Tag Info

New answers tagged

1

Both chains are actually OK. The third certificate in both cases matches a real root CA (I checked against my machine's root, which fingerprints I then checked against the CA's sites via HTTPS on a separate iPad which is newly-purchased and should have proper certificates installed). Here's what's happening: Certificates and public keys don't have a ...


3

From point 1), if you live in those countries, with "spain...etc", if there anyway to check that the CA you are using (in firefox for example or other) is the proper company , for example google/gmail? and not the government one? You can check the certification path to find out which intermediary and root CAs signed the certificate that you are ...


2

Two years after the initial question, things seem to have changed a bit. Facing the same issue, I found that the letsencrypt service does not sign certificates for localhost and the reason for that is stated here: https://github.com/letsencrypt/boulder/issues/137 and here: https://cabforum.org/pipermail/public/2015-June/005673.html In a nutshell, indeed ...


1

As a user/client, you can revoke a certificate only if it contains the same subject name as the certificate presented for authentication. You can do that using the revocation form provided in the end-entities page. Otherwise only if you are a CA administrator or a Certificate Manager you can do it by yourself. Implement Role-Based Administration: CA ...


0

Certificates can't be changed after they are created, but you can always create/request another. Talk to the company that created your certificate (e.g GoDaddy) and says you want them to revoke your old certificate and issue a new one they will probably create another with SHA2 by default.


0

For the European Union, there seems to be a list of Trusted CA available here usable to authentify such signature. You should import the list into you software (the same way that browsers are provided with a common Web CA list already imported in them) then it will be usable as root to ensure digital signature authenticity. Some countries also propose ...


1

Does any nation-state CA (certificate authority) have a public API to verify digital signatures? No, the CAs do not verify digital signatures, the relying-parties (the recipients) do the verification by themselves, using their own software applications. Eg, use Adobe Reader (free version) to verify digitally signed PDFs. However, the CA's do publish a ...


5

Generally speaking, in the certificate request, these values do not matter. What matters is what appears in the resulting certificate, and the certificate contents will be chosen by the CA, not by you. The certificate request is a vessel to convey your public key to the CA; that request uses a format (normally PKCS#10) that includes a space of a "subject ...


3

The CA/Browser Forum Baseline Requirements (PDF) specifies that these fields in the Subject of the certificate should be filled in accordance with the validation of the identity and address of the requestor by the CA. This validation shall be done with a document or information provided by: A government agency in the jurisdiction of the Applicant’s ...


3

You should provide the information of the company (postal address being the HQ's location) or your own information if you're an individual. Truth is, for an automatically-issued DV (domain validation) certificate, nobody is going to check and all you really care for is that the CN (common name) matches the hostname of the server you're getting the ...


1

The required information are information about the owner of the domain and have nothing to do with the location of the server. This is similar to the registrant in DNS. This means if you own the domain as an individual there is no organization.


0

You do not have to install them. This is the certificate chain the webserver should provide for the clients so they are able to verify the certificate. The CA's root certificate is in the browsers or OS' store of trusted certificates. CA's usually don't sign client's CSRs with the root certs, but with intermediate certificates, which are by themselves ...


43

You are right assuming the certificate is useless without the private key, so sending it in the mail is no big security risk and is common practice actually. The certificate is supposed to be public, connecting to your website would also provide me with your certificate, so no need to hack your email there. edit When starting the connection the server ...


29

Yes, what you are getting in the zip file is exactly what every visitor to your site would get every time they start a TLS session - the public keys with certifying information. The private key is the only thing that should be kept hidden from unauthorized access.


2

Certificates are transient in nature: they expire, and must be renewed. Even worse, the validity of a certificate is the property of the current time, since certificates may be revoked at any time. Therefore, if you want to store signed documents, and be able to validate them at a later date, then you need time stamps. See this answer for some details. ...


0

It seems as though they will last until the expiration of the certificates (as in, past the shutdown of the CA) Quoting from this reddit thread IIRC, If the certs are not in a CRL, they should work until their expiration date regardless of if the CA is online. The CA will continue to function after being p2v'ed so long as the server name doesn't ...


5

While prices differ they don't differ that much. You are comparing certificates from Symantec with support for multiple domains with single-domain certificates from Comodo. Once you try to use multiple domains with Comodo the price will be much higher. While Symantec is still more expensive Comodo is with around $2000 for 2 years not that much cheaper ...


2

In my experience, the top CAs - like in any industry - charge more for a reputation of good service. If your goal is to get your server up and running as cheap as possible, then get something cheap. But if you want things like fast turn-around times on your certificate requests, fast ping times on revocation requests (OCSP), early adoption of new protocols ...


4

SSL certificate price depends basically on how much the vendor feels he can charge for it. The per-certificate issuing cost is extremely small; most of it is about the manual operations to verify the identity of the requester, but that is still a lot less than what CA typically charge. Like with software, CA charge money to cover their development cost, ...


-2

Creating a new SSL certificate has no cost for Certificate Authorities (If we don't consider the cost of staffs, electricity, keeping servers secure, etc). But, other services that they offer like insurance can make difference on prices. So, they can charge you as much as they want, $1 or $10000, it's their own kindness :)


3

It is not unexpected for enterprise networks to run web security proxies that inspect encrypted traffic when given a reason to suspect something problematic. This allows them to detect encrypted malware and prevent it from infecting you. (It also allows them to restrict other content, such as porn or some other policy enforcement that is not related to ...


3

From the description, one may infer that the attack works the following way (warning: I wrote "infer" and I mean it -- I have not tried it): The attacker is in position to intercept all network traffic from the victim (e.g. the attacker operates the WiFi access point to which the victim unwisely connected). The attacker owns (legitimately !) some domain, ...


2

It might be least-problematic to set up a new root CA for Department-New for dev work. On their machines install both root certs (rootCA-general and rootCA-dev) into the trust store, on everybody else's machines only install rootCA-general.


0

What are you using the certs for? You can constrain the certs at at an intermediary using EKU policies (HTTPS vs Email vs SmartCards) Name Constraints The combination of above might accomplish what you're looking for


2

If you are asking can you use the same keypair, yes you can always use the same keypair. Your first and second certs could have also used the same keypair. If you mean will the CSR do a reissue instead of requiring you to purchase a new cert? That isn't a technical question. They certainly "can" but most will not. Any change to the cert will require ...


0

Finally I did it with BouncyCastle library. PKCS#7 is a complex format, also called CMS. Sun JCE has no direct support to PKCS#7. This is the code that I used to extract my content: // Loading the file first File f = new File("myFile.p7b"); byte[] buffer = new byte[(int) f.length()]; DataInputStream in = new DataInputStream(new ...



Top 50 recent answers are included