A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

1
vote
2answers
106 views

Should every SAML identity provider provide a unique public certificate to the service provider?

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
1
vote
2answers
82 views

Certificate authorities: history and registration

CA's are a key part of the internet's infrastructure few people are aware of. SSL was mostly hacked together at Netscape in 1995. I'd like to understand more about the organizational structure of CA's ...
0
votes
2answers
77 views

How does Matrix SSL perform certificate validation?

We use a custom app which uses Matrix SSL (client side) to perform certificate validation on MAC and Linux systems. My question is, does Matrix SSL keep a cert store cache of intermediate and trusted ...
0
votes
2answers
71 views

PKI certificate validation graphs, trees and cross signing

I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it ...
5
votes
1answer
158 views

Where are the anonymous/private domain validation SSL certs?

I have yet to find a CA that doesn't require personal information for DV certificates. Is this because all of the major browsers and operating systems have a policy to reject CAs that don't require ...
3
votes
1answer
116 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
2
votes
1answer
278 views

Is keystore file(server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I did to generate .p7b file. I generated jks(java keystore) file using below ...
1
vote
1answer
167 views

ADFS: Verify requests from relying party

In ADFS, serveral certificates are used. This is explained (very clearly) on this page: ...
-1
votes
1answer
24 views

How do server know the CSR sender is approved client?

Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The prblem is anyone can POST a CSR to the server and then ...
-1
votes
1answer
89 views

VPN security/compromise

I want to get a VPN with one of the known providers. I don't know much about VPNs but I know they issue certificates which you download and it authenticates the connection and basically gives access. ...
-1
votes
1answer
119 views

generating extensions request in a PKCS#10 request using C# and CertENrollLib

I have to add extensions to a certificate request ( CSR ) in such a way that I respect a given structure. Namely this one On the left is the structure I must respect for the chalenge password, on the ...
-1
votes
1answer
104 views

How does SSL client authentication work?

I read the RFC document, it mentioned that there are some kinds of client certificate type. So I don't understand what does this type mean. For a instance, one type named rsa_fixed_ecdh, it said, the ...
1
vote
0answers
23 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
1
vote
0answers
32 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
1
vote
0answers
40 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: ...
1
vote
0answers
18 views

Email, Certificates and DANE

Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is jd@foo.com but mail.bar.com is the email server, ...
1
vote
0answers
79 views

Are any major websites offering ECDSA authentication?

At the time the Cloudflare blog post “ECDSA: The digital signature algorithm of a better internet” was authored, Cloudflare was apparently one of "fewer than fifty" users of ECDSA certificates on the ...
1
vote
0answers
73 views

Reverse proxy and corporate PKI

Here at OU=PKI we've been requested to issue a certificate with CA capabilities to install it in our reverse proxy, so that it could issue trustable certificates for every single web. (SSL ending) ...
1
vote
0answers
417 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
0answers
30 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
1
vote
0answers
56 views

Deploying software that requires X.509 certificates

I have a self-hosted WCF application, with a server application running on the server (obviously) and a client application that will be installed on the users PC. Up until this point I have been ...
1
vote
0answers
46 views

Does Active Directory Certificate Services support Card Verifiable Certificates?

Does Active Directory Certificate Services support accepting requests for, and generation of, Card Verifiable Certificates (TR-03110)? If so, in which version of Windows Server was the functionality ...
1
vote
0answers
152 views

“Keyset does not exist” when using SignData function with RSA

"Keyset does not exist". I know that there are tons of question about this error, but mine is totally different. I'm not gona use the key from windows certificate store, but load the public key & ...
1
vote
0answers
52 views

Cetificate Pinning. How do we handle the situation where a website is visited for the first time?

What I essentially mean to ask is, how is the scenario where a user who visits a website for the first time (the certificate for the website is not pinned in the browser) handled ? Additionally how is ...
1
vote
0answers
101 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
1
vote
0answers
441 views

Safe communication via rest api between two known servers

i would like to have some advice on the following scenario: I'm using kinvey as backend but because it doesn't provide the ability to run custom code i have set up another server. So basically when x ...
0
votes
0answers
29 views

Do iOS applications have access to the certificates installed?

As the title says, I'm curious if a generic iOS application can access/retrieve the certificates installed in the device (e.g., via a management profile) Thanks
0
votes
0answers
28 views

Attack Vector for Wildcard Cert

So I am looking to the security risks of WildCard Certs, in a previous post most of the questions were answered however I have one follow up question for that. In my instance I use DigiCert, so ...
0
votes
0answers
28 views

What certificate attributes can I check to verify if an issuer is correct?

Apologies if this is a duplicate question. I thought I saw this discussed earlier but couldn't find the thread when searching. What attribute can I check to verify if I have the correct ...
0
votes
0answers
18 views

Is there any way possible that a Digital certificate is issued by admin on wireless channel?

I want that an admin who is working in a wireless environment have to issue digital certificate to the node, who wants to register itself with the network. this certificate will be used by user to ...
0
votes
0answers
17 views

Installer digital signature timestamp inconsistency

I just noticed that the digital signature on an old installer EXE is expired (it's LibreOffice from May 2013, and I'm pretty sure it was valid when I installed it). Investigating further, the time ...
0
votes
0answers
20 views

Certificate Errors on Network and Desktop Icons Freeze

What causes a screen on all devices on the same network to temporarily lock up and display certificate errors? After accessing Facebook; I have received a certificate error on both the student laptop ...
0
votes
0answers
47 views

Problems implementing Authority Information Access in a certificate

I am implementing SSL certificates for internal use in an application. Due to the nature of this app, I'm basically implementing my own CA. I have created a self-signed cert for the CA to issue ...
0
votes
0answers
63 views

Is a android app signing certificate unique?

The Certificates that are used to sign Android applications are generated by the user and not checked or signed by any authority. They are RSA or DSA Certificates and as i read on ...
0
votes
0answers
76 views

Openssl command line: How to get “Policy: X509v3 Any Policy” in a certificate I am generating through openssl

I am trying to generate a certificate through openssl which has the following line X509v3 Certificate Policies: Policy: X509v3 Any Policy But I end up getting X509v3 Certificate Policies: ...
0
votes
0answers
17 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
0
votes
0answers
36 views

How to gather/verify certificate data with limited information (Issuer, Serial, CN)

I asked this question in the "programming" section, Here. However it may be a simple answer for someone familiar with the security of certificates. The basic premise is I have a large table with ...
0
votes
0answers
38 views

Changing the string format of Burp generated certificates

The certificate verification in a piece of software I'm poking uses UTF-8 encoded strings to verify the certificate's host name. Certificates generated by Burp suite, however, use the custom type ...
0
votes
0answers
121 views

Does Mac OS X 10.8+ support self-signed Package Installer

I'm not sure whether self-signed Package Installer are supported by Mac OS X 10.8+ Using informations in How to create an Apple Installer Package Signing Certificate I could create a Package ...
-1
votes
0answers
27 views

how to intercept SSL and enter outlook.com or gmail.com after confirmed with mobile phone

after configure config t interface FastEthernet0/21 no monitor session 2 monitor session 2 source interface FastEthernet0/21 monitor session 2 filter vlan 10 monitor session 2 destination interface ...