A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

5
votes
1answer
184 views

'Trusted CA Certificates' and 'Trusted remote Certificates'

What is the difference between Trusted CA Certificates and Trusted remote Certificates?
5
votes
2answers
2k views

How to set “Not Before” value to past when creating certificate request

We have lots of embedded TLS clients on the field. TLS Servers must be authenticated. Because long power cuts may reset clock of those devices, we have requirement to use certificates with validity ...
5
votes
1answer
304 views

Certification authority only for certain domains

Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
5
votes
1answer
29k views

Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?

I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug? I'm on a WPA2 encrypted wireless connection using Chrome ...
5
votes
2answers
2k views

Dealing with expired or revoked signing certificates with Infopath documents

Suppose I have an Infopath form that is digitally signed today by a valid, and active user. When that user leaves the company, we disable the account and revoke the certificate. This causes a problem ...
5
votes
1answer
2k views

What damage could be done if a malicious certificate had an identical “Subject Key Identifier”?

I'm looking at the the Subject Key Identifier attribute of a CA certificate and am trying to understand the role it plays in validation and infer how validating client software could get it wrong. ...
5
votes
1answer
2k views

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
5
votes
2answers
694 views

Adding custom data in X.509 certificate

I am using SSL with client authentication. I need to send some extra data while sending the client certificate? Can I send it in the certificate? Can I use the extension fields in certificate for that ...
5
votes
2answers
572 views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
5
votes
1answer
2k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
5
votes
2answers
147 views

How can a certificate be valid in the Hybrid Model but not in the Chain Model?

All dates in European format! I am learning about validity models, but the solution for this assignment confuses me. Translation: The relevant data for the applicable certificates are shown ...
5
votes
1answer
192 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
5
votes
1answer
385 views

Retrieving client certificate using Tcpdump results in zero length certificate

I am trying to proxy a mobile app (with Fiddler), which sends a client certificate to the server it connects to. I would think that capturing traffic with Tcpdump, retrieving the client certificate ...
5
votes
1answer
510 views

How do I make or get computer certificates to use with IPSEC user authentication on Windows?

I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
5
votes
1answer
109 views

Authentication by Signing or MAC?

I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
5
votes
1answer
7k views

What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?

What root certificates are/are not updated when the following checkbox is checked? Additional questions If I manually remove a root certificate, will this service replace that very certificate? ...
4
votes
3answers
262 views

Are SSL certificates from a CA necessary for secure communication?

Am I right in thinking that SSL certificates from a CA are purely for identification purposes and serve no purpose in the actual encryption of data? In other words if I were to create a self signed ...
4
votes
3answers
5k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
4
votes
3answers
1k views

System time and certificates

Recently I accidentally changed the system time to a different month, and then I surfed to a secure site. I got a warning from Google Chrome that mentioned my system time and said the certificate ...
4
votes
2answers
4k views

Internal SSL Certificates?

As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
4
votes
1answer
253 views

Who is this strangely named Certificate Authority?

I'm researching certificate authorities, and I just have no idea what to think of the CA named x00Ax00-x00Tx00rx00ux00sx00tx00 x00Gx00ex00sx00.x00 x00fx00xFCx00rx00 ...
4
votes
4answers
407 views

Is it possible to detect SSL private key changes?

I wonder if it would be possible to detect a change of an SSL private key? If you change the key, then I think one must issue a new certificate, but new certificates could be issued without changing ...
4
votes
3answers
533 views

How do you verify a certificate belongs to a domain?

I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to. Currently I can verify the certificate is valid using the following code $resource = fsockopen( ...
4
votes
3answers
3k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
4
votes
2answers
618 views

What is the difference between SSL and X.509 Certificates?

I used openssl to create a X.509 certificate but I don't quite understand the relationship between a X.509 and a SSL certificate. Are they the same? Is a SSL certificate just a X.509 certificate that ...
4
votes
4answers
2k views

Is it possible to create a self signed certificate authority?

Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious. To explain my question : Suppose I sign a public ...
4
votes
2answers
196 views

How to verify certificate with very little information

Lets assume there is a server and a client and you want to connect those two. Server has a self-signed certificate, and prior to establishing the connection for the first time (enrollment) the server ...
4
votes
3answers
922 views

What does it mean for a digital certificate to be “signed”?

When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
4
votes
3answers
135 views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
4
votes
4answers
5k views

Adding self signed certificate to trusted store

I have been reading about certificates and often is said that self signed certificate should not be added to the trusted authority store and even if you did, remove it after usage immediately. MSDN ...
4
votes
1answer
309 views

Is possible that a TLS server send more than one certificate to the client for the same site?

What I'm trying to archive is enable ECDSA and DSS ciphers in my site, but at the same time not depend just of self signed certificates, so I could sent to my client more than one certificate and them ...
4
votes
2answers
144 views

Can the client certificate authentication process treated as a user digitally signed the content(and then get verified on the server)?

The authentication was triggered by certain event (like approving button) on the form. In the process of client certificate authentication (in IIS), user was asked to use their PIN (private key) and ...
4
votes
1answer
147 views

How powerful are top Verisign executives?

I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a ...
4
votes
1answer
395 views

Does Authenticode still work offline and with a “fake” certificate

Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
4
votes
2answers
303 views

What is the severity of a fake certificate?

I'm not a security specialist, thus reading this Google Blog post about a fake *.google.com certificate, raises a lot of concerns, if anyone can impersonate a website, especially a google website, my ...
4
votes
2answers
164 views

What is the state of the Windows Update certificate after Flame?

May 28, The Flame malware is discovered in Iran and by Kaspersky Labs. June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
4
votes
2answers
664 views

Is it okay to just secure (using SSL) the login page, but not the rest of the site? [duplicate]

Possible Duplicate: What are the pros and cons of site wide SSL (https)? I'm creating a custom PHP/MySQL CMS for a client (because Wordpress is overkill for this client's particular needs). ...
4
votes
2answers
557 views

How practical is a certificate's “basic constraint” property in protecting my HTTPS / SSL session?

Suppose a leaf node creates a certificate for a different domain, acting as a CA. Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be ...
4
votes
3answers
478 views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
4
votes
1answer
165 views

Certificate Revocation List

There are many fields on a certificate revocation list (CRL) like Algorithm, Parameters, Issuer Name, This update date, Next update date, user certificate serial #, etc. While I understand the purpose ...
4
votes
1answer
125 views

How would you know a certificate/private key if you extracted it from RAM? Or would you?

Related to, of course, the heartbleed vulnerability, I've been reading the news about the worst case scenario for this attack being the extraction of the SSL private key, because, of course, this ...
4
votes
1answer
311 views

What is a Certification Path in SSL certificate?

I've been trying to learn more about Digital certificates for the past few days and I'm struggling in order to understand how actually this concept is applied in the real world. Anyways, as I visited ...
4
votes
1answer
124 views

How to secure a certificate internally

Say I have a certificate which I use to sign the software I ship. This happens in the (daily or more) build on the buildserver (Windows machine). Easiest solution would be to put the certificate file ...
4
votes
2answers
545 views

What did the certificate authority do with my CSR?

I needed to reach a web service which is not mine. The IT department of that web service has asked me to send them a CSR (certificate signing request). Then, he will send me back a signed certificate ...
4
votes
3answers
331 views

Issuing SSL certificates for device automation software package without domain names

We are developing the automation software for Windows which communicates with the certain devices via our own private connection protocol. That software package consists of several server (including ...
4
votes
3answers
2k views

How is an X509 certificate signer verified?

Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is, ...
4
votes
2answers
462 views

What are the real-time applications of long term digital signature with timestamp

I want to know the real time applications that uses digital signatures with timestamps. Specially I am interested to know the applications where we can trust an old signed document which is now ...
4
votes
2answers
601 views

How long shall a certificate be valid?

See title. Are there any sources where there are recommended validity times of certificates (based on length, algo, etc)? I'm particularly interested in validity of RSA certificates...
4
votes
1answer
1k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
4
votes
1answer
14k views

How to use OpenSSL generated keys in Java?

I have my pair of Public and Private keys and my certificate. Those where created in OpenSSL (why? because I was asked to do it in OpenSSL). Now I want to use those things to make a Java app that ...