Tag Info

Hot answers tagged

12

Google blogged about flagging Certificates using SHA-1 here -> Gradually sunsetting SHA-1 There's no reason to get a new certificate yet as Chrome won't be actually blocking the certificate just treated as “secure, but with minor errors”, I believe that some issuers are offering to reissue certificate but as always, YMMV.


12

Solved. The problem was indeed triggered by installing Apple Mavericks/ML Security Update 2015-004. As mentioned in this Apple release note, it included updates to the certificate trust policy. There was a duplicate certificate installed (with a wrong serial no.), removing it fixed the problem. The serial number for the cert as published by Apple matched ...


7

It's a rather short list: ‘admin’, ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’ Now that's the fixed and static list. But: contact info from WHOIS is also legal. From the CAB-Forums' Baseline requirements, page 17: 11.1.1 Authorization by Domain Name Registrant For each Fully-Qualified Domain Name listed in a Certificate, the CA SHALL ...


5

You don't need to get another new certificate. In order to resolve this issue, you need to just reissue your certificate with SHA-2 signature. That's it.


5

is it trust-worthy because the CA authority did a background check on them? No. A SSL certificate is comparable to a passport: it says who the person is and which country the passport issued. But it does not say how trustworthy the person is. The main use of the certificate is to make end-to-end encryption possible, that is protecting against ...


2

No, you cannot use the same certificate for both server- and client-side SSL authentication. (Well, technically, you can - it won't break anything - but it means that the server private key will be known to N clients, each of which can then impersonate it, so that's just not going to work out.) If you wanted to do Client SSL authentication, you'd want to ...


2

Actually, there is an often unused (at least on the web) optional part of SSL/TLS that allows for client authentication. It is generally not used on the web because the server doesn't really care if the client is who they say they are - they just need to have the proper credentials. Additionally, imagine the nightmare of having to verify every client in the ...


2

There are two chains up to Verisign Class 3 G5. At one point, Verisign was chaining to that root via a longer chain, and some OSes were confused when walking up the AIA versus walking up the chain handed by the server to the client. This sounds like a significant problem, especially since the combined Symantec properties are the largest tier 1 CAs. I do ...


2

The PKI model works on the trust you can give to the initial third party. Namely, the root CA. If you trust the root CA, you should import their root certificate, so that any certificate they issue (sign) will be automatically accepted by your system. If you do not trust the CA, well there is nothing more you can do. So why would you trust CAcert.org ? ...


1

Trusting a CA means that you trust the CA for all certificates issued by this CA. But because all CAs are treated the same by the browser (except for EV certificates) any CA could create a certificate for any site. This means it is enough if a single trusted CA is not as trustworthy as needed and this kind of trust problems happened several times in the ...


1

I found a solution as I was looking for; http://blog.engelke.com/2015/03/03/creating-x-509-certificates-with-web-crypto-and-pkijs/ But I'll try pem modulus at first. Because it works on back-end and seems more simple.


1

It should be noted that there's nothing wrong with the certificates from a TLS or x509 point of view. The CA/Browser forum applies to CAs issuing publicly-trusted certificates that subscribe to those guidelines. Not all TLS or x509 use cases involve public trust. An internal government or enterprise CA, for example, might reasonably choose to completely ...


1

The structure is all wrong. If Google uses this intermediate cert only for signing Google-owned domains (which I think is the case) they can't do it with a restricted path certificate, because they need to sign google.com and google.co.uk and gmail.com and even com.google now that they own that TLD. In my opinion, the PKI was poorly designed to begin with, ...


1

It's possible that this CA certificate is linked to GeoTrust's root certificate by way of Geotrust's 'GeoRoot' service, which "Allows Organizations with Their Own Certificate Authority (CA) to Chain to GeoTrust's Ubiquitous Public Root ". See ...


1

"fakebook.com has acquired a certificate from on the trusted CAs" : Normally (and I said normally, because to say it so "the world isn't perfect") this step should not happen. A really trustable CA should benefit from specific services from third-party societies (like Netcraft) so, when you try to register a new domain name, they will automatically check it ...


1

Generally, the very nature of PKI (and some good system maintenance) should prevent this from being a security risk. But personally, I'm not sure I'd really want just any website to be able to enumerate my Trusted Root CA list. This sounds like a good way to phish out systems vulnerable to attacks using stuff like DigiNotar certs or certificates from other ...



Only top voted, non community-wiki answers of a minimum length are eligible