A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
0answers
103 views

Are any major websites offering ECDSA authentication?

At the time the Cloudflare blog post “ECDSA: The digital signature algorithm of a better internet” was authored, Cloudflare was apparently one of "fewer than fifty" users of ECDSA certificates on the ...
0
votes
1answer
1k views

Verify Certificate is revoked by CRL

I set up a CA and signed some cert request. I revoke them by: openssl ca -config config.cnf -revoke cert.pem I update CRL by: openssl ca -config config.cnf -gencrl -out crl/crl.pem ...
1
vote
2answers
71 views

Own attributes openssl

Is there a way to include my own attributes into an openssl certificate? e.g ... Country Name (2 letter code) [GB]: State or Province Name (full name) [State]: Locality Name (eg, city) [City]: ...
12
votes
5answers
2k views

Why are certificates limited in time?

If a certificate has a limited duration of, say 5 years, but it gets somehow compromised after 2 years, waiting the 3 remaining years for it to get invalid is not a real solution to the breach ...
0
votes
0answers
37 views

How to gather/verify certificate data with limited information (Issuer, Serial, CN)

I asked this question in the "programming" section, Here. However it may be a simple answer for someone familiar with the security of certificates. The basic premise is I have a large table with ...
2
votes
2answers
87 views

PKI certificate validation graphs, trees and cross signing

I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it ...
2
votes
1answer
394 views

“global” OCSP with Apache mod_ssl / Alternative to -VAfile option Openssl

Context I'm developping my own OCSP responder which signed its ocsp responses with its own self signed certificate caOcspBC.crt. You can find it here : https://github.com/Dinou/ocspResponder I want ...
0
votes
2answers
55 views

Self signed certificate secure when just client sends sensitive information?

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for ...
3
votes
2answers
224 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
2
votes
1answer
65 views

How does checking CRLs make sites less safe?

With the frantic certificate upheaval resulting from the Heartbleed fiasco [drink!], there has been lots of talk regarding certificate revocation, and in particular the policy of certificate ...
0
votes
0answers
45 views

Changing the string format of Burp generated certificates

The certificate verification in a piece of software I'm poking uses UTF-8 encoded strings to verify the certificate's host name. Certificates generated by Burp suite, however, use the custom type ...
3
votes
1answer
89 views

Windows - service account default certificate store

I am writing a web app that connects to external web services. The external web services serve an intermediate certificate signed by Thawte SGC CA - G2. When I setup IIS to run the web app using ...
3
votes
2answers
132 views

What are Implicit and Explicit Certificates in Public Key Cryptography?

A Public key is certified by a Trusted Certifying authority, to ensure the integrity of the key and authenticity of the entity who claims to have the corresponding private key. In this Public Key ...
0
votes
1answer
117 views

Certificate request - why does the requester have to create a private key?

If remember right, then before I send a CSR (Certificate signing request) to the CA, I have to create private and public keys. Then I use the public key to encrypt my personal details before I send ...
2
votes
2answers
188 views

What happens if the CA has knowledge of private keys?

In a classic PKI scenario, the certificate authority receives signing requests generated by an end-user which owns the keychain, and thus has his private key secret. Consider a scenario in which the ...
2
votes
1answer
652 views

What happens when intermediate certificates are installed in the wrong order?

I have noticed that the intermediate certificates on a web service are installed in the wrong order. What effects could I expect from this? I used the Symantec certificate checker which stated: ...
3
votes
2answers
146 views

SSL Wildcard certificate to issue anther certificates

Let's say, that I buy an *.example.com SSL certificate. I want now to generate subcertificates and include the *.example.com certificate in a trust path: host1.example.com, with an alternate name ...
11
votes
2answers
2k views

Is Apple's push notification service implementation vulnerable to a MitM attack

Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2 Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf ...
1
vote
2answers
3k views

Unrecognized leaf certificate

Every 15 minutes or so I get this message in my system.log Apr 25 22:05:36 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate Apr 25 22:20:57 Ivans-MacBook-Pro.local apsd[194]: ...
1
vote
1answer
68 views

When does S/MIME require the other party's certificate and when is their key enough?

Trying to understand S/MIME implementation, I see that sometimes you must have the other party's certificate, and sometimes its enough to just have their public key. I'm confused as to when you need ...
0
votes
0answers
155 views

Does Mac OS X 10.8+ support self-signed Package Installer

I'm not sure whether self-signed Package Installer are supported by Mac OS X 10.8+ Using informations in How to create an Apple Installer Package Signing Certificate I could create a Package ...
2
votes
2answers
666 views

Load balancer and two machines - how many SSL certificates do I need?

We have a load balancer facing the Internet. It's balancing load towards two systems behind it in the back-end running apache. How many SSL certificates do I need to buy? - One for the load-balancer ...
1
vote
0answers
79 views

Reverse proxy and corporate PKI

Here at OU=PKI we've been requested to issue a certificate with CA capabilities to install it in our reverse proxy, so that it could issue trustable certificates for every single web. (SSL ending) ...
2
votes
1answer
1k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
2
votes
1answer
282 views

How do I securely deal with SSL certificate validation failure when the client date is incorrect?

I have an application that runs in mobile devices and connects to my server via HTTPS. At times the connection fail because the device has a date set in the past (before the 'valid from' date on my ...
5
votes
3answers
219 views

Risk in buying an SSL cert from a not well-known party

Let's say I know a guy is selling an SSL cert at a very low price, assume they will generate a real and valid cert for me, since I need to submit my CSR to them and they pass to the CA, are there any ...
0
votes
1answer
53 views

Downloading list of pinned certificates

I'm thinking about implementing certificate pinning in a mobile app. The app will need to connect to several secure sites. Rather than having to update the app every time one of their certificates ...
1
vote
1answer
609 views

What is the different between CMP and SCEP protocol?

What is the different between CMPV and SCEP protocol? Which one is better ?
2
votes
8answers
540 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
23
votes
1answer
2k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
1
vote
1answer
689 views

IE11 on windows 8.1 and ssl fallback

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 ...
7
votes
1answer
281 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
4
votes
1answer
261 views

Certificate Revocation List

There are many fields on a certificate revocation list (CRL) like Algorithm, Parameters, Issuer Name, This update date, Next update date, user certificate serial #, etc. While I understand the purpose ...
1
vote
0answers
491 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
2answers
459 views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
0
votes
1answer
83 views

list of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
4
votes
1answer
289 views

How would you know a certificate/private key if you extracted it from RAM? Or would you?

Related to, of course, the heartbleed vulnerability, I've been reading the news about the worst case scenario for this attack being the extraction of the SSL private key, because, of course, this ...
2
votes
2answers
186 views

After heartbleed, how can you safely distribute new certs?

It's been a while since I studied key distribution, so I may have some fundamental misunderstanding.. From what I remember, man in the middle attacks can't occur during cert distribution because the ...
4
votes
2answers
1k views

How to configure Browser to detect revoked certificates?

In the context of the Heartbleed bug I would like to make sure that I can detect if someone tries to do a MITM attack with a stolen certificate, which since has been revoked. The problem is that ...
3
votes
2answers
133 views

Is the Common Name mandatory for digital certificates?

I'm working on a project, where we use the Common Name as a certificate's basic identifier. However, importing certificates without the Common Name fails. What's the default way to use digital ...
1
vote
2answers
104 views

Where to find or purchase non-SSL certificates

I hope this is the right stackexchange - if not, please advise. As to the actual question: have a system we've developed that makes heavy use of asymmetric cryptography in various different ways ...
1
vote
0answers
35 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
3
votes
0answers
159 views

Does heartbleed have any effect if OpenSSL was only used to generate the certificate [duplicate]

Edit: Please follow the above link to the original. I have a self-signed certificate which is use to sign other certificates that I issued. This is all done with an affected version of OpenSSL. ...
0
votes
1answer
283 views

Trusted Certificate Authorities - how do they work?

microsoft.com for example can use a Verisign Certificate for their domain. What are the chances that an attacker could ask verisign for a m1crosoft.com domain and get approved? It is very simillar, ...
2
votes
3answers
209 views

How can I know when a certificate was created?

I want to know whether my various providers changed their certificate because of Heartbleed, or they are using an old vulnerable certificate. How can I know that? Is the "valid from" date also the ...
1
vote
1answer
334 views

Would there be MITM attack even fix the heartbleed vulnerability? [closed]

I have read this post askbuntu, the step to fix the heartbleed vulnerability almost: 1. upgrade openssl. 2. generte new keys. 3. revoke the old certificates. Some posts say attackers may have got ...
2
votes
1answer
98 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' bowsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
1
vote
2answers
116 views

Should every SAML identity provider provide a unique public certificate to the service provider?

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
1
vote
1answer
200 views

Certificate services will not start with “server is offline” error [closed]

I have a subordinate CA. The Enterprise root service was uninstalled from the network by accident and then migrated to a new box using the same key. This new server has a different server name. It ...
5
votes
2answers
339 views

When you buy a certificate, does the certificate authority have (a copy of) the private key?

I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this: You generate a public and private key pair From this key pair you generate a ...