Tag Info

Hot answers tagged

6

Because what is considered adequate security 10 years ago is not the case today (or we'd all be using SSL_RSA_EXPORT_WITH_RC4_40_MD5). Because it makes CRLs umanageable - now we have OCSP for that but would require more frequent checking and moves the volume problem elsewhere. Because it doesn't fit the business model of the encumbent certification ...


6

real time Looking at the signed message, the reason gets very obvious. gpg --list-packets takes the input and lists all packets contained in a somewhat readable fashion: $ echo "foo" | gpg --sign | gpg --list-packets [gpg asking for passphrase] :compressed packet: algo=1 :onepass_sig packet: keyid 8E78E44DFB1B55E9 version 3, sigclass 0x00, digest ...


5

telephoneNumber is what you're looking for. Add the following to openssl.cnf; I used the Ubuntu 14 system version to start with, section names may vary by your distribution: Under policy_match and policy_anything sections (probably policy_* in whatever openssl.cnf you're using as a template): telephoneNumber = optional Under ...


3

Yes, this is possible. When the www or root domain are accessed, the users will see the green bar in the browser, since those sites will be returning the EV certificate. When a user loads a page from another sub-domain, it will be served over HTTPS, but without the green bar, since those sites will be using the wildcard non-EV certificate. If the ...


3

There are two sessions: Client <====1====> SSL Terminator <====2====> Webserver Each of those is a TCP session. Session 1 is SSL-over-TCP, and session 2 is plain TCP. SSL Terminator has dedicated hardware which speeds up the SSL encryption/decryption process (commonly 'cryption is "offloaded" to specialized cards). Because this special hardware is ...


3

It is possible: Server and client negotiate SSL without client certificate requirement Encrypted communications begin Server sends another Server Hello to trigger a renegotiation, this one encrypted Server sends a Certificate Request to trigger client certificate authentication (Encrypted) handshake continues normally, and client certificate is protected ...


3

Is it reasonable to assume that this is an attack, or could this kind of issues have natural causes? It can be an attack or just really badly implemented login portal or something like that. Does it happen only on facebook or on any site you try to access? What it is saying is that the SSL certificate presented to you does not match the site you ...


2

This information was taken from the article from noflex.org: Implementing DNSSEC and DANE for email. Here some summary of this long article What you need is: DNSSEC capable nameserver DNSSEC capable registrar DNSSEC capable resolver MTA with DANE support To use DANE in mail server, first you must enable DNSSEC for your domain foo.com as DNSSEC was ...


2

Technically, there's nothing prohibiting you from using a certificate for multiple purposes. A correctly implemented client should check the certificate's key usage and basic constraints extension values to determine if it is allowed to be used for the purpose that it's being presented for, but a certificate can certainly be created to serve two purposes. ...


2

No, you don't have the private key for that root to sign certificates. However, as Julian suggested you could generate your own self signed certificate and then add it to your trusted store. Assuming you're running Windows, this is how you add it to the trusted store: ...


2

Having a CA specific to a domain is possible with X.509, using Name Constraints. It is not well supported, though -- many implementations will ignore the constraints. If it did work well, commercial CA could sell domain-specific subCA certificates to domain owners (that would be a technically much better solution than wildcard certificates). In many cases ...


2

You do need a certificate, because the Diffie-Hellman parameters have to be signed. Diffie-Hellman only makes sense if the client can rely on the authenticity of the parameters (meaning: they actually come from the server). Otherwise a man-in-the-middle attack would be trivial. You just need a standard RSA (or DSA) certificate. In fact, the only difference ...


1

No I'd say no. Not in any practical way. You'd have to have a parser to turn it back into a DER encoded ASN.1 data structure. This would give you the original certificate. Two difficulties: 1. No parser. You probably don't have a parser to do this. 2. You'll miss ASN.1 details. Even if you did have a parser, not all information might be exposed to you. ...


1

DH only takes care of the key-exchange. In practice you will need some form of authentication, eg. RSA or DSA for TLS. IPSec also allows pre-shared keys. Without authentication the communication will always be susceptible to man-in-the-middle attacks.


1

Does the client establish the TCP connection to the SSL terminator or to the Webserver? With SSL offload enabled the client makes an SSL connection to the SSL terminator, then the unencrypted traffic is passed to the webserver from the SSL terminator. If SSL Offload is disabled the SSL traffic is passed through directly to the webserver(SSL ...


1

This is to prevent a "Chosen Ciphertext Attack" if your key produced the same output over and over again, there would be no entropy. An attacker can launch attacks against the encrypted message.


1

Specifying openssl pkcs12 -nokeys -clcerts says to NOT output any chain certs. If the chain certs are present in the PKCS12, omit -clcerts to include them in the PEM output. They will be present in the PKCS12 if you create it with Windows Export Wizard and check Include all certificates in the certification path if possible, which is not the default (on my ...



Only top voted, non community-wiki answers of a minimum length are eligible