Tag Info

Hot answers tagged

3

The signature algorithm specified when creating the CSR corresponds to the message digest used to sign the request itself, it is not intented to ask the CA to prefer that algorithm when signing your certificate. The MD used in the CSR establishes the level of confidence in your request, but does not imply what algorithm is used on the certificate since ...


2

No matter which CA you go with, your users' assurance that they're actually communicating with your site and not an attacker is only as good as the worst CA their browser trusts - an attacker who wants to forge a certificate can shop for a CA with bad practices. So I don't see any plausible argument that your choice of CA impacts your site's security, unless ...


1

Like this: CA machine: ca.crt, ca.key Server: ca.crt, server.crt, server.key Clients: client.crt, client.key, ca.crt Notably, ca.key does NOT go on the server. If the server is compromised, then the attacker won't get ca.key. With easy-rsa you generate the key and certicate on the CA machine, and send them to the client. Technically you don't need to ...


1

GeoTrust (and RapidSSL) certs have two trust paths. There is a root cert for GeoTrust Global CA valid 2002-05-21 to 2022-05-21 and now widespread, and also a "bridge" cert for the same CA valid 2002-05-21 to 2018-08-21 chaining back to Equifax Secure Certificate Authority which as you saw is valid 1998-08-22 to 2018-08-22. See my (updated) answer to google ...


1

They will have to issue a new certificate before theirs becomes invalid. As long as they use the same private key to sign their new (root) certificate, your (longer valid) certificate will be accepted, as long as you trust their authority. The certificate validity is not based upon the certificate itself, but the signature of the private key. Using the ...


1

Can you confirm what you're actually asking here; Is it that you have two domain names IE; 1 - Networkguys001-website.co.uk 2 - Networkguys001-mobileapp.co.uk and you want to have 1 certificate which secures both domains? If this is the case then what type of certificate did you buy from Digicert, I've included a list below; WildCard SSL ...


1

I think it's more of a security concern as highlighted in 1. CAs like VeriSign uses the two-tier hierarchy (or trust chain) concept to provide more security. This is because the roles of the primary and secondary CAs are separated and may be hosted in different servers, maybe in different geographical locations. So, most probably more precautions are ...



Only top voted, non community-wiki answers of a minimum length are eligible