An ITU-T standard for privilege management infrastructure (PMI) and a public key infrastructure (PKI).

learn more… | top users | synonyms

-1
votes
2answers
46 views

what is the different between X.509 certificate and 2-way SSL? or both are same? [duplicate]

Can anyone clarify what is the difference between an X509 certificate and two-way SSL? or both are same?
2
votes
0answers
32 views

SSL/TLS: Policy Constraints vs. Basic Constraints

Could someone please explain the difference between Policy Constraints and Basic Constraints? It appears to me that they are either redundant, or two names for the same thing. I would love some ...
5
votes
1answer
32 views

Can attribute certificates be used with TLS / HTTPS?

Can attribute certificates (also known as authorization certificates) be used with HTTPS? For instance, can a HTTPS server supply an attribute certificate in addition to its ordinary SSL certificate? ...
4
votes
1answer
71 views

X.509 Certificate Signature Collision Vulnerability

Customer complained that during security scan performed on our application the following was raised: 172.22.0.19 - xxxxx - IETF X.509 Certificate Signature Collision Vulnerability - ...
1
vote
1answer
68 views

Are fields of a root CA certificate checked?

During SSL server validation, it seems that the only fields of X509 certificates found in trust stores that are actually used are the "Common Name" and the "Public Key". I'm not talking about any ...
0
votes
1answer
151 views

Creating root CA to issue certificates programatically

I have to generate a self signed root CA and use it to issue to certificates programatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
0
votes
0answers
16 views

SCEP CertRep SUCCESS: how many certs are in the response?

I am working on an SCEP implementation (both requester and authority). The project uses JScep as a library. During the communication for a PKCSReq the client receives a CertRep SUCCESS. The draft ...
2
votes
1answer
51 views

signature and padding

I use JcaContentSignerBuilder to sign a self-signed certificate but I don't know what the default padding is. My requirement is that I must NOT use PKCS#1.5 padding. The code I use is below - can ...
1
vote
2answers
40 views

Include multiple pub keys in a x509v3-cert

Is it possible to include multiple public keys and the issuer's public key in one x509v3-certificate?
0
votes
1answer
40 views

CRL verification with renewed CA

I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed. Suppose I have the following setup: ...
1
vote
1answer
21 views

Validating a certificate chain without x509v3 Subject Key IDs

I work for a hosting company and we do not currently offer certificate signing services, so we have to accept 3rd-party certificates from non-technical clients. I am trying to build a tool to verify ...
1
vote
0answers
40 views

Verify request using the X509 certificate [closed]

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML. BinarySecurityToken (X509PKIPathv1 certificate) ...
3
votes
1answer
133 views

How can I use my HSM to turn a CSR into a certificate?

I create a CSR using OpenSSL, so I have public and private keys. Now I want to sign this CSR and convert it into an X.509 certificate. The only problem is, my signer is a custom HSM. I can send bytes ...
1
vote
1answer
112 views

x.690 universal class tags implementation reference

Can anyone with enough knowledge of X.690 tell me where can I find the official reference implementation for the universal class tags for X.690. (For example: For TLS we can reference RFC 5246.) When ...
2
votes
1answer
62 views

Attribute Certificates and Access Management

I recently came across Attribute Certificates (RFC 5755), which can be used as a means for authorisation. I like the idea but I have spent a lot of time searching for information how this works in a ...
0
votes
1answer
223 views

Difference between certificates with “extension fields” and “Non Repudiation” usage

For example we have two certificate pairs: First pair: Server cert with "Non Repudiation" (sometimes called Content Commitment) usage, Client cert without any "extension fields". Second pair: ...
0
votes
0answers
56 views

Certificate policies extension in Root CA and Issuing CA

I am building new CA chain and PKI and I actually don't fully understand how I should include certificate policies (CP) and certificate practice statements (CPS) as extensions and how to work with it ...
1
vote
1answer
83 views

Certificate expiry validation - in what stage?

I'm implementing certificate expiry validation for a client. I'm not sure about the following. Is there a standard/popular implementation regarding the order of validation- Check if the ...
4
votes
2answers
146 views

Are X.509 nameConstraints on certificates supported on OS X?

I have the following "chain" of certificates on a test machine right now: A self-signed CA cert, in my Keychain and trusted & trusted by Firefox. A CA cert with with the following, X509v3 Name ...
3
votes
1answer
103 views

OpenSSL Certificate Expiry

I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL ...
0
votes
1answer
150 views

Should I use the certificate serial number or the subject key identifier to look up public key?

I'm designing an API authentication mechanism similar to the one AWS use. As part of that, I need to look up which public key belongs to which user to verify. The public keys come from x509 ...
1
vote
0answers
81 views

Distribution of a public key with a dotnet client application?

I have a pretty good understanding of X509 cryptography etc, from my career in the smart card industry. So I know that the card scheme (e.g. Visa, MasterCard) is the highest level of trust - they sign ...
0
votes
2answers
250 views

How to identify which root CA does the client certificate use?

How can we identify which root CA client used when there are multiple root CAs on the server? We can compare the public keys of the client certificate and the root certificate but if we have many ...
3
votes
3answers
76 views

do serial numbers for x509 certs need to be sequential or can they be timestamp's?

Serial numbers need to be unique for X.509 certs but do they need to be sequential or is making them equal to the time that the cert was generated sufficient?
2
votes
2answers
236 views

OpenSSL x509: Is there an order in subjectName fields?

Is there an order to respect in subjectName field when creating a x509 certificate with OpenSSL command? In other words, what are all possibilities of displaying subjectName of x509 certificate in ...
0
votes
0answers
90 views

How to generate “CRL numbers” for X.509 CRL

(Context: I'm working a process to publish a CRL periodically -- eg once every day.) With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to ...
2
votes
1answer
83 views

is x509 certificate signed by ca valid?

I've got certificate 'sample cert' which is valid to '2015-12-31' but it was signed by root CA certificate. But when it was signing CA cert was valid to 2015-06-30'. So my question is, is today ...
1
vote
1answer
344 views

Create PKCS7 signature, signed by X.509 CA, which embeds an XML file

I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within. How to do that with OpenSSL or any other tool?
4
votes
1answer
202 views

Difference between public key and private key validity period

In the section about certificate extensions, the ITU-T X.509 recommendation writes: The private key corresponding to a certified public key is typically used over a different period from the ...
6
votes
2answers
211 views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
2
votes
0answers
40 views

Potential hazards for reusing an X.509 private key for multiple services?

One thing I've been thinking about for a while is using a X.509 private key stored in a hardware security device (think YubiKey et al) on a one-per-machine basis. Theoretically, it should be possible ...
1
vote
1answer
135 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
3
votes
1answer
49 views

How common are UTF8 strings in X509

In theory, names in X509 certs are defined as: CHOICE { teletexString TeletexString (SIZE (1..ub-state-name)), printableString PrintableString (SIZE (1..ub-state-name)), universalString ...
3
votes
1answer
98 views

RemoveFromCRL and DeltaCRL

I have a question about DeltaCRL with an entry which contains RemoveFromCRL reason. At the start, PKI has revoked the certificate with certificateHold reason. And create next CRL: Last Update: May ...
0
votes
2answers
231 views

Is there any use in an AIA Extension in a Certificate directly issued by a Root CA?

While most documentation I've read states that there is no requirement to have the AIA extension in a self-signed Root certificate (logical enough), I can't find anything that tells me not to do so in ...
1
vote
2answers
101 views

Is the private key the only entropy in a X509 certificate?

Specifically, if I preserve the private key can I reproduce the exact same (self-signed) certificate at any time? The use case I have is a server-to-server protocol that allows (even encourages) ...
10
votes
3answers
2k views

Allowing the public to generate a CSR from your private key

As a hosting provider, I'd like to make the process of generating a certificate for a customer's domain as convenient as possible. I was pondering creating a webpage where anyone could: generate a ...
1
vote
1answer
316 views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
2
votes
1answer
58 views

Embed root certificate in software library

I am developing a network communication software library that uses handshaking similar to STARTTLS to enable upgrading to TLS security. I will be embedding a custom critical OIN policy into the ...
1
vote
2answers
228 views

How to be sure laptop's trusted certificates are safe

I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification ...
4
votes
1answer
83 views

Why there is a signed hash in Certificate request (.csr file)?

I wonder why there is a hash signed by private key in the CSR? It does prove that I have the private key that belongs to the public key in the .csr. But who cares whether I actually do possess the ...
3
votes
2answers
224 views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a ...
0
votes
0answers
153 views

Guidance on Login using Digital Signature DSC (PKCS12 and x509 certificate)

I'm interesting in exploring possibility to authenticate user using their Digital Certificate. The methodology is to first register the DSC from the user and keep their Public key along with Serial ...
1
vote
1answer
184 views

Generating x509 PEM files for testing PEM parser

I need to test a parser of PEM formatted certificates. Thus, I need to generate many variations including variations that are invalid for various reasons. Obviously I can use openssl or a library like ...
0
votes
1answer
97 views

Obtain X.509 Certificate Fingerprint from Certificate Info

I would like to obtain the SHA1/MD5 fingerprint of an X.509 certificate in order to compare it with the one presented by a server before connecting. However, I currently don't have access to the ...
2
votes
1answer
253 views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...
0
votes
2answers
101 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
5
votes
2answers
4k views

Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?

we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
3
votes
1answer
147 views

using commonName for DNS vs subjAltName

According to http://stackoverflow.com/a/26195101/569976#comment41093099_26195101 "[Using the DNS name as the common name is] deprecated by both the IETF and CA/B Forums, and it should not be done. ...
0
votes
2answers
177 views

How are “Certificate Signing” key usage certificates restricted to what domains they can sign?

Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate ...