1
vote
1answer
44 views

Client authentication flaw in old Netscape SSL protocol

Below is a screenshot from the paper "Prudent Engineering Practice for Cryptographic Protocols" by Martin Abadi and Roger Needham. I can't see what's wrong with the protocol and what the fix achieves. ...
0
votes
1answer
423 views

iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)

As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2. ...
3
votes
3answers
560 views

Revoke a certificate without index.txt

I generate self-signed client certificates for a little Apache server hosted under my stairs. The script below was hacked together for this purpose - note it uses the 'mini-CA' x509 method, therefore ...
2
votes
2answers
145 views

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
4
votes
2answers
2k views

Certificate Chain checking

I have a very specific question. A client verifies a sever by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (According to the ...
1
vote
2answers
357 views

SSL: How to send generated client certificate from server to avoid MITM?

The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
284 views

Generate openSSL certificates from within C code using commands?

This is an openSSL command for generating a private key and a certificate, openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key The question I have is whether there is some ...
6
votes
2answers
304 views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...