Tag Info

New answers tagged

3

Self signing would give you the benefits of encryption, but would not give the assurance that your clients were connecting to your server as it is not verifiable by a Certificate Authority. Self signing the server against its IP address would put you at risk of IP hijacking. Using IP instead of domain name takes DNS spoofing out of the equation, but does ...


50

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed. Source: http://support.microsoft.com/kb/293781 Some certificates that are listed in ...


0

I had the same issue while renewing the certificate for our server at www.tpsynergy.com . After importing the new server certificate and restarting the tomcat, the error we were getting was ERR_SSL_VERSION_OR_CIPHER_MISMATCH. After lot of research, I used this link https://www.sslshopper.com/certificate-key-matcher.html to compare the csr (certificate ...


0

I think that's a calculated value by the Windows GUI. And not actually inside the cert. Have a look at the cert itself using OpenSSL. (openssl x509 -in MYFILENAME.CER -noout -text) Here's a blog that talks about this: http://morgansimonsen.wordpress.com/2013/04/16/understanding-x-509-digital-certificate-thumbprints/ the thumbprint is a computed field, ...


0

I am making a web site which can be considered similar to Reddit in some ways. I need to implement a sign up form so I will store informations about the users. My idea is to store the username, password, email address, and if they want also the gender, birthday and country. The type of data being transferred has little to no bearing in regards ...


0

To have a secure service, you must: Ensure that the data from your Client -> your Server is encrypted, that's where you need the SSL/TLS certificate Ensure that the security-related data (e.g. password) on your server is stored in encrypted / hashed+salted form. A certificate from StartSSL is as secure as a certificate from other CAs, if your client's ...


1

Signing will be done by the key only, so as long the key is not changed all signatures done by this certificate are still valid. But, when building the trust chain for a certificate it will look at the certificates issuer field and then search for a certificate having this issuer as the subject. Only after it found a certificate (or multiple) having this ...


0

So, how does an Intermmediate CA change one field, without having to reissue every single cert? It does a cross signature with it's old key (--placeholder -- would love to see a great answer on how cross signing works, or I'lll plainly and clearly ask that)


0

Because domain-validated certificates may scare Comodo Dragon users. Consider these five tiers of HTTP security (not an official list): No TLS (http:) TLS with a certificate that is self-signed or from an otherwise unknown issuer TLS with domain-validated certificate from a known issuer (organization not part of certificate) TLS with ...


1

This may or may not even be possible depending on what checks Nintendo does. If Nintendo only trusts their own certificate, signed by them, then you will be unable to make a key pair for the proxy that your DS will trust. Normal SSL/TLS MITM proxies require that the client trust the certificate used by the proxy as a root cert, that way the proxy can make ...


0

CA or a Sub CA Anything apart from a Root CA may in principle be revoked using the regular ways. (CRL and/or OCSP) [...] they may want to suspend the certificate till the time, they confirm that this is true. Technically you should be able to do this by using reason code "certificateHold (6)" on your CRL. This is a temporary revocation and ...


1

Is it a must-act-immediately-because-attacks-are-feasible-now? No. That said, when working with PKI, you must have a long vision, so start planning now. It is estimated that by the end of 2017, precomputed hash-collisions to create imposter certificates (and hence imposter CA certificates) may drop below 100,000$ in computation, using cloud computing ...


0

If you think a downstream (subordinate) CA is compromised, you have a duty in your position of trust to revoke the suspected compromised CA to prevent them from eroding trust in you, the parent CA.


2

Is this a hot issue for mostly security reasons [...] Not yet. There is no practical published attack yet. But it's in the post. The gradual transition now is better than the transition from the earlier MD5 hashing algorithm to SHA1. Back then there was no explicit deprecation strategy AFAIK and there actually were evil attacks that used ...


1

(Edit 2014-11-25: Reworded flushed out to phased out.) Short answer: From what I can tell, they will be gracefully phased out, not flushed out. (At least by Microsoft.) The old SHA1 root certs will expire regularly and Microsoft will no longer accept NEW SHA1-roots starting 2016. The old ones will stay in I guess, since they were compliant to the guidelines ...


1

If you want to do that install Firefox. Firefox comes with its own trusted CA store and what you add there will only be available to Firefox.



Top 50 recent answers are included