A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

2
votes
1answer
1k views

Is keystore file(server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I did to generate .p7b file. I generated jks(java keystore) file using below ...
49
votes
1answer
3k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
1
vote
0answers
106 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
4
votes
1answer
209 views

Multi Domain SSL for different ip? [closed]

i have 5 domains(example.com,example2.net...) hosted on separate servers. is possible to use one Multi domain SSL certificate for these domain ?
4
votes
2answers
180 views

Using a verified certificate to sign others

This relates to PKI and certificates generally but websites more specifically. Could you get a verified certificate from a CA that is signed and fine for use, and then use it to sign your own ...
1
vote
0answers
597 views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
11
votes
1answer
228 views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
-4
votes
2answers
205 views

Using my own encryption instead of https in app

I am writing a program that uses a webserver as a backend for communication between different users. Is it okay to use my own encryption (such as ...
1
vote
2answers
113 views

What kind of SSL certificate do I need? [duplicate]

I am making a web site which can be considered similar to Reddit in some ways. I need to implement a sign up form so I will store informations about the users. My idea is to store the username, ...
16
votes
2answers
16k views

Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”

I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain. ...
1
vote
1answer
61 views

Should a private key be protected by a password even if the software using it needs to know that password?

We have an embedded device running a web server. That web server uses HTTPS and so has a private certificate which is embedded on the device. Right now we are unsure if this private key should be ...
0
votes
1answer
78 views

Is digital certificate with 'issued to' field as *.example.com valid?

Came across a Digital Certificate which has issued to field *.example.com Is this a valid certificate?
19
votes
3answers
29k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
0
votes
1answer
52 views

generate certificate at runtime and validate

I have a project that require client application to register and then use the services. I would like to do the following: A client app sends a request with IP, domain name, etc. to my REST service ...
0
votes
1answer
96 views

Is my sha1 SSL cert safe if they expire before 2016?

According to the Google [1], if my SSL cert expire after 2016 and at some points they will show a warning. But, if all my cert expired before 2016, so I assume no action need to be taken to prevent ...
5
votes
3answers
4k views

How trustable are third party root certificates?

I recently tried to use Fiddler2 from a third-party vendor Telerik. While decrypting the HTTPS traffic of my network, it asked me to install its own root certificate in my Windows operating system: ...
2
votes
1answer
226 views

certificate authentication between apps

I have a .NET MVC Application which is hosted in IIS. Users of the Application will be company only and it will be access so it will be on the intranet - app wont be exposed via internet. Within IIS I ...
3
votes
2answers
5k views

How to go about an ssl certificate renewal

I've got an ssl certificate from godaddy, and it's time to renew. I ended up with a single "keystore" file, which I give to my webserver (jetty). This is the process I went through to generate the ...
0
votes
1answer
2k views

Should the thumbprint be SHA2 in addition to the Signature Hash Algorithm?

I'm looking at a Windows PKI and see that the Thumbprint is SHA1, while the Signature is SHA2 (SHA256). Is this an acceptable configuration? Should I recommend that the client update to SHA2 for a ...
71
votes
11answers
18k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
0
votes
1answer
123 views

MITM faking certificates

I am looking at the theory behind MITM attacks in order to see some unencrypted packets from the 3DS. From research here is what I understand so far: 3DS > Proxy > Nintendo server I am going to try ...
0
votes
2answers
170 views

How does Matrix SSL perform certificate validation?

We use a custom app which uses Matrix SSL (client side) to perform certificate validation on MAC and Linux systems. My question is, does Matrix SSL keep a cert store cache of intermediate and trusted ...
4
votes
3answers
564 views

Steps to find out whether a SSL certificate is trustworthy

For doing business with a company I have to browse to https://www.prioenergie.de/nc/mein-prioenergie.html (German website). Firefox says the certificate is invalid, because it is not signed by a ...
3
votes
1answer
57 views

Can javascript code served by a server under HTTPS talk to another server under a subdomain with a different certificate?

Lets assume we have two servers : (1) https://adomain.com (2) https://abc.x.adomain.com The each have different certificates, (2) has a wildcard and (1) does not. If we remove https from the ...
2
votes
2answers
181 views

Why Google Chrome complains about mozilla.org identity?

On a "brand new" (but fully updated) Windows XP installation (an Asus EeePC that I restored to factory setting and than updated with all Microsoft's upgrades) I installed a few days ago Google Chrome. ...
0
votes
0answers
143 views

How to add basicConstraints extention to a self signed certificate

Using openssl to create a self signed certificate. The certificate needs to have the Basic Constraints value defined and showing in the cert but I can't seem to be finding the right location to modify ...
0
votes
0answers
112 views

Why is the public key extracted from the CSR different than the one extracted from the associated certificate?

I am playing around with pyopenssl. I am trying to extract the public key from a CSR and to check if it is the same than the one I find in the associated certificate. There is a small difference ...
1
vote
1answer
195 views

How will SHA1 deprecation affect SHA1 roots in OS/Browser trust stores.

I understand the SHA1 deprecation policy applies to CA's issuing SHA2 end-entity certs and intermediates starting Jan 2017 but how will this policy affect the actual root certificates in OS/Browser ...
5
votes
3answers
4k views

TLS library problem when connecting to Dovecot

I have a Comodo PositiveSSL certificate issued for mail.btcontract.com and I've set up Postfix and Dovecot to work with it in the following way: Postfix main.cf: smtpd_tls_cert_file = ...
5
votes
2answers
5k views

What's the difference between X.509 and PKCS#7 Certificate?

Am I correct calling file with .p7b file extension saved as 'Cryptographic Message Syntax Standard - PKCS#7 Certificates (.P7B)' in Windows - a 'PKCS#7 certificate'? Or is it better called 'X.509 ...
1
vote
0answers
255 views

If even Apple cannot properly install certificate [closed]

I've just installed a new copy of Mozilla Firefox/29.0 SeaMonkey/2.26.1 on a new Mac with OS X 10.9.4, and I'm getting an error message in place of a webpage when trying to access ...
3
votes
5answers
257 views

Can we have https without certificates?

I apologize in advance if I am fundamentally misunderstanding something, but is it possible to have encrypted communication protocols (https, I suppose) without resorting to a certificate system? ...
8
votes
5answers
2k views

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
6
votes
2answers
508 views

Where are the anonymous/private domain validation SSL certs?

I have yet to find a CA that doesn't require personal information for DV certificates. Is this because all of the major browsers and operating systems have a policy to reject CAs that don't require ...
1
vote
2answers
128 views

Will CA's still validate internal IP's in SSL certs?

Just wondering what Certificate Authority (CA) policy is nowadays on validating someone's internal IP address in a certificate? I have heard that some CA's used to do this but won't anymore.
1
vote
2answers
189 views

Certificate security in intranet environment?

We have this topology in our company: A new rule says that each document being sent by Outlook should be encrypted. We decided using PGP. We already have a certificate (self-signed). The problem ...
0
votes
2answers
77 views

Why does IP address need to be listed as a DNS name in SAN/UCC certs?

I have heard that when creating a CSR that if you want to validate an IP address that you should list the IP as a "DNS" name and not "IP Address". I have actually had to re-create CSR's like this to ...
1
vote
1answer
151 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
0
votes
0answers
40 views

Question regarding SSL / TLS / Certificates in general [duplicate]

for the last two days I played around a bit with nginx's SSL configuration. A question came up: I created asymmetric key using $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:4096 -keyout ...
0
votes
1answer
51 views

How to change the expiration time for the pkcs certificate?

I have an application (which I'm testing), in which I create some services. These services are accessible via libraries i.e java and python apis. In order to authenticate the api calls, the ...
7
votes
4answers
1k views

How to prove Bob has received Alice message

I have read up on Digital signature and it is stated that it provides non-repudation. Assuming Alice signs the message using her private key and sends it to Bob, Bob can use Alice's public key to ...
1
vote
2answers
786 views

To trust, or not to trust? Adding exceptions to the Trusted Certificates List in (firefox) Light

I recently installed the Light (a more compact forking of Firefox). I started getting the "This Connection is Untrusted" error, which got me wondering: when should I add an exception to the list of ...
3
votes
1answer
865 views

Can Fiddler decrypt HTTPS traffic when using elliptic curves + client cert authetication?

Case 1 involves TLS + client certificate authentication with both client and server using secp384 based EC certificates. In this case, when monitoring traffic via fiddler, the tunneling/handshaking as ...
2
votes
0answers
28 views

Why do some unrelated websites (appear to) share certificates? [duplicate]

If you browse to https://blog.stackoverflow.com/ you see a certificate error. In Chrome: This server could not prove that it is blog.stackoverflow.com; its security certificate is from ...
2
votes
2answers
133 views

PKI certificate validation graphs, trees and cross signing

I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it ...
0
votes
2answers
156 views

How to be sure that downloaded file is correct? [duplicate]

Last week I read a lot about security. I have a basic understanding how public keys or private keys works. But I still have a lot of questions I can't find an answer. Right now I'm interested in ...
2
votes
2answers
400 views

Certificate authorities: history and registration

CA's are a key part of the internet's infrastructure few people are aware of. SSL was mostly hacked together at Netscape in 1995. I'd like to understand more about the organizational structure of CA's ...
1
vote
1answer
188 views

Machine Certificate Key File Artifacts

When a new machine certificate is imported with a private key a MachineKey file is generated in "%ProgramData%\Microsoft\Crypto\RSA\MachineKeys". When using the certificate mmc snapin or removing a ...
1
vote
2answers
942 views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
0
votes
1answer
407 views

Mac OS X : Certificates signed by company trusted CA cannot be verified

I'm trying to setup a keychain on Apache Tomcat that contains a server certificate that was signed by a custom root ca certificate. (not sure if custom is the right word here, but it's a root ...