A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

4
votes
3answers
630 views

How do you verify a certificate belongs to a domain?

I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to. Currently I can verify the certificate is valid using the following code $resource = fsockopen( ...
4
votes
3answers
252 views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
4
votes
2answers
207 views

How to verify certificate with very little information

Lets assume there is a server and a client and you want to connect those two. Server has a self-signed certificate, and prior to establishing the connection for the first time (enrollment) the server ...
4
votes
2answers
217 views

Are Windows Updates susceptible to tampering, eg. using a MiTM attack.

My real question is how are patches and updates authenticated in general. But for example how does windows know a windows update is really a windows update, does it just trust the URL or is there some ...
4
votes
3answers
1k views

What does it mean for a digital certificate to be “signed”?

When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
4
votes
2answers
995 views

Is it okay to just secure (using SSL) the login page, but not the rest of the site? [duplicate]

Possible Duplicate: What are the pros and cons of site wide SSL (https)? I'm creating a custom PHP/MySQL CMS for a client (because Wordpress is overkill for this client's particular needs). ...
4
votes
1answer
439 views

Is possible that a TLS server send more than one certificate to the client for the same site?

What I'm trying to archive is enable ECDSA and DSS ciphers in my site, but at the same time not depend just of self signed certificates, so I could sent to my client more than one certificate and them ...
4
votes
2answers
167 views

Can the client certificate authentication process treated as a user digitally signed the content(and then get verified on the server)?

The authentication was triggered by certain event (like approving button) on the form. In the process of client certificate authentication (in IIS), user was asked to use their PIN (private key) and ...
4
votes
3answers
7k views

Is it possible to use wildcard certificates on multiple devices?

I have a server that I want to use a wildcard cert on. It runs multiple services. I purchase a wildcard cert so that I can protect mail.something.dom, www.something.dom, im.something.dom, ...
4
votes
1answer
153 views

How powerful are top Verisign executives?

I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a ...
4
votes
2answers
500 views

Does Authenticode still work offline and with a “fake” certificate

Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
4
votes
2answers
389 views

What is the severity of a fake certificate?

I'm not a security specialist, thus reading this Google Blog post about a fake *.google.com certificate, raises a lot of concerns, if anyone can impersonate a website, especially a google website, my ...
4
votes
2answers
169 views

What is the state of the Windows Update certificate after Flame?

May 28, The Flame malware is discovered in Iran and by Kaspersky Labs. June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
4
votes
3answers
605 views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
4
votes
3answers
221 views

From a trust perspective, is renewing a CA certificate the same as trusting a sub-CA?

I'm trying to understand the validation logic that would occur in the following hypothetical scenario An unpatched XP user who trusts a list of root CAs. Those CAs in particular have been renewed ...
4
votes
1answer
217 views

How would you know a certificate/private key if you extracted it from RAM? Or would you?

Related to, of course, the heartbleed vulnerability, I've been reading the news about the worst case scenario for this attack being the extraction of the SSL private key, because, of course, this ...
4
votes
1answer
105 views

Public keys without the certificates

There are two clients and a server. Each client generates an RSA key pair and uploads public key to the server. The server associates the public key with the user identifier that is specified during ...
4
votes
2answers
624 views

How practical is a certificate's “basic constraint” property in protecting my HTTPS / SSL session?

Suppose a leaf node creates a certificate for a different domain, acting as a CA. Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be ...
4
votes
3answers
323 views

Protecting the Java keystore with a weak password, what's the risk?

From my understanding, the Java keystore contains certificate information, but this information is public (i.e. other machine certificates which you want the local machine to trust). Is there ...
4
votes
1answer
228 views

Certificate Revocation List

There are many fields on a certificate revocation list (CRL) like Algorithm, Parameters, Issuer Name, This update date, Next update date, user certificate serial #, etc. While I understand the purpose ...
4
votes
1answer
626 views

Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA

I would like to ask if it is possible to use different CA for the client certificate and the web certificate? For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
4
votes
1answer
138 views

How to secure a certificate internally

Say I have a certificate which I use to sign the software I ship. This happens in the (daily or more) build on the buildserver (Windows machine). Easiest solution would be to put the certificate file ...
4
votes
2answers
872 views

What did the certificate authority do with my CSR?

I needed to reach a web service which is not mine. The IT department of that web service has asked me to send them a CSR (certificate signing request). Then, he will send me back a signed certificate ...
4
votes
2answers
604 views

What are the real-time applications of long term digital signature with timestamp

I want to know the real time applications that uses digital signatures with timestamps. Specially I am interested to know the applications where we can trust an old signed document which is now ...
4
votes
2answers
876 views

How long shall a certificate be valid?

See title. Are there any sources where there are recommended validity times of certificates (based on length, algo, etc)? I'm particularly interested in validity of RSA certificates...
4
votes
1answer
2k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
4
votes
3answers
674 views

Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]

Recently while trying to log-in to Facebook this notification starts to appear: At first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website! I ...
4
votes
1answer
2k views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is ...
4
votes
1answer
225 views

How is an Authenticode timestamp verified?

For an Authenticode signed file to be verifiable by Windows after the original signing certificate has expired (typically 1-3 years after issue), the file also needs to have a cryptographically signed ...
4
votes
2answers
652 views

Single domain SSL certificates, actually support 2 subdomains?

While browsing for SSL certificates, specifically domain validation type (the cheapest), I noticed that they advertise as valid for a single domain/subdomain, but then I noticed that they are valid ...
4
votes
3answers
571 views

Why are SSL certificates valid only from a certain date?

Each SSL certificate is valid starting from a specific date and up to the expiration date. What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
4
votes
2answers
2k views

Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?

Suppose I have several independent PKIs that are used Two internal PKIs: One with SHA1 support the other with Suite B algorithms. A partner who I trust and have a policy map with. Since both my ...
4
votes
3answers
399 views

Does the following data stream look secure to you?

I understand the basic concept of SSL but maybe I am missing the point. Please could someone take a look at the following part of a test log to a server and tell me if it looks secure. My concerns are ...
4
votes
2answers
215 views

TLS server key: possible to sign another TLS server key?

If I have a valid (verifiable) certificate C_K_s that links the server key K_s to "www.example.com", is it possible to : use K_s to sign K_d, and let S_K_d be this signature use K_d as the TLS ...
4
votes
1answer
1k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...
4
votes
1answer
874 views

How secure is TOTP key on phones?

Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
4
votes
2answers
698 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
4
votes
1answer
612 views

What is the impact of certificate validation level (or class) on deployed web applications?

Certificates can have a class level (or validation level). What is the impact of these levels on deployed web applications? More specifically: Is the certificate level included in the certificate ...
4
votes
1answer
287 views

Cellphones IMEI public exposed?

Currently I'm in the middle of a developement process, and I have some security questions for you. I have a webservice, asp.net which is configured to run over https. The first authentication step for ...
4
votes
1answer
2k views

Which extensions to use for a S/MIME certificate?

Analogously to the SSL server certificate question, which extensions should I use for S/MIME, and should the CA be restricted somehow as well? (I'm using openssl, which at the moment creates CA and ...
4
votes
2answers
3k views

Extensions for SSL server certificate

I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
4
votes
1answer
76 views

Standards for CA cert revocation and time-constrained cryptographic algorithm parameters

I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
4
votes
2answers
739 views

Is it possible to modify a CA without having to reissue all of the derived certificates?

Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I ...
4
votes
4answers
770 views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
4
votes
2answers
915 views

Is DIGEST-MD5 secure if done over HTTPS?

If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?: Digest access authentication is intended as a security ...
4
votes
1answer
827 views

X.509 algorithm identifier parameters vs. extension values

From the X.509 specs: AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } ...
4
votes
1answer
279 views

How secure is a https website? [duplicate]

Possible Duplicate: Does an established ssl connection mean a line is really secure When I visit a website -- say, https://ebanking.pick-your-bank.com -- my browser (fully patched version ...
4
votes
1answer
106 views

Are there any public examples of an encrypted attribute in a Verisign-issued certificate?

This Credentica- UProve paper describes how Verisign issues (or did issue in the past) certs with encrypted attributes: "VeriSign issues certificates that contain encrypted attributes that can be ...
4
votes
2answers
99 views

Using SSL Certification in Multiple Locations

I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access. The ...
4
votes
1answer
841 views

Would introducing client certificates for a mobile app improve security?

I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...