A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.
172
votes
3answers
45k views
How does SSL work?
How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering.
I'd like to see details in terms of:
A high level description of the protocol.
...
41
votes
10answers
2k views
Why do we not trust an SSL certificate that expired recently?
Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
41
votes
5answers
10k views
Certificate based authentication vs Username and Password authentication
What are the advantages and drawbacks of the certificate based authentication over username and password authentication?
I know some, but I would appreciate a structured and detailed answer.
UPDATE
...
31
votes
3answers
3k views
Are all SSL Certificates equal?
After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against.
Are all SSL ...
28
votes
4answers
13k views
What is the difference between an x.509 “client certificate” and a normal SSL certificate?
I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
24
votes
3answers
810 views
A Different Approach to PKI
After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
23
votes
9answers
1k views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
20
votes
8answers
2k views
Is anybody using client browser certificates?
Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
20
votes
7answers
3k views
Where to get an SSL certificate for personal website?
I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
20
votes
7answers
1k views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
20
votes
3answers
615 views
What is an SSL certificate intended to prove, and how does it do it?
If I get an SSL certificate from a well-known provider, what does that prove about my site and how?
Here's what I know:
Assume Alice and Bob both have public and private keys
If Alice encrypts ...
19
votes
11answers
2k views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
15
votes
4answers
556 views
What is the potential impact of these SSL certificate validation vulnerabilities?
I just finished reading through this paper by Georgiev et al, which demonstrates a wide range of serious security flaws in SSL certificate validation in various non-browser software, libraries and ...
13
votes
4answers
939 views
Is my Company Tracking Me?
Every time I try to connect to a site through HTTPS from my office computer, there is a Certificate Error thrown 2-3 times before showing the login screen. Till now I use to ignore this and click ...
12
votes
3answers
1k views
What happens when an Intermediate CA is revoked?
Currently I'm working on a certificate manager that allows our product to securely (over TLS/SSL) connect to remote webservices.
For security, we use CRL-checking to find out if a certain certificate ...
12
votes
2answers
389 views
Digital Certificate deployment: using two certs for each user?
At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs:
One for signing documents, emails, etc. that is ...
12
votes
2answers
357 views
Encryption and the “security time decay” of prior encrypted data
This question is on the assumption that any data once encrypted, may (eventually) be decrypted through
Brute force (compute power/time)
Exploits in the cryptography used
Theft of private keys
...
11
votes
3answers
531 views
Incorrect use of HTTPS?
When I open https://java.com my browser says “untrusted connection” but when I open https://www.java.com my browser says it’s ok. But it's the same site.
So my question is: Is this a security bug? ...
11
votes
3answers
9k views
Expired SSL Certificate Implications
What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
11
votes
1answer
1k views
REST specific security weaknesses
I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST.
What I would ...
11
votes
4answers
6k views
What ciphers should I use in my web server after I configure my SSL certificate?
There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list.
...
11
votes
4answers
396 views
What alternatives are there to the existing Certificate Authority system for SSL?
Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
11
votes
3answers
698 views
What are the risks of a Certificate Authority hack for 'the average user'?
Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
11
votes
4answers
2k views
What is certificate pinning?
I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
10
votes
5answers
445 views
Why is this certificate valid for so many domains?
If you look at the (invalid) certificate for https://i.imgur.com/ it says only valid for the following names:
The certificate is only valid for the following names and then a list of about 100 names.
...
10
votes
4answers
648 views
Why isn't OCSP required by default in browsers?
According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers.
Can someone please explain why this isn't ...
10
votes
4answers
1k views
Are there technical disadvantages in using free ssl certificates?
Note this question is related, except this one is about free SSL certs.
There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
10
votes
3answers
6k views
Understanding 2048 bit SSL and 256 bit encryption
On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm
What exactly is the difference here and why are two encryption bits ...
10
votes
2answers
1k views
What vulnerabilities could be caused by a wildcard SSL cert?
In a comment on this answer, AviD says:
"There are numerous security issues with wildcard SSL certs."
So, what are the problems? I understand that the same private key is being used in multiple ...
10
votes
3answers
157 views
Domain name expiration and TLS
If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
9
votes
2answers
6k views
Does https prevent man in the middle attacks by proxy server?
There is a desktop client A connecting to website W in a https connection
A --> W
Somehow between A and W, there is a proxy G.
A --> G --> W
In this case, will G be able to get the ...
9
votes
2answers
831 views
Secure communication between applications using SSL Certificates
I am looking for a way how to secure communication between our applications. There is a "server" application listening on some TCP port and "client" application which is communicating with the ...
9
votes
3answers
399 views
Multiple CAs signing a single Cert/CSR?
Just saw this suggested on Slashdot
So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
9
votes
2answers
636 views
SSL fingerprint inconsistency: what does it mean?
I apologize if this is not the best place to ask my question on the stackexchange network, I couldn't figure out where to get enough attention and be relevant.
Facebook provides a SSL host, it can be ...
8
votes
2answers
597 views
Are there really functioning quantum computers?
I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
8
votes
4answers
964 views
I see two different sets of certificates for Google websites when I am at work and when I am at home
I see two different sets of certificates for Google websites when I am at work and when I am at home.
I mean if I save the certificates (in firefox, click on the "Google.com" block on the left of ...
8
votes
3answers
24k views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
8
votes
3answers
2k views
What are the risks of self signing a certificate for SSL
Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
8
votes
3answers
322 views
Difference between Certificate Authorities
I've been wondering for a long time about is. There are many certificate authorities having different types of certificates. But even certificates of the same security level cost a lot more with one ...
8
votes
2answers
2k views
SSL Certificate revocation check
In the SSL protocol I don't see where the certificate is checked for revocation status.
https://developer.mozilla.org/en/Introduction_to_SSL
Is the Certificate Revocation and Status Checking not ...
8
votes
2answers
3k views
Checklist on building an Offline Root & Intermediate Certificate Authority (CA)
Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite.
Here is an image of the default cryptography settings ...
8
votes
4answers
383 views
Can real end-to-end SSL encryption be made?
I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate.
I've got a very precise question but first I need to give some background.
Basically I'm very ...
8
votes
1answer
215 views
Why can the validity of an SSL certificate exceed the registration period of a domain?
I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
8
votes
3answers
340 views
Are there any smartcard/hardware-tokens for certificate-based authentication which are easily destroyed?
It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can ...
7
votes
5answers
2k views
Does HTTPS Everywhere defend me against sslsniff-like attacks?
http://www.thoughtcrime.org/software/sslsniff/
If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
7
votes
3answers
235 views
Would using distinct IP addresses help support browsers with older SSL implementations?
We have a site with two wildcard certificates: *.foo.com and *.bar.foo.com. All of our subdomains resolve to the same IP address.
Newer browsers work fine with this, but IE7, for example, does not. ...
7
votes
2answers
2k views
ssltest: Chain issues - Contains anchor
I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)")
What does it mean? Should it be fixed? Can it be exploited?
7
votes
3answers
3k views
How do I check if a gmail/gtalk SSL certificate is valid?
Pidgin started prompting me to accept/reject new gtalk SSL certificate a few days ago and I am not able at the moment to tunnel the traffic to check if it would continue to happen or if it wouldn't ...
7
votes
2answers
679 views
Can a wildcard SSL certificate be issued for a second level domain?
Something like *.com or *.net? How about *.edu.au?
The RFC 2818 does not say anything about this topic.
7
votes
1answer
223 views
Why are website certificates secure?
I understand how HTTPS connections work, and I also understand they they require a certificate to know that the secure connection you have is with the right server (and not someone pretending to be ...
