate signing request be signed by my private key?

Why should my certificate signing request be signed by my private key? Even if I obtain a bogus certificate out of someone else's public key, that is going to be useless, since in SSL the ...
15
votes
2answers
504 views

How much of a problem is it that Windows “hides” some of the trusted root CA certs?

Based on information on this page, Windows actually trusts many more root CA certificates than what are displayed when a user launches certmgr.msc and navigates to Trusted Root Certification ...
3
votes
0answers
47 views

Certificate and Path validation for S/MIME

I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My ...
6
votes
1answer
190 views

Client identification using client certificates

I have the following scenario: Several independent embedded servers (Linux/ARM/lighttpd) Several independent controlling devices (win32/iOS/Android) Each server should have at least one controlling ...
5
votes
2answers
163 views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
1
vote
2answers
97 views

Application that uses USB token to assign user on a server

I have the following situation: One user with a USB token certificate access a site and log-in using this certificate, the logging process ask for the USB token password; When the user is logged he ...
1
vote
0answers
27 views

Can there be two certificates with a same serial number in the world? [duplicate]

Recently I came across this odd question. I hope, Serial number is unique across certificates signed by a particular CA. So is there any chance that two different CAs sign two different certificates ...
1
vote
2answers
64 views

Do secure ciphers break multi-domain certificates?

In the past days, I was halfway successful with securing my websites. So far, I have achieved the following: Get a certificate from letsencrypt.org, securing the domains example1.com, example2.com ...
1
vote
2answers
110 views

What server software uses .der?

So apps linked against openssl uses PEM, and Windows generally uses PKCS12, but I haven't seem much .DER in the wild - what server software uses DER?
0
votes
1answer
72 views

Why does not appear the public key from certificate?

I'm creating a certificate in LAMP, the public key is: Public Key: 30 81 89 02 81 81 00 CC CB 64 54 C2 FA A3 7A 81 36 5F 1B D5 10 81 75 B7 42 02 31 83 B1 D5 5A 76 72 6A 77 BE 62 69 16 AB EB 39 66 B5 ...
8
votes
2answers
594 views

How do user receive server's certificate?

Let's imagine our user's computer wants to talk to some server for the first time in history via https. The computer sends a hello message, the server sends his public key and the certificate, ...
3
votes
2answers
113 views

Using Self sign certificate in internet

Basically the purpose of SSL cert is for trusting each other. If I have an application that only a few clients I know can use, is generating self sign certs enough? Or do I really need to sign with a ...
-1
votes
2answers
158 views

Client certificate vs HMAC

My team is working on web API project for one customer which will call this API. Now we are thinking about authentication. We've stopped on two options HMAC and client certificates HMAC: pros - no ...
1
vote
2answers
100 views

Verification of client certificates

I've read a lot of articles about client certificates. Please correct me if I'm wrong: client certificates are issued using CA CA could be created by myself (self-signed) or bought client ...
3
votes
1answer
105 views

TLS - How to know a CRL URL is not changed

If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be ...
0
votes
2answers
59 views

Analyzing whether browser certificates have been compromised

How can I know that my installed certificates (in Firefox), are (still) reliable?
0
votes
2answers
139 views

Why can you not trust a certificate directly?

If you want to set up a service that is signed using some Certificate Authority system (SSL/TLS, certain configurations of IKE, etc), if you want to use a self-signed certificate (e.g., for testing), ...
1
vote
1answer
85 views

Are fields of a root CA certificate checked?

During SSL server validation, it seems that the only fields of X509 certificates found in trust stores that are actually used are the "Common Name" and the "Public Key". I'm not talking about any ...
1
vote
3answers
90 views

HTTPS client “pairing”

I've been redirected here from SuperUser, I hope the question is appropriate. I need to restrict usage of a certain site to a limited number of customers. More than that, actually: I would like to ...
4
votes
1answer
127 views

Issuing and managing large numbers of certificates for client authentication

I am developing an Internet of Things product and plan to use client certificate authentication, issuing each "thing" its own certificate on the production line so that it may authenticate with a ...
2
votes
1answer
114 views

When can I commit an OpenSSL Certificate (.pem) to source control?

That is to say, in what cases does it make sense to commit .cer files, or a stack of .cer files in a .pem, to internal source control like SVN or Git? If it's just a list of signed public keys, I ...
1
vote
1answer
41 views

Prevent credential roaming for certain accounts/certificates?

I want to use credential roaming in Windows 7, 8 and 10 for EFS certificates, so users can access their encrypted files from any computer they login to. However, some of these users will also have ...