A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

2
votes
0answers
8 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
1
vote
1answer
53 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
1
vote
1answer
568 views

Forcing EAP-TLS 1.2 authentication with FreeRadius and OpenSSL

Been working with TLS DHECE certificate based handshake with a FreeRADIUS server and WPA_supplicant - both running OpenSSL 1.0.1j FIPS. Afer watching the Wireshark traffic, I notice that the client ...
2
votes
0answers
31 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time ...
-4
votes
0answers
17 views

With regards to performance, which one is better CMPV2 or SCEP? [on hold]

Which one is better SCEP or CMPV2? And how to measure the performance of these protocols.
2
votes
0answers
15 views

Can I use different certifcates for www and Exchange? [migrated]

I have a website www.domainname.com and a published Exchange address of webmail.domainname.com The website is hosted offsite and the Exchange server is on-premises. I need extended validation for the ...
1
vote
1answer
34 views

Create PKCS7 signature, signed by X.509 CA, which embeds an XML file

I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within. How to do that with OpenSSL or any other tool?
0
votes
0answers
18 views

Extract the content of PKCS7 file in Java

I have a PKCS#7 signature that have the content‐type signed data and it embeds an XML document, and I have to extract the xml document from this PKCS7 file. Anyone know how to do that in java ??
2
votes
1answer
42 views

Squid SSL Bump - getting “unknown issuer” despite having certificate, do I need CA?

I am using pfSense on the gateway of my network. I configured Squid and enabled the HTTPS filtering. I created the internal CA and configured Squid to use this internal CA for SSL Bump. Now the ...
1
vote
2answers
193 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
0
votes
0answers
46 views

What is the cheapest kind of SSL cert I need for multiple sites on multiple servers? [duplicate]

Quick SSL question What is the cheapest kind of ssl cert I need? I have two servers, one windows vps with a static IP and another linux reseller with 2 domains attached and a shared IP. Ideally ...
1
vote
0answers
40 views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
2
votes
2answers
78 views

Why is it fine for Certificates above the end-entity certificate to be SHA1 based?

I have heard about the phasing out of Sha1 based certificates for end entity use, and the steps that are outlined for chrome to display progressively more aggressive warnings for Sha1 certs not ...
1
vote
3answers
1k views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
0
votes
1answer
42 views

sftp first connection before exchange cert

If a client connects for the first time to a server via SFTP, the first connection before receiving the server certificate is transmitted in the clear?Let me explain: it is assumed that the client ...
0
votes
2answers
265 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
3
votes
4answers
658 views

SSL is Extended Validation more secure?

Talking about SSL certificates, there are 3 types. Basic validation Business validation Extended Validation The first one checks only if a domain name is registered for the user which ...
1
vote
0answers
48 views

JSEncrypt encrypt on client and decrypt on server [migrated]

I am using JSEncrypt to encrypt user's password on the client and send to server to decrypt. I get the public key from the server which I build the RSA Key on the client with Javascript: var leafCert ...
1
vote
2answers
4k views

Unrecognized leaf certificate

Every 15 minutes or so I get this message in my system.log Apr 25 22:05:36 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate Apr 25 22:20:57 Ivans-MacBook-Pro.local apsd[194]: ...
1
vote
2answers
44 views

Can an embedded CRL be trusted?

Embedding CRLs in a signed document will allow the signature to be validated "long term", by providing a snapshot of the signer's state the moment the document was signed. Im wondering if these ...
1
vote
3answers
2k views

SSL interception with Burp Suite using Firefox - Strange behavior when intercepting twitter

I am learning Burp Suite(Free Edition v1.6). I have set it up with the default settings. The proxy listener is listening to 127.0.0.1 on port 8080 and Certificate option is set to 'Generate CA-signed ...
0
votes
1answer
184 views

Certificate request - why does the requester have to create a private key?

If remember right, then before I send a CSR (Certificate signing request) to the CA, I have to create private and public keys. Then I use the public key to encrypt my personal details before I send ...
0
votes
2answers
102 views

Authenticating Hotmail's certificate and connection security

I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or ...
3
votes
1answer
38 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...
0
votes
1answer
235 views

How to generate self-signed EV SSL Certificate?

I configured XAMPP / Windows on my laptop so that this URL: https://www.supersite.com/ points to XAMPP / localhost rather look elsewhere. I basically generated a self-signing certificate, imported ...
21
votes
3answers
11k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
49
votes
2answers
3k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
2
votes
5answers
2k views

Provide subjectAltName to openssl directly on command line

Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line? I know it's possible via a openssl.cnf file but that's not really elegant for ...
1
vote
1answer
37 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
0
votes
2answers
34 views

TLS Certificate domain-expectation

If I request the Cert from example.com and the server answers with the (legit) certificate from notexample.com, will the browser throw an error?
0
votes
3answers
199 views

What can i do to trust less on CA's?

I never trusted and liked CA's and in fact i remove a lot of them from my devices...but now after this question i'm wondering if i should generate my own certificates for the sites i care(e.g like my ...
2
votes
3answers
33 views

PKI usage in a cluster; per application instance or per application?

I'm having a cluster with nodes (let's call them A and B for the sake of example) running identical micro services (1, 2 and 3 - so the application 2 running on node A is called A2). The applications ...
0
votes
0answers
11 views

error code -207 during import of certificate using GnuTLS [migrated]

I try to import a certificate, to process it in my C++ code. What am I doing wrong? Here are the steps I perform in my code: I initiate with gnutls_global_init() I get a FILE-type opject into my ...
3
votes
5answers
6k views

Two-factor authentication w/certificate and username & password?

Example scenario: ActiveSync Authentication method: certificate-based authentication AND Active Directory domain username-password Encrypted on device: public & private key AD username ...
1
vote
2answers
39 views

Is there a PKCS certificate format that signs ASCII data?

Is there a PKCS #x already out there that was designed to sign ASCII data and protect it from manipulation? I was originally guided to PKCS #7, but based on posts here it looks like the data is not ...
0
votes
2answers
38 views

Sniffing TLS / SSL through HSTS?

Imagine the following: Client C wants to communicate with server S. The evil attacker A is the Man-In-The-Middle. C sends a request to S, A intercepts it. A creates a self-signed certificate with ...
0
votes
0answers
31 views

Update certificate in Outlook contacts [migrated]

How can I update an encryption security in Outlook contacts? I got an email signed with an updated certificate by someone who is already in my contacts with an expired certificate. If I REPLY to ...
11
votes
6answers
2k views

Can Javascript/Flash verify the SSL connection to prevent “SSL Inspection”?

I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy. So some people may ask What is the point of re-validating SSL using javascript? ...
15
votes
4answers
4k views

Why can SSL certificates not be free of charge?

I am a newbie in this field. I am confused with why SSL certificates cannot be free of charge. In my understanding the certificate is just a text file consisting of cryptic numbers installed on a ...
0
votes
1answer
296 views

Can I create an SSL certificate on windows signed with the machine's certificate?

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a ...
2
votes
1answer
1k views

ADFS: Verify requests from relying party

In ADFS, serveral certificates are used. This is explained (very clearly) on this page: ...
4
votes
1answer
70 views

distributing SSL certificates?

I'm only familiar with SSL certificates in a simple-use case: I've installed them to websites, Windows servers, and a few Linux servers. I'm now faced with the task of securing every possible device ...
3
votes
0answers
64 views

TLS connection to untrusted server - client reaction for dropping connection standardized?

I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
5
votes
2answers
316 views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
1
vote
0answers
35 views

How get X509 certificate's full cert chain programatically? [migrated]

Imagine I have p12 container of private key and public certificate. When I export p12 public cert to separate .cer file with Java keytool I may click to .cer file and see full cert chain. How may I ...
2
votes
1answer
55 views

Identicon for SSL certificate

I have a few self-signed certificates that I use, and I find it tedious comparing the entire hex value of the hash when accepting it in a new location. To be honest I usually just look at the first ...
0
votes
1answer
46 views

Tomcat Client authentication

I want to make sure that my webapp is secured: I have a tomcat server - and defined the connector to use clientAuth="true". In my trust store there is only the certificate of my CA (self signed). ...
0
votes
1answer
78 views

Faking and injecting cryptographic certificates

Suppose as an attacker I provide a fake certificate to a user.A warning pops up on her window but she decides to continue anyways.Is my fake certificate now added in her browser's trusted certificate ...
13
votes
2answers
721 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
1
vote
0answers
37 views

Delete certificate from user local store using script [migrated]

I manage to delete a certificate using a script with command : certutil -delstore -v -enterprise CA "Certificate CN" But unfortunately, it only works if this certificate was first added using the ...