Tag Info

Hot answers tagged

56

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed. Source: http://support.microsoft.com/kb/293781 Some certificates that are listed in ...


4

Self signing would give you the benefits of encryption, but would not give the assurance that your clients were connecting to your server as it is not verifiable by a Certificate Authority. Self signing the server against its IP address would put you at risk of IP hijacking. Using IP instead of domain name takes DNS spoofing out of the equation, but does ...


2

Is this a hot issue for mostly security reasons [...] Not yet. There is no practical published attack yet. But it's in the post. The gradual transition now is better than the transition from the earlier MD5 hashing algorithm to SHA1. Back then there was no explicit deprecation strategy AFAIK and there actually were evil attacks that used ...


1

Signing will be done by the key only, so as long the key is not changed all signatures done by this certificate are still valid. But, when building the trust chain for a certificate it will look at the certificates issuer field and then search for a certificate having this issuer as the subject. Only after it found a certificate (or multiple) having this ...


1

This may or may not even be possible depending on what checks Nintendo does. If Nintendo only trusts their own certificate, signed by them, then you will be unable to make a key pair for the proxy that your DS will trust. Normal SSL/TLS MITM proxies require that the client trust the certificate used by the proxy as a root cert, that way the proxy can make ...


1

Is it a must-act-immediately-because-attacks-are-feasible-now? No. That said, when working with PKI, you must have a long vision, so start planning now. It is estimated that by the end of 2017, precomputed hash-collisions to create imposter certificates (and hence imposter CA certificates) may drop below 100,000$ in computation, using cloud computing ...



Only top voted, non community-wiki answers of a minimum length are eligible