Tag Info

New answers tagged

2

No matter which CA you go with, your users' assurance that they're actually communicating with your site and not an attacker is only as good as the worst CA their browser trusts - an attacker who wants to forge a certificate can shop for a CA with bad practices. So I don't see any plausible argument that your choice of CA impacts your site's security, unless ...


0

Mainly There are 3 types of SSL Certificates: (1) Domain Validation SSL Certificates It has a less rigorous validation procedure. Only the applicant's name and contact information are checked and verified with the data that was entered during registration. The legitimate factor is not checked, and therefore, this is excellent for online sites or ...


3

The signature algorithm specified when creating the CSR corresponds to the message digest used to sign the request itself, it is not intented to ask the CA to prefer that algorithm when signing your certificate. The MD used in the CSR establishes the level of confidence in your request, but does not imply what algorithm is used on the certificate since ...


0

It is legal and possible for the CA to take a CSR and modify the DN it finds there before issuing the certificate. For instance, with StartSSL free certificates they ignore the DN provided and issue based solely on the public key, the domain name requested (CN), the country (C), and email of the requester (E). And according to the user interface, ...


1

Like this: CA machine: ca.crt, ca.key Server: ca.crt, server.crt, server.key Clients: client.crt, client.key, ca.crt Notably, ca.key does NOT go on the server. If the server is compromised, then the attacker won't get ca.key. With easy-rsa you generate the key and certicate on the CA machine, and send them to the client. Technically you don't need to ...


0

Added as an at-least-partial answer so I can format: Those files (in comment to @Steffen) do have an encoding difference. ServerGroupCertificate.cer has Subject containing Org and OrgUnit as PrintableString and CommonName as T61String aka TeletexString, and 12-Digit-Working.cer has Issuer the same, but 10-Digit-Broken.cer (which is also client_cert.pem) ...


1

GeoTrust (and RapidSSL) certs have two trust paths. There is a root cert for GeoTrust Global CA valid 2002-05-21 to 2022-05-21 and now widespread, and also a "bridge" cert for the same CA valid 2002-05-21 to 2018-08-21 chaining back to Equifax Secure Certificate Authority which as you saw is valid 1998-08-22 to 2018-08-22. See my (updated) answer to google ...


1

They will have to issue a new certificate before theirs becomes invalid. As long as they use the same private key to sign their new (root) certificate, your (longer valid) certificate will be accepted, as long as you trust their authority. The certificate validity is not based upon the certificate itself, but the signature of the private key. Using the ...


1

Can you confirm what you're actually asking here; Is it that you have two domain names IE; 1 - Networkguys001-website.co.uk 2 - Networkguys001-mobileapp.co.uk and you want to have 1 certificate which secures both domains? If this is the case then what type of certificate did you buy from Digicert, I've included a list below; WildCard SSL ...


0

There are lot of strange things people doing wrong when using SSL. And while I've not seen this one it might be, that they are trying to use the serial number as 32 bit, which means a maximum value of 4294967296 (or 2147483648 is they use signed int). This would fit into your description where 10 digit is ok (at least if below 4294967296), but 12 digit is ...


1

I think it's more of a security concern as highlighted in 1. CAs like VeriSign uses the two-tier hierarchy (or trust chain) concept to provide more security. This is because the roles of the primary and secondary CAs are separated and may be hosted in different servers, maybe in different geographical locations. So, most probably more precautions are ...


0

The "DO NOT TRUST" is actually in the certificate itself as created by Fiddler. Fiddler is able to interpret HTTPS connections by acting as an HTTPS proxy. When you connect to a site via HTTPS, Fiddler produces a certificate that claims to be from that site and then accesses the real site. This way Fiddler can see the traffic, but your browser still acts ...


0

The way that I understand that Fiddler (And similar proxyies such as Burp or OWASP ZAP) work is that each installation generates a unique root certificate which it then uses to generate certificates on the fly when you have it assigned as a proxy, so you can intercept and modify traffic flowing over this connection (the purpose of the software). As the root ...


3

It's safe as long as you understand the implications. Fiddler acts as a proxy / man in the middle to intercept and decrypt traffic between you and the target. For SSL sites, it does this by dynamically generating an SSL certificate with the name of the target. The problem is that your browser will not trust certificates issued by Fiddler, hence the ...


5

From RFC 5280 3.3 Revocation An entry MUST NOT be removed from the CRL until it appears on one regularly scheduled CRL issued beyond the revoked certificate's validity period. If you have a lot of changes (people leaving etc.) it's best to not make the certificate validity too long otherwise the CRL can grow large (some CRLs are > 30MB which ...


2

Expiration date is "baked" into certificate itself, so even if time on client is incorrect this wouldn't cause server to mistakenly accept the certificate. Server clock, on the contrary, have to be correct. Now, whether or not it is safe to remove expired certificates from the CRL depends on how server verifies certificates and, in particular, whether it ...



Top 50 recent answers are included