A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
2answers
571 views

Self-signed SSL certificate on chromebook (and android)

I am having the following problem on both my android phone and on my chromebook. I'm running a website on an internal server (10.3.3.3) using nginx with a self-signed ssl certificate. Since it is just ...
1
vote
2answers
283 views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
0
votes
1answer
66 views

list of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
2
votes
1answer
90 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' bowsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
2
votes
2answers
184 views

After heartbleed, how can you safely distribute new certs?

It's been a while since I studied key distribution, so I may have some fundamental misunderstanding.. From what I remember, man in the middle attacks can't occur during cert distribution because the ...
4
votes
1answer
211 views

How would you know a certificate/private key if you extracted it from RAM? Or would you?

Related to, of course, the heartbleed vulnerability, I've been reading the news about the worst case scenario for this attack being the extraction of the SSL private key, because, of course, this ...
3
votes
2answers
105 views

Is the Common Name mandatory for digital certificates?

I'm working on a project, where we use the Common Name as a certificate's basic identifier. However, importing certificates without the Common Name fails. What's the default way to use digital ...
4
votes
2answers
626 views

Single domain SSL certificates, actually support 2 subdomains?

While browsing for SSL certificates, specifically domain validation type (the cheapest), I noticed that they advertise as valid for a single domain/subdomain, but then I noticed that they are valid ...
1
vote
2answers
100 views

Where to find or purchase non-SSL certificates

I hope this is the right stackexchange - if not, please advise. As to the actual question: have a system we've developed that makes heavy use of asymmetric cryptography in various different ways ...
3
votes
0answers
159 views

Does heartbleed have any effect if OpenSSL was only used to generate the certificate [duplicate]

Edit: Please follow the above link to the original. I have a self-signed certificate which is use to sign other certificates that I issued. This is all done with an affected version of OpenSSL. ...
1
vote
0answers
30 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
2
votes
3answers
195 views

How can I know when a certificate was created?

I want to know whether my various providers changed their certificate because of Heartbleed, or they are using an old vulnerable certificate. How can I know that? Is the "valid from" date also the ...
0
votes
1answer
162 views

Trusted Certificate Authorities - how do they work?

microsoft.com for example can use a Verisign Certificate for their domain. What are the chances that an attacker could ask verisign for a m1crosoft.com domain and get approved? It is very simillar, ...
1
vote
1answer
326 views

Would there be MITM attack even fix the heartbleed vulnerability? [closed]

I have read this post askbuntu, the step to fix the heartbleed vulnerability almost: 1. upgrade openssl. 2. generte new keys. 3. revoke the old certificates. Some posts say attackers may have got ...
1
vote
1answer
126 views

Certificate services will not start with “server is offline” error [closed]

I have a subordinate CA. The Enterprise root service was uninstalled from the network by accident and then migrated to a new box using the same key. This new server has a different server name. It ...
5
votes
2answers
300 views

When you buy a certificate, does the certificate authority have (a copy of) the private key?

I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this: You generate a public and private key pair From this key pair you generate a ...
17
votes
3answers
6k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
0
votes
1answer
31 views

Certificate extensions - specific constraints

I have question about extensions of certificate and what specific extension should I use in my situation. The problem is following: I have a CA and I want that CA will issue certificate only for ...
2
votes
1answer
111 views

How secure is PKCS #12

I need to move user cryptographic identity between several user devices. In the operating system I have only one option: use password-protected PKCS #12 to import the identity to the OS secure store. ...
2
votes
1answer
102 views

Finding the type of SSL certificate with cURL

This is a part of curl's verbose output when connecting to the HTTPS site of Google. * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * ...
0
votes
1answer
159 views

Accepting an untrusted security certificate?

What is the risk of accepting an untrusted site security certificate in your browser if you're not entering any data, but merely browsing the site?
2
votes
3answers
321 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
1
vote
3answers
149 views

Https forms on tens of domains

What is the optimal way (cost-wise, too) to secure page forms (https) on a large number of domains&subdomains? Are certificates required for all domains? Is putting all the page forms on a single ...
2
votes
1answer
832 views

Certificate verified using two different paths

StartSSL has an intermediate certificate that they use to sign their EV certificates: sub.class4.server.ca.pem. This certificate's issuer is shown by openssl x509 to be /C=IL/O=StartCom ...
3
votes
1answer
99 views

Public keys without the certificates

There are two clients and a server. Each client generates an RSA key pair and uploads public key to the server. The server associates the public key with the user identifier that is specified during ...
1
vote
0answers
53 views

Deploying software that requires X.509 certificates

I have a self-hosted WCF application, with a server application running on the server (obviously) and a client application that will be installed on the users PC. Up until this point I have been ...
0
votes
3answers
368 views

SSL Certificate for an email server

I am completely new to SSL/TLS and would appreciate any help you guys could give me. To give you some background info, our company website is hosted externally by our ISP, however our email is ...
0
votes
1answer
78 views

Good reason to continue using fraudulent certificate?

A relative of mine used a favorites link to login to yahoo. The favorite link is https://de.mg40.mail.yahoo.com/neo/launch? However, this link uses a fraudulent certificate. Visiting the Yahoo ...
0
votes
1answer
127 views

My WCF application uses 2 way certificate message encryption - does it still need SSL?

I have a WCF service configured to use two-way certificate authentication on the messages. The server is also locked down through a firewall to only allow traffic from a single IP:Port that the ...
17
votes
2answers
2k views

How can you prevent employees of your company from creating valid ssl certs? [duplicate]

When registering for an SSL cert, I was able to validate that I "owned" the domain I was creating the cert for by having a valid @domain.com email address. If I worked for a large company, say ...
0
votes
1answer
85 views

Secure Communication Between .Net Application and Website

Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our ...
6
votes
2answers
511 views

VPNs vulnerable to MiTM because ANY certificate goes

I spoke to a sysadmin in a business center today who intended to basically perform a MiTM (as he called it) on every connection in his network because people in his office building are using VPNs and ...
4
votes
3answers
623 views

How do you verify a certificate belongs to a domain?

I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to. Currently I can verify the certificate is valid using the following code $resource = fsockopen( ...
1
vote
0answers
46 views

Does Active Directory Certificate Services support Card Verifiable Certificates?

Does Active Directory Certificate Services support accepting requests for, and generation of, Card Verifiable Certificates (TR-03110)? If so, in which version of Windows Server was the functionality ...
1
vote
1answer
105 views

Is there any way to restrict multiple access to my server at the same time using one client certificate?

My Server is Windows 2008. Mr. X is accessing my web server using Mr. X's certificate. In that time, an outsider is also trying to access my server using Mr. X's certificate (somehow he got it). Is ...
1
vote
3answers
153 views

Howto pass overly protective corporate firewall

My Corporate Network was always being monitored, but a few days ago they started to block and censor all HTTPS traffic. Recently IT guys forged certificates for all major HTTPS web sites and acts as a ...
1
vote
1answer
507 views

Convert a DER encoded Certificate to PEM encoded Certificate

I have a p7b certificate(DER encoded) which I need to convert to a PEM encoded certificate so that I can import it into my keystore. I see that the openssl command below does the job of the ...
39
votes
2answers
9k views

What exactly does it mean when Chrome reports a certificate 'does not have public audit records'?

When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I received a message 'The identity of this website has been verified by Google Internet ...
3
votes
2answers
567 views

How To Recover EFS Cert From Backup?

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access ...
1
vote
0answers
67 views

Certificate authorities: history and registration

CA's are a key part of the internet's infrastructure few people are aware of. SSL was mostly hacked together at Netscape in 1995. I'd like to understand more about the organizational structure of CA's ...
1
vote
2answers
86 views

How to prove the integrity of a digital file if certificates are not an option

Certificates are a fantastic way to prove the integrity of a file - provided that they have been signed from the beginning. This methodology can prove the files authenticity, in addition proving it's ...
1
vote
1answer
177 views

Risks associated with distributing encrypted private key with our software?

Our software contains two executables that need to serve data over SSL (and several that need to do requests over HTTPS)). I notice that it is distributed with some .PEM files created with OpenSSL. ...
1
vote
1answer
179 views

valid PDF signature without using hardware HSM or usb Token

I have a DMS system(alfresco) that needs to sign approx 50.000 valid signatures a year. The signing certificate needs to be acquired from one of the affiliated sub-CA's. So according to the Adobe CDS ...
15
votes
3answers
22k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
2
votes
1answer
103 views

SSL certificate to protect spoofing of API server

I have a program written in Python that checks the validity of its license key with a remote server. Am I right that an SSL certificate would make it possible to prevent spoofing (host redirects for ...
0
votes
1answer
130 views

Why not use client certificates for premaster key generation

The question is about a very specific SSL handshake scenario. I understand that some servers may request client certificates in order to authenticate connecting clients. However, as far as I can ...
2
votes
1answer
94 views

Does using Chrome bypass the Apple iOS gotofail bug ?

Does the recent certificate gotofail bug affect me if I'm running version 6 of iOS, but only use Chrome as my browser?
22
votes
1answer
2k views

Why does Firefox not trust this US government SSL certificate?

Shouldn't this be a trusted certificate considering it's a wildcard SSL certificate? That is, shouldn't *.delaware.gov cover www.corp.delaware.gov?
1
vote
2answers
342 views

Does Google use extended validation certificates

I just changed a password on a Google account while using the Chrome browser. After doing so, I noticed that the https connection to Google was not highlighted in green signifying that it was an ...
0
votes
1answer
103 views

X509 Certificate Thumbprint

Does an issued X509 certificate have a thumbprint (hash) included as one of the items in the X509 certificate?