Tag Info

Hot answers tagged

7

Unfortunately, this won't do anything to fix the problem, and might even make things worse for you if you don't set things up properly. Certificates are designed to provide assurance that the public key your connection is encrypted with actually belongs to the server you are trying to connect to. It does this by using a signature from a third party ...


7

This is not for "certificates above the end-entity" but for "root certificates" only. In pure X.509, there is no such thing as a "root certificate". There are certificates, and there are trust anchors. A certificate contains a public key, the name of the entity that owns that key, and is signed by another entity (an "upper certification authority"). This ...


6

If the entity is supposed to sign CRL but not certificates, then it is not a CA -- it is a CRL issuer. It is often called an indirect CRL issuer because, by definition, it is distinct from the CA that issued the certificates whose revocation status is specified by the CRL. A certificate may be validated as a CA only if (among other things) it has a Basic ...


5

A certification authority is supposed to verify the identity of whoever request a certificate before issuing (signing) that certificate; a certificate containing the name www.example.com shall be awarded only to an entity who indeed "owns" the domain example.com. An Extended Validation Certificate is a certificate where the CA made that identity verification ...


5

IMHO you miss the idea of CA. You have on your computer/browser root certificates and as CA issue certificate to the bank for example they sign this public key with own key and with your root certificates you can check the validity of bank certificate. If you create own CA and issue certificate to the bank how you think to make them install your certificate. ...


4

The Web browser is indeed supposed to complain loudly if the intended server name (the one from the target URL) does not appear at a suitable place in the server certificate (normally as a Subject Alt Name extension of type dNSName). See RFC 2818, section 3.1. In practice, modern browsers emit very conspicuous warnings, often scary and red. Some browsers ...


4

In order to perform this task, you typically rely not on a single cert but on an internal certificate authority. You first setup your own , off-line root CA and then immediately setup at least one (usually more) intermediate certificate authority with keys signed by your private root (if you're using a windows AD infrastructure, these ICAs can be setup ...


3

No, the only way to change the validity date is to re-issue. The reason is that the certificate's hash is calculated after the rest of the certificate is written, editing that field would cause the certificate's hash to change. If the hash is changed anyone else checking the certificate will know it has been altered, but won't be able to tell what changed. ...


3

The disadvantage that makes big companies not consider Let's Encrypt is that visitors that connect to the site can't be sure that it is the actual company that hosts the site. This is because Let's Encrypt issues certificates for any webpage freely, without the need for identity validation (personal or corporate) (Let's Encrypt only offers domain ...


3

The reason to use Let's Encrypt can be the price. Those certificates will be for free. But I see one possible disadvantage for nonsmall web sites. Big CA offer wildcard certificates, Extended Validation certificates which have some advantages (from my point of view). Moreover this program is directed to web servers, but what if you have some application ...


2

Once C's browser has established that S is a known HSTS host (either via its preload list or by having previously received a valid Strict-Transport-Security header), self-signed certificates and similar security problems produce errors that the user can't simply click through. https://tools.ietf.org/html/rfc6797#section-12.1 So the answer to your question ...


2

A CRL has value, and is acceptable, by virtue of being signed. Since the CRL is signed, how you obtained it is of no consequence whatsoever on its acceptability. That's the point of certificates and CRL: they can be distributed over arbitrary networks, protected or not, even plain HTTP, email, avian carriers... it does not matter. Conversely, that the CRL ...


2

To answer the first two bullet points: Firefox has its own list of trusted CAs. You can add certificates in Menu Button>Options>Advanced>Certificates(tab)>View Certificates>Authorities(tab). This is for Firefox version 38. Yes Google is trying to shame people into moving from SHA1 to a more secure hash such as SHA2. Here is the chromium blog post about it. ...


2

To be clear, the data to be signed is exactly the contents of a file, XML or otherwise? You can't sign with only a certificate. You must sign with a privatekey and then provide the matching certificate to allow the recipient(s) to verify the message when they receive it. When using a certificate issued by a well-known CA (e.g. Verisign) you usually must ...


2

You need to add the generated CA certificate to your browser as squid is performing MITM on your https connections.


1

The simple answer is no you can't have an RSA cert which has a ECC public key. By definition an RSA cert is a cert which has an RSA public key. The CA could sign your ECC cert with their RSA key but that wouldn't make it a RSA cert it would make it a ECC cert signed with an RSA key. Likewise a CA could sign a RSA cert with their ECC key but that wouldn't ...


1

It depended on the root CA's and it's connection with another CA's. However generally in client authentication, you show your certificate to it, it will check this certificate parent's since it get the root CA. And what happen if the root CA certificate not valid? I think you should report this problem to support team of that CA.


1

Yes the entire keystore can be optionally protected with a password (encrypted) and no if that is the case you can not view the public information short of brute forcing the password. You can verify the status of the keystore by using this command: openssl pkcs12 -info -in keyStore.p12 The file may have a .pfx instead of .p12 extension. It is the same ...


1

Isn't identity proven by the advocate (higher authority) signing a hash of the certificate? Root certificates are built into the system (or shipped with the browser). They are the end of the trust chain and there is no higher authority which signed them. They are self-signed, but only because there has to be some signature. The signature does not need ...


1

I think you cannot authenticate the client using mutual SSL/TLS handshake with GAE. To achieve this in Java EE you should put this into web.xml <login-config> <auth-method>CLIENT-CERT</auth-method> </login-config> Source: https://docs.oracle.com/javaee/6/tutorial/doc/glien.html However, AppEngine docs says: App Engine ...


1

SFTP is an extension of SSH. The SSH protocol supports: There are several ways to use SSH; one is to use automatically generated public-private key pairs to simply encrypt a network connection, and then use password authentication to log on. That is, the secure connection is created before authentication occurs. In short, username and password are ...


1

Based on link from DarkLighting, here's the command I came up with using nested subshells. openssl req -new -sha256 \ -key domain.key \ -subj "/C=US/ST=CA/O=Acme, Inc./CN=example.com" \ -reqexts SAN \ -config <(cat /etc/ssl/openssl.cnf \ <(printf "[SAN]\nsubjectAltName=DNS:example.com,DNS:www.example.com")) \ -out ...


1

I believe the general name for this is CRL Stapling, which might be a useful google search term for finding your answer. Here is an excellent security.SE question explaining CRL Stapling. Some thoughts on your question: Even if a CA is configured to publish multiple small CRLs, each certificate includes an extension which points to the CRL file in which ...


1

A bit of a painful workaround but it works for use with BurpSuite / Charles / Fiddler etc is to revert to Firefox 3 when you want to proxy the connection to HSTS sites: https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/3.0/win32/en-GB/


1

Can i assume that if MITM myself and the sites i care with my own certificates i will make impossible to others to the same to me ? In fact it would be probably easier as before for others to MITM you. Since you don't trust the existing CA system I assume that you don't want to use it to check the certificate of the sites before doing an MITM for ...


1

"No user recourse" RFC 6797, section 12.1 states that the user SHOULD not be presented with a "click here to ignore and proceed" dialog. Now this is a "SHOULD" clause and not a "MUST" clause. In RFC speak this means you are free to ignore it. But urged not to. So if your browser honors the RFC's recommendation, then you won't be able to ignore it. And if ...


1

This is not currently support (as far as I can tell) by any of the browsers. There is an outstanding bug on Firefox to introduce some kind of support for this but it has not been resolved. You can support this in Javascript by using OpenSSL compiled with Emscripten although that link only provides the bones, you will need to build the JS linkage to your ...


1

A "certificate" by the definition used in cryptography is information about a cryptographic entity in a specific format and signed by a "certificate authority" or CA; X.509 is the most common type of certificate and the one used by PKCS#7 or its updated version CMS (and S/MIME, which is a thin wrapper on CMS). If you want to sign your own data, not special ...


1

if you generate your SSL Certificate by yourself, HTTPS/SSL will work, but a browser will issue a warning encouraging the user to not trust the site, as there is no way to tell if the site you are accessing is really who they say they are. So you need an authentication from a Root CA to avoid this problem. To get this authentication you need to pay. But now ...


1

Is my fake certificate now added in her browser's trusted certificate list? Yes, depending on the browser being used. It used to be that ALL browsers behaved this way. Adding a self signed certificate to the trusted certificate store. If she tries to visit my website and I provide the fake certificate again is she warned again or not? In the ...



Only top voted, non community-wiki answers of a minimum length are eligible