The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
22 views

Are X.509 nameConstraints on certificates supported on OS X?

I have the following "chain" of certificates on a test machine right now: A self-signed CA cert, in my Keychain and trusted & trusted by Firefox. A CA cert with with the following, X509v3 Name ...
3
votes
1answer
55 views

OpenSSL Certificate Expiry

I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL ...
0
votes
1answer
33 views

Should I use the certificate serial number or the subject key identifier to look up public key?

I'm designing an API authentication mechanism similar to the one AWS use. As part of that, I need to look up which public key belongs to which user to verify. The public keys come from x509 ...
1
vote
0answers
58 views

Distribution of a public key with a dotnet client application?

I have a pretty good understanding of X509 cryptography etc, from my career in the smart card industry. So I know that the card scheme (e.g. Visa, MasterCard) is the highest level of trust - they sign ...
0
votes
0answers
9 views

How to verify Signature Value using cert file in C#? [migrated]

I am noob in security sorry for that. I have an xml file which include, <?xml version="1.0" encoding="UTF-8" standalone="no"?> <ID_VG_Response> <Result> ...
0
votes
2answers
51 views

How to identify which root CA does the client certificate use?

How can we identify which root CA client used when there are multiple root CAs on the server? We can compare the public keys of the client certificate and the root certificate but if we have many ...
3
votes
3answers
37 views

do serial numbers for x509 certs need to be sequential or can they be timestamp's?

Serial numbers need to be unique for X.509 certs but do they need to be sequential or is making them equal to the time that the cert was generated sufficient?
2
votes
2answers
70 views

OpenSSL x509: Is there an order in subjectName fields?

Is there an order to respect in subjectName field when creating a x509 certificate with OpenSSL command? In other words, what are all possibilities of displaying subjectName of x509 certificate in ...
0
votes
0answers
28 views

How to generate “CRL numbers” for X.509 CRL

(Context: I'm working a process to publish a CRL periodically -- eg once every day.) With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to ...
2
votes
1answer
67 views

is x509 certificate signed by ca valid?

I've got certificate 'sample cert' which is valid to '2015-12-31' but it was signed by root CA certificate. But when it was signing CA cert was valid to 2015-06-30'. So my question is, is today ...
1
vote
1answer
63 views

Create PKCS7 signature, signed by X.509 CA, which embeds an XML file

I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within. How to do that with OpenSSL or any other tool?
4
votes
1answer
66 views

Difference between public key and private key validity period

In the section about certificate extensions, the ITU-T X.509 recommendation writes: The private key corresponding to a certified public key is typically used over a different period from the ...
1
vote
0answers
66 views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
1
vote
0answers
30 views

Potential hazards for reusing an X.509 private key for multiple services?

One thing I've been thinking about for a while is using a X.509 private key stored in a hardware security device (think YubiKey et al) on a one-per-machine basis. Theoretically, it should be possible ...
1
vote
1answer
52 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
3
votes
1answer
27 views

How common are UTF8 strings in X509

In theory, names in X509 certs are defined as: CHOICE { teletexString TeletexString (SIZE (1..ub-state-name)), printableString PrintableString (SIZE (1..ub-state-name)), universalString ...
3
votes
1answer
67 views

RemoveFromCRL and DeltaCRL

I have a question about DeltaCRL with an entry which contains RemoveFromCRL reason. At the start, PKI has revoked the certificate with certificateHold reason. And create next CRL: Last Update: May ...
0
votes
2answers
103 views

Is there any use in an AIA Extension in a Certificate directly issued by a Root CA?

While most documentation I've read states that there is no requirement to have the AIA extension in a self-signed Root certificate (logical enough), I can't find anything that tells me not to do so in ...
1
vote
2answers
68 views

Is the private key the only entropy in a X509 certificate?

Specifically, if I preserve the private key can I reproduce the exact same (self-signed) certificate at any time? The use case I have is a server-to-server protocol that allows (even encourages) ...
10
votes
3answers
2k views

Allowing the public to generate a CSR from your private key

As a hosting provider, I'd like to make the process of generating a certificate for a customer's domain as convenient as possible. I was pondering creating a webpage where anyone could: generate a ...
1
vote
0answers
127 views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
2
votes
1answer
51 views

Embed root certificate in software library

I am developing a network communication software library that uses handshaking similar to STARTTLS to enable upgrading to TLS security. I will be embedding a custom critical OIN policy into the ...
1
vote
2answers
167 views

How to be sure laptop's trusted certificates are safe

I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification ...
4
votes
1answer
61 views

Why there is a signed hash in Certificate request (.csr file)?

I wonder why there is a hash signed by private key in the CSR? It does prove that I have the private key that belongs to the public key in the .csr. But who cares whether I actually do possess the ...
3
votes
2answers
127 views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a ...
0
votes
0answers
56 views

Guidance on Login using Digital Signature DSC (PKCS12 and x509 certificate)

I'm interesting in exploring possibility to authenticate user using their Digital Certificate. The methodology is to first register the DSC from the user and keep their Public key along with Serial ...
1
vote
1answer
137 views

Generating x509 PEM files for testing PEM parser

I need to test a parser of PEM formatted certificates. Thus, I need to generate many variations including variations that are invalid for various reasons. Obviously I can use openssl or a library like ...
0
votes
1answer
64 views

Obtain X.509 Certificate Fingerprint from Certificate Info

I would like to obtain the SHA1/MD5 fingerprint of an X.509 certificate in order to compare it with the one presented by a server before connecting. However, I currently don't have access to the ...
2
votes
1answer
216 views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...
0
votes
2answers
73 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
3
votes
2answers
2k views

Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?

we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
2
votes
1answer
78 views

using commonName for DNS vs subjAltName

According to http://stackoverflow.com/a/26195101/569976#comment41093099_26195101 "[Using the DNS name as the common name is] deprecated by both the IETF and CA/B Forums, and it should not be done. ...
0
votes
2answers
114 views

How are “Certificate Signing” key usage certificates restricted to what domains they can sign?

Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate ...
0
votes
1answer
53 views

Can I sign a new certificate with a previously paid for certificate [duplicate]

For the last few months, I have been using self signed certificates to provide ssl for a system that I have been building. We are now getting ready to start getting external users on the system, but ...
2
votes
1answer
1k views

Recommended Key Usage for a client certificate

My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicate with the server to a path that requires a ...
0
votes
2answers
253 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
6
votes
2answers
3k views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...
3
votes
1answer
126 views

Must the distinguished subject name of an issued SSL Certificate match that of the generated Certificate Signing Request?

For example: from Issued SSL Certificate: CN = abc.com.my, OU = Room, O = House, C = MY from generated CSR: CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY Is it legal for a ...
2
votes
2answers
6k views

This certificate has an invalid digital signature

I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. ...
0
votes
1answer
1k views

x509 serial number - hex or decimal

When I run the openssl command openssl x509 -noout -text -in certname on different certs, on some I get a serial number which looks like this. Serial Number: 256 (0x100) On others, I get one ...
1
vote
0answers
131 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: ...
0
votes
0answers
183 views

Openssl command line: How to get “Policy: X509v3 Any Policy” in a certificate I am generating through openssl

I am trying to generate a certificate through openssl which has the following line X509v3 Certificate Policies: Policy: X509v3 Any Policy But I end up getting X509v3 Certificate Policies: ...
2
votes
3answers
144 views

Generating deterministic X.509 certificates?

Is there a way to deterministically create an RSA private-key for an X.509 certificate, ideally through a library which has been vetted already? i.e. user enters some phrase like "this is my private ...
1
vote
1answer
126 views

CSR's with null bytes in them

According to wikipedia.org's article on X.509 certificates, "There are implementation errors with X.509 that allow e.g. falsified subject names using null-terminated strings Marlinspike Blackhat 2009 ...
10
votes
3answers
2k views

Creating an X.509 certificate with an invalid signature

Creating an X.509 certificate with a valid signature with OpenSSL is pretty well documented all over the Internet. There are instructions on creating certificates that are signed by themselves and ...
2
votes
2answers
465 views

Certificate authority structure - best practices

I'm working for a company that sells software products to customers some of which do not have the resources and/or know-how to build and maintain their own CA (used for the SSL communication of our ...
0
votes
1answer
607 views

Security weaknesses in using RSA encrypted MD5 hash of certificate content

Suppose you have an Internet banking site based on a secure web server running the HTTPS protocol via port 443. The server authenticates itself to clients through an X.509 certificate signed by a ...
5
votes
1answer
2k views

Determine if private key belongs to certificate?

Given a certificate¹ and a private key file², how can I determine if the public key on the certificate matches the private key? My initial thought was to simply encrypt some text with the public key ...
2
votes
2answers
1k views

Load balancer and two machines - how many SSL certificates do I need?

We have a load balancer facing the Internet. It's balancing load towards two systems behind it in the back-end running apache. How many SSL certificates do I need to buy? - One for the load-balancer ...
2
votes
1answer
77 views

X509Certificate - How to set validation Policies?

I have an X509Certificate (say Certificate-A) for signing purpose. While validating this certificate, I have to check its path with Intermediate & Root certificate which I have implemented fully. ...