A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.
3
votes
2answers
158 views
What did the certificate authority do with my CSR?
I needed to reach a web service which is not mine.
The IT department of that web service has asked me to send them a CSR (certificate signing request).
Then, he will send me back a signed certificate ...
3
votes
1answer
148 views
What are the Netscape Cert Type attributes? Why/when are they needed?
What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions?
Example:
There is the Client/Server Extended Key Usage (X.509) but there is ...
3
votes
2answers
231 views
What are the real-time applications of long term digital signature with timestamp
I want to know the real time applications that uses digital signatures with timestamps. Specially I am interested to know the applications where we can trust an old signed document which is now ...
3
votes
1answer
338 views
What kind of certificate do I need to be able to make and sign my own digital signing certicates?
At build time for a program, I would like to generate a new key pair, and create a certificate that will be embedded (securely) into the program. The purpose of the key pair is to digitally sign an ...
3
votes
3answers
139 views
Warn about specific CA in Firefox
Consider a setup where all HTTP/HTTPS traffic goes through a proxy. The certificate of this proxy must be trusted by all browsers (in this case, Firefox). This certificate replaces the original ...
3
votes
1answer
258 views
Enhanced Key Usage vs. Extended Key Usage
I've seen both the terms Enhanced Key Usage and Extended Key Usage, and both were abbreviated as EKU. Do both refer to the same extension or property?
3
votes
1answer
68 views
How to secure a certificate internally
Say I have a certificate which I use to sign the software I ship. This happens in the (daily or more) build on the buildserver (Windows machine). Easiest solution would be to put the certificate file ...
3
votes
2answers
224 views
Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?
Suppose I have several independent PKIs that are used
Two internal PKIs: One with SHA1 support the other with Suite B algorithms.
A partner who I trust and have a policy map with.
Since both my ...
3
votes
3answers
544 views
How is an X509 certificate signer verified?
Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is,
...
3
votes
2answers
252 views
Mitigations for Windows clients that don't support OCSP Nonces
Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of ...
3
votes
2answers
269 views
How and when should I use OpenSSL for IT Security? How do I understand the output?
I'm discovering OpenSSL, and already used it to diagnose a faulty SMTP TLS connection, but I'd like to get a better / full understanding of the tool and how to use it.
What resources should I use ...
3
votes
2answers
244 views
Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]
Recently while trying to log-in to facebook this notification starts to appear
at first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website!
I ...
3
votes
1answer
72 views
Creation and deployment of self-signed certificates for a two-machine scenario
Let us assume that I have two computers:
client
server
Now, in the server computer, I set up a legacy ASMX web service which will going to be used by the client. Before the client can connect to ...
3
votes
2answers
89 views
Why are SSL certificates valid only from a certain date?
Each SSL certificate is valid starting from a specific date and up to the expiration date.
What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
3
votes
1answer
296 views
Apple Developer Account Hacked?
I just did a fresh install of Snow Leopard on a newly-formatted hard drive.
Logged into the iPhone Developer Page with Google Chrome (latest build) here:
...
3
votes
1answer
444 views
parsing the id-ce-keyUsage extension in X.509 certs
I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows:
...
3
votes
1answer
296 views
What is the impact of certificate validation level (or class) on deployed web applications?
Certificates can have a class level (or validation level). What is the impact of these levels on deployed web applications?
More specifically:
Is the certificate level included in the certificate ...
3
votes
1answer
75 views
How does an end user differentiate between OV and DV certificates?
This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
3
votes
1answer
141 views
Cellphones IMEI public exposed?
Currently I'm in the middle of a developement process, and I have some security questions for you. I have a webservice, asp.net which is configured to run over https. The first authentication step for ...
3
votes
1answer
95 views
How can an “alternate” or duplicate HTTPS certificate be used in an attack?
Inspired by an old question from PulpSpy, I'm trying to think of whether this is a significant weakness in the Certificate Authority system. Here are the attack methods that I think would work - ...
3
votes
1answer
158 views
How secure is a https website? [duplicate]
Possible Duplicate:
Does an established ssl connection mean a line is really secure
When I visit a website -- say, https://ebanking.pick-your-bank.com -- my browser (fully patched version ...
3
votes
1answer
103 views
How can I use certificates to secure my webservices? What is available to javascript?
I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
3
votes
1answer
60 views
CMC (RFC 5272) compatible CA server
I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
3
votes
1answer
55 views
Within a CSR, is there a field to have the MS PKI server change the default cert filename
I'm not intimately familiar with MS PKI, but it was a question that came up in a discussion for an issue a coworker is having. When you input the request fields manually on a PKI server, the cert ...
3
votes
1answer
330 views
How to create an Apple Installer Package Signing Certificate
How can we create a certificate with the following Extended Key Usage extension using OpenSSL?
Extended Key Usage extension, critical, with a purpose containing Developer ID Installer Package Code ...
3
votes
1answer
249 views
Loginless Client/Server Architecture (iOS)
I'm currently in the phase of planing a project involving loginless service.
Users would be identified by an unique device id created on the client (ios).
What are the security concerns?
sockets ...
3
votes
0answers
145 views
How secure is HTTP basic authentication over SSL? [duplicate]
Possible Duplicate:
Is BASIC-Auth secure if done over HTTPS?
I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
2
votes
4answers
2k views
Two-factor authentication w/certificate and username & password?
Example scenario:
ActiveSync
Authentication method:
certificate-based authentication AND Active Directory domain username-password
Encrypted on device:
public & private key
AD username ...
2
votes
3answers
2k views
What data should I validate when validating X.509 certificates using Java?
Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation.
I know it ...
2
votes
4answers
919 views
What web browsers support OCSP stapling? Are the privacy and performance features the same?
OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
2
votes
1answer
54 views
Is it a good idea to generate certificate-specific CRLs? What is this technique called?
Suppose I create 3 certificates with the following CRLs
Cert1 http://crl.server.com/batch1/root1.crl
Cert2 http://crl.server.com/batch2/root2.crl
Cert3 ...
2
votes
2answers
196 views
Trust and signing: full public key or thumbprint?
Imagine a B2B service where two parties need to set up a two-way trust relationship: Alice will only accept requests from Bob, and Bob wants to know his requests are only going to Alice.
When ...
2
votes
2answers
138 views
Ssl certificate rekey or revoke
I want to be sure to understand well the situation where SSL certificate is compromised.
If I ask for a rekey, I suppose the old certificate will remain valid.
The future communications with the new ...
2
votes
2answers
141 views
distribution mechanisms for CRLs
From the X.509 RFC:
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer ...
2
votes
2answers
433 views
What are the implications of adding a self signed certificate to the Windows Trusted Root Certification Authorities store?
I'm a budding website developer, so please bear with my ignorance.
Say I had to encrypt my website with HTTPS and I got sick of having to click "Continue" every time a warning came up about an ...
2
votes
2answers
102 views
What number of bits does a browser use to generate a key?
The question comes from the accepted answer in this thread:
My understanding of how HTTPS works (gmail for example)
The Gmail server sends your client a certificate.
The certificate includes the ...
2
votes
3answers
137 views
Transfer Client Certificate
What, if anything, could or would be embedded into a client-side certificate that would prevent it from "working" when transferred to a new client machine on a new network?
Being unfamiliar with the ...
2
votes
1answer
6k views
How to use OpenSSL generated keys in Java?
I have my pair of Public and Private keys and my certificate. Those where created in OpenSSL (why? because I was asked to do it in OpenSSL).
Now I want to use those things to make a Java app that ...
2
votes
2answers
112 views
Need an overview of web service / web site security world, where do I start? [duplicate]
Possible Duplicate:
Resources to learn about security
I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and ...
2
votes
2answers
617 views
SSL verification of host name of https server
I recently found that a library I am using (specifically Apache HTTPClient) when is configured to verify the hostname of the remote server against the certificate's CN it just seems to be doing a ...
2
votes
2answers
88 views
Looking for general guidance on securing web API application for client applications and users
I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.
After a lot of googling ...
2
votes
1answer
80 views
How do I diagnose client-side SSL errors?
Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
2
votes
1answer
65 views
Certificate Chains When Importing Signed CSR Response
I'm interfacing with a secure web service, and authenticating using a client certificate. I'm confused about step #3 in the client configuration:
Generate a private key into keystore
Generate a CSR ...
2
votes
2answers
372 views
Protecting against SSL Strip [duplicate]
I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe?
Does it depend on the cert strength?
Do you ...
2
votes
4answers
254 views
Client Certificate in SSL HandShake insecure?
Imagine we have an application which is trying to establish a secure connection to a server by using SSL. Now we want the user to authenticate himself with a client certificate which he stores in an ...
2
votes
1answer
117 views
Can Diffie-Hellman Anonymous be used as a cipher for SSL for one-way certifiate-based authentication
I want to use Diffie-Hellman anonymous cipher for SSL. I also want to use a one-way certificate for server authentication. Is this possible?
2
votes
3answers
98 views
Whether certificates can be used for regulating access
I am thinking of a mechanism where I need to authenticate the client and control the access. I am thinking of using SSL for this purpose. I want to know whether using SSL solves my purpose.
My ...
2
votes
1answer
97 views
Spurious SSL Certificates when accessing sites through enterprise network
I've noticed recently when I log on to sites like Hotmail that IE has been telling me there is something wrong with my SSL certs. When I examine the certs, the Issuer appears as "Blue Coat" from ...
2
votes
1answer
268 views
Does client certificate authentication demand more server-side entropy?
We have a secure web service running Apache that requires client certificates for access. This service has a problem with running out of entropy. We have several other sites that use TLS that get ...
2
votes
1answer
539 views
SSL encryption and SSL certificates
I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
