Tag Info

Hot answers tagged

50

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed. Source: http://support.microsoft.com/kb/293781 Some certificates that are listed in ...


2

Is this a hot issue for mostly security reasons [...] Not yet. There is no practical published attack yet. But it's in the post. The gradual transition now is better than the transition from the earlier MD5 hashing algorithm to SHA1. Back then there was no explicit deprecation strategy AFAIK and there actually were evil attacks that used ...


1

(Edit 2014-11-25: Reworded flushed out to phased out.) Short answer: From what I can tell, they will be gracefully phased out, not flushed out. (At least by Microsoft.) The old SHA1 root certs will expire regularly and Microsoft will no longer accept NEW SHA1-roots starting 2016. The old ones will stay in I guess, since they were compliant to the guidelines ...


1

If you want to do that install Firefox. Firefox comes with its own trusted CA store and what you add there will only be available to Firefox.


1

Signing will be done by the key only, so as long the key is not changed all signatures done by this certificate are still valid. But, when building the trust chain for a certificate it will look at the certificates issuer field and then search for a certificate having this issuer as the subject. Only after it found a certificate (or multiple) having this ...


1

This may or may not even be possible depending on what checks Nintendo does. If Nintendo only trusts their own certificate, signed by them, then you will be unable to make a key pair for the proxy that your DS will trust. Normal SSL/TLS MITM proxies require that the client trust the certificate used by the proxy as a root cert, that way the proxy can make ...


1

Is it a must-act-immediately-because-attacks-are-feasible-now? No. That said, when working with PKI, you must have a long vision, so start planning now. It is estimated that by the end of 2017, precomputed hash-collisions to create imposter certificates (and hence imposter CA certificates) may drop below 100,000$ in computation, using cloud computing ...



Only top voted, non community-wiki answers of a minimum length are eligible