Tagged Questions
1
vote
1answer
142 views
Does Java's implementation of OCSP and CRL checking handle intermediate CAs?
I've read that Java provides OCSP and CRL checking for CertPaths via:
Security.setProperty("ocsp.enable", "true");
System.setProperty("com.sun.security.enableCRLDP", "true");
Do these implementations ...
1
vote
1answer
83 views
Can I use any ssl certificate to sign and encrypt AS2 message?
I'm absolutely new to this topic of ssl certificates, so please be patient with me.
My task is to install an AS2 communication with some business partner. Therefore we need message signing and ...
3
votes
2answers
91 views
Why are SSL certificates valid only from a certain date?
Each SSL certificate is valid starting from a specific date and up to the expiration date.
What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
0
votes
1answer
102 views
What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?
Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange?
Can the server be configured to use weak key sizes for ...
41
votes
10answers
2k views
Why do we not trust an SSL certificate that expired recently?
Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
1
vote
1answer
116 views
How to troubleshoot why Thunderbird rejects a PKCS#12 certificate with “Could not verify this certificate for unknown reasons”?
After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a ...
11
votes
4answers
2k views
What is certificate pinning?
I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
3
votes
4answers
481 views
Is it possible to create a self signed certificate authority?
Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious.
To explain my question : Suppose I sign a public ...
0
votes
1answer
109 views
Behavior when validating an expired certificate chain
I have the following situation:
A server certificate (CServ) is signed by self-signed certificate (C0)
A client certificate (CCli) is signed by CServ
Client's trust-store contains C0, so the client ...
4
votes
2answers
214 views
Extensions for SSL server certificate
I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
4
votes
4answers
505 views
Why would someone want to encrypt RSS feeds?
I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
2
votes
3answers
200 views
Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”
Maybe this is a superuser.com question, I don't know.
Anyway, I want my cert to show up like this when I double click on it in Windows:
If I just double click on a random cert I get this:
The ...
1
vote
5answers
711 views
how to import a private key in windows
Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys?
Is the only way I can do that by converting both ...
2
votes
1answer
76 views
how does OpenSSL create X.509 certs from SPKACs?
The SPKAC ASN.1 description:
PublicKeyAndChallenge ::= SEQUENCE {
spki SubjectPublicKeyInfo,
challenge IA5STRING
}
SignedPublicKeyAndChallenge ::= SEQUENCE {
publicKeyAndChallenge ...
1
vote
1answer
67 views
spkac: what is the purpose of the challenge string?
The SPKAC ASN.1 description:
PublicKeyAndChallenge ::= SEQUENCE {
spki SubjectPublicKeyInfo,
challenge IA5STRING
}
SignedPublicKeyAndChallenge ::= SEQUENCE {
publicKeyAndChallenge ...
3
votes
2answers
164 views
What did the certificate authority do with my CSR?
I needed to reach a web service which is not mine.
The IT department of that web service has asked me to send them a CSR (certificate signing request).
Then, he will send me back a signed certificate ...
4
votes
3answers
273 views
What issues arise from sharing a SSL certificate's private key?
Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website.
I have ...
0
votes
0answers
32 views
Source(s) for getting listed vulnerabilities? [closed]
As I know cve.mitre.org, is one major source from which we can get to know all the listed vulnerabilities (new and old).
Are there any other such sites or databases available?
Also, if I want ...
1
vote
1answer
86 views
signatureAlgorithm vs. tbsCertificate -> signature
From the X.509 RFC:
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
TBSCertificate ::= ...
-1
votes
1answer
66 views
XER encoded X.509 certs [closed]
Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it?
Thanks!
1
vote
1answer
83 views
How are root CAs for SSL distributed?
For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser.
But what about for firefox and chrome?
...
3
votes
3answers
453 views
How to distribute client certificates without exposing private key?
I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication.
I'm ...
4
votes
1answer
158 views
where to download revoked certificates from
I don't want the certificate revocation lists - I want actual full on revoked certificates for test purposes.
For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and ...
11
votes
4answers
403 views
What alternatives are there to the existing Certificate Authority system for SSL?
Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
5
votes
1answer
179 views
Which attributes of a X509v3 certificate are never really used?
Are there any extensions/extended key usage attributes of a X.509Certificate that are rarely or never used in practice?
Either due to never being part of an issued certificate or because they are ...
8
votes
2answers
605 views
Are there really functioning quantum computers?
I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
3
votes
1answer
152 views
What are the Netscape Cert Type attributes? Why/when are they needed?
What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions?
Example:
There is the Client/Server Extended Key Usage (X.509) but there is ...
5
votes
2answers
143 views
ASN.1: ENUMERATED vs INTEGER
From the X.509 specs:
CRLReason ::= ENUMERATED {
unspecified (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
...
4
votes
3answers
564 views
How is an X509 certificate signer verified?
Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is,
...
173
votes
3answers
45k views
How does SSL work?
How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering.
I'd like to see details in terms of:
A high level description of the protocol.
...
6
votes
3answers
175 views
What risks would exist in transmitting an encrypted PKCS12 via Https
I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate ...
3
votes
1answer
61 views
CMC (RFC 5272) compatible CA server
I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
4
votes
5answers
441 views
Is Spoofing a CA signed certificate possible?
I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway.
When a communication starts with a server, during the client handshake, the ...
10
votes
4answers
1k views
Are there technical disadvantages in using free ssl certificates?
Note this question is related, except this one is about free SSL certs.
There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
1
vote
1answer
228 views
Any reason not to use same key for multiple SSL domains on one server?
Assume I've generated a server key for use by Apache for SSL. The server will be handling several different domains that use SSL via unique IPs (no SNI).
I want to generate a CSR for each domain from ...
3
votes
4answers
2k views
How are Chrome and Firefox validating SSL Certificates?
How are Chrome and Firefox validating SSL Certificates?
Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?
4
votes
4answers
754 views
Can an intermediate CA be trusted like a self-signed root CA?
Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
3
votes
2answers
133 views
In practice, does crypto software accept a *.com or or even a *. certificate?
Assuming this will be done with your own PKI, and not a public trusted CA.
Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
1
vote
1answer
402 views
openSSL Not Displaying all attributes
Here's a background of what I've done so far:
I've been able to add a CRL to a self signed certificate using OpenSSL (see attached). But I'm not sure how to create an X.509 certificate issued by ...
3
votes
1answer
543 views
how do extended validation X.509 certs work?
https://www.forumatic.com/ uses an extended validation cert. wikipedia.org's entry on extended validation certs says that a cert is known to be an extended validation cert if the OID in the ...
0
votes
1answer
300 views
URIs in the subjAltName X.509 extension
The subjAltTag extension for X.509 certificates can take in domain names, email addresses, URIs, etc. I was playing around with an X.509 whose subjAltTag had just a URI in it doesn't seem to work. ...
8
votes
3answers
323 views
Difference between Certificate Authorities
I've been wondering for a long time about is. There are many certificate authorities having different types of certificates. But even certificates of the same security level cost a lot more with one ...
1
vote
1answer
85 views
valid intermediate certs not in browser
Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
7
votes
2answers
282 views
X.509 certificate policies question
I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies.
To quote from the X.509 RFC:
In an end entity certificate, these ...
1
vote
1answer
209 views
X.509 certificate policy mapping question
So I'm a little confused how X.509 certificate policy mappings work. So let's say the following depicts my cert chain:
root CA ---> intermediary CA ---> client cert
Would the root CA have a ...
10
votes
2answers
649 views
SSL fingerprint inconsistency: what does it mean?
I apologize if this is not the best place to ask my question on the stackexchange network, I couldn't figure out where to get enough attention and be relevant.
Facebook provides a SSL host, it can be ...
0
votes
3answers
882 views
Firefox detected an invalid SSL certificate
February 14, 2012 UTC:
Yesterday, I connected to a website of a VPN provider for which Firefox 8.0.1 on Windows 7 Ultimate x86-64 stated that its' SSL certificate is invalid. I saved the received ...
6
votes
2answers
397 views
Why would the downloaded certificate show a different end-date as compared to the same certificate when viewed online?
This is sort-of a follow-up to my previous question What fields in a suspicious certificate should I look at?
Chrome just presented the warning icon against the certificate presented by ...
5
votes
2answers
661 views
OCSP and CRLs: Specified in CA or client certificate?
Here's an example PKI setup:
* Root CA (offline)
* Issuing CA
* Client 1
* Client 2
I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
4
votes
1answer
2k views
openssl verify signature
For S/MIME, I now know I can verify PKCS#7 detached signatures with:
openssl smime -verify -in detachedsign.pem -content content.txt
But what about non-MIME messages?
So if I sign the message ...
