A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
1answer
50 views

What bits of data is revoked in a CRL? Is it the hash(CSR) or hash(CSR + PKI signature)

My understanding is that a CSR contains the public key from the client, and the response is a signed version of that CSR, with certain attributes (EKU, expiration) and other attributes the CA decides ...
3
votes
1answer
184 views

A certificate site name mismatch when using preinstalled Toshiba software? (Superfish?)

On my Toshiba laptop there are a variety of different Toshiba programs that came pre-installed. Many of them are some sort of utility, optimizer, checkup, and update kind of programs that I guess are ...
-1
votes
1answer
105 views

Fido U2F Public keys in registration response

What is the deference between the two public keys: user public key (2nd element in Token response) user public key inside signature in U2F Token response for registration ?
7
votes
2answers
7k views

How is an X509 certificate signer verified?

Lets say I create a self-signed X509 certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question ...
0
votes
0answers
24 views

SSL Handshakes and authentication? [duplicate]

I was just wondering if someone could explain the complete process of SSL handshake with certificates, public - private keys and MAC exchange. And in which cases does the Certificate warnings arise ...
0
votes
1answer
107 views

Can I use a CA certificate for two ways (mutual) authentication

I cannot get an answer from a CA company for this question. I have to implement two ways SSL authentication between my server and my users computers. Users should access to my several API securly. I ...
0
votes
2answers
2k views

How to test for OCSP?

I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?
1
vote
0answers
115 views

Identify the attestation certificate (X.509) in Fido U2F registration response

I'm trying to identify the attestation certificate (X.509) in Fido U2F registration response as described in fido-u2f-raw-message-formats-v1.0-rd-20141008.pdf document: An attestation certificate ...
2
votes
1answer
159 views

HTTPS client certificates for server-to-server

Say you have two servers with certificates proving their domains (e.g. for use with HTTPS). Can one of these servers use their certificate as a client certificate when talking to the other, so that ...
0
votes
1answer
230 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
5
votes
1answer
4k views

What is the difference between a “Thumbprint Algorithm” “Signature Algorithm” and “Signature Hash Algorithm” for a certificates?

I'm a bit confused on the differences between Signature Algorithm, Signature Hash Algorithm, and Thumbprint Algorithm that are present in SSL/TLS certificates. Can someone please elaborate?
0
votes
2answers
94 views

What is the real use of certificates on the web?

When you get a certificate from a website you visit, signed by a trusted CA, is it trust-worthy because the CA authority did a background check on them? But how does this help with spoof websites? ...
1
vote
0answers
62 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password ...
8
votes
6answers
736 views

Easy explanation of SSL client certificates for a developer

I've been thinking about using client certificates for my web apps, desperately hoping for security-conscious users to put their private key on HSMs so they don't get stolen even if the machine is ...
8
votes
6answers
2k views

I see two different sets of certificates for Google websites when I am at work and when I am at home

I see two different sets of certificates for Google websites when I am at work and when I am at home. I mean if I save the certificates (in firefox, click on the "Google.com" block on the left of ...
4
votes
1answer
62 views

Do CA Public Audit Records increase the visibility, and risk of attack?

Does the CA feature of Public Audit Records increase the visibility of my hosts, and therefore the risk of host-specific attacks? Would the only mitigation be to only enable this for wildcard ...
1
vote
1answer
82 views

Use appstore using trusted certificate [closed]

I connected my iPad to my laptop's localproxy. I also installed a trusted digital certificate in my iPad. I am now able to use all HTTPS networks through my iPad except appstore. If I disable proxy, I ...
0
votes
3answers
92 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...
2
votes
1answer
103 views

Can I modify my certificate chain?

I've had SSL/TLS running on my site now for a while. In order to learn a bit more about general PKI, I studied Qualys' SSL test, and optimised my configuration (including the adoption of OCSP ...
0
votes
1answer
173 views

Can public certificates be password-protected?

I've only seen private key files (.pfx, .pkcs12) being password protected. Someone told me public cert files (.cer) can also be password-protected. Is that true? Is it also true to say any certificate ...
1
vote
0answers
142 views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
0
votes
1answer
17 views

Number of certificates in a PKCS#12 archive

Is there command to find the number of certificates in a PKCS#12 archive? I have the .pfx file sent by a client but need to find out how many certificates it contains. I don't need any of the ...
2
votes
0answers
17 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
0
votes
3answers
129 views

In order to trust the digital certificate, does immediate CA cert also needs to be in trust store or root CA cert is enough?

In order to trust the digital certificate, does immediate CA certificate also needs to be in trust store or root CA certificate is enough?
19
votes
3answers
17k views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
0
votes
1answer
60 views

Combining wildcard and subdomain-specific SSL certificates

Not quite sure which Google terms to use to find the answer, so I thought I'd ask it here, presented as a scenario: Say you have a corporate entity (Example Co) with a wildcard SSL cert issued for ...
0
votes
1answer
147 views

Begin of Certificate/ End of Certificate dash “-----”

What significance does the dash "-" holds along with the line -----BEGIN CERTIFICATE----- or -----END CERTIFICATE-----. I checked multiple docs and linked RFC's as well but could not find the ...
1
vote
1answer
147 views

Is a self-signed SHA-1 certificate sufficient security for a company transmitting sensitive data?

We recently decided to pay an ISP (a substantial sum, mind) for a managed internet service up to and including the router in our head office. Part of the initial discussions made it clear that ...
1
vote
1answer
48 views

Possible to change the CA that a keypair is using?

Pretend I take the same CSR and send it to two different CAs as described in the following scenario: I create a CSR on Windows I submit the CSR and edit my SAN names. Request is pending at the CA ...
7
votes
7answers
4k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
0
votes
1answer
52 views

CSR signing follow up question

This is a follow up question , after getting a signed certificate from one CA. researched a lot , but no luck. After getting the CA reply, While downloading the certificate, it popped up saying ...
3
votes
3answers
232 views

SSL Cert for sub.domain.com and www.sub.domain.com

I have a wildcard cert issued by godaddy for *.domain.com. currently, https://sub.domain.com works just fine. however, https://www.sub.domain.com does not work. Do I need a separate cert for ...
1
vote
1answer
113 views

Why deploy a .p12 client certificate bundled with a root CA?

I have been asked to connect to a government agency secure site that uses client certificates to authenticate its clients. I received by email an encrypted client certificate as a PKCS#12 file and by ...
2
votes
4answers
1k views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
0
votes
0answers
42 views

Certificate verification

I work on a desktop application which generates Security certificates. The Business use of these certificates is - they will be used as an authentication and authorization mechanism to enable users to ...
17
votes
1answer
33k views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
3
votes
2answers
94 views

CSR Signing simulation

Tried a lot get my test csr signed from root CA(trial versions option), somehow i am not getting it dues to some of their internal check. Few questions that cropped up Can i somehow signed that ...
3
votes
2answers
250 views

If your company/university requires you to install root certificates what protects you from man in the middle attacks?

Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is ...
1
vote
1answer
690 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
18
votes
4answers
12k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
0
votes
3answers
178 views

Do all non-CA certs have to be End Entity certs?

Still learning the differences between certs. Can someone explain? The internet has so far been surprising not lucid in describing certificates. *EDIT to clarify EE
3
votes
3answers
752 views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
3
votes
1answer
97 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
5
votes
2answers
10k views

Openssl generate different type of self signed certificate

Does anyone know how to use openssl to generate certificate for the following public key type: 1) DSA - For DHE_DSS key exchange. 2) Diffie-Hellman - For DH_DSS and DH_RSA key exchange. 3) ECDH - For ...
1
vote
1answer
44 views

Protecting the root ca bundle

Applications (e.g. Firefox) often include a root ca bundle file containing trusted certificates. How can I protect those files from malicious agents trying to modify them? I think signing is not an ...
22
votes
3answers
2k views

Superfish vs. Corporate MITM

I work for a consulting company, and I have been implementing a tool from a security vendor, which is a cloud proxy for all user traffic. It will perform malware scanning and filtering of all web ...
3
votes
1answer
120 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
0
votes
1answer
71 views

How do SSL certificates become compromised after expiring [duplicate]

I'm reading into security issues surrounding SSL, and one of that has come up is certificate expiration. The general idea is that once a certificate expires, the site is insecure. What is the ...
1
vote
2answers
115 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
0
votes
0answers
56 views

What is the minimum acceptable time for “Freshest CRL” to be updated?

I'm working with MSFT CA, and not sure if this behavior is the same across all CAs, but when I run certutil -CRL, the base revocation cert is updated weekly, and the Freshest CRL (the differential) ...