A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
1answer
54 views

Can MITM redirect my HttpsURLConnection?

Scenario: Let's say a MITM was able to plant a faked, self-signed certificate on my client (Android app), instead of the self-signed certificate of my server. When now my app tries to connect to the ...
0
votes
1answer
2k views

Security weaknesses in using RSA encrypted MD5 hash of certificate content

Suppose you have an Internet banking site based on a secure web server running the HTTPS protocol via port 443. The server authenticates itself to clients through an X.509 certificate signed by a CA....
3
votes
1answer
199 views

How to simply check if a certificate has the OCSP must-staple attribute?

http://tools.ietf.org/html/rfc7633 https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/ How can I simple check if a certificate of a ...
15
votes
5answers
3k views

How can trusting ONE certificate jeopardize everything I do online?

I am not sure I understand how TLS works correctly. To my understanding trusting a certain website's certificate is all about trusting that website or not, but the questions below suggest that ...
1
vote
1answer
37 views

SSL certificates for a mixture of subdomains and top level domains [closed]

In order to provide https-enabled access to several (e.g. around 5) subdomains and several top level domains on different IPs. Which of the following approaches is technically feasible? a one-use ...
1
vote
1answer
103 views

Why is CertificateVerify message necessary? (Why isn't client authentication done through the KeyExchange)

Why is client authentication not done throught the KeyExchange like with the server, but through a CertificateVerify message? EDIT: To be more clear: When using RSA key exchange the client encrypts ...
1
vote
2answers
85 views

understanding client certificate - pfx on the general

Today I am given a pfx and told to access a website. I have absolutely no idea what was given to me initially, so please kindly confirm my understanding on a general level 1) the pfx is a container ...
1
vote
2answers
66 views

Subdomains on a multidomain EV SSL [closed]

I have a domain https://joshmurray.eu/ which has a Standard SSL certificate. I also have two subdomains: http://one.joshmurray.eu/ and http://two.joshmurray.eu/. I wish to upgrade my SSL certificate ...
0
votes
2answers
41 views

Files related/required to a digital certificate

I am new to digital certification and I am trying to understand it as well as get my domain certified. I know this question may be broad, but can someone give me a general idea of the usage of the ...
1
vote
1answer
64 views

Subject Alt Name certs

Is it ok to specify subdomains in certificates that support SAN. For example base domain is example.com and I want a.example.com, b.example.com, and c.example.com to be included? What is the primary ...
1
vote
2answers
63 views

What are the steps to take after adding an invalid certificat authority?

in order to pay my bills online internet , I have to go through the website for my internet provider , type the login and password then I redirect to a page your connection is not private i proceed to ...
2
votes
1answer
2k views

Bitdefender Antivirus SSL Cert substitution

I am using Bitdefender AV 2013 ed and I have noticed that when the Scan SSL is enabled in the configuration BD will use a local certificate, as mentioned here. This modifies the cert chain with BD as ...
8
votes
4answers
2k views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
1
vote
0answers
30 views

Certificate transparency monitoring [closed]

Does exists monitoring for certificate transparency logs ? For example, a web service how send you an email each time a new certificate for a specific domain is seen in a CT log ?
0
votes
2answers
46 views

Local certification authority and certificate chain

I know that I can set up a local certification authority for a local network. I can issue certificates for all the devices in my network, and as long as they trust me, they can use such certificates ...
3
votes
2answers
276 views

Use openssl to individually verify components of a certificate chain

This is related to another question, How to verify a signature of one entity by another using OpenSSL CLI? I used openssl s_client -showcerts -connect www.google.com:443 to collect three certificates ...
6
votes
2answers
799 views

Can I use my old SSL certificate with websites in subfolders?

We have a single domain SSL for a website that looks like this: www.website.company.com We are going to expand and do following: www.website.company.com www.website.company.com/dk www.website....
1
vote
1answer
359 views

MITMproxy doesn't display HTTP/HTTPS traffic of Android Apps

I am using mitmproxy to analyse the https traffic of some Android Apps. A few days ago I was able to intercept all the traffic without any problem and now mitmproxy doesn't seem to work properly. ...
79
votes
4answers
72k views

What certificates are needed for multi-level subdomains?

I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy. Here's what I need to secure: foo....
1
vote
1answer
18 views

Conditions for reusing client certs in TLSv1

In my setup I am using client certs, and the client devices are iPhones running iOS 9.0. In comparing some network traces I noticed that in some cases, the server asks for the client certificate for ...
2
votes
1answer
57 views

Will browsers trust an expired self sign certificate in the Trusted Root store

I recently discovered that if Windows AD LDS services are bound to a self signed certificate, that processes will continue to trust the cert even if it's expired. My guess is this is because the cert ...
0
votes
1answer
101 views

Are Free SSL/TLS Certificates Trustworthy ? Can Cert Providers Snoop On Traffic? [duplicate]

I know nothing about encryption, SSL, TLS, certificates and have come across several companies offering free SSL/TLS certificates. How trustworthy are these offers? Why would I want to adopt this ...
6
votes
5answers
262 views

VPN with client certificate via managed PKI - where did private key come from?

$company allows Mac users to request a client certificate via Symantec PKI to connect to their SSL VPN server. This process involves going to a specific Symantec website (has some sort of ID to ...
3
votes
1answer
71 views

SSL negotiating too low a protocol?

I'm trying to diagnose a potential SSL/TLS problem between a Mac client and a Windows server. I have generated my own root cert and signed a cert for the server, and installed the root cert on the ...
28
votes
3answers
2k views

Does any technology prevent a CA unilaterally revoking a certificate?

As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP). In an increasingly TLS world, what current technology stops a CA shutting ...
2
votes
3answers
265 views

Why doesn't openssl s_client correctly validate google.com:443?

I try $ openssl s_client -connect www.google.com:443 but it openssl complains that the cert chain is invalid: $ openssl s_client -connect www.google.com:443 CONNECTED(00000003) depth=2 C = US, O = ...
3
votes
1answer
94 views

How to verify a signature of one entity by another using OpenSSL CLI?

I'm teaching a class about certificate chains, so I download the chain from www.google.com which has 4 certs. I want to demonstrate how the dependencies work from issuer to subject by showing that ...
4
votes
2answers
366 views

Is OpenVPN secure if both the certificate and private key, are publicly known?

My ISP is rubbish and the state of the internet in the UK seems to be heading to 1984. I've started looking at VPNs and stumbled on IPredator as a cheapy test. It gives you the option of OpenVPN and ...
4
votes
5answers
269 views

How does Blucoat Proxy allow governments to decrypt SSL?

I am asking about systems like: Bluecoat ProxySG I saw some relevant answers here: Can my company see what HTTPS sites I went to? It explains how employers can do it using root certificates, but ...
1
vote
2answers
168 views

Single Domain SSL Certificate vs Wildcard Certificate

Probably a rather odd question, but something that came to mind. Wildcard certificates are about 10 times more expensive than a single certificate. However with a single certificate, you can secure ...
0
votes
1answer
63 views

Verifying that a request is internal

I've got a web app that will only output safe code. It needs to pass this to a Python backend. The logical way to pass things between JavaScript and Python is to have a Flask server running. Then, the ...
4
votes
3answers
468 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
11
votes
2answers
862 views

How long can X.509 certificate chains be?

Usually, I only see certificate chains with a root CA, an intermediate one, and a third one for the particular SSL/TLS website; but can X.509 certificate chains be deeper than 3 levels? Is there a ...
4
votes
2answers
98 views

Does SSL certification have anything to do with the website legitamacy?

Does SSL certification have anything to do with the website's legitimacy? Are those websites which has it are under some kinda monitoring? Generally speaking, can a company say they follow the law ...
1
vote
0answers
104 views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
3
votes
2answers
148 views

Can a CN-only certificate bypass a name constraint if the CA goes rogue?

I am trying to cross-certify an internal issuer certificate, adding a name constraint for our domain. However, it seems that an attacker could bypass this protection by putting the desired host name ...
7
votes
2answers
15k views

Is it technically possible to configure two different SSL certificates for the same domain?

Say I have these URLs: https://example.org/ https://example.org/criticalpath I want the first one to be served with a domain validated commercial SSL certificate and the second one with an ...
1
vote
0answers
178 views

MQTT (Mosquitto) certificate SSL23_GET_CLIENT_HELLO:unknown protocol [closed]

I'm been desperately trying to get my MQTT clients to connect to my MQTT broker which is set up with a certificate from a CA. To be able to get the CA certificate, I've used the letsencrypt python ...
11
votes
3answers
465 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
3
votes
1answer
130 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
0
votes
2answers
57 views

Using client certs issued by a third party CA

I have a site that is protected with a user name/password login. For users that want to enter a certain area of the site, there is (legacy) code that looks for a client certificate and if the email in ...
1
vote
1answer
83 views

ECDSA implicit certificate using OpenSSL

I am trying to generate implicit ECDSA certificate only for signing and verification using OpenSSL. I tried google but I am getting many research papers. I understood that A messages need to be signed ...
0
votes
3answers
115 views

What implications does the KeRanger infection have for Mac OSX security?

Recently some hackers replaced installers for a popular torrent client with an infected version. According to paloaltonetworks, they have no idea how the hackers managed to do this (let's just assume ...
0
votes
1answer
153 views

CSR with only public key with openssl

So I have been doing my research and haven't found anything specific enough to my problem. As the question title states, I want to make a CSR with only the public key. What I have been able to do is ...
0
votes
2answers
134 views

How In-House Certificate Authority works (e.g. EJBCA)

I have a simple (dumb?) question with respect to EJBCA. I have been exploring how In-house CAs work and issue certificates. However, I am not able to understand who will be trusted on the top level in ...
5
votes
2answers
155 views

Why is weakness of SHA-1 considered a threat to TLS security

If I understand correctly the role that a hashing algorithm (e.g. SHA-1) plays in TLS certificates is as follows: The hashing function is applied to a subject's public key. The CA then uses their ...
1
vote
2answers
58 views

Client verification with PKCS#7

When a client sends you a pkcs#7 file to communicate with you, Is this because the file has their public key(certificate) and their chain and to avoid the confusion on your side what needs to be there ...
0
votes
1answer
96 views

What is the difference between a certificate, a signature and a thumbprint in case of windows exe/binaries?

I am trying to understand the difference between signature , thumbprint and certificate in context of windows executable and binaries. I looked up on internet before posting this question but I did ...
1
vote
2answers
78 views

Reissuing certificates with SHA-2

I recently setup my own CA, and imported the CA cert into devices across the company. I then deployed certificates to our various servers, etc.. All using SHA-1 signatures (the default in the tool I ...
3
votes
1answer
162 views

Understanding how does certificate validation work

I'm using Wireshark for better understanding how is a SSL connection established. I captured the traffic of visiting three pages: reddit, facebook and this one. All HTTPS of course. Reddit: after the ...