A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

2
votes
2answers
110 views

Is Certificate pinning different from CA pinning?

I am trying to understand if pinning a certificate essentially means pinning the CA or if they are different how so ?
1
vote
3answers
980 views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
1
vote
2answers
409 views

Windows certificate store suddenly changed security level of one of my certificates

I use Windows 8.1 Pro 64 bit and IE11. I have two personal certificates (with private key) of mine in the system certificate store. They are both set to require a password before they can be used. ...
1
vote
3answers
138 views

Using public/private key without signed certificate

I am working on a java program and I am now working on its network security. I want to use a secure connection since it transfers a lot of sensitive information. On all security guides it is mentioned ...
5
votes
3answers
507 views

Does checking the fingerprint of a self signed certificate improve security?

I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
0
votes
1answer
72 views

Different certificate information for the same website?

Apologies for the funny title, I'll try to give a better explanation here :) I have just noticed something weird with regards to a website certificate: if I go to https://www.anobii.com/login using ...
1
vote
2answers
110 views

Why do client certificates not protected against improper server certificate validation

I understand the question of client certs and MITM attacks has been asked several times, but I don't believe this specific scenario has been answered. It was my (seemingly incorrect) assumption, that ...
2
votes
1answer
2k views

Java Applet - Need Code Signing Certificate vs SSL Certificate

I'm working on a Java Applet that used to be self-signed. Now that java 7u51 is being used, I am working to get the jar for the Applet signed. I used the certificate/key used for the apache2 ssl ...
0
votes
1answer
176 views

Creating Client Certificates

Consider an application where client certificates are to be used for authentication. The application web server requires SSL and client certificates for all users. In this case, it's IIS 7. I've used ...
1
vote
4answers
148 views

search CA for someone's public key

do CAs offer service wherein an application can request someone's public key? i am trying to do this but i am unsure if it is correct (suggestions of better ways to do it will be most appreciated): ...
0
votes
2answers
70 views

Modifying SSL Certificate once created, Multi domain

We're developing an application that has the ability to run across multiple top level domains, each with its own sub domain. (www.foo.com, www.bar.com, would each point to the same application on the ...
2
votes
1answer
189 views

How can a trusted intranet certificate be issued if they are being phased out?

I've just seen this article regarding the phasing out of intranet names on SSL certificates. However, CAs such as this one claim to still issue them and it will be "Trusted by all popular browsers" ...
0
votes
1answer
91 views

Advantage Mutual authentication over PSK [duplicate]

I have a client - server setup with TLS communication. I want to be sure of mutual authentication. The safety that certificates can offer assumes that the private key that links to the certificate ...
1
vote
5answers
479 views

How to validate a client certificate

My understanding is that when using a client certificate for security one issues a private and public key cert (for example X509) of some sort and sends that of to the consumer of the service that one ...
0
votes
1answer
134 views

Server not requesting for certificate in SSL handshake

I have one windows service and web service trying to make a web service call over TLS. I have setup the certificates in MMC and I am able to successfully connect using the web service. However, when ...
1
vote
2answers
255 views

Does critical SubjectAltName IP:x.x.x.x on an SSL client certificate limit where the certificate can be used from?

I have a requirement to limit SSL certificates by source IP. Would setting a critical SubjectAltName limit this (server side validation is by OpenSSL via nginx)? If not, how could this be ...
4
votes
1answer
371 views

Who is this strangely named Certificate Authority?

I'm researching certificate authorities, and I just have no idea what to think of the CA named x00Ax00-x00Tx00rx00ux00sx00tx00 x00Gx00ex00sx00.x00 x00fx00xFCx00rx00 ...
2
votes
1answer
99 views

What do people mean by “top-down manner” in X.509 certificates?

What do people mean by saying that X.509 certificates work in "top-down manner"? Do they say that because CAs can do cross certifications?
2
votes
4answers
210 views

Why isn't there a Global Root for SSL?

I was just wondering why there is a file on your computer implementing the trusted root CA's instead of something similar to DNS where there is a file on root servers that computers check against to ...
1
vote
0answers
32 views

Writing Security Functionality Requirements [closed]

Is there any Guideline Doc. or Tutorials for writing Security Functionality Requirement (Common Criteria)for a product?
7
votes
3answers
850 views

How to check if wifi is safe while travelling?

I'm quite a bit of a traveller. So i tend to just stay with my smartphone and sometimes notebook. I'm not a security expert but i would like to check how to know if wifi is safe to use. For example, ...
15
votes
2answers
37k views

Difference between .pfx and .cert certificates

What is the difference between .pfx and .cert certificate files? Do we distribute .pfx or .cert for client authentication?
2
votes
1answer
2k views

Why is a CA certificate required for EAP-TLS clients?

When setting up clients with WPA2 EAP-TLS, most clients (ie: my phone, my computer) require both a client public/private keypair (for obvious reasons) and a certificate authority certificate. It's ...
23
votes
5answers
15k views

What ciphers should I use in my web server after I configure my SSL certificate?

There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list. ...
7
votes
1answer
189 views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
4
votes
2answers
853 views

How to create an Apple Installer Package Signing Certificate

How can we create a certificate with the following Extended Key Usage extension using OpenSSL? Extended Key Usage extension, critical, with a purpose containing Developer ID Installer Package Code ...
7
votes
3answers
895 views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, ...
2
votes
1answer
459 views

How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?

If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe. Let me explain before this ...
3
votes
1answer
895 views

Client certificate for 2 way SSL works in some programs, and fails in most

I am trying to establish 2 way SSL connection with remote server and I have received certificate to connect. Can somebody explain behaviour described below. I am able only to use it with SOAP UI ...
4
votes
3answers
205 views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
0
votes
1answer
619 views

Grey vs Green padlock in address bar - technical difference [duplicate]

What is a technical difference between "grey padlock" and "green padlock" in URL bar in browsers? As an example we can take: Green padlock: Bank of America Grey padlock: Google Search Both of ...
5
votes
1answer
2k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
4
votes
1answer
167 views

How is an Authenticode timestamp verified?

For an Authenticode signed file to be verifiable by Windows after the original signing certificate has expired (typically 1-3 years after issue), the file also needs to have a cryptographically signed ...
2
votes
2answers
144 views

Can I buy a signing-valid certificate for internal use?

So now that I have to implement "secure transport" as defined by The Direct Project (not to mention reinventing a bunch of wheels, but that's another story for SO), I find myself staring down the ...
2
votes
3answers
307 views

Does HTTPS encryption work when there is invalid or there is no certificate?

When I have a website run on https and there is no certificate, there is wrong certificate or out of date like here does encryption still work or not?
0
votes
2answers
171 views

How to detect authenticity Of Client and Server Certificate?

How its possible to detect authenticity Of Client and Server Certificate. For example, If server A has certificate and someone C stolen its certificate and send it to B then How we decide that it's ...
14
votes
4answers
11k views

how digital signature verification process works

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
0
votes
1answer
185 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
9
votes
2answers
236 views

Why do some certificates specifically identify a corporation and most don't?

Looking at a handful of websites that allow for/require HTTPS, I realized that the certificate for a few of them specifically identifies the owning corporation, but some (most) don't. What's the ...
0
votes
1answer
64 views

Certificate for Email Encryption and signing

I don't understand the flow of Digital Certificate with Email Encryption and Signing. For Example, There is 2 users, Sender A and Receiver B. Is Certificate required to encryption to A or just ...
15
votes
1answer
5k views

What is the difference between Serial Number and Thumbprint?

I have problems to understand what the difference between the Serial Number of a certificate and its SHA1 Hash is. the MSDN says: Serial number A number that uniquely identifies the ...
2
votes
1answer
6k views

OpenVPN Tap vs Tun Mode [closed]

I would like to know practical difference between TAP and TUN mode when use with OpenVPN. When to use TAP and When to use TUN ? What types of traffic will pass with both mode ?
6
votes
3answers
1k views

How and when should I use OpenSSL for IT Security? How do I understand the output?

I'm discovering OpenSSL, and already used it to diagnose a faulty SMTP TLS connection, but I'd like to get a better / full understanding of the tool and how to use it. What resources should I use ...
0
votes
2answers
625 views

Digital Certificate “Signature and Fingerprint”

What's the difference between Digital certificate's signature and fingerprint (thumbprint) ? I know that Signature: The actual signature to verify that it came from the issuer. and Thumbprint ...
0
votes
1answer
586 views

OpenSSL get key length of all certs [closed]

I am trying to ensure that all certificates in a chain for a host have a key length of 2048 bits. Using openssl s_client, only the key length for that host's cert is given, is there a simple way to ...
1
vote
1answer
1k views

Sending Client Certificate to Server

I have a simple question. Is a web browser sends client certificate to the web server on demand(means web server is configured for client authentication and demand the client certificate) or just ...
12
votes
3answers
2k views

Why can SSL certificates not be free of charge?

I am a newbie in this field. I am confused with why SSL certificates cannot be free of charge. In my understanding the certificate is just a text file consisting of cryptic numbers installed on a ...
1
vote
1answer
287 views

Trying to verify my X509 certificate “could not verify this certificate for unknown reasons”

I have created my own X509 certificate with my own CA. I am able to import the CA certificate into Firefox, but when I try to import the user's certificates i get the following: "Could not verify ...
1
vote
1answer
1k views

SSLv3 or SSL Certificate Version 2?

Below is the SSLScan output, what does it mean with SSL Cerficate Version 2? Aren't SSLv3 and SSL Certificate Version 2 the same? ...
0
votes
1answer
129 views

How does ssl prevent MITM attacks [duplicate]

My understanding of how it works : A victim asks for the public key of a server. The attacker just forwards this request. The server now responds with a certificate which contains the Public key. The ...