Hot answers tagged

8

Secrets -- private keys and passwords alike -- shouldn't be stored in source control. Where possible, self-signed certs should be replaced with centrally signed certs as well. Software such as Vault facilitates distribution of secrets and most importantly rolling of them. In this way you can setup your development machines with a level of control and stay ...


7

My guess is that this site is using Server Name Indication (SNI). In this case the served certificates depends on the hostname specified in the SNI extension and will often differ if no SNI extension is used. I.e. it will be some completely different default certificate or it will be some old certificate because they only replaced the certificate used for ...


6

Refer to the guidelines set up by the CA/Browser forum for extended validation. 8.5.1 General The CA MAY only issue EV Certificates to Applicants that meet the Private Organization, Government Entity,Business Entity and Non-Commercial Entity requirements specified below. 8.5.2 Private Organization Subjects An Applicant qualifies as a ...


5

It's a way of managing "trust". Let's say you do business with MyBank.com. Would you want to type your account number and PIN in the clear, and let any hacker on the network view it? Probably not -- you shouldn't trust such a system. So you want to encrypt the data. Also, would you trust every web page with a pretty logo proclaiming itself to be ...


5

Is it ok to use self-signed certificates for development, and then use the acquired one for production only? Yes, that is the way almost every one does. You don't have to pay a certification authority to certify that you are talking to your own server. Self sign it until production, buy a real certificate later. Does using self-signed certificates ...


5

Depends what you are doing, and what you want to verify. If you are accessing data, and want to be sure that the server which knows the corresponding private key is the one sending you data (e.g. you're accessing a web page), you don't need your own certificate. If the server wants to be able to verify that the client is a pre-defined one, which knows a ...


4

A: Authentication only. You can still do "null" encryption afterwards, if you like. But if you do non-null encryption, then you'll have an idea of who with you're doing that. That's the authentication part. -- There used to be a time when SGC, Server-Gated-Cryptography, was a thing. An extra bit in the certificate would either allow or disallow any decent ...


4

It is important to understand that certificates provide integrity and encryption provides confidentiality. In other words; the certificate makes sure that you are talking to who you think you are (if part of chain of trust), but it does not encrypt your connection. However integrity and confidentiality nearly always go hand-in-hand, which is why the public ...


4

Why is it designed to trust all root CA to issue certs for any domain name? This has historical reasons and maybe for reasons to promote competition. At the beginning you had only a few root CA with very high prices. Now the prices are down because all CA can issue a certificate for anybody. If each CA would only be able to sign certificates for a ...


4

Relying on DNSSEC would essentially amount to transferring our trust from the CA's to the registrars (e.g. firms like GoDaddy), the TLD's (e.g. VeriSign), and the root (e.g. ICANN). I'm not sure we can trust these entities any more than we can trust the CA's. See Moxie Marlinspike's blog post for a great write-up on this subject: ...


3

OpenPGP Signatures The program outputs a small picture.sig file to the destination folder. What does this file contain? [...] But the .sig file should also contain entire certificate, or maybe a fingerprint of it. What does it contain? How does Kleopatra automatically choose the right certificate? OpenPGP signatures can contain the original ...


2

The signature algorithm used for the validation of the certificate (SHA-512 in your case) is independent from the algorithm used as the HMAC in the ciphers, i.e. for the encryption (SHA-256, SHA-384 in your case).


2

encrypt a connection between an application server and a database I think you should just establish an IPSEC tunnel between the database server and app server. This will provide you both confidentiality and integrity. (ESP + AH) Configuration Reference


2

Generally, most web servers running HTTPS do not require the client to have a certificate. If the server requires the client to authenticate, this is often done through credentials (e.g. username and password). However, the converse is generally not true - i.e. most clients DO require web servers to have a valid certificate signed by a recognized CA. It ...


2

I do not see any public key being "attached" into the CSR. It's there. Here's where: When you generate your key like so: $ openssl genrsa -out server.key 1024 Generating RSA private key, 1024 bit long modulus ....................................++++++ ......++++++ e is 65537 (0x10001) And you generate your CSR like so: $ openssl req -new -key ...


2

If you are just talking about the certificate, there is no cryptographic reason to not put it under source control, as certificates are designed to be public. You still should make sure you don't leak any proprietary information in the certificate metadata, like X.509 names of privileged entities. If you think about also storing the secret key in the ...


2

It is valid. See this change in the developement tree. That said, your configuration should be simplified. When using a predefined resolver, all you need is the resolver name: DNSCRYPT_PROXY_RESOLVER_NAME=dnscrypt.eu-dk It doesn't make any sense to provide the name of a predefined resolver and then manually override everything. Worse, it will break if ...


2

I'been digging in the Certificate field recently, and I know it's been a month since you asked, but I hope this helps you some way. In order to give each of your customers a certificate, You'll basically need a server with its own selfsigned Certificate. This server will "give" your customers their new Certificate. The flow would be something like this: 1) ...


2

The best practice is to trust the root CA, for very practical reasons. Root CAs are a special beast and are expected to have very long lifetimes (20 years or more) because they require replacement in the client software, which is usually a manual process. Intermediate and server certificates are expected to change frequently - in some cases (load ...


2

protocol HTTPS protects against connecting to false server ? It depends on what you consider a false server but given this weak phrase I would suggest the answer should be NO. Lets's see what you get with https and what you get not: You get that the browser checks if the hostname of the URL matches the certificates subject and if this certificate is ...


1

You can add - inside your app - a trusted certificate to the chain, and you can use a self-sustaining private CA. Even more I'm encouraging you to do so because of security, encode a key's checksums inside your app and verify them too.


1

If you want to trust any certificate issued by A or B you put these into the trust store. If you want to accept only this specific certificate as trusted than you should only add this certificate. But you are right that you get problems when the certificates gets renewed. If you just want to trust this specific certificate only but want to accept it also if ...


1

When you install ADCS, you get the option of generating a new key pair, or reusing an existing key pair. The sentence you quote seems to indicate the latter: You export the certificate and private key from an existing CA, as a PFX file. You import the PFX into a Windows Server 2012 machine. You install ADCS on that machine, directing it to reuse the ...


1

Sorry, per the sourcecode you can't prevent the writing of $outdir/$serial.pem and still get your (desired) -out. You could put $outdir someplace like /tmp that gets discarded frequently; or on an OS that allows you to add new filesystem types (Linux at least) you could create a filesystem type that implements a directory such that anything created in it is ...


1

There is also a command-line utility: C:\> cmdkey /? Creates, displays, and deletes stored user names and passwords. The syntax of this command is: CMDKEY [{/add | /generic}:targetname {/smartcard | /user:username {/pass{:password}}} | /delete{:targetname | /ras} | /list{:targetname}] Examples: To list available credentials: cmdkey /list ...


1

..would be quite slow. Am I missing something in this protocol? You are right that this is slow and these CRLs can be really large. Therefore browsers usually don't use CRLs. Instead they use OCSP to check the status of a specific certificate or yet another mechanism like CRLsets.


1

A proxy is better for that. I think if you configure this proxy but skip the SSL cert configuration you should get your answer.



Only top voted, non community-wiki answers of a minimum length are eligible