Tag Info

Hot answers tagged


So we had to install their root certificate "PrivateCompany Root CA" to our web server. Why? Globally trusted CAs are useful in general purpose clients like browsers. But if you consume specific web services from a custom client you can add that CA locally. Every decent SSL client allows you to influence certificate validation. For example by ...


There is only full trust with the CAs you've installed. This means, that there is no restriction which certificates a trusted CA can sign. So it can also sign fake certificates for sites they don't own (e.g. banking.com) and you will accept them. I don't know how you communicate with the partner, but with languages like Perl, Python etc you can specify a CA ...


Not only will they not issue new certificates for unvalidatable IPs, but also revoke them in 2016. https://www.digicert.com/internal-names.htm As from 1 October 2016, CAs shall revoke all unexpired Certificates. More info in Mozilla's Wiki: CA:Problematic_Practices#Certificates_referencing_hostnames_or_private_IP_addresses


For public IP it must be checked that the IP is actually owned by the one who requests the certificate. Issuing certificates for private (reserved) IP is deprecated because obviously the ownership cannot be checked. For more information see CA baseline requirements Sect 9.2.1.


While there doesn't appear to be any existing privacy-friendly CAs at this moment, all evidence suggests that the recently-announced Let's Encrypt CA (launching summer 2015) will not require users to provide personal information. This could change, but I doubt it will given EFF's involvement. If Let's Encrypt will not collect any personal information when ...


As far as other Certificate Authority (CA) root certificates security is concern, then there are no issues expect if you are going to implement an authorized Certificate Authority SSL certificate. If the security certificate is from Trusted Certificate authority then it never cause any security trouble.


To some extent what the company can do is limited to The Name Constraints (if any are applied) The Enhanced Key Usages (if any are applied) Of course this depends on client software properly validating each and every intermediate certificate in the chain, up to and including the root. It's possible that some client software doesn't validate the chain ...

Only top voted, non community-wiki answers of a minimum length are eligible