Hot answers tagged certificate-authority
This "Kaspersky Anti-Virus Personal Root Certificate" is the sign that your anti-virus is actively intercepting the connection, in effect running a Man-in-the-Middle attack. This can work because your anti-virus runs locally (on your computer) its own certification authority, and inserted the corresponding CA key in the "trusted store" used by your browsers ...
As pointed out in other answers, the reason why you see "Kaspersky Anti-Virus Personal Root Certificate" is because Kaspersky intercepts the connection, in order to scan for malware. Now, the reason why it isn't the case for Google websites in Chrome is not related to certificate pinning: Chrome does not perform pin validation when the certificate ...
Edit 2015-11-25 "PowerShell-PKI" project looks promising Bryan Lockwood has put a a nice project on GitHub: https://github.com/bklockwood/Powershell-PKI And here's his blog post that introduced it Bryan Lockwood, 2015-02-24, Auditing Your Root Certificates (Archived here.) You can run the script like so: Copy Nov2015-WindowsRootCAList.txt to ...
This is because Kaspersky installs a CA Certificate on your system and in commonly used browsers to be able to intercept SSL connections. This can be useful to detect malware. The second hierarchy you quoted is the correct one.
Why would browser community need/want a blacklist if these "harmless" certificates never left the Symantec test labs? These are certificates for official and even critical domains. There were created and signed by an official CA. A certificate is just some data which can be easily copied. So how do guarantee that they never left the lab? Should you ...
Marketing. The providers want you to select them because they list something that someone else doesn't list, even though all certs support the same level of encryption as you noted. Price has nothing to do with security. In fact, all the SSL certificates depend on the lowest level security of any of them. No. The SSL handshake has zero to do with ...
As long as they are valid certificates issued by a trusted CA and you aren't using something like HPKP, there will be no impact on the client. In fact, it looks like the client won't even see the cert on the server itself. It will only see what the WAF is using.
To get the SSL/TLS Certificate of an SMPT server pick the domain of one MX record from the answer section of your DNS query and feed it to openssl: $ dig gmail.com mx [...] ;; ANSWER SECTION: gmail.com. 3599 IN MX 20 alt2.gmail-smtp-in.l.google.com. gmail.com. 3599 IN MX 5 gmail-smtp-in.l.google.com. gmail.com. 3599 IN MX 30 ...
Which CRL should the crlDistributionPoints contain to for the intermediate CA? The root CA's CRL or the intermediate CA's CRL? The crlDistributionPoints must point to the CRL which will contain the revocation for the certificate itself. Thus in case of an intermediate CA this will probably be the CRL signed by the issuer CA, although it can be any other ...
According to the last post (dated 2015-09-09) in the subjectAltNames certificates thread: yes, subjectAltNames for unrelated domains will be allowed.
I think there is a fundamental misunderstanding in this question. HTTPS does not provide reliable authenticity. The use of Domain Validation by CAs helps to ensure that the certificate corresponds to the domain, but if you go to citti.com when you meant to go to citi.com, caveat emptor! AFAIK, the risk of MITM attacks involving a false certificate has ...
Strangely, if we install the Issuer (intermediate) cert on the server manually, the authentication goes through. It looks like the client is not sending the necessary intermediate certificate but only the lead certificate or the leaf certificate and some older intermediate certificate.
To validate the certificate of the client the server must be able to build the trust chain. That means that either the server needs to know all intermediate certificates already or the client has to include these together with its own certificate. This is no different from checking the server certificate at the client.
Only top voted, non community-wiki answers of a minimum length are eligible