A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.
1
vote
2answers
18 views
Change 'Key Usage' of a certificate
Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
172
votes
3answers
45k views
How does SSL work?
How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering.
I'd like to see details in terms of:
A high level description of the protocol.
...
0
votes
2answers
39 views
Force SSL/TLS client cert authentication even if server does not request it?
Usually the server specifies in the Server Hello message if a client certificate is needed/wanted.
Does anybody know if it is possible to perform an authentication via client cert if the server does ...
1
vote
1answer
25 views
Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA
I would like to ask if it is possible to use different CA for the client certificate and the web certificate?
For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
-3
votes
0answers
46 views
How to determine the sequence of ordering certificates by browser? [closed]
I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram:
----------
| ...
-4
votes
0answers
33 views
missing configuration in apache to achive mutual SSL authentcaion [closed]
After implementing a Mutual Certificate Authentication with OpenSSL and Apache Web Server on CentOS platform. I tried this scenario ( see this diagram ):
----------
...
4
votes
2answers
212 views
How do you verify a certificate belongs to a domain?
I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to.
Currently I can verify the certificate is valid using the following code
$resource = fsockopen( ...
1
vote
1answer
46 views
Certificate authentication with jQuery's ajax() function
I need to sync with my server with the client certificate abc.pfx which is generated by the server using Ajax. How do I send my certificate with Ajax object. Can I do this certificate authentication ...
-1
votes
1answer
67 views
Wireshark Decode HTTPS Root Certificate
I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
3
votes
1answer
75 views
What is the difference between Serial and Thumbprint
I have problems to understand what the difference between the Serial Number of a certificate and its SHA1 Hash is.
the MSDN says:
Serial number A number that uniquely identifies the ...
-1
votes
0answers
51 views
TLS Certificate in OSX Mail
My question hasn't been asked before here but when I googled for an answer I arrived at this thread @ macrumors.com. The question is quoted below:
I'm just curious, but in Lion's Mail there is a ...
3
votes
2answers
2k views
Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”
I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain.
...
7
votes
1answer
139 views
Does dnssec protect against malicious registrars?
With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).
This is especially ...
8
votes
1answer
215 views
Why can the validity of an SSL certificate exceed the registration period of a domain?
I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
10
votes
3answers
157 views
Domain name expiration and TLS
If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
1
vote
2answers
97 views
Secure cookies and Path Length Constraint
Using apache 2.2.3 on oracle enterprise linux.
When setting following setting in httpd.conf:
Header edit Set-Cookie ^(.*)$ $1;Secure ,
cookie generation (which happens on our registration page) ...
3
votes
1answer
75 views
How does an end user differentiate between OV and DV certificates?
This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
5
votes
5answers
152 views
A standard way to manually add a digital signature to a pdf file?
I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
2
votes
1answer
74 views
How does an offline CA revoke certificates?
If an RSA private key of a root CA is stored offline, how does it revoke certificates it signs?
From looking at OpenSSL config the default_crl_days option seems to indicate that a CRL must be ...
31
votes
3answers
3k views
Are all SSL Certificates equal?
After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against.
Are all SSL ...
3
votes
1answer
296 views
Apple Developer Account Hacked?
I just did a fresh install of Snow Leopard on a newly-formatted hard drive.
Logged into the iPhone Developer Page with Google Chrome (latest build) here:
...
1
vote
1answer
65 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
0
votes
1answer
64 views
Determine the Identity of Caller
Let me explain my situation.
I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
11
votes
4answers
2k views
What is certificate pinning?
I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
2
votes
1answer
40 views
Sending Digital Certificates
I used the makecert tool in order to create:
a self-signed certificate
a server certificate using the self-signed certificate
a client certificate using the self-signed certificate
I then ...
2
votes
1answer
61 views
Security Certificates - Tools to Generate Security Certificates
I want to create a self-signed certificate that will be installed as a trusted certificate authority.
I then want to create another two certificates which are signed using the private key of the ...
1
vote
1answer
83 views
The request was aborted: Could not create SSL/TLS secure channel Exception
Let me explain my situation.
I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC.
I then created two certificates using the self-signed ...
3
votes
1answer
72 views
Creation and deployment of self-signed certificates for a two-machine scenario
Let us assume that I have two computers:
client
server
Now, in the server computer, I set up a legacy ASMX web service which will going to be used by the client. Before the client can connect to ...
9
votes
2answers
6k views
Does https prevent man in the middle attacks by proxy server?
There is a desktop client A connecting to website W in a https connection
A --> W
Somehow between A and W, there is a proxy G.
A --> G --> W
In this case, will G be able to get the ...
8
votes
3answers
2k views
What are the risks of self signing a certificate for SSL
Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
20
votes
7answers
3k views
Where to get an SSL certificate for personal website?
I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
2
votes
0answers
72 views
How do I make or get computer certificates to use with IPSEC user authentication?
I am having trouble and need some direction using computer certificates with windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
2
votes
1answer
41 views
How does a function certificate work?
Say that we have a client / server solution (written in .NET). If we want to use a certificate for the TCP communication, is it enough to use one function/service certificate to encrypt communication ...
3
votes
3answers
204 views
Self signed certificates for https
Where I work, currently for internal sites, self signed certificates are being used.
In Firefox, the info regarding the certificate are displayed:
site domain: xxx.com
Owner: Site doesn't supply ...
1
vote
2answers
159 views
SSL: How to send generated client certificate from server to avoid MITM?
The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
85 views
Generate openSSL certificates from within C code using commands?
This is an openSSL command for generating a private key and a certificate,
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
The question I have is whether there is some ...
3
votes
1answer
296 views
What is the impact of certificate validation level (or class) on deployed web applications?
Certificates can have a class level (or validation level). What is the impact of these levels on deployed web applications?
More specifically:
Is the certificate level included in the certificate ...
4
votes
1answer
132 views
SSL Cert Types and Key Usage
I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
2
votes
0answers
74 views
SANS Forensic Course -worth it? [closed]
I'm a Security Student at Pennsylvania State University and I am considering taking FOR408 through SANS this summer in Pittsburgh (not far from my home). I really want this to help me stand out in my ...
2
votes
2answers
88 views
Looking for general guidance on securing web API application for client applications and users
I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.
After a lot of googling ...
4
votes
2answers
71 views
Using SSL Certification in Multiple Locations
I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access.
The ...
6
votes
4answers
3k views
What certificates are needed for multi-level subdomains?
I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy.
Here's what I need to secure:
...
2
votes
1answer
80 views
How do I diagnose client-side SSL errors?
Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
4
votes
1answer
2k views
What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?
What root certificates are/are not updated when the following checkbox is checked?
Additional questions
If I manually remove a root certificate, will this service replace that very certificate?
...
6
votes
2answers
151 views
Limiting the root certificate chain
I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
1
vote
4answers
99 views
certificate usage for signing and encryption
I have a question for basic operating with certificates in emails and pdfs. Im familiar with public key cryptography.
The scenario:
In my scenario I want to send a confidential email to a person A ...
1
vote
1answer
75 views
Can I use any ssl certificate to sign and encrypt AS2 message?
I'm absolutely new to this topic of ssl certificates, so please be patient with me.
My task is to install an AS2 communication with some business partner. Therefore we need message signing and ...
1
vote
1answer
76 views
x509: must the signature algorithm and public key algorithm match?
I'm having trouble getting Firefox to send an encrypted message using a certificate, and I've found that the only difference between this one and others that work fine are that this one has a DSA ...
2
votes
1answer
87 views
Would introducing client certificates for a mobile app improve security?
I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...
2
votes
1answer
139 views
ECDHE_RSA and gmail
I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange.
Based on my understanding of TLS and Gmail, my client ...
