X.509 is an standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

learn more… | top users | synonyms

1
vote
0answers
24 views

Kohnfelder Certificate [on hold]

The Kohnfelder certificate standard is very similar to that of X.509 certificate standard. Comparing the two standards, does one have an advantage edge over the other? or what are the pros and cons of ...
0
votes
2answers
38 views

can a x.509 certificate alone be used for user authentication?

we have a scenario for implementing SSO using x.509 certificates. A secure client will download a x.509 certificate (only certificate...no private key is available) upon user logs into the windows ...
2
votes
1answer
54 views

Certificate verified using two different paths

StartSSL has an intermediate certificate that they use to sign their EV certificates: sub.class4.server.ca.pem. This certificate's issuer is shown by openssl x509 to be /C=IL/O=StartCom ...
1
vote
0answers
21 views

Deploying software that requires X.509 certificates

I have a self-hosted WCF application, with a server application running on the server (obviously) and a client application that will be installed on the users PC. Up until this point I have been ...
1
vote
2answers
55 views

Why has public key certificate “Trust anchor”, why is it SPoF vulnerable?

When you look at currently used concept of Root CA (primarily in SSL/TLS context), you can see SPoF vulnerability, which means, if your private key is disclosed, you automatically lose whole chain. ...
1
vote
1answer
72 views

Can anyone explain how to use an X509 client certificate to securely authenticate a user?

Bit of background. Web Application that can generate Pub/Priv Keys and X.509 certificates. How would I make use of the certificate in a web application, username and password login form to provide ...
1
vote
3answers
299 views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
5
votes
1answer
147 views

Is is typical to create both x509 and OpenPGP key pairs?

I'm looking into increasing my use of signed and encrypted "things" - LibreOffice Documents, Off-the-record chat, PDFs, emails, etc. I'm finding that some things only support x509 format-certificates, ...
5
votes
1answer
2k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
3
votes
1answer
91 views

How is an Authenticode timestamp verified?

For an Authenticode signed file to be verifiable by Windows after the original signing certificate has expired (typically 1-3 years after issue), the file also needs to have a cryptographically signed ...
0
votes
1answer
156 views

SSL (TLS v1.2) - Can i offer fallback CAs when upgrading Certificates? (Java)

I am currently developing a product that involves two network situations. At the client side, multiple computers form a P2P network (multiple locations, multiple p2p networks), and a subset of nodes ...
10
votes
1answer
3k views

What is the difference between Serial Number and Thumbprint?

I have problems to understand what the difference between the Serial Number of a certificate and its SHA1 Hash is. the MSDN says: Serial number A number that uniquely identifies the ...
1
vote
2answers
156 views

Choosing the right X.509 certificate infrastructure for securing LAN communications between a PC and a device

Edit: seems like I was quite hasty when typing in my question at first, so here is an updated version of it. I am developing an application that runs on PCs which are on the same LAN as other ...
5
votes
1answer
302 views

SSL - Null Prefix Attacks Still Possible?

At DEFCON 17 (2009) Moxie Marlinspike gave a talk were he was able to use a malformed certificate signing request to get SSL certs signed for domains he doesn't own. The gist of it was that for the ...
-1
votes
2answers
69 views

user identity certificate

I want to create a new scheme for user identification, like X.509 certificates, but not X.509. Is it possible to use this new certificate over the existing Internet? and if yes, what are basic ...
1
vote
1answer
85 views

Two way delegation?

I am looking into using the X.509 for mutual delegation where mutual delegation is bi-directional where an entity can only delegate a task or a set of permissions to another entity if the latter is ...
2
votes
1answer
434 views

question about implicitly tags in ASN.1

From the X.509 RFC, in the "Implicitly Tagged Module" section: CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint DistributionPoint ::= SEQUENCE { distributionPoint [0] ...
1
vote
3answers
276 views

accepted naming convention for public keys/certificates

Is there an accepted naming convention for referring to PKI artifacts? There seems to be a lot of confusion with naming of artifacts. For example, it seems that some people refer to: public keys ...
5
votes
4answers
2k views

Can an intermediate CA be trusted like a self-signed root CA?

Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
3
votes
1answer
78 views

Why is the issuer name field signed in X.509?

In the X.509 specification it sais that the issuer name is to be signed. Since we verify the certificate with the authenticated issuer's public key, it seems infeasible to forge the issuer name ...
3
votes
2answers
167 views

self-signed certs that aren't the final certificates in the path

The X.509 spec makes frequent statements like this: (b) If certificate i is self-issued and it is not the final certificate in the path, skip this step for certificate i. How can you have ...
3
votes
2answers
149 views

Teaching security concepts

I think it would be nice to teach security concepts by giving practical examples. I am looking for some practical cases for x509 certificates, kerberos and SET. How could I know an ecommerse site ...
7
votes
4answers
841 views

Why is it a good idea that X.509 digital certificates have an expiry date?

What is the benefit of having certificates expire at some fixed date?
4
votes
3answers
477 views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
4
votes
2answers
604 views

What is the difference between SSL and X.509 Certificates?

I used openssl to create a X.509 certificate but I don't quite understand the relationship between a X.509 and a SSL certificate. Are they the same? Is a SSL certificate just a X.509 certificate that ...
6
votes
5answers
2k views

A standard way to manually add a digital signature to a pdf file?

I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
6
votes
2answers
185 views

Limiting the root certificate chain

I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
3
votes
1answer
2k views

Enhanced Key Usage vs. Extended Key Usage

I've seen both the terms Enhanced Key Usage and Extended Key Usage, and both were abbreviated as EKU. Do both refer to the same extension or property?
7
votes
1answer
805 views

Why do X.509 certificates have “Key Usage” attribute?

I can find their values and all details in the RFC, but I cannot find why it was decided to have this attribute in certificates, instead of leaving them to be multipurposes. Is there a reasoning ...
6
votes
1answer
1k views

Which properties of a X.509 certificate should be critical and which not?

RFC5280's section 4.2 states Each extension in a certificate is designated as either critical or non-critical. A certificate-using system MUST reject the certificate if it encounters ...
1
vote
1answer
345 views

How to troubleshoot why Thunderbird rejects a PKCS#12 certificate with “Could not verify this certificate for unknown reasons”?

After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a ...
0
votes
1answer
374 views

Behavior when validating an expired certificate chain

I have the following situation: A server certificate (CServ) is signed by self-signed certificate (C0) A client certificate (CCli) is signed by CServ Client's trust-store contains C0, so the client ...
6
votes
2answers
3k views

Encrypting local HTTP traffic using a self-signed certificate

For the past couple of hours I've been trying to create a self-signed certificate which I'd like to use to encrypt HTTP traffic between computers and a server on my home network (because I'm paranoid ...
2
votes
2answers
433 views

distribution mechanisms for CRLs

From the X.509 RFC: DistributionPoint ::= SEQUENCE { distributionPoint [0] DistributionPointName OPTIONAL, reasons [1] ReasonFlags OPTIONAL, cRLIssuer ...
6
votes
2answers
370 views

ASN.1: ENUMERATED vs INTEGER

From the X.509 specs: CRLReason ::= ENUMERATED { unspecified (0), keyCompromise (1), cACompromise (2), affiliationChanged (3), ...
5
votes
2answers
2k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
2
votes
1answer
366 views

What is the difference between `extendedKeyUsage` and an application policy?

In some Microsoft articles like http://technet.microsoft.com/en-us/library/cc731792%28v=ws.10%29.aspx, I find some confusing statements like Application policies are sometimes called extended key ...
0
votes
1answer
218 views

Does S/MIME provide means to propagate a certificate's revocation?

Can a revocation certificate for an old X.509 certificate be attached to an email in addition to a replacement certificate in such a way that the client user does not have to manually intervene? Or ...
9
votes
1answer
3k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
4
votes
1answer
1k views

Which extensions to use for a S/MIME certificate?

Analogously to the SSL server certificate question, which extensions should I use for S/MIME, and should the CA be restricted somehow as well? (I'm using openssl, which at the moment creates CA and ...
4
votes
2answers
2k views

Extensions for SSL server certificate

I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
3
votes
2answers
1k views

x.509 CRLs: next update?

An X.509 certificate revocation list contains a field specifying when the next such list is expected to be issued. I'm trying to figure out the importance of this field...I know that sometimes ...
8
votes
2answers
482 views

X.509 certificate policies question

I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies. To quote from the X.509 RFC: In an end entity certificate, these ...
2
votes
1answer
130 views

how does OpenSSL create X.509 certs from SPKACs?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
0
votes
1answer
662 views

X.509 certificate attack (small sha1 private key)

I've got a X.509 certificate, created by an unknown CA. The only thing I know is that the private key is very short, so I can retrive the private key. Is there any program I can use? The used ...
2
votes
1answer
402 views

X.509 certificate policy mapping question

So I'm a little confused how X.509 certificate policy mappings work. So let's say the following depicts my cert chain: root CA ---> intermediary CA ---> client cert Would the root CA have a ...
5
votes
1answer
2k views

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
4
votes
1answer
229 views

where to download revoked certificates from

I don't want the certificate revocation lists - I want actual full on revoked certificates for test purposes. For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and ...
5
votes
1answer
320 views

Which attributes of a X509v3 certificate are never really used?

Are there any extensions/extended key usage attributes of a X.509Certificate that are rarely or never used in practice? Either due to never being part of an issued certificate or because they are ...
3
votes
1answer
651 views

What are the Netscape Cert Type attributes? Why/when are they needed?

What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions? Example: There is the Client/Server Extended Key Usage (X.509) but there is ...