Tag Info

Hot answers tagged

52

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed. Source: http://support.microsoft.com/kb/293781 Some certificates that are listed in ...


12

No, it isn't safe because you expose (in your program) a key which should be secret. Your proposal is based on symmetric key cryptography, where both ends of the communication channel need a copy of the same key. Symmetric key cryptography is effective only when both ends of the channel are secure. As others have pointed out, a key embedded in a program ...


9

Yes, you can. You can have all of the domains listed in the SAN (Subject Alternate Name) field in the one certificate, and use it for them all. This comes with a couple of things to consider, namely: If any of your servers are compromised, or the certificate is leaked, you'll have to replace it everywhere. You now have approximately five times the ...


4

When you are browsing TOR hidden services, the TOR system already provides end-to-end encryption, so another TLS layer is redundant. It is in fact counter-productive, because one of the goals of TLS is to de-anonymize the server. It makes no sense to go through the trouble to set up a hidden service and then get a certificate from a certificate authority ...


4

No, this is not a secure alternative. It is entirely possible that a hard-coded key could be discovered, which would leave you with application traffic that is essentially unencrypted. So, if you feel the data is not sensitive enough to secure, don't bother encrypting it at all. Deliver it over HTTP. If, however, there is any reason to secure it, do ...


3

You are proposing doing it backwards. It doesn't do you any good to hold a private key on the server and hand out a public certificate to be used to validate the client. Instead, you want the client to make a key pair and submit the certificate to the server to be stored. The server can then use the certificate to generate a challenge for the client to ...


3

This is a purely technical error on the side of the website administrators. This is not a security issue. They simply exchanged the end entity certificate but forgot to exchange the chain. This makes it seem invalid to some browsers. It is required by the standards that the webserver must present this this chain. But this is a courtesy to the client and a ...


3

If you run the following command, you will see that when the person managing TLS for the server replaced the leaf certificate (the certificate for the server himself), he did not replace the chain (the certificates of the Certifying Authorities that build the chain of trust). echo |openssl s_client -connect www.prioenergie.de:443 -showcerts 2>&1 |grep ...


3

Check if you're running Chrome 39, there are major changes to the way some certificates are treated - e.g. Chrome 39 starts to penalize sites with long-lived SHA1 certificates This release warns about SHA1 certificates that expire in 2017. Versions 40 and 41 will increase the scope of the warnings to include certificates that expire in 2016. More info can ...


2

Is this a hot issue for mostly security reasons [...] Not yet. There is no practical published attack yet. But it's in the post. The gradual transition now is better than the transition from the earlier MD5 hashing algorithm to SHA1. Back then there was no explicit deprecation strategy AFAIK and there actually were evil attacks that used ...


2

I had a very similar problem with Postfix and Dovecot on Ubuntu. I had purchased the basic SSL certificate from Comodo and because I selected "other" as the server type I ended up with a zip file with four certificate files in it, as per the above posts. I wasn't getting security exceptions in the client. In my case I couldn't even get past the account ...


2

Can a page served by (1) call (2) by javascript ? Yes, using Cross-origin resource sharing (aka CORS). Access-Control-Allow-Origin: https://adomain.com Access-Control-Allow-Methods: GET, POST Can (1) and (2) "share" cookies ? Yes, you can share cookies setting them to domain = ".adomain.com".


2

The 2nd post in this link says that it not possible to do that only from command line, but the 4th post in the same link provides a workaround using bash's ability of referencing data as if it was in a file. Taking a further look into it, someone mentioned the reqexts parameter used to make additions to certificate request. This blog uses bash's env as an ...


2

A certificate issued to *.example.com is a so-called "Wildcard Certificate". It is valid for all subdomains of example.com like www.example.com, mail.example.com, forum.example.com etc.. It would not be valid for the main domain (just example.com) or on any nested subdomains like login.forum.example.com. However, additional domains can be added to a ...


1

If the device has a way to keep the password separate from the key file (like in firmware) it will avoid abuse when someone can copy the key file out of the device. If the password resides in a script or a configuration file, it does not add much.


1

But, if all my cert expired before 2016, so I assume no action need to be taken to prevent the warning, right? Correct. Chrome (your link), Firefox (https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/) and Windows (http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx) ...


1

It sounds to me like you need to configure the Tomcat service to request a client side certificate for authentication. I'm wise in the ways of IIS, but unfortunately Tomcat is not my forte. DO NOT give the admin of Tomcat your CSR. I recommend referencing Configure SSL Mutual (Two-way) Authentication Ideally you would use your internal CA to sign a ...


1

My solution to this problem was to create and reference a temporary cnf file by appending my command-line-collected subjectAltName information.


1

This may or may not even be possible depending on what checks Nintendo does. If Nintendo only trusts their own certificate, signed by them, then you will be unable to make a key pair for the proxy that your DS will trust. Normal SSL/TLS MITM proxies require that the client trust the certificate used by the proxy as a root cert, that way the proxy can make ...


1

Is it a must-act-immediately-because-attacks-are-feasible-now? No. That said, when working with PKI, you must have a long vision, so start planning now. It is estimated that by the end of 2017, precomputed hash-collisions to create imposter certificates (and hence imposter CA certificates) may drop below 100,000$ in computation, using cloud computing ...


1

The certificate is not valid. By definition you cannot trust it. That's the whole point of having a certificate chain. In all evidence, it has simply been incorrectly configured; you can find the same problem - from the point of view of the webmaster - here. You might query Thawte... but I wouldn't hold my breath for an answer. They'll probably feel, quite ...


1

Thanks to Milen I saw that I have had a version update of google chrome (from 38.0.2125.111 to 39.0.2171.71) just while downloading firefox. The Chrome's UI did the update without any notification, and this fooled me. Quite strange, from Google. I mean: would you like to know that an upgrade will change the security policy in the next execution of the ...


1

Verify that your Key is not protected by passphrase. Postfix does not supports passphrase protected Keys anyway you can remove the passphrase from the key using an openssl command openssl rsa -in passphrase.key -out nopassphrase.key is not necessary to include the Root CA if your CA Bundle does not include your CA Root you can append it: cat ...


1

(Edit 2014-11-25: Reworded flushed out to phased out.) Short answer: From what I can tell, they will be gracefully phased out, not flushed out. (At least by Microsoft.) The old SHA1 root certs will expire regularly and Microsoft will no longer accept NEW SHA1-roots starting 2016. The old ones will stay in I guess, since they were compliant to the guidelines ...


1

The whole goal of HTTPS is to prevent eavesdropping so that anyone monitoring your web traffic can't see what you're sending. As useful as it is, HTTPS presents a bit of a problem to antivirus software because when you visit sites over an encrypted connection, your antivirus software cannot see what sites you're visiting or what files you're downloading, at ...



Only top voted, non community-wiki answers of a minimum length are eligible