X.509 is an standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

learn more… | top users | synonyms

6
votes
2answers
630 views

ASN.1: ENUMERATED vs INTEGER

From the X.509 specs: CRLReason ::= ENUMERATED { unspecified (0), keyCompromise (1), cACompromise (2), affiliationChanged (3), ...
1
vote
1answer
147 views

What keys are involved in an X.509 certificate?

I'm trying to examine some instances where an X.509 certificate uses public and private keys for a paper I'm going to write. However, the only thing I have explicitly seen so far is in one of the ...
3
votes
2answers
2k views

x.509 CRLs: next update?

An X.509 certificate revocation list contains a field specifying when the next such list is expected to be issued. I'm trying to figure out the importance of this field...I know that sometimes ...
5
votes
2answers
1k views

Adding custom data in X.509 certificate

I am using SSL with client authentication. I need to send some extra data while sending the client certificate? Can I send it in the certificate? Can I use the extension fields in certificate for that ...
6
votes
4answers
3k views

Can an intermediate CA be trusted like a self-signed root CA?

Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
3
votes
1answer
2k views

how do extended validation X.509 certs work?

https://www.forumatic.com/ uses an extended validation cert. wikipedia.org's entry on extended validation certs says that a cert is known to be an extended validation cert if the OID in the ...
4
votes
2answers
4k views

What is the use of cross signing certificates in X.509?

In X.509 architecture what are the uses of cross signing certificates from other hierarchy? Does it just expand trust? So from the answer I am assuming that if CA3 is cross signed by CA2 (from ...
0
votes
1answer
772 views

URIs in the subjAltName X.509 extension

The subjAltTag extension for X.509 certificates can take in domain names, email addresses, URIs, etc. I was playing around with an X.509 whose subjAltTag had just a URI in it doesn't seem to work. ...
2
votes
3answers
760 views

why does the first certificate have a RSA public key in x.509?

Example from http://en.wikipedia.org/wiki/X.509#Extensions_informing_a_specific_usage_of_a_certificate 1st certficate - freesoft 2nd - CA thawte Don't we use the RSA public key from the 2nd ...
1
vote
1answer
111 views

valid intermediate certs not in browser

Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
3
votes
2answers
215 views

self-signed certs that aren't the final certificates in the path

The X.509 spec makes frequent statements like this: (b) If certificate i is self-issued and it is not the final certificate in the path, skip this step for certificate i. How can you have ...
8
votes
2answers
667 views

X.509 certificate policies question

I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies. To quote from the X.509 RFC: In an end entity certificate, these ...
2
votes
1answer
559 views

X.509 certificate policy mapping question

So I'm a little confused how X.509 certificate policy mappings work. So let's say the following depicts my cert chain: root CA ---> intermediary CA ---> client cert Would the root CA have a ...
0
votes
1answer
294 views

id-ce-cRLDistributionPoints ASN.1 / DER encoding question

I have a file - test.pem - with the following contents: -----BEGIN CERTIFICATE----- MBIwEKAOoAwwCqMIMAZhBEFCQ0Q= -----END CERTIFICATE----- openssl asn1parse -inform PEM -in test.pem -i returns the ...
2
votes
1answer
547 views

question about implicitly tags in ASN.1

From the X.509 RFC, in the "Implicitly Tagged Module" section: CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint DistributionPoint ::= SEQUENCE { distributionPoint [0] ...
3
votes
2answers
160 views

Teaching security concepts

I think it would be nice to teach security concepts by giving practical examples. I am looking for some practical cases for x509 certificates, kerberos and SET. How could I know an ecommerse site ...
7
votes
2answers
677 views

Enforce Code/Script Signing

I have both a couple of X.509 Code Signing certificates and a GPG keypair that I can use to sign against code I run on my VPS. Every now and again I write code for iOS, OS X and Windows and always ...
4
votes
1answer
875 views

X.509 algorithm identifier parameters vs. extension values

From the X.509 specs: AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } ...
3
votes
1answer
1k views

Why doesn't asn1parse parse all DER encoding strings?

I have a file - crl.txt - that contains the following: MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw= It's from one of the extensions in a particular X.509 cert. Why ...
3
votes
1answer
1k views

parsing the id-ce-keyUsage extension in X.509 certs

I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows: ...
4
votes
3answers
6k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
8
votes
4answers
1k views

Why is it a good idea that X.509 digital certificates have an expiry date?

What is the benefit of having certificates expire at some fixed date?
7
votes
3answers
225 views

Limiting the root certificate chain

I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
4
votes
3answers
650 views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...