A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

15
votes
1answer
30k views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
3
votes
2answers
90 views

CSR Signing simulation

Tried a lot get my test csr signed from root CA(trial versions option), somehow i am not getting it dues to some of their internal check. Few questions that cropped up Can i somehow signed that ...
2
votes
2answers
241 views

If your company/university requires you to install root certificates what protects you from man in the middle attacks?

Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is ...
1
vote
1answer
684 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
18
votes
4answers
12k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
0
votes
3answers
143 views

Do all non-CA certs have to be End Entity certs?

Still learning the differences between certs. Can someone explain? The internet has so far been surprising not lucid in describing certificates. *EDIT to clarify EE
2
votes
3answers
479 views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
3
votes
1answer
88 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
5
votes
2answers
10k views

Openssl generate different type of self signed certificate

Does anyone know how to use openssl to generate certificate for the following public key type: 1) DSA - For DHE_DSS key exchange. 2) Diffie-Hellman - For DH_DSS and DH_RSA key exchange. 3) ECDH - For ...
1
vote
1answer
44 views

Protecting the root ca bundle

Applications (e.g. Firefox) often include a root ca bundle file containing trusted certificates. How can I protect those files from malicious agents trying to modify them? I think signing is not an ...
22
votes
3answers
2k views

Superfish vs. Corporate MITM

I work for a consulting company, and I have been implementing a tool from a security vendor, which is a cloud proxy for all user traffic. It will perform malware scanning and filtering of all web ...
3
votes
1answer
107 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
0
votes
1answer
70 views

How do SSL certificates become compromised after expiring [duplicate]

I'm reading into security issues surrounding SSL, and one of that has come up is certificate expiration. The general idea is that once a certificate expires, the site is insecure. What is the ...
1
vote
2answers
107 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
0
votes
0answers
50 views

What is the minimum acceptable time for “Freshest CRL” to be updated?

I'm working with MSFT CA, and not sure if this behavior is the same across all CAs, but when I run certutil -CRL, the base revocation cert is updated weekly, and the Freshest CRL (the differential) ...
2
votes
2answers
6k views

This certificate has an invalid digital signature

I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. ...
0
votes
0answers
134 views

Getting Certificate KeyContainerName to initialize CspParameters

How can I get the name of a Key Container that's in a smart card required for initialization of CspParameters? CspParameters^ cspa = gcnew CspParameters(ProviderType, ProviderName, keyContainerName, ...
1
vote
0answers
57 views

Making the Firefox key and CSR creation process transparent

Background I was a bit surprised that several CAs do not allow anymore to send a plain old CSR in text form to them which was created in the classic fashion with OpenSSL or similar. But this would ...
4
votes
2answers
108 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
1
vote
0answers
26 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
1
vote
1answer
88 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
1
vote
1answer
117 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
54
votes
4answers
7k views

Why was the private key of the Superfish certificate so easily extractable?

Robert Graham detailed on the Errata Security blog how he was able to get the private key of the Superfish certificate. I understand that attackers can now use this key to generate certificates of ...
2
votes
1answer
101 views

How do Client-specific keys and Certificates work?

I have clients that communicates with my server. Clients sends it unique id (guid) to server with its request over a secure https channel. Also to increase security I use my own private-public key ...
11
votes
1answer
468 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
2
votes
1answer
6k views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
2
votes
0answers
48 views

How can I restore my Windows certificate cache so I only have those from trusted CAs? [duplicate]

All this talk about Superfish and other adware crap has made me healthily paranoid that a wrong certificate can enter my certificate cache at any time. I have no reason to assume that there is a ...
0
votes
1answer
137 views

Create certificate without private key with OpenSSL

I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely ...
1
vote
2answers
165 views

How to be sure laptop's trusted certificates are safe

I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification ...
27
votes
4answers
2k views

Can any CA sign any domain?

Can any CA sign any cert for any domain? If the answer is yes, what prevents having two different CAs creating a valid cert for the same domain? Does that mean that the whole TLS security has the ...
11
votes
1answer
8k views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
0answers
96 views

How to associate an oAuth token with a particular user. Is this possible?

We have HTTP Rest services and SignalR (aka Web sockets, server send events, etc) for cases in which we need to push data from the server to the Web UI . We are currently using the built in tools that ...
3
votes
1answer
2k views

Active Directory - Certificate Based Authentication - Multiple certificates for user

First, I have very limited knowledge about AD. Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will ...
1
vote
1answer
137 views

how to extract a valid digital certificate and put it on other program

I am working on this matter as a graduate, but I need some help. how can extract a valid digital certificate to put it on other program? can I put a digital certificate on other executables and be ...
1
vote
0answers
27 views

How can i know my security level as “ SSL 256 bit encryption” [duplicate]

I am using openssl tool to create certificate self-signed certificate I have known that [2048 bit SSL] it is the length of the public key then what about [256 bit encryption] how can i know type of ...
0
votes
0answers
42 views

Additional security for services hosted on a 2FA or Multi-Factor Authenticated Network

I am aiming to lock down a web service that accesses other services and has a publicly facing UI. I have a hosted service on a network that requires 2-factor authentication to access. This service's ...
1
vote
0answers
39 views

Certificate advice for deploying code-signed software as a 3rd party vendor

I am in the process of developing an application for an organization, and am looking for a sanity check on my strategy, especially given the the nature of the SuperFish nonsense that was exposed. The ...
3
votes
1answer
72 views

Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?

If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA. The use case is that some clients have ...
1
vote
0answers
57 views

Proxpy- certificate issue

I am using proxpy, a proxy server written in Python. It comes with its certificates and after installing one of the certificates in Firefox, I got 'Connection is untrusted'. Any help in this regard ...
4
votes
3answers
503 views

What part of TLS specifies how to verify a certificate chain

I have sometimes run into a situation where I see a root CA certificate which is set to expire sooner than the intermediate CA certificate. My question is - if you were interested in keeping your ...
1
vote
1answer
102 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
0
votes
2answers
109 views

Why do certificate authorities often require/use multiple intermediates?

I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway. Why do most modern certificate authorities (e.g. ...
6
votes
2answers
2k views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...
2
votes
1answer
691 views

Intercepting HTTPS Android app traffic

I'm trying to intercept Android application traffic from my Android phone....Basically what worked before was that i had simply installed fiddler proxy on my PC, exported the root certificate (and ...
-2
votes
2answers
213 views

How do certificates stop this man in the middle attack?

Alice and Bob are trying to set up a secure conversation, but unknown to them in the middle is Eve, who can intercept and modify all packets sent between them. The communication goes as follows: ...
3
votes
1answer
98 views

Why do Certificate Authorites cross-sign each other?

A Certificate Authority (CA) issues digital certificates to certify the ownership of a public key by the named subject of the certificate. What is the rationale for CAs cross-signing each other (i.e. ...
0
votes
1answer
66 views

Is it possible for a successful domain hijacker to fraudulently use the certificate issued to the real owner of the domain name?

In other words, while visiting https://www.mybank.com, for example, can I always trust the site as long as I click the padlock in the address bar of my browser and find no problem with the ...
1
vote
2answers
222 views

Are there other roots of trust on my computer aside from these 46 root certificates?

I've heard many people imply that modern browsers and OSes trust a myriad of root certificates. The implication is that it is impossible to ensure the private keys of all of the root certificates ...
2
votes
1answer
121 views

Is an SSL/TLS HTTPS certificate 'fingerprinting' attack possible?

If you download a friend's site's unique HTTPS root certificate (independent of default browser-shipped ones), or you simply make a 'permanent exception' to an obscure self-signed cert, in Firefox, I ...
3
votes
2answers
124 views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a ...