Hot answers tagged

5

You cannot use your SSL certificate purchased from Let's Encrypt to sign other certificates. In order to do this, your certificate must be CA certificate. This is done by setting isCA=true in the BasicConstraints certificate extension. In addition, KeyUsages extension should include a keyCertSign bit enabled. Your SSL certificate doesn't have such setting ...


4

["Facebook" here is just "an example of someone that wants a certificate." There is no inherent special Facebookness about this situation.] Who generated that public key that I can see in facebook certificate? Is it generated by Facebook or that intermediary CA? Facebook generates the "keypair" consisting of a public key and a private key. ...


3

"Complexity is the enemy of security" I would always look to use the least amount of certs possible for a number of reasons, mostly due to the ease of administration. It's my understanding that letsencrypt is not currently allowing wild card certificates (these certificates essentially allow you to secure all subdomains of a domain where the traditional ...


2

It depends on a multiple factors, certificate management strategy, policies and so on. For general purpose web applications I would go with a single certificate per machine if they use different names. You can run separate certificates on per-service basis, but this will increase administrative efforts in certificate management. If you go with single ...


1

(1) Does the verification of the chain end there or does it continue on until we get to D? it depends on a certificate chaining engine (CCE) implementation. Different platforms have different implementations which may not support all recommended/mandatory validation logic described in RFC5280. Certificate trust requires an end of chain point which is ...


1

The JDK is offered over HTTP because they also offer a hash for you to confirm over secure channels. Since the hash is over a secure channel, if that hash can't be confirmed you shouldn't use the download. The fact that the part of truth(the hash you check against) is delivered securely means they can offer it over HTTP because you will be able to securely ...


1

AFAIK, some of them are in countries, where single entity (gov) can covertly do whatever it wants on their machines. Yes, pretty many countries are like that today. Sadly, concerning governments, the CA system is not (and never was) secure. CAs are still good for preventing some people and organisations from attacking, just not all.


1

It is an arbitrary, administrative decision for the creator of CA what client certificates they want to enable to be signed by the CA. The policy_match in the following configuration line: policy = policy_match is a chosen name that corresponds to a particular section in the configuration file. That section defines in details each of the [ ...


1

For instance the procedure never asks you to create a private key, instead they magically create one for you. I know cryptography is magic, but in this case it is also secure... :-) Because when using a Let's Encrypt client the key pair is generated locally on your server and not send to Let's Encrypt servers* - in contrast to some other commercial CAs, ...


1

Thomas Pornin's answer is good, but a little outdated. Support for Name Constraints is growing. I've found that OpenSSL 1.0.1k and Windows 7 support the extension. Test Using XCA, I created a self-signed CA certificate, and added a critical Name Constraints extension for .lab.example.com, by adding the following line on the "Advanced" tab during ...



Only top voted, non community-wiki answers of a minimum length are eligible