Tag Info

Hot answers tagged

6

The question is... a bit complex. The critical issues are existence and availability of intermediate CA certificates. Consider the following points: Root CA are not "revoked". Revocation is a mechanism by which the issuer for a given certificate specifies, directly or indirectly, that one of its issued certificates is not to be trusted and must not be used ...


5

They are designed specifically to not allow this. As you brought up yourself, that would be a massive security risk. If you want to be able to browse your own systems without clicking "confirm security exception" a million times, add the certificates to your trust store on your computer, using the "Certificates" MMC snap-in. This can be done even better ...


4

What you're describing is called certificate pinning; essentially, you ignore the whole CA process and just give the user application a certificate to trust. It's actually widely recommended for non-browser applications (e.g., mobile apps) for the exact reason you stated - if you rely on a CA and it goes down, you're in pretty deep trouble, whereas it's ...


4

Because your browser comes with its own set of certificates. When you install a new version of Windows 7, it comes with Internet Explorer. Internet Explorer, like any other browser, comes with its own set of certificates that it trusts. All the web authentication is based on the fact that there are only valid certificates in your browser. How does ...


4

You are using the expression "zero-knowledge proof" but it does not mean what you believe it to mean. A ZKP proof is a kind of cryptographic protocol by which a Prover demonstrates to a Verifier a given property on a secret value. The proof is "zero-knowledge" if it does not divulge any extra information to the verifier. For instance, suppose that there is ...


3

"Signer's identity is unknown because it has not been included in your [...]" Apparently your PDF client is not happy about your certificate because it should have been included in your something. I suggest expanding the window in order to read the word which would follow "your", because that word will probably be a good clue about what your problem ...


3

You can "regenerate" the certificate on your gateway, but it will work only if you take care to reuse the same name and key. This is a certificate chain: the certificate on the gateway is the "CA certificate" and the clients have been issued certificates by that CA. Such a client certificate will be deemed valid (aka "acceptable") if whoever does the ...


3

If you are talking about the truststore, the risk isn't that someone will see or steal the certs in the truststore. The risk is that someone will add a certificate into the store which you do not want to trust. The store should be protected first protected by the OS permissions. The password is an additional protection.


2

You client is looking for the server to provide copies of the intermediate certificates and it appears your server is not doing so. The exact configuration will vary based on your server, but it should be possible to download the intermediate certificates (from your CA) and share them along with your server certificate in order to get to a certificate that ...


2

It is not a good idea to have a public DNS record which points to a non-public IP address. This can be used to circumvent same origin policies by exploiting issues on internal systems. For more details see http://www.securityfocus.com/archive/1/486606, where a vulnerability in CUPS on localhost was exploited this way. Probably easier and definitly safer ...


2

What you intend to do by signing your primary key with a secondary key is essentially using your own CA. In theory, a CA is a third party trusted by the participiant who tries to verify the identity of his communication party to reliably verify this identity. In practice, in web context this decision which CAs are trustworthy is not made by the enduser ...


2

There is no really well-established command known as "mkcert" (there is apparently one under that name in some IBM systems). Since you are talking about IIS, I suppose that you mean MakeCert. Certificates follow a standard called "X.509"(*). There are several tools out there who can create certificates. The main virtue of a certificate is to be signed by a ...


2

Certificates are for authentication, not for authorization. Authentication is (here) about the OpenVPN server making sure that the alleged client is who they claim to be. This is the point of certificates: the client shows his certificate, which contains his public key and identity; the server validates the certificate (with regards to its trusted CA) to ...


2

Microsoft has a "Microsoft Root Certificate Program" here they check the trustworthiness of a certificate authority (CA). If a CA wants their certificate to be automatically updated with Microsoft they need send Microsoft a test certificate so they can test the root certificate. These certificates are then installed by default and updated as they change. ...


1

PEM means Privacy Enhanced Mail, but the acronym has been long outlived by the file format. The "PEM" format is a method to encode binary data into text, so that the data may survive the transport through a medium which is text-based and not very careful with the data (typically emails). Basically, PEM begins with some header: -----BEGIN FOOBAR----- ...


1

How do you validate the signature? If you can compromise the system files, chances are you can also compromise the root public keys being used to validate against and the files would still appear valid. Signed files only helps if the system is otherwise secure, if the system files themselves are corrupt, that is no longer a true statement and all pretense ...


1

The "right" way to think about renewals is to ask yourself why you want to renew. As I understand it, you have a root CA which is hardcoded in some application installed in the clients. Moreover, the clients themselves own certificates, presumably issued (directly, or indirectly through an intermediate CA) by that root CA. This hints at some mutual ...


1

The fingerprint of a certificate the digest of the binary certificate, i.e. DER/ASN.1 encoded. You use probably the PEM encoded form and because openssl dgst just uses whatever data you put in it will be different. To get the correct fingerprint: openssl x509 -in cert.crt -outform der | openssl dgst -sha1 The fingerprint of the certificate is shown in the ...


1

Trying to focus on the second question. The issue of «Which default trusted root certificates should I remove?» depends basically on who you deal with. You will "only" need to trust all the CAs that sign any of the websites you connect to. For a grandma-type user that always visits the same few sites, probably a handful CAs will be enough, while the list ...


1

Sorry, but the answer is "no". The top level root certificate "signs" your other certificates. When your client goes to validate their certificate, they are going to look at the signature on it, and they will see it was signed by "oldcert", they will then attempt to validate "oldcert", and discover and that "oldcert" has expired. Just having the new ...


1

The text you quote basically means: the file is signed with RSA, and the signature is appended "as is" to the file. There is nothing about certificates here; signatures use keys. Certificates are ways to bind public keys to identities. The passage you quote, though atrocious in many ways, is still relatively clear about the certificates: there are none here. ...


1

Technically your certificate is not for you. You have a certificate so you can show it to other people; it is meant to convince them, not you. You don't necessarily trust your own certificate. As a safeguard against bugs, you may want to check that the public key in the certificate matches your private key: if the CA fumbled (badly) and sent you the wrong ...


1

the Java keystore contains certificate information To be more precise it contains public keys or key pairs (public and private key). The keystore is protected by a password and every private key is also protected by a password. However you are able to change or remove passwords. It's up to you. A Java keystore is like a detached keystore of a web ...


1

Certificate "class" is essentially a marketing terminology. Each CA is free to call some of the certificates "class 0" or "class 1" or whatever, roughly meaning "I issued that but I did not bother to check" or "this time I did some checks because the owner paid me enough for that". Theoretically, as per X.509 rules, the "class" should be encoded in the ...


1

Faced with this question, Microsoft answered the way they are accustomed to: with a Microsoft-specific extension. They defined the User Principal Name, which is actually an OtherName element, the UPN being identified by a Microsoft OID (1.3.6.1.4.1.311.20.2.3) and encoded as an UTF8String (as succinctly specified there). The format of the string mimics that ...


1

In an Active Directory setup, the "certificate templates" are supposed to be used by the clients and by the CA itself ("AD Certificate Services"). For the CA, the templates describe how certificates shall be issued, including: The certificate contents, including all the extensions, validity period and so on. The issuing conditions, e.g. whether the ...


1

It looks like the chain is not correct. It looks like there are three certificates but all of them are the same. It looks like you are missing at least the Comodo Intermediate certificate: CN=COMODO RSA Certification Authority.


1

Unfortunately, the only way to get a CA client certificate is by using the managed PKI solutions you have mentioned. As I have mentioned in my comment StartCom StartSSL Corporate may be the cheapest at around $2/certificate but says its for 1,000 certificates you have to contact them for an exact price. Another solution that may be possible (depending on ...


1

I think it is important to have a strong password when you keep a chain of certificates in the keystore in order to perform a client-side authentication. Some servers, i.e: banking servers need client-authentication to set up a trustful connection: "proof me that you are the client that I think you are". You'll want to put these certificates in the keystore ...


1

I will caution that I haven't tested this behavior, so while I believe my answers are based on sound logic it may not be the same logic that Microsoft chose to implement. When a client is determining whether to trust a certificate it will work its way up the CA tree (from initial certificate to root CA) verifying signatures of the certs. If a CA's key pair ...



Only top voted, non community-wiki answers of a minimum length are eligible