Tag Info

Hot answers tagged

19

This client behavior is prohibited by section 8.1 of the RFC: If an HTTP response is received over insecure transport, the UA MUST ignore any present STS header field(s). The spec prohibits severs from sending insecure HSTS directives and clients from processing insecure HSTS directives. This ensures that a faulty implementation in either a server or ...


14

Google blogged about flagging Certificates using SHA-1 here -> Gradually sunsetting SHA-1 There's no reason to get a new certificate yet as Chrome won't be actually blocking the certificate just treated as “secure, but with minor errors”, I believe that some issuers are offering to reissue certificate but as always, YMMV.


9

First of, CRL do not cover root CA. By definition, a root CA is a root: it has no issuer except itself. A CRL conveys revocation information, which is a way for a certificate issuer to announce that a previously issued certificate should be considered as invalid even though it looks fine and its signature is correct and everything. Thus, a CRL that talks ...


6

You don't need to get another new certificate. In order to resolve this issue, you need to just reissue your certificate with SHA-2 signature. That's it.


5

is it trust-worthy because the CA authority did a background check on them? No. A SSL certificate is comparable to a passport: it says who the person is and which country the passport issued. But it does not say how trustworthy the person is. The main use of the certificate is to make end-to-end encryption possible, that is protecting against ...


3

It is hard to tell you exactly what is going on because we don't know what request actually triggered the message and you do. What it looks like, however, is that for some reason, a secure request intended for Toshiba's update server went to www.bcrea.bc.ca. There can be many reason for this but few are really encouraging: Something in your DNS resolution ...


3

Edit: I realise that this may not be clear from the answer below... but from the point of view of your application, it doesn't really make any difference whether you run the PKI/CA yourself or whether you use one or more third-party CAs. Even if you choose to run your own PKI, you really don't want to code it yourself - so you'd use one of the existing ones, ...


3

This may be to avoid the use of this header to cause a denial of service attack. Imagine an insecure HTTP-only website. Now imagine someone able to tamper with the HTTP headers sent by this site to add an HSTS header. According to the RFC: The UA should stop trying to access the site through HTTP, and try to use HTTPS only instead. If the UA is unable to ...


2

You can not generate your own EV certificates and especially you can not generate self-signed EV certificates. Only some CA's are able to generate these and these CA's are specifically marked in the SSL stacks of the browser or operating systems. If you want to create EV by yourself you would have to change the SSL stack used by the browser to accept the ...


2

No, you cannot use the same certificate for both server- and client-side SSL authentication. (Well, technically, you can - it won't break anything - but it means that the server private key will be known to N clients, each of which can then impersonate it, so that's just not going to work out.) If you wanted to do Client SSL authentication, you'd want to ...


2

Short answer: you can't, because they are two different and incompatible key+certificate systems. Longer answer: Windows Certificate Manager uses X.509 certificates, each of which must be signed by a Certification Authority whose root certificate is considered valid by Windows. Thunderbird will use the public key stored in your recipient's certificate to ...


2

Actually, there is an often unused (at least on the web) optional part of SSL/TLS that allows for client authentication. It is generally not used on the web because the server doesn't really care if the client is who they say they are - they just need to have the proper credentials. Additionally, imagine the nightmare of having to verify every client in the ...


2

This would have been better here. However we can still answer your question. I inspected the site you referred to and the reason, why chrome shows you a security warning is because the intermediate certificate of StartSSL uses SHA-1 for signature-hashing. Your certificate is in fact SHA-256/RSA-4096 as claimed, but because one certificate in the chain (the ...


2

They are doing a man-in-the-middle attack which needs the user to either ignore security warnings or to explicit import the CA used by fiddler. For more discussion about this topic have a look at How can I prevent a man-in-the-middle (MITM) attack on my Android app API?


2

The PKI model works on the trust you can give to the initial third party. Namely, the root CA. If you trust the root CA, you should import their root certificate, so that any certificate they issue (sign) will be automatically accepted by your system. If you do not trust the CA, well there is nothing more you can do. So why would you trust CAcert.org ? ...


2

Chrome 42 has now been released, and I can answer my own question: yes, they must have slowed down. 42 has the behavior that was expected in 41. I'm still not aware of any official explanation or acknowledgement of the delay.


1

Trusting a CA means that you trust the CA for all certificates issued by this CA. But because all CAs are treated the same by the browser (except for EV certificates) any CA could create a certificate for any site. This means it is enough if a single trusted CA is not as trustworthy as needed and this kind of trust problems happened several times in the ...


1

I found a solution as I was looking for; http://blog.engelke.com/2015/03/03/creating-x-509-certificates-with-web-crypto-and-pkijs/ But I'll try pem modulus at first. Because it works on back-end and seems more simple.


1

They're the same. Note that signature doesn't contain the data shown in grey - rather, it's a signature of that data.


1

"fakebook.com has acquired a certificate from on the trusted CAs" : Normally (and I said normally, because to say it so "the world isn't perfect") this step should not happen. A really trustable CA should benefit from specific services from third-party societies (like Netcraft) so, when you try to register a new domain name, they will automatically check it ...


1

I use the -subj modifier to add alternate dns on command line. Example below for a self signed x509 certificate : openssl req \ -x509 \ -batch \ -nodes \ -sha256 \ -days 3650 \ -newkey rsa:2048 \ -keyout selfsigned.key \ -out selfsigned.crt \ -subj "/C=FR/ST=Ile de ...


1

Are you using Firefox? If so go into Tools->Options->Advanced-> and choose view Certificates. Delete or distrust it. I believe if you want to be "safe" you should make the certificate chain the same path when viewing from the the same computer. When I did this from Firefox the certificate chain was then the same as presented from Chrome.


1

Wildcarding your certs as a countermeasure would be considered security by obscurity and as such is not really helpful. Your sites can be listed in other databases and there is only finite number of IP addresses out there anyway so it doesn't really matter how hard you try to hide. Eventually they'll find you and you have to be prepared for them. It can ...


1

Both the goal and the approach are rather questionable. Users don't have HSMs in their PC (unless you're all working at a very special company which somehow provides its employees with crypto hardware). At best, you'll encounter a user with a smartcard, but even then they probably won't use the card for your site, because it's just too cumbersome. A more ...



Only top voted, non community-wiki answers of a minimum length are eligible