A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

3
votes
0answers
72 views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...
3
votes
0answers
265 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect ...
3
votes
0answers
47 views

Certificate and Path validation for S/MIME

I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My ...
3
votes
0answers
71 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time ...
2
votes
0answers
38 views

How to enable self signed certificates in Windows 10?

I want to use a Yubikey 4 with Windows 10 Pro for Bitlocker and login with my TPM. Unfortunately, I found out I need to enable self signed certificates and all the guides on the Internet I found were ...
2
votes
0answers
26 views

Finding the EMSA-PKCS1-v1_5 DigestAlgorithm field in the x509 certificate

From the RFC - https://www.ietf.org/rfc/rfc3447.txt A.2.4 RSASSA-PKCS1-v1_5 For each OID, the parameters field associated with this OID in a value of type AlgorithmIdentifier shall have a value ...
2
votes
0answers
79 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
2
votes
0answers
50 views

Windows IIS Event/Security Log ID of Private Key deletion of corresponding TLS certificate?

I'm in the middle of writing an MS Active Directory Certificate Services Key Management Lifecycle document for my organization. The primary purpose certificates will serve for this organization is to ...
2
votes
0answers
71 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
2
votes
0answers
73 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
2
votes
0answers
98 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
2
votes
0answers
908 views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
1
vote
0answers
36 views

OCSP recording with JMeter

How can I record an application which is using OCSP security with the help of JMeter? I am not able to record the application i.e. a native app with the help of JMeter as it is using OCSP protocol ...
1
vote
0answers
28 views

How to provide our customers ability to self service client certificate creation?

We have an API for B2B customers to access our platform. We require each B2B customer to have a client certificate. This is not the URL SSL certificate (https). The CN of each customer's client ...
1
vote
0answers
37 views

What comes into calculation of certificate signature?

I have written my own code with openssl in order to create certificates. In order to verify this code, I tried to reconstruct an openssl commandline generated self-signed certificate ... openssl req ...
1
vote
0answers
67 views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
1
vote
0answers
42 views

How Do I Create a Production Client Authentication Certificate for Azure Key Vault?

I am learning about Azure Key Vault, and one of the scenarios it supports is certificate authentication, which you can read about here. The samples do a great job of explaining how to make a ...
1
vote
0answers
51 views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...
1
vote
0answers
32 views

Problem using custom CryptoNG KSP on IE 11

We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for ...
1
vote
0answers
53 views

Theory behind certificate for job account

I made it work a job account protected by a certificate in a java spring application but is not that clear to me the minimal steps.(Could you believe that :) I need some theory. Here my steps: ...
1
vote
0answers
271 views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: ...
1
vote
0answers
136 views

How to generate “CRL numbers” for X.509 CRL

(Context: I'm working a process to publish a CRL periodically -- eg once every day.) With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to ...
1
vote
0answers
157 views

Making the Firefox key and CSR creation process transparent

Background I was a bit surprised that several CAs do not allow anymore to send a plain old CSR in text form to them which was created in the classic fashion with OpenSSL or similar. But this would ...
1
vote
0answers
90 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password ...
1
vote
0answers
38 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
1
vote
0answers
66 views

Certificate advice for deploying code-signed software as a 3rd party vendor

I am in the process of developing an application for an organization, and am looking for a sanity check on my strategy, especially given the the nature of the SuperFish nonsense that was exposed. The ...
1
vote
0answers
98 views

Can't get my SSL CA to work with Apache

So I have an SSL enabled website running on Apache2. https://eamorr.com (I get a warning in my browser, as expected) I have a config file for this website at: ...
1
vote
0answers
71 views

Setup local Certificate Authority & integrate with SCEP

I want setup local Certificate Authority and issue X.509 certificates under my CA. In order to achieve this I am exploring following options such as: OpenSSL/OpenCA BouncyCastle Cryptographic APIs ...
1
vote
0answers
272 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
1
vote
0answers
152 views

Is a android app signing certificate unique?

The Certificates that are used to sign Android applications are generated by the user and not checked or signed by any authority. They are RSA or DSA Certificates and as i read on ...
1
vote
0answers
216 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: ...
1
vote
0answers
44 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
1
vote
0answers
258 views

Does Mac OS X 10.8+ support self-signed Package Installer

I'm not sure whether self-signed Package Installer are supported by Mac OS X 10.8+ Using informations in How to create an Apple Installer Package Signing Certificate I could create a Package ...
1
vote
0answers
40 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
1
vote
0answers
169 views

Deploying software that requires X.509 certificates

I have a self-hosted WCF application, with a server application running on the server (obviously) and a client application that will be installed on the users PC. Up until this point I have been ...
1
vote
0answers
56 views

Does Active Directory Certificate Services support Card Verifiable Certificates?

Does Active Directory Certificate Services support accepting requests for, and generation of, Card Verifiable Certificates (TR-03110)? If so, in which version of Windows Server was the functionality ...
1
vote
0answers
241 views

“Keyset does not exist” when using SignData function with RSA

"Keyset does not exist". I know that there are tons of question about this error, but mine is totally different. I'm not gona use the key from windows certificate store, but load the public key & ...
1
vote
0answers
128 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
0
votes
0answers
8 views

What is the exact problem if a website has an SHA-1 certificate?

There was a recent question about trusting (or not) a website showing an SHA-1 certificate. I would like to know whether I understand the actual issue correctly. The dangers are (a) that someone ...
0
votes
0answers
18 views

Certificate not showing up for signing in Outlook

I have a new ECA certificate installed on my Windows 7 machine, but when I use Outlook it is not letting me change the signing certificate to the new certificate, but it does let me change the ...
0
votes
0answers
27 views

Validate Code Signing Root Certificate Offline

I am developing a library distributed as a Windows DLL to be called by 3rd party executables. I expect the calling EXE to be digitally signed and need to verify that. I have no control over the ...
0
votes
0answers
28 views

Web service authorization to specific applications: certificates, embedded secret or both?

My needs are somehow similar to this answer, but I would to be more specific. I have a set of web applications (A and B) that access to a REST service (R). A, B and R could be on the same server or ...
0
votes
0answers
24 views

Securing several Servers (Certificates)

I got a Question regarding Certificates. We got a situation, where only "Server 4" and its clients are given in the picture above. That Server4 (SLES11) and its Clients are using a self signed ...
0
votes
0answers
17 views

Does the AppId matter when self signing a cert?

We are going to start using self-signed certificates on our dev server. I went through some step-by-step instructions on how to generate the cert and set up ssl with my service. To add the cert, I ran ...
0
votes
0answers
33 views

How do the eduroam WPA-Enterprise 802.1X certificates look like?

As outlined in another answer, the official eduroam WiFi profiles available from https://cat.eduroam.org/ (verified for uWaterloo and uOttawa), as well as sample official instructions of the ...
0
votes
0answers
27 views

SpriteKit Level Data Security Handling

I have been reading many different posts, threads, etc. regarding the best practices to store level data to be used throughout a game application (level boundary data, images, characters, time, etc.). ...
0
votes
0answers
52 views

Validation client certificate for site in iis

Input: I send client certificate to client. He uses it to work with my web application which works in IIS. I installed CA certificate (which was used to create client certificate) on web server. AFAIK ...
0
votes
0answers
42 views

Applocker rules Publisher vs hash

I'm interested in deploying application white-listing for a large scale environment by using the Windows Server built-in AppLocker mechanism. There is no Internet connection to the environment. My ...
0
votes
0answers
25 views

Is there any extra validation that Firefox perform to certificates serial number

I open a secured site in my computer. for my reasons, I created new certificate every 15 minutes. I noticed that, sometimes, Firefox "doesn't like" my certificate. after little investigation, I ...
0
votes
0answers
48 views

deceptive digital signature?

I am new to cyphering and I try to understand this case : my government sends me so-called "digitally signed" PDFs, as you can see below (text only, after "Thanks"). Although there is a certificate ...