A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

2
votes
2answers
55 views

How does Certificate Transparance detect fake or forked logs?

I am trying to understand Certificate Transparency. Let's say I want to snoop on somebody's email. So I go hack or bribe a CA, have them issue a certificate for google.com, and then I present it when ...
0
votes
0answers
23 views

Different KeySizes from Different Stores same pfx

Sorry, i'm new to all of this. I have a question as to why the KeySize of a RSACryptoServiceProvider will differ between Store Locations? I've imported the same pfx in the LocalMachine store, as ...
0
votes
1answer
74 views

Is a SSL Certificate for a static IP Address a good idea

Is it possible to acquire a SSL Certificate for a static IP address that is not registered to a domain name and is there any issues that could be encountered?
14
votes
4answers
12k views

Provide subjectAltName to openssl directly on command line

Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line? I know it's possible via a openssl.cnf file but that's not really elegant for ...
0
votes
1answer
40 views

CRL verification with renewed CA

I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed. Suppose I have the following setup: ...
6
votes
3answers
7k views

How trustable are third party root certificates?

I recently tried to use Fiddler2 from a third-party vendor Telerik. While decrypting the HTTPS traffic of my network, it asked me to install its own root certificate in my Windows operating system: ...
7
votes
2answers
988 views

Let's Encrypt for intranet websites?

Many companies have many intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate which causes a bad habit for the users, since they get used to just ...
1
vote
1answer
38 views

If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them?

Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head: Let's say that I decide to ...
4
votes
2answers
88 views

Cetificate Pinning. How do we handle the situation where a website is visited for the first time?

What I essentially mean to ask is, how is the scenario where a user who visits a website for the first time (the certificate for the website is not pinned in the browser) handled ? Additionally how is ...
0
votes
0answers
160 views

Cannot connect to SSL site in Safari only on Windows and Mac

I am having an issue with users connecting to my site via SSL on Safari - this is both on Windows and Mac so it doesn't appear to be OS specific. When they try to connect they get an error: Safari ...
0
votes
2answers
105 views

Where are certificates used to prove identity and why aren't DNS responsible for the job?

I've been reading about how certificates are used to verify the owner of a public key in asymmetric encryption. Right now everything seems really theoretical to me and I'd like to know how this works ...
0
votes
2answers
88 views

TLS or IPsec protocol for client-server communication? [duplicate]

What is the best protocol for client-server communication? TLS or IPsec? I have a public channel where users communicate with each other using a digital certificate like X.509.
4
votes
2answers
3k views

Recommended key usage for a client certificate

My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicates with the server to a path that requires a ...
7
votes
2answers
277 views

Should a wildcard ssl certificate be shared with a different organization hosting a subdomain?

We are hosting our own secure site with a wildcard certificate. However, we are working with a marketing company that provides landing pages on subdomains of our domain, on ip addresses supplied by ...
3
votes
1answer
338 views

Why is google's site identity icon a red lock?

Why does google.com have this icon (see picture) for me? What does it mean? Screenshot: Google.com. There are two lock icons. The top one is RED and the bottom one is green. Screenshot: Google.se. ...
1
vote
0answers
40 views

Verify request using the X509 certificate [closed]

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML. BinarySecurityToken (X509PKIPathv1 certificate) ...
1
vote
1answer
55 views

TLS 1.2 mutual authentication certificate based standard

I'm running an analysis on a TLS1.2 mutual authentication certificate-based client-server implementation and I'm wondering if there's a RFC or a reference document covering the handshake process when ...
1
vote
2answers
73 views

Will a wildcard SSL work properly for an A record subdomain pointing to another domain/website?

Client has wildcard SSL for his domain/subdomains. The application we are building is on one of our linux servers using one of our IP addresses and is contained within an account named ...
-2
votes
1answer
129 views

How to dnsspoof against HTTPS

I am doing a dnsspoof PoC, but apparently it doesn't work with HTTPS because of the certificate. Please don't tell me that I have to generate a certificate or send a legitimate certificate, I want ...
12
votes
4answers
27k views

how to import a private key in windows

Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys? Is the only way I can do that by converting both ...
3
votes
1answer
91 views

Understanding the signing and verification process through a CA

I have been researching on this topic and I need to understand the exact signing and verification process when made through a trusted CA. From what I understand, this is how it works at a very high ...
2
votes
2answers
92 views

Is it possible to let a fake certificate appear valid by sending fake OCSP responses?

In a MITM-Attack I can exchange the server certificate by one I created on my own with tools like MITMProxy or SSLSplit. But this only works well when I have installed a fake CA cerrtificate in the ...
9
votes
1answer
617 views

What are the problems with creating an own CA for intranet?

In the comments to Creating my own CA for an intranet several people strongly advise against creating your own CA for an intranet. Especially: don't do it. Nope. Bad idea. Buy $10 CA signed ...
1
vote
1answer
119 views

What are WiFi certificates used for? What are they?

Recently my university updated the certificates for authenticating on their WiFi network. I was hesitant to accept it because I wasn't sure what accepting it entailed or even what it was and what ...
1
vote
1answer
73 views

What does it mean to “sign with a certificate”? [duplicate]

As part of the SSL handshake, the server responds to the browser with 2 things - The server's public key Some metadata, like what version of SSL is being used, the cipher algorithm being used, ...
6
votes
3answers
4k views

Why are Certificate Revocation List periodically renewed?

While studying a security course I have been asked this very question: Why are CRL periodically renewed, even if there are no new revoked certificates to add to the list? Honestly I can't find the ...
3
votes
2answers
342 views

Why would Comodo SSL certs have two intermediate CAs (chain length 4)?

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs. What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a ...
2
votes
1answer
89 views

Can an Android malware install a SSL/TLS certificate into non-root devices?

Does there exist some standard API that allow an Android malware to download and install a SSL/TLS certificate as RCA, in the default keystore, in non-root devices? I think that this is a very ...
1
vote
1answer
55 views

Certificate-verification in TLS

Out of curiosity I wonder why in the Handshake Protocol of TLS there is an explicit message, i.e. CertificateVerify, that serves to verify that the client is indeed the owner of the certificate he ...
0
votes
1answer
42 views

Certificate format

Analyzing some payload I faced up to one which contains a string like this : VeriSign, Inc.10UVeriSign Trust Network1:08U1(c) 2006 VeriSign, Inc. - For authorized use only1E0CU VeriSign Class 3 ...
1
vote
0answers
69 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
2
votes
1answer
58 views

Attribute Certificates and Access Management

I recently came across Attribute Certificates (RFC 5755), which can be used as a means for authorisation. I like the idea but I have spent a lot of time searching for information how this works in a ...
9
votes
8answers
5k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
0
votes
1answer
1k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: ...
1
vote
0answers
52 views

Theory behind certificate for job account

I made it work a job account protected by a certificate in a java spring application but is not that clear to me the minimal steps.(Could you believe that :) I need some theory. Here my steps: ...
0
votes
1answer
69 views

Certificate - Digital fingerprint vs Signature [duplicate]

What is the purpose of the « fingerprint » section of a x509 certificate, and is there an issue using SHA1 for it ? I understand the certificate signature section, but I can’t see the point with the ...
0
votes
1answer
71 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. Indeed, I am wondering if the code signing certificate (the “final cert”) must already ...
5
votes
2answers
328 views

Private key to PEM

I'm new to security and I'm trying to decode some SSL encrypted communication between my machine and server. I managed to obtain private and public keys as far as I understand private key is this ...
139
votes
4answers
83k views

What exactly does it mean when Chrome reports 'no certificate transparency information was supplied by the server?'

When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I receive a message 'no certificate transparency information was supplied by the server' ...
17
votes
1answer
13k views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
1answer
203 views

Difference between certificates with “extension fields” and “Non Repudiation” usage

For example we have two certificate pairs: First pair: Server cert with "Non Repudiation" (sometimes called Content Commitment) usage, Client cert without any "extension fields". Second pair: ...
-3
votes
1answer
113 views

Illegal Russian Forums [closed]

I recently found this link hxxps://maza.cc:888 and it was saying No required SSL certificate was sent. How can I bypass to see the content on this site?
8
votes
1answer
273 views

What to do when Google disables SSLv3 and RC4?

I've read this article from Google's Online Security Blog, and it says that Google will disable support for SSLv3 and RC4. Here's the reason: SSLv3 has been obsolete for over 16 years and is so ...
69
votes
4answers
25k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
-4
votes
2answers
56 views

Does SSL doesn't work without a secondary Symmetric/Asymmetric session key?

I keep reading that Symmetric session key is used in SSL after handshake only for faster performance but isn't true a secondary session key either Symmetric or Asymmetric key generated by the client ...
0
votes
2answers
141 views

Understanding SSL certificates [duplicate]

How does an SSL certificate prove the emitter is who he pretends to be ? If Bob (holding a certificate) and Alice wanted to establish a SSL-secured connection, wouldn't John be able to get the ...
1
vote
1answer
128 views

Cannot connect using ECDH-RSA-AES256-SHA

I try to establish an SSL connection using the ECDH-RSA-AES256-SHA cipher using OpenSSL, but it fails saying "no shared cipher": On the server, I run: $ openssl s_server -cert selfsigned_cert.pem ...
5
votes
2answers
15k views

OpenSSL generate different types of self signed certificate

Does anyone know how to use OpenSSL to generate certificates for the following public key types: DSA - For DHE_DSS key exchange. Diffie-Hellman - For DH_DSS and DH_RSA key exchange. ECDH - For ...
5
votes
2answers
528 views

One website - two different SSL certificates: two different CA's

I have seen multiple questions focusing on multiple certificates for a single domain (e.g.: a.com/example and a.com/example_one). However, what stops an individual from purchasing a certificate and ...
3
votes
1answer
90 views

Sign certificates using a web server certificate issued by a public CA

I have obtained a certificate from GoDaddy. It's usage and constraints are as follows: Key Usage Digital Signature, Key Encipherment (a0) Enhanced Key Usage: Server Authentication ...