Tag Info

Hot answers tagged

52

It is already done: It is the FPKI root CA, under explicit and full control of the US government. Windows already trusts it by default. Before you flip out and begin to delete root CA certificates, burn your computer's motherboard, or drink a gallon of vodka, think about what it means. It means that the US government could technically emit a fake ...


2

No, this is not the case. A certificate signed by a CA contains only the public key, but for decrypting you need the private key too. This private key is not needed for the CA to sign the key, so they usually don't have it either. But, some CA offer to simplify the process of certificate generation by generating a key pair for the certificate too. In this ...


2

You are missing a very important part of a Digital Certificate here. That part is Digital Signature. Basically, a Digital Certificate consists of 3 parts: A public key. Certificate information. ("Identity" information about user, such as name, user ID, and so on.) One or more digital signatures. A digital signature an encrypted hash of the ...


2

SSL certificates have an extension field that defines what a certificate is allowed to be used for. When you buy a certificate from VeriSign with your certificate signing request, it typically will not include the extension permission for signing downstream certificates with your certificate; especially for any domain you don't have authority for. Take ...


2

In many cases, the intermediate certs do mean something. Sometimes it mean the Insurance level (how much the signer will pay you in the event of a fraudulent verification) or it can mean the validation level (only domain verified, or full verified with Company details and Everything). In this case, Comodo isnt even the top signer. Instead its a Company ...


2

They don't need to offer another certificate which points to them. They just need the private key of the server certificate to eavesdrop on the communication, which is probably easy to obtain if you have that kind of resources.


1

Ironically enough, X.509 certificates can theoretically be scoped to specific domains and sub-domains, through the Name Constraints extension: if a CA certificate contains a Name Constraints extension with a permittedSubtrees field containing a dNSName of value example.com may issue certificates only if the host names appearing in the Subject Alt Names ...


1

There is potential protection in the form of certificate pinning. This can be done in an application, and some browsers (hopefully all in the future) support it in the form of certificate pinning. Certificate pinning can take two forms, first, you can submit the fingerprint for your certificate to the browser vendors (Google and Mozilla, currently) to be ...


1

All a site needs to do is to present a certificate signed by a trusted CA. There is currently no way to "scope" CAs (limiting what origins they can sign certificates for) nor is there a way for a site to specify which CAs are valid for it. (And even if there were, this is a bit of a chicken-and-egg problem, how would you know that information is valid?) ...


1

One way to do this is open the server up in your browser like so: https://[smtp server]:[port]. Then save the certificate that your browser encounters. For instance, https://smtp.gmail.com:465/ To do this quickly, I used Internet Explorer. To do this in a real browser you will need to override port "protection", as apparently internet users are toddlers to ...


1

The problem you are outlining is not a problem with digital signature per say, but is part of a bigger problem with establishing identity in PKI systems. A digital signature on some data proves (assuming that your digital signature algorithm is secure) that this data has not been altered except by whoever holds the matching private key. You still need to ...


1

No. It's irrelevant, although it's better that they don't use weak root signatures. I think the setting may refer to the intermediate CA instead. Remember that from 01/01/2017 Microsoft will start rejecting SHA-1 signed SSL certificates, and Google will degrade the security level indicator for those sites with a certificate which is valid after 01/01/2016, ...


1

Yes. You can use OpenSSL to convert the certificate into different formats as required by the application / server. I've seen Apache / Tomcat configured a number of ways. Sometimes with a .pfx, sometimes with .pem files, and sometimes using the Java keystore. IIS typically uses .pfx files. With that being said, you want to make sure that your CA allows ...


1

Yes, you can buy one certificate and use it on unlimited number of servers. However, some servers may require you to convert the certificate and the private key into an appropriate format. You may look into documentation to find the details for each program.



Only top voted, non community-wiki answers of a minimum length are eligible