Tagged Questions
5
votes
5answers
154 views
A standard way to manually add a digital signature to a pdf file?
I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
1
vote
2answers
291 views
How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?
Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
0
votes
1answer
68 views
Does S/MIME provide means to propagate a certificate's revocation?
Can a revocation certificate for an old X.509 certificate be attached to an email in addition to a replacement certificate in such a way that the client user does not have to manually intervene? Or ...
2
votes
2answers
142 views
distribution mechanisms for CRLs
From the X.509 RFC:
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer ...
4
votes
4answers
741 views
Can an intermediate CA be trusted like a self-signed root CA?
Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
6
votes
2answers
151 views
Limiting the root certificate chain
I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
