A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.
7
votes
1answer
245 views
How do i store Diffie-Hellman parameters in a X.509?
In there paper Authentication and authenticated key exchange Diffie, van Oorschot and Wiener recommend to insert the DH parameters into the certificate of Alice. As a result an attacker can not change ...
4
votes
2answers
163 views
Is it okay to just secure (using SSL) the login page, but not the rest of the site? [duplicate]
Possible Duplicate:
What are the pros and cons of site wide SSL (https)?
I'm creating a custom PHP/MySQL CMS for a client (because Wordpress is overkill for this client's particular needs). ...
4
votes
1answer
137 views
How does my antivirus determine which CTL is used?
I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
3
votes
2answers
231 views
What are the real-time applications of long term digital signature with timestamp
I want to know the real time applications that uses digital signatures with timestamps. Specially I am interested to know the applications where we can trust an old signed document which is now ...
0
votes
1answer
190 views
How does a Web Security Gateway analyse SSL Encrypted Traffic?
Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
1
vote
3answers
498 views
RSA encryption : How to create “.arm” certificate file for Public key?
I am required to store a certificate as ".arm" file only for a public key that is intended for use in RSA Encryption.
I am currently able to generate the public key as ".key" file.
P.S I am new to ...
2
votes
1answer
80 views
IKEv2 in remote access scenarios
Can someone explain why, in remote access scenarios, IKEv2 EAP password-based user auth combined with IKEv2 PUBKEY gateway auth is preferable over mixed IKEv2 PSK/PUBKEY auth using the same password ...
4
votes
4answers
734 views
Can an intermediate CA be trusted like a self-signed root CA?
Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
2
votes
4answers
2k views
Two-factor authentication w/certificate and username & password?
Example scenario:
ActiveSync
Authentication method:
certificate-based authentication AND Active Directory domain username-password
Encrypted on device:
public & private key
AD username ...
23
votes
9answers
1k views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
1
vote
1answer
154 views
Signature and Timestamp for Long Term Document Archival Question
I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.
As far as I understand, I ...
6
votes
3answers
233 views
On-line cryptographically signed date/time?
I’m looking for a source of on-line cryptographically signed date/time. I do not need a full timestamp service, as I am happy with the information « date/time was that », without a link to a ...
-6
votes
4answers
200 views
Is TLS-in-TLS supported in any software? Does it make sense? [closed]
I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
2
votes
3answers
137 views
Transfer Client Certificate
What, if anything, could or would be embedded into a client-side certificate that would prevent it from "working" when transferred to a new client machine on a new network?
Being unfamiliar with the ...
19
votes
11answers
2k views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
5
votes
1answer
3k views
Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?
I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug?
I'm on a WPA2 encrypted wireless connection using Chrome ...
2
votes
2answers
80 views
Does it make sense that OCSP returns state for the signer CA itself
I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...
-1
votes
2answers
224 views
Request/Creating a Code Signing Certificate
I have need for a code signing certificate which is trusted by a CA in the windows domain. How do I request/create this certificate?
Do I have to request a code signing certificate on the ...
7
votes
1answer
841 views
Should I regenerate new SSL private key yearly?
Im' renewing my certificate every year. Since I have to make a CSR, should I also renew my key pair at the same time, or is it ok to get a new cert with the same key ?
Please supply any security ...
1
vote
3answers
3k views
What does these warnings mean on an SSL connection by firefox (only)
I am connecting to a secure site and firefox mentions about identity:
Owner: This website does not supply ownership information
Verified by: Not specified
Technical Details:
Connection ...
4
votes
2answers
185 views
Is it possible to modify a CA without having to reissue all of the derived certificates?
Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I ...
3
votes
0answers
145 views
How secure is HTTP basic authentication over SSL? [duplicate]
Possible Duplicate:
Is BASIC-Auth secure if done over HTTPS?
I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
2
votes
1answer
839 views
SSL cert not turning green anymore
I'm running a drupal site and have asked about this issue pertaining specifically to the drupal aspect of it here. I know that the "Green" https url doesn't show up because the cert itself isn't ...
3
votes
2answers
1k views
Internal SSL Certificates?
As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
4
votes
3answers
302 views
What does it mean for a digital certificate to be “signed”?
When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
0
votes
1answer
176 views
Purpose and Uses of Root SSL Certificates
I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?).
When and ...
7
votes
5answers
2k views
Does HTTPS Everywhere defend me against sslsniff-like attacks?
http://www.thoughtcrime.org/software/sslsniff/
If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
4
votes
2answers
151 views
TLS server key: possible to sign another TLS server key?
If I have a valid (verifiable) certificate C_K_s that links the server key K_s to "www.example.com", is it possible to :
use K_s to sign K_d, and let S_K_d be this signature
use K_d as the TLS ...
20
votes
3answers
615 views
What is an SSL certificate intended to prove, and how does it do it?
If I get an SSL certificate from a well-known provider, what does that prove about my site and how?
Here's what I know:
Assume Alice and Bob both have public and private keys
If Alice encrypts ...
7
votes
4answers
1k views
Can Javascript/Flash verify the SSL connection to prevent “SSL Inspection”?
I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy.
So some people may ask
What is the point of re-validating SSL using javascript?
...
3
votes
2answers
252 views
Mitigations for Windows clients that don't support OCSP Nonces
Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of ...
4
votes
2answers
500 views
What are the advantages of EV Certificate?
What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit?
I know that the ...
1
vote
2answers
158 views
Using digital signatures to identify users
Consider the following requirement:
Bob should be able to verify that a payment request came from Alice.
The above is in simple terms the basic idea, however, in reality Alice would be user A of ...
6
votes
1answer
1k views
How does adding a random serial number improve a certificates' security?
This article says:
"Finding collisions is a tricky process, since it requires you to muck
with the bits of the public key embedded in the certificate (see this
paper for more details). Also, ...
2
votes
1answer
231 views
Is the Netscape SMIME extension still required in a certificate?
Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image)
I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
1
vote
3answers
208 views
Is it possible to use same certificate on several machines by exporting it?
My bank proposes certificate. They say I will be able to use it only on one computer. I don't understand: can't I use same certificate on several machines by exporting and reimporting it ?
1
vote
1answer
195 views
What makes a secure smartcard secure? Is contactless/RFID better?
In short what security features exist that I should look for in a smart card?
What physical features exist, which are important?
It appears smart cards may exhibit different levels of wear and ...
4
votes
1answer
415 views
Can a certificate have multiple chains and multiple self-signed roots?
The following MSFT document has this paragraph:
All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed
...
2
votes
2answers
77 views
Using External Certificates on a network that doesn't permit outbound HTTP/S access
Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data
I can guess that issues with signature validation occur ...
1
vote
1answer
299 views
What are attribute certificates? Why would someone partition a certificate by reason codes?
In "How Certificate Revocation Works" a brief mention of Attribute Certificate and Reason Code partition is made:
If validated by a client that supports partitioned and indirect CRLs,
the IDP ...
5
votes
1answer
15k views
How do I clear cached credentials from my Windows Profile?
Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data.
How can I backup and purge this data?
1
vote
1answer
989 views
Clearing IE temp files don't erase CRL history. How can this be purged?
Even after I purge all my Internet temporary files, I still see information when I type
certutil -urlcache
How do I purge this information?
1
vote
1answer
901 views
What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?
MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed.
Based on this and this KB article the EKU section of the certificate should contain "Client ...
6
votes
1answer
2k views
What is the actual value of a certificate fingerprint?
In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
2
votes
2answers
196 views
Trust and signing: full public key or thumbprint?
Imagine a B2B service where two parties need to set up a two-way trust relationship: Alice will only accept requests from Bob, and Bob wants to know his requests are only going to Alice.
When ...
1
vote
1answer
317 views
Best Practices for Storing Digital Certificate
I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
2
votes
2answers
438 views
How to use 'key material' so that multiple people can access protected files?
I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
2
votes
1answer
98 views
Spurious SSL Certificates when accessing sites through enterprise network
I've noticed recently when I log on to sites like Hotmail that IE has been telling me there is something wrong with my SSL certs. When I examine the certs, the Issuer appears as "Blue Coat" from ...
5
votes
4answers
438 views
Is it safe to send a CSR via email?
I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?
4
votes
3answers
829 views
How do I check that I have a direct SSL connection to a website?
I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
