A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
2answers
18 views

Conflict between cipher-suite and certificate

When capturing my ssl session (using Chrome) I have noticed that the server chose TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) as the cipher-suite and the certificate signedcertificate signature ...
2
votes
0answers
25 views

Creating SSL certificate signed by a self-signed CA certificate in Jetty [migrated]

I'm trying to configure a jetty-distribution-9.3.1.v20150714 backend running on Java 1.8.0_45-b14 with a certificate signed by a self-signed CA certificate, for SSL pinning. Following Apple's guide, ...
0
votes
0answers
9 views

How to verify Signature Value using cert file in C#? [migrated]

I am noob in security sorry for that. I have an xml file which include, <?xml version="1.0" encoding="UTF-8" standalone="no"?> <ID_VG_Response> <Result> ...
3
votes
1answer
59 views

Browsers root CA accepted, countries and checking fingerprints

This is a question derived from several others, and I can not comment on those, so it is not duplicated, please read: In some related questions some users comment that: "They wouldn't ...
1
vote
2answers
36 views

What exactly is IE / Chrome checking when I view the “certification path” tab on cert connection details?

When I bring up certificate details for a web page in IE or Chrome, I have the option to view the certificate hierarchy (under a tab called "Certification Path"). Here's an example for ...
22
votes
5answers
2k views

What prevents a man in the middle from requesting a certificate for your server?

Let's say you have a server at shop.example.com and you are requesting a certificate from some trusted CA like Comodo (they say they'll issue it within few minutes online). First of all, how can ...
0
votes
2answers
48 views

How to identify which root CA does the client certificate use?

How can we identify which root CA client used when there are multiple root CAs on the server? We can compare the public keys of the client certificate and the root certificate but if we have many ...
0
votes
1answer
31 views

Is there an official standard and/or name for PEM certificate bundles?

This is a question that's not really about security proper. It's about security/crypto nomenclature. It's been bugging me a bit, so here goes: I know two approaches for bundling related ...
3
votes
2answers
67 views

Internet Explorer - Advanced Properties for Trusted Root Certificates

If you go to IE -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities. Now Click on some CA certificates and click on Advanced You can add properties to the ...
2
votes
2answers
147 views

Should I update my SHA-1 certificates? If so, how?

Q: Should I update my SHA-1 certificates? If so, how? Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been ...
4
votes
1answer
198 views

Why does COMODO have 5 root certificates on a new Apple laptop?

Why does Apple include 5 COMODO root certs in OS X? There's "AddTrust {Class 1, External, Public, Qualified} CA Root" and also "COMODO Root Certificate". Why isn't one enough, if it's owned by a ...
1
vote
2answers
122 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: I have been researching how trusted root authorities (such as GlobalSign or Verisign) are used ...
3
votes
0answers
66 views

How should certificates be shared between a proxy and a frontend?

At work, I've been asked to look into creating a reference topology for a WebSocket chat application, which includes a proxy between the web-facing frontend server and the backend. At the moment, I am ...
-3
votes
1answer
29 views

A collection of tests and demos for security headers and TLS configurations [closed]

There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/) I want to build a ...
2
votes
2answers
224 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
1
vote
2answers
131 views

Can an individual get an extended validation certificate?

I am not saying I am actually going to buy one but I am wondering if an individual can get an Extended Validation SSL certificate? I know this is intended for companies / organisations but would this ...
0
votes
2answers
66 views

Unable to “trust” self-signed certificate

I am currently running a setup that interfaces with many appliances running HTTP servers (running on Windows Embedded). The connections I use are HTTPS connections. My problem is, every time I open ...
506
votes
3answers
254k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the ...
5
votes
2answers
773 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
8
votes
4answers
520 views

What Country, State and City should I choose when requesting an SSL certificate?

I am really confused about the country, state and city I should select when submitting an SSL certificate. Should I provide the location of my servers or my current home address?I can always reissue a ...
0
votes
2answers
324 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
2
votes
0answers
25 views

Get RSA private key and certificate from GlobalSign certificate [migrated]

I can generate my own private key and certificate as follows: openssl genrsa -out privatekey.pem 2048 openssl req -new -x509 -key privatekey.pem -out g4certificate.pem -days 1095 Copy+pasting the ...
3
votes
2answers
41 views

Using Different Algorithms in Single PKI

Assume the following Public Key Infrastructure: |Root CA (RSA) |-Sub CA (RSA) |-Sub CA (ECC) Is there any rational that explains why this would not be an acceptable implementation? Is the ...
1
vote
3answers
1k views

“A third party is capable of monitoring your network activity” with [imported] certificates?

I installed the CAcert root certificates on my Android device (which is not rooted), so that I could visit websites with server CAcert certificates without getting the "certificate not trusted" ...
7
votes
1answer
58 views

“Manually” verify a certificate

I want to 'manually' verify a certificate and the first step in doing so, I accessed paypal.com and obtained the following RSA modulus and signature value. modulus = ...
1
vote
1answer
51 views

What are these two certificates I need to install - external CA root certificate

I have to install 2 certificates on a computer and I am a little puzzled by the certificates. The first certificate has these details: Issuer: CN = AddTrust External CA Root OU = AddTrust External ...
2
votes
0answers
24 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
27
votes
2answers
3k views

Is it safe to send SSL certificates via email?

I just ordered a cheap Comodo PositiveSSL Certificate via a UK reseller, and I was rather surprised to find that the following files were emailed to me automatically, in a zip file: Root CA ...
0
votes
3answers
253 views

What can I do to rely less on certificate authorities?

I never trusted and liked CA's and in fact I removed a lot of them from my devices. But now after this question I'm wondering if I should generate my own certificates for the sites I care (e.g, like ...
6
votes
1answer
74 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...
3
votes
2answers
6k views

Is it technically possible to configure two different SSL certificates for the same domain?

Say I have these URLs: https://example.org/ https://example.org/criticalpath I want the first one to be served with a domain validated commercial SSL certificate and the second one with an ...
2
votes
2answers
68 views

OpenSSL x509: Is there an order in subjectName fields?

Is there an order to respect in subjectName field when creating a x509 certificate with OpenSSL command? In other words, what are all possibilities of displaying subjectName of x509 certificate in ...
2
votes
4answers
138 views

SSL encryption process and its security

I know the basics of SSL encryption and how certificates work, but there are some points that are not clear to me regarding the SSL security: If there is a intercepting proxy between the web server ...
5
votes
2answers
82 views

How do I prepare for Certificate Authority end of business?

We are deploying a security solution which uses certificates to validate documents. These certificates are issued by our government-authorized CA. What if in a distant future, the CA who provided us ...
1
vote
1answer
76 views

Should self signed wildcard certs be used?

I think this is more urban legend around where I work than anything. I do not see anything in RFC 2459 that specifically says whether or not they should be used or if there are any known problems with ...
4
votes
1answer
142 views
91
votes
5answers
64k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
4
votes
4answers
471 views

Why are there very expensive and cheap SSL same type certificates? [duplicate]

I am about to launch an online shopping site (currently running http) and I was thinking heavily of moving to SSL which includes a green bar, because this is very important. However, when I first ...
2
votes
3answers
40 views

PKI usage in a cluster; per application instance or per application?

I'm having a cluster with nodes (let's call them A and B for the sake of example) running identical micro services (1, 2 and 3 - so the application 2 running on node A is called A2). The applications ...
5
votes
2answers
59 views

Understanding digitial certifications

q1) Does that mean that every time information is exchanged, both the original data + digital certification is sent? Meaning data + signature for each and every exchange. q2) Can any kind soul here ...
7
votes
1answer
228 views

How does the OpenSSL Alternative chains certificate forgery (CVE-2015-1793) attack work?

The security advisory for the issue can be found here: https://www.openssl.org/news/secadv_20150709.txt OpenSSL Security Advisory [9 Jul 2015] Alternative chains certificate forgery ...
5
votes
1answer
241 views

Is my ISP trying to impersonate google?

Everything has been well for years and today I wake up with this: A warning on EM Client (also got the same on my iPhone) that the certificate for googleapis.com isn't valid. And the certificate ...
2
votes
3answers
275 views

How does a CA send a digital certificate?

I would like to know after approving the Certificate signing request, does the Certificate Authority send the Digital certificate to the applicant by converting the digital certificate to PEM format ...
6
votes
2answers
76 views

Issuing certificates to two departments from same ROOT CA so one does not trust the other

Scenario: We have two departments within IT; Say Department-OLD and Department-NEW. A single internal PKI environment exists and a root CA (singular) is trusted by All endpoints. Problem: ...
3
votes
1answer
1k views

ADFS: Verify requests from relying party

In ADFS, serveral certificates are used. This is explained (very clearly) on this page: ...
0
votes
0answers
34 views

Implications of IP Address as Subject Alt Name in certificates

Are there specific known negative security implications of including the IP address of a server as a Subject Alternate Name in the server's certificate?
2
votes
1answer
48 views

Is it possible to use obtained wildcard certificate on more than one server?

We are using two Debian servers in our company (with apache 2 as httpd) and our services are split between those two of them. One server has the website, the other has some minor sites under ...
2
votes
1answer
62 views

Extract the content of PKCS7 file in Java

I have a PKCS#7 signature that have the content‐type signed data and it embeds an XML document, and I have to extract the xml document from this PKCS7 file. Anyone know how to do that in java ??
3
votes
1answer
163 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' browsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
0
votes
0answers
19 views

What are null certificates in Gnome Seahorse? [migrated]

In the "Default Trust" tab in Seahorse there are several personal certificates named simply "(null)", which are issued by "No name". There's nothing on their property pages. What are these? Can they ...