A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

-1
votes
1answer
37 views

Signed E-Mail certificate invalid [closed]

I sent a valid signed e mail a few weeks ago. Now I reinstalled everything on my computer (including the OS). Is the certificate now invalid?
2
votes
2answers
355 views

OpenSSL - Generate self signed certificates with different cipher suites

I want to generate a root certificate and SSL certificate (self-signed) for communication between an embedded device and our backend servers (IIS 8.0). I used OpenSSL to generate a certificate with ...
1
vote
1answer
93 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
0
votes
2answers
70 views

Does X.509 standard claim to check client certificate's expiration date on server side?

Does the X.509 standard claim to check client certificate's expiration date on server side? Consider an expired client certificate in the trust store of web server. If some client tries to ...
6
votes
2answers
522 views

Did scammers take control of a subdomain to host phishing site?

This morning I received a text message (ostensibly) from my bank: We need to contact you. Please visit https://paymentassistance.nationwide.co.uk for more information My spidey sense immediately ...
1
vote
1answer
60 views

Self created CA root for client certificates [duplicate]

My company wants to use client certificates for clients on production. We have a HTTPS certificate. As I understand we need a CA root certificate to create client certificates. Question: is it OK if I ...
6
votes
1answer
195 views

How do Lync and SSL inspection play together?

Whitelisting all Lync hostnames is cumbersome. Globally deactivating SSL inspection is undesirable. At a place I work for, they have SSL-inspection enabled on their proxy. All traffic to the Internet ...
6
votes
2answers
551 views

Could a stolen certificate show as trusted?

I have recently started learning about PKI and have the following question/s. As far as I know a signed certificate contains the domain name of the server that the certificate will be placed upon. ...
3
votes
1answer
43 views

Connection not secure when using a proxy

I connect to the Internet using a proxy at my university residence and I noticed at some sites (like my bank and PayPal), the browser reports that: it's unable to check if the website certificate ...
1
vote
1answer
227 views

Client authentication successful when using a pfx with Java, fails using OpenSSL. Why?

I've been trying to troubleshoot issues with client authentication and am seeing different behaviour when connecting from a Java application vs OpenSSL. A third party has provided me with a pfx, I've ...
6
votes
2answers
138 views

How can I verify that a root certificate is authentic?

I have found that my home PC (Windows 10) currently has 39 root certificates installed. While scrolling though the list I have noticed: Names that look familiar (e.g. Thawte / VeriSign) Names ...
9
votes
3answers
801 views

Do client certificates need to be trusted by the client?

I'm looking for some clarification around the trust requirements (if any) of client certificates. I'm working with a third party to access their services via Mutual TLS. I generate a CSR, send it ...
-1
votes
1answer
54 views

Do certificates need to be protected at rest? [closed]

I have downloaded numerous certificates to my device. How do I ensure the confidentiality and integrity of the data at rest?
3
votes
1answer
113 views

Are the elliptical curves in ECDHE and ECDSA the same?

ECDHE is quite widely used and recommend. And it works with elliptical keys and provides forward secrecy. It's used for the key exchange. ECDSA is not widely used though, but it does also use ...
1
vote
1answer
62 views

Using Keytool to export and change password of certificate in a KeyStore

I'd like to use Keytool to export a certificate from my KeyStore. I'd also like to change the certificate password, is it possible? What I thought should be done is one of the following: 1. Changing ...
1
vote
3answers
47 views

Automatically ensure that a site's certificate (authority) has not changed

My Situation : I've setup my own certificate authority, and generated a certificate for a server used primarily internally. As I understand it, I can configure my browsers/computers to trust the ...
4
votes
2answers
153 views

Risk of self signed certificates with Android

In the OWASP top ten list for mobile, it is mentioned that self-signed certificates should never be allowed. I want to check with others why is this so ? If I have a server back end for my mobile ...
6
votes
1answer
108 views

S/MIME certificates and “information leakage”

I'm considering getting an S/MIME certificate that verifies my name and email address. I've been trying to ascertain what information "leaks" if I do. The Wikipedia page on S/MIME says: Depending ...
1
vote
1answer
108 views

Safe to store encrypted data with (password protected) pfx file

I have created a self signed certificate using Powershell's New-SelfSignedCertificate, with the intention of encrypting and storing a username / password in public. Specifically using - ...
0
votes
1answer
230 views

Creating root CA to issue certificates programatically

I have to generate a self signed root CA and use it to issue to certificates programatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
4
votes
2answers
76 views

What threats can come from an outdated Certificate in a private LAN

In our company, we use a LAN "about 1,000 users", served with internal servers including email, DNS, and many web servers. Whenever I access any of the network sites, I receive a message about an ...
6
votes
2answers
240 views

What is the best strategy to store and share pem files between team?

Our company's small tech team works with several different servers, to which we connect with pem files. What is a good way of storing the pem files so that it can be accessed by other team members if ...
6
votes
5answers
342 views

Should I accept a self-signed certificate from my university?

My university set up a new domain we (student) can access to do some things. Chrome blocks the loading of the page in question saying that the certificate is invalid: Your connection is not ...
5
votes
2answers
158 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
30
votes
3answers
8k views

Which CA issued certificate for https://www.google.com

I installed Kaspersky internet Security 2016 on my laptop; in Firefox and Edge the root issuer is Kaspersky Anti-Virus Personal Root Certificate. but in chrome the root issuer is GeoTrust. in my ...
3
votes
1answer
119 views

Need raw certificate/key to sign PDFs via Java app. But vendors seem to only sell HSMs for this. What to do?

Our organisation wants to purchase a digital signature certificate for signing financial PDF documents. We want to automate this process, so we'll be having Java code do the signing work. For that the ...
0
votes
1answer
83 views

Protecting a jar file from being used by unauthorized parties

I have a jar file that has some business critical functionality. Keeping this logic safe and preventing unauthorized usage of this jar is very important to me. To achieve this, I have obfuscated the ...
1
vote
1answer
100 views

Automate certificate signing in Linux

In a private network I wish to automate signing for new clients/servers. Something like this: New client is created (dockers & etc) The client create a new private key and a CSR The client send ...
2
votes
1answer
76 views

SSL Client Authentication Failure

I have a setup where the client wants to make https call to the server. The client has a certificate installed on the machine The trust chain of the cert: Root CA      ...
8
votes
1answer
146 views

Browser blacklists & the Symantec-Google Certification Debacle

Background: As explained e.g. on this Google company blog, Google writes that: On September 14, around 19:20 GMT, Symantec’s Thawte-branded CA issued an Extended Validation (EV) pre-certificate ...
11
votes
3answers
1k views

How does obtaining a SSL certificate work?

I have been carrying out some work on SSL certificates and found that there are some places that charge you for an SSL certificate, but, how do they obtain the rights to do so? And, how, are they ...
6
votes
2answers
547 views

Generate CSR from existing certificate

Can we generate the CSR (certificate signing request) used for certificate signing from the signed certificate? It should work with the original private key when signed again with different authority. ...
1
vote
0answers
14 views

Partially Valid PKI certificate--But still we are able to login to our Application [closed]

User having a PKI card with an invalid PKI certificate (Among the two PKI certificates – One certificate is revoked (Damaged/ officially Cancelled) and another certificate is active)and try to login ...
3
votes
1answer
88 views

Does client Authentication needs the server to have intermediate certificate?

I have a scenario where in the client send send a client certificate issued from trusted root. The path of the client cert is like : Trusted Root |-----Intermediate Issuer |---- ...
2
votes
2answers
59 views

How does Certificate Transparance detect fake or forked logs?

I am trying to understand Certificate Transparency. Let's say I want to snoop on somebody's email. So I go hack or bribe a CA, have them issue a certificate for google.com, and then I present it when ...
0
votes
0answers
23 views

Different KeySizes from Different Stores same pfx

Sorry, i'm new to all of this. I have a question as to why the KeySize of a RSACryptoServiceProvider will differ between Store Locations? I've imported the same pfx in the LocalMachine store, as ...
0
votes
1answer
98 views

Is a SSL Certificate for a static IP Address a good idea

Is it possible to acquire a SSL Certificate for a static IP address that is not registered to a domain name and is there any issues that could be encountered?
1
vote
1answer
55 views

CRL verification with renewed CA

I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed. Suppose I have the following setup: ...
18
votes
3answers
3k views

Let's Encrypt for intranet websites?

Many companies have intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate, which causes a bad habit for the users since they get used to just ...
1
vote
1answer
39 views

If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them?

Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head: Let's say that I decide to ...
0
votes
0answers
212 views

Cannot connect to SSL site in Safari only on Windows and Mac

I am having an issue with users connecting to my site via SSL on Safari - this is both on Windows and Mac so it doesn't appear to be OS specific. When they try to connect they get an error: Safari ...
0
votes
2answers
115 views

TLS or IPsec protocol for client-server communication? [duplicate]

What is the best protocol for client-server communication? TLS or IPsec? I have a public channel where users communicate with each other using a digital certificate like X.509.
7
votes
2answers
296 views

Should a wildcard ssl certificate be shared with a different organization hosting a subdomain?

We are hosting our own secure site with a wildcard certificate. However, we are working with a marketing company that provides landing pages on subdomains of our domain, on ip addresses supplied by ...
0
votes
2answers
113 views

Where are certificates used to prove identity and why aren't DNS responsible for the job?

I've been reading about how certificates are used to verify the owner of a public key in asymmetric encryption. Right now everything seems really theoretical to me and I'd like to know how this works ...
2
votes
1answer
402 views

Why is google's site identity icon a red lock?

Why does google.com have this icon (see picture) for me? What does it mean? Screenshot: Google.com. There are two lock icons. The top one is RED and the bottom one is green. Screenshot: Google.se. ...
1
vote
1answer
91 views

TLS 1.2 mutual authentication certificate based standard

I'm running an analysis on a TLS1.2 mutual authentication certificate-based client-server implementation and I'm wondering if there's a RFC or a reference document covering the handshake process when ...
1
vote
0answers
41 views

Verify request using the X509 certificate [closed]

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML. BinarySecurityToken (X509PKIPathv1 certificate) ...
-2
votes
1answer
205 views

How to dnsspoof against HTTPS

I am doing a dnsspoof PoC, but apparently it doesn't work with HTTPS because of the certificate. Please don't tell me that I have to generate a certificate or send a legitimate certificate, I want ...
3
votes
1answer
56 views

Best practice to verify data against a CA

Let's say that I have signed my public key with a trusted CA and the CA provided my with a signed certificate, and I want any client applications to verify against this certificate. The general ...
1
vote
2answers
141 views

Will a wildcard SSL work properly for an A record subdomain pointing to another domain/website?

Client has wildcard SSL for his domain/subdomains. The application we are building is on one of our linux servers using one of our IP addresses and is contained within an account named ...