Questions tagged [certificates]
A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.
2,871
questions
1288
votes
3
answers
688k
views
How does SSL/TLS work?
How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering.
I'd like to see details in terms of:
A high level description of the protocol.
...
- 135k
371
votes
6
answers
342k
views
What is certificate pinning?
I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
- 3,835
301
votes
18
answers
534k
views
Provide subjectAltName to openssl directly on the command line
Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line?
I know it's possible via a openssl.cnf file, but that's not really elegant for batch-...
- 3,143
262
votes
7
answers
51k
views
How do certification authorities store their private root keys?
Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
- 10.7k
217
votes
7
answers
216k
views
Does https prevent man in the middle attacks by proxy server?
There is a desktop client A connecting to website W in a https connection
A --> W
Somehow between A and W, there is a proxy G.
A --> G --> W
In this case, will G be able to get the ...
- 2,281
170
votes
4
answers
380k
views
Difference between .pfx and .cert certificates
What is the difference between .pfx and .cert certificate files?
Do we distribute .pfx or .cert for client authentication?
- 1,823
159
votes
4
answers
122k
views
What exactly does it mean when Chrome reports 'no certificate transparency information was supplied by the server?'
When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I receive a message 'no certificate transparency information was supplied by the server' (...
- 1,806
151
votes
5
answers
522k
views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
- 5,203
144
votes
14
answers
48k
views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
- 2,247
131
votes
7
answers
111k
views
Let's Encrypt for intranet websites?
Many companies have intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate, which causes a bad habit for the users since they get used to just ...
- 1,581
117
votes
4
answers
109k
views
What certificates are needed for multi-level subdomains?
I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy.
Here's what I need to secure:
foo....
- 2,734
116
votes
6
answers
33k
views
I can't access websites that use HTTPS, instead getting the message "your connection is not private"!
I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But ...
- 1,073
112
votes
10
answers
80k
views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
- 1,223
109
votes
8
answers
153k
views
Certificate based authentication vs Username and Password authentication
What are the advantages and drawbacks of the certificate based authentication over username and password authentication?
I know some, but I would appreciate a structured and detailed answer.
UPDATE
...
- 1,287
101
votes
4
answers
126k
views
What is the difference between an X.509 "client certificate" and a normal SSL certificate?
I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
- 1,113
100
votes
5
answers
59k
views
Are there any downsides to using Let's Encrypt for a website's SSL certificates?
On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
- 1,143
97
votes
10
answers
38k
views
Why do we not trust an SSL certificate that expired recently?
Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
- 2,241
96
votes
2
answers
97k
views
Why would I choose SHA-256 over SHA-512 for a SSL/TLS certificate?
I'm looking to renew an SSL (okay, TLS) wildcard certificate with a well-known service. I need to provide a CSR, which I have created using a 2048-bit key. I also need to choose a signature hash. The ...
- 2,226
94
votes
4
answers
86k
views
SSL Certificate framework 101: How does the browser verify the validity of a given server certificate?
(I have a basic understanding of public/private key, hashing, digital signatures... I have been searching online & stack forums last couple days but cannot seem to find a satisfactory answer.)
...
- 1,051
93
votes
4
answers
11k
views
Should I revoke no longer used Let's Encrypt certificates before destroying them?
The Let's Encrypt documentation recommends that when a certificate’s corresponding private key is no longer safe, you should revoke the certificate.
But should you do the same if there are no ...
- 1,074
90
votes
12
answers
18k
views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
- 50.9k
90
votes
2
answers
128k
views
What is the difference between serial number and thumbprint?
I have problems to understand what is the difference between the serial number of a certificate and its SHA1 hash.
The MSDN says:
Serial number A number that uniquely identifies the ...
- 1,052
88
votes
4
answers
19k
views
What prevents me from buying a SSL certificate for a domain I don't control?
Can I simply build a webserver, make its hostname "google.com", create a CSR off that server, and send that to a Certificate Authority for signing? Let's say I pick the cheapest and dodgiest outfit I ...
- 859
88
votes
2
answers
53k
views
ssltest: Chain issues - Contains anchor
I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)")
What does it mean? Should it be fixed? Can it be exploited?
- 5,397
87
votes
5
answers
39k
views
Are all SSL Certificates equal?
After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against.
Are all SSL ...
- 4,025
81
votes
1
answer
24k
views
Is Starbucks spoofing me?
When I connected to Starbucks's Wi-Fi, I got a security alert from MS Outlook that looks like this:
I looked up secure.datavalet.io, but there's no mention of this thing anywhere. This does not ...
- 799
77
votes
6
answers
11k
views
Should I reject a CSR when the host emailed me the private key for SSL certificate request?
I just requested a CSR from my shared web hosting provider, to generate a certificate which I will send back to them to install. (The certificate itself is to be generated properly by an organisation ...
- 873
75
votes
1
answer
17k
views
How can Kazakhstan perform MITM attacks on all HTTPS traffic?
There is now MITM on HTTPS traffic in Kazakhstan.
But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
- 2,473
73
votes
2
answers
126k
views
What's the difference between X.509 and PKCS#7 Certificate?
Am I correct calling file with .p7b file extension saved as 'Cryptographic Message Syntax Standard - PKCS#7 Certificates (.P7B)' in Windows - a 'PKCS#7 certificate'? Or is it better called 'X.509 ...
- 993
71
votes
4
answers
530k
views
How do I clear cached credentials from my Windows Profile?
Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data.
How can I backup and purge this data?
- 50.9k
70
votes
5
answers
208k
views
Understanding 2048 bit SSL and 256 bit encryption
On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm
What exactly is the difference here and why are two encryption bits ...
- 867
69
votes
4
answers
110k
views
How does the digital signature verification process work?
I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
- 881
65
votes
7
answers
19k
views
Why would a school need to install certificates on student laptops?
This question indicates parents are to buy laptops for a school to install software and certificates. I am seeking to understand reasons for site certificates installation:
Why would site ...
- 1,531
64
votes
3
answers
14k
views
Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?
After installing Firefox 54.0.1 on my work laptop, the first page I see warns me that "Your connection is not secure" when opening https://www.mozilla.org/.
"The owner of Firefox has configured their ...
- 1,535
62
votes
2
answers
17k
views
Can I restrict a Certification Authority to signing certain domains only?
Is it possible to create a CA certificate (even unsigned), which is only allowed to sign certificates for specific limited domain(s), so that it can't be misused for other domains?
- 1,791
62
votes
4
answers
9k
views
Why was the private key of the Superfish certificate so easily extractable?
Robert Graham detailed on the Errata Security blog how he was able to get the private key of the Superfish certificate. I understand that attackers can now use this key to generate certificates of ...
- 897
62
votes
1
answer
22k
views
How does my browser inherently trust a CA?
I am reading this post and not understanding the answer.
The answer ends with the words
...your browser can verify one cert against the next, all the way to the root CA, which your browser ...
- 641
61
votes
4
answers
11k
views
Is there a way to make sure my government does not swap out SSL certificates?
I was recently wondering whether there exists a way to make sure my government is not swapping out SSL certificates in order to intercept the traffic.
I know almost all browsers are complaining in ...
- 681
60
votes
3
answers
12k
views
Why is this certificate for Imgur only valid for one day?
I'm connected over a café WiFi and received a warning from my mobile browser. When I looked further, it seems like the certificate is only valid for one day, which seems super suspicious.
It ...
- 1,925
59
votes
7
answers
11k
views
Can a CA decrypt HTTPS traffic?
My state has made a statement that in case my country will be disconnected from the world's CAs, it is necessary to install its own state certificates. In many forums, information has flashed that in ...
- 1,035
59
votes
2
answers
6k
views
Why does Windows Ship with Expired SSL Certificates?
I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete.
Why does a fresh install of Windows Server 2012 R2 ...
- 949
58
votes
1
answer
4k
views
Does a client certificate identify the owner to unrelated websites?
If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it?
I once visited an ssl diagnostic site that immediately ...
- 453
57
votes
3
answers
113k
views
Generate CSR from existing certificate
Can we generate the CSR (certificate signing request) used for certificate signing from the signed certificate? It should work with the original private key when signed again with different authority.
- 701
56
votes
2
answers
56k
views
What are the risks of self signing a certificate for SSL
Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
- 808
55
votes
3
answers
64k
views
4096 bit RSA encryption keys vs 2048
Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
- 2,737
53
votes
2
answers
11k
views
Digital Certificate deployment: using two certs for each user?
At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs:
One for signing documents, emails, etc. that is ...
- 2,833
53
votes
2
answers
80k
views
What is the difference between SSL and X.509 Certificates?
I used openssl to create a X.509 certificate but I don't quite understand the relationship between a X.509 and a SSL certificate. Are they the same? Is a SSL certificate just a X.509 certificate that ...
vernomcrp
51
votes
2
answers
11k
views
Why aren't infinite-depth wildcard certificates allowed?
As far as I can tell, an SSL certificate for *.example.com is good for foo.example.com and bar.example.com, but not foo.bar.example.com.
Wildcards certificates cannot have *.*.example.com as their ...
- 8,317
49
votes
4
answers
38k
views
What vulnerabilities could be caused by a wildcard SSL cert?
In a comment on this answer, AviD says:
"There are numerous security issues with wildcard SSL certs."
So, what are the problems? I understand that the same private key is being used in multiple ...
user185
48
votes
5
answers
22k
views
Are there technical disadvantages in using free ssl certificates?
Note this question is related, except this one is about free SSL certs.
There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
- 2,968