A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...
5
votes
3answers
856 views
Why does OpenVPN require securely sharing certs with clients?
The ubuntu docs on OpenVPN have this part in the instructions:
Copy the following files to the client:
/etc/openvpn/ca.crt
/etc/openvpn/easy-rsa/keys/hostname.crt
...
8
votes
3answers
560 views
Is it safe to store a single symmetric key encrypted with several different RSA public keys?
For the field-based encryption of a database containing sensitive information, I was thinking of the following design:
Every user has a smartcard used for client certificate login.
After login the ...
3
votes
3answers
223 views
Public key system confusion
I read the following about PKI:
Using a public key system, a user may encrypt a portion of a document
using his or her private key. This message will later be decrypted by
the recipient using ...
10
votes
2answers
647 views
SSL fingerprint inconsistency: what does it mean?
I apologize if this is not the best place to ask my question on the stackexchange network, I couldn't figure out where to get enough attention and be relevant.
Facebook provides a SSL host, it can be ...
0
votes
3answers
879 views
Firefox detected an invalid SSL certificate
February 14, 2012 UTC:
Yesterday, I connected to a website of a VPN provider for which Firefox 8.0.1 on Windows 7 Ultimate x86-64 stated that its' SSL certificate is invalid. I saved the received ...
10
votes
3answers
737 views
What's the common pragmatic strategy for managing key pairs?
I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH.
Originally when I learned about PKI, I created a single ...
6
votes
2answers
396 views
Why would the downloaded certificate show a different end-date as compared to the same certificate when viewed online?
This is sort-of a follow-up to my previous question What fields in a suspicious certificate should I look at?
Chrome just presented the warning icon against the certificate presented by ...
2
votes
3answers
518 views
How can I share files with other individuals in the cloud in a secure way?
I would like to us a dropbox because it is easy and convenient.
But I want to encrypt the files with the public key of the intended recipient, so he will be the only one who can access the data in ...
5
votes
2answers
659 views
OCSP and CRLs: Specified in CA or client certificate?
Here's an example PKI setup:
* Root CA (offline)
* Issuing CA
* Client 1
* Client 2
I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
0
votes
1answer
250 views
Enterprise Encryption Considerations
What are the different aspects to consider for Enterprise Encryption policy?
So far the resources I have are:
https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet
...
5
votes
4answers
232 views
What fields in a suspicious certificate should I look at?
Looking at a certificate for a web-site (in Windows/Google Chrome) I see it lists the following fields
Version
Serial number
Signature algorithm
Issuer
Valid from
Valid to
Subject
Public Key
Basic ...
4
votes
1answer
307 views
Two certificates on smart card
I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?
Background:
In Sweden you can have a "citizen ...
4
votes
1answer
2k views
openssl verify signature
For S/MIME, I now know I can verify PKCS#7 detached signatures with:
openssl smime -verify -in detachedsign.pem -content content.txt
But what about non-MIME messages?
So if I sign the message ...
3
votes
2answers
156 views
Null content digitally signed message
IA technical specification I'm following requires me to send:
The Digital Signature must be in the form of a null content Digitally
Signed message (i.e. a PKCS#7 object containing the signature ...
7
votes
1answer
237 views
Why is there no Domain CA?
I was asked to deliver a signed SSL certificate for an IIS server for a client.
I have previously done this for the same client/domain before, so it start to seem like
an unnecessary expense to hold ...
11
votes
3answers
9k views
Expired SSL Certificate Implications
What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
3
votes
2answers
272 views
How and when should I use OpenSSL for IT Security? How do I understand the output?
I'm discovering OpenSSL, and already used it to diagnose a faulty SMTP TLS connection, but I'd like to get a better / full understanding of the tool and how to use it.
What resources should I use ...
8
votes
3answers
2k views
What are the risks of self signing a certificate for SSL
Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
12
votes
4answers
3k views
how digital signature verification process works
I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
16
votes
4answers
4k views
How does PGP differ from S/MIME?
Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
3
votes
2answers
391 views
How practical is a certificate's “basic constraint” property in protecting my HTTPS / SSL session?
Suppose a leaf node creates a certificate for a different domain, acting as a CA.
Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be ...
6
votes
3answers
148 views
Guarding against rogue certificates
There has been a lot of news recently about certificates being falsely issued (due to the issuing authority having poor system security!). Apparently the targeted users were mostly Iranians, but it's ...
5
votes
4answers
4k views
Recommendations for a Certificate Management tool for Linux
A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients.
This creates a new challenge to manage all these certificates and ...
6
votes
3answers
315 views
Why are CA's signing keys available on the internet
I am not very knowledgeable about CA certificates, but I thought these things mainly said
"The public key for bank X is Y, and this is verified by CA Z".
Once you've bought this certificate, there is ...
9
votes
3answers
402 views
Multiple CAs signing a single Cert/CSR?
Just saw this suggested on Slashdot
So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
4
votes
2answers
236 views
How are possible uses for X.509 (SSL) certificates denoted?
X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
21
votes
3answers
624 views
What is an SSL certificate intended to prove, and how does it do it?
If I get an SSL certificate from a well-known provider, what does that prove about my site and how?
Here's what I know:
Assume Alice and Bob both have public and private keys
If Alice encrypts ...
8
votes
3answers
483 views
Does the SSL encryption strength of a website really matter?
When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart.
Immediately there seems to be 4 major ...
3
votes
1answer
344 views
What kind of certificate do I need to be able to make and sign my own digital signing certicates?
At build time for a program, I would like to generate a new key pair, and create a certificate that will be embedded (securely) into the program. The purpose of the key pair is to digitally sign an ...
6
votes
2answers
224 views
Geographic equivilent of RFC 3161 (X.509 PKI Time-stamp Protocol)
First time poster here, hope to be around more often.
I'm in need of a cryptographically secure 'stamping' system that allows not only time but also location to be attached to data, while still ...
16
votes
3answers
1k views
What happens when an Intermediate CA is revoked?
Currently I'm working on a certificate manager that allows our product to securely connect to remote webservices (over TLS/SSL).
For security, we use Certificate Revocation List checking (or ...
10
votes
4answers
650 views
Why isn't OCSP required by default in browsers?
According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers.
Can someone please explain why this isn't ...
10
votes
7answers
783 views
Can a HTTPS connection be compromised because of a rogue DNS server
If I'm visiting (just a desktop pc, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using [not with free will, so e.g.: I'm "attacked"] a rouge DNS ...
7
votes
1answer
149 views
distributing files to VPN partners
suppose i've created VPN certificates for a certain VPN-RoadWarrior-Client, expressed in the files VPN-RoadWarrior-Client.key and VPN-RoadWarrior-Client.crt*, however VPN-RoadWarrior-Client is ...
6
votes
2answers
372 views
security of PKI, Certificates, certificate authorities, forward secrecy
I want to understand how certificates add to the security of information exchange.
Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
10
votes
3answers
1k views
Computationally simple, lightweight replacement for SSL/TLS
Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
7
votes
1answer
541 views
Moving from a one tier to a two tier Microsoft Certificate Authority hierachy
Right now we have a single Microsoft Enterprise Root CA which issues certificates to our VPN users for two factor authentication. We're planning to extend use of the CA to issue certificates for RDP ...
7
votes
1answer
959 views
Renewing Microsoft Certificate Services Root Certificate
We currently have Microsoft Enterprise Certificate Server installed on a domain member machine which issues 1 year certificates to users for authenticating to VPN.
We'd like to start issuing web ...
11
votes
1answer
670 views
How would I implement “Broadcast Encryption”?
I have a stream that I want to encrypt for broadcast to 10,000 subscribers. I know I should encrypt this data using a symmetric key; and also intend that this symmetric key will be rotated every 30 ...
5
votes
1answer
630 views
Thunderbird - what happens if Gmail SSL cert gets spoofed?
I use a good MUA: Thunderbird [to read/reply to my emails on Gmail].
So: what happens, if i go to a place, where is public wifi, and someone tryes to sniff my password/username/emails?
Questions:
...
12
votes
2answers
357 views
Encryption and the “security time decay” of prior encrypted data
This question is on the assumption that any data once encrypted, may (eventually) be decrypted through
Brute force (compute power/time)
Exploits in the cryptography used
Theft of private keys
...
7
votes
3answers
1k views
Certificate authorities for a PKI
Some people think the certificate authorities for a PKI should be the government, but others think certificate authorities should be private entities, such as banks, corporations, or schools. What are ...
19
votes
11answers
2k views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
5
votes
1answer
211 views
PKI solution vendor selection
What would you look for in a (X.509-) PKI solution, and why would you look for that, given the following constraints:
Available programming/sw-engineering know how is limited (ie, "OpenSSL with a ...
6
votes
3answers
188 views
Renew digital certificate
If I have deployed a digital certificate on a webserver and if it needs to be renewed then what steps do I need to follow? Will I need to generate a new longer public key private key pair? Why do ...
6
votes
3answers
923 views
Certificate chain
For my computer to verify the identity of a certain certificate should it have all the certificates up to the root certificate?
8
votes
2answers
2k views
SSL Certificate revocation check
In the SSL protocol I don't see where the certificate is checked for revocation status.
https://developer.mozilla.org/en/Introduction_to_SSL
Is the Certificate Revocation and Status Checking not ...
0
votes
2answers
176 views
Create a certificate signing request [closed]
can someone please tell me a few tools that can be used to create a CSR ?
2
votes
2answers
1k views
What is an intermediate certificate authority?
What is meant by an "intermediate certificate authority?"
11
votes
2answers
2k views
How does RSA encryption compare to PGP?
On this answer ck says
RSA and PGP are different.
What you are essentially asking is how
do I run my petrol car on diesel? The
answer is you can't.
I would be interested in a more ...
