Hot answers tagged

7

Kinda. The browser verifies the certificate was issued by the CA without contacting the CA. But the certificate might have been revoked since then, for example because the site's private key leaked. To verify the certificate has not been revoked, the browser needs to contact the CA's CRL or OCSP site. If those are down, there is no way to know whether the ...


5

It would be a huge operational cost in environments that don't have automated certificate management in place, which, in reality is the vast majority of the operational environments in the world today. In fact, in most environment little to nothing is automated. We've just started seeing people dip their toes in those waters in the past few years, and most ...


3

No. The CA's root certificate is usually installed in the client's certificate store. When the client makes a handshake request, they receive the cert from the site (which I'll refer to as example.com). The cert for example.com will include a root cert and possibly an intermediate cert, and the client (in this case, the browser) will check its cert store to ...


3

In short: the intermediate certificates have to be sent within the TLS handshake (needs proper configuration of the server) and only the CA local at the client will be considered as trust anchors. In detail: ... see that it does not have the issuing ca (intermediate ca's public key), will it automatically download those intermediate cert (e.g. ...


2

First, you should read through the most famous question on this site: How does SSL/TLS work?, having a good understanding of TLS will clear up a lot of your questions. Answering your questions: a) When a browser visit my site ... will prompt the end-user (using the browser) whether he/she wanted to install those certs? No, visiting a site in a ...


2

PKCS#10 is a specification defining what and how attributes should be contained in a Certificate Signing Request in order for it to be compliant. It is used as the default specification for most certificate signing authorities. This specification dictates the use of ASN.1. ASN.1, also known as Abstract Syntax Notation One, is a standard that defines rules ...


2

I have never heard the term "retire" applied to certificates. Maybe it has a specific meaning within the context of your certificate management tool? A "revoked" certificate should be considered compromised and no longer trusted. My guess is that a "retired" certificate is no longer being managed by the CA, but there's no evidence of compromise, so the ...


2

I would think this might have to do with what flag is used to mark the cert when it is added to the revocation list. A cert added with reason 4(superseded) or reason 5(cessationOfOperation) are not being revoked because of some compromise or inherent flaw so could be considered to be "retired". There have been several types of certs(sha1 and MD5) that are ...


2

[Note: In the first wording of the question, there appeared to be some pretty glaring conceptual problems, the re-wording fixed these. I am going to leave this answer here anyway in hopes that it's useful to somebody.] PKI Fundamentals I think we need to go back to basics on how Public Key Infrastructure and certificates work. I am going to shamelessly ...


2

I just suspect the configuration is maybe wrong somehow, but why Chromium on my PC gives a green light? If you check your site with SSLLabs you will probably see that it has chain issues, i.e. missing an intermediate certificate. Chrome on Desktop tries to fill in missing certificates by itself and thus works. Firefox will only fill in a missing ...


1

As to the first part of your question. the answer is NO, and all who say it is forget that that also means breaking essential layers of security on the device. as to the second it is possible but highly dubious to do so. The way to do this is by buying a certificate for a domain (like localapp.example.com) and have its DNS entry point to 127.0.0.1. and ...


1

The two options you mention are almost correct: However, you can (and should) install self-signed certificates without them being Certificate Authority certificates. The difference between a self signed cert and a CA cert is that a CA certificate is a special self-signed certificate with its "basicConstraints" set to "CA:true" (usually with the critical ...


1

The name of the field is Certificate Signature Value. For example, this site SSL certifcate for : ssl333133.cloudflaressl.com has the value : Size: 72 Bytes / 576 Bits 30 46 02 21 00 b7 76 6a 60 32 00 4b 76 49 92 8f cb 1a b5 d7 64 55 37 fb 81 0c 65 23 1e 80 b5 a1 e5 1b 7a 7c 5e 02 21 00 a5 22 6e 4e fe 3a b4 4e 15 72 e1 d9 48 c8 b5 4a 3e 63 5f c4 d5 34 ...


1

Resolved. The site needed to add the intermediate cert to the PEM file. I was overlooking the trust chain view in the browser that showed it was fetching the intermediate cert, a step that wasn't performed in the other use cases. So to answer my questions: The effective trust chain was in fact visible by calling up the security details by clicking the ...


1

The signature algorithm used in the root certificate is not used to establish trust against the root certificate because a root certificate is trusted by the virtue of a copy of the root certificate is installed in the browser, either included in the browser as part of the installation, or added later by the user to their certificate store. For the rest of ...



Only top voted, non community-wiki answers of a minimum length are eligible