New answers tagged

1

This here will be human readable. And (thanks to the semicolon as the delimiter) it will also open nicely in Excel: dir cert: -Recurse | where {$_.subject -ne $null} | where {$_.subject -eq $_.issuer} | Export-Csv -NoTypeInformation -Encoding UTF8 -delimiter ';' -path selfsignedcerts.csv


0

Looking at google certificate’s, it’s now very clear… The answer is yes of course since you can request to be a certificate authority for the domains you control…


2

From the github readme for the iOS SSL Kill Switch project: Once installed on a jailbroken device, iOS SSL Kill Switch patches low-level SSL functions within the Secure Transport API So your question basically boils down to: "How do I prevent my app from being infected with malware on a rooted / jailbroken device?". In short: you don't. This is why you ...


2

There is no point in trying to prevent this. Technically I guess you could slow down an attacker by implementing your own crypto (SSL Kill Switch modifies the OS-provided crypto functions) but even that will eventually get cracked given enough time and effort. If you don't control the hardware, your software has no chances. Just live with it and let people ...


4

From the OpenVPN 2 Cookbook: The OpenSSL ca command generates its CRL by looking at the index.txt file. Each line that starts with an ' R ' is added to the CRL, after which the CRL is cryptographically signed using the CA private key. To reinstate your revoked certificate, you could edit your CA database: database = $dir/index.txt ...


1

Reading the X.509 recommendation tells us that a certificate can be "un-holded" by 2 means: either really revoke it, by changing the reason code while keeping the date or completely remove it from the CRL. If you plan to issue deltaCRLs, you MUST use the "removeFromCRL" reason code for such certificates, only for the deltaCRLs.


3

The technical answer is actually "no, because SHA-256 with RSA-2048 Encryption is not a certificate hashing algorithm. However, SHA-256 is a perfectly good secure hashing algorithm and quite suitable for use on certificates, and 2048-bit RSA is a good signing algorithm (signing is not the same as encrypting). Using 2048-bit RSA with SHA-256 is a secure ...


0

I'm sorry you don't need the private key to "decrypt" something encrypted using asymmetric encryption, you need the public key, which is in the certificate, or the certificate of the trusted authority. Using the public key also provides proof that the private key was indeed used. See this prior entry Digital Signature and Verification? and this: how ...


0

Client certificates have all the nicest quality for authentication. But because of a chicken and egg problem users have no reason to acquire a serious certificate (costs money and time because the delivery should be a face to face operation) because few sites use them, and site administrators have no reason to actively support them since their users ...


1

As to the first part of your question. the answer is NO, and all who say it is forget that that also means breaking essential layers of security on the device. as to the second it is possible but highly dubious to do so. The way to do this is by buying a certificate for a domain (like localapp.example.com) and have its DNS entry point to 127.0.0.1. and ...


0

I work developing a site which offers smart card authentication. The user connects a USB card reader, goes to the site, and when he wants to log in, he inserts the card and supplies a PIN. The issue is that the system uses a Java Applet, and these applets are no longer supported by Chrome or by MS Edge. New middleware is being developed which does not use ...


1

There is no method to "unsuspend" a certificate in openssl on the CLI that I am aware of. And the following quote may give you a bit more guidance: Martin Abalea, OpenSSL mailing list, 2008-10-13, Re: Put certificate on hold: Reading the X.509 recommendation (downloadable for free from the ITU-T web site) tells us that a certificate can be "un-holded" ...


3

You can have multiple valid certificates with the same subject but different keys active at the same time. A possible use with SAN certificates would be to use certificates with the same subject but different key for the different hostnames contained in the certificate. You could even use it for the same hostname (i.e. same hostname on multiple IP addresses) ...


0

You would be able to get another Wildcard SSL certificate from another CA. But you will only able to install single certificate at the time. So either you have to remove existing Wildcard SSL and have to install a new one. OR… wait till expiry of existing certificate. There is no technical hurdle in getting another certificate at this time but you won’t be ...


1

Addressing your points: Our team has looked into certificate pinning [of the document signing cert]. ... We decided against it for a couple reasons. The biggest reason is that if a key was compromised or a cert expired we'd have to re-ship our software ... We'd rather let a public CAs CRL take care of revocation for us. Yup, that makes sense. Public ...


2

[Note: In the first wording of the question, there appeared to be some pretty glaring conceptual problems, the re-wording fixed these. I am going to leave this answer here anyway in hopes that it's useful to somebody.] PKI Fundamentals I think we need to go back to basics on how Public Key Infrastructure and certificates work. I am going to shamelessly ...


1

It is possible that a device may stay un-sold/unused for a couple of years after its manufacture date and most (if not all) CAs will probably be unwilling to issue device certificates that have long expiry dates, so a straight forward solution is perhaps impractical. However, I propose the following alternative: Use alternative method to establish initial ...


0

Points 1 and 2 are addressed by buying a certificate from a trusted CA. As for your second point - If the private key of the device was compromised, an attacker should not be able to use this key to perform MitM attack against another device If you can find a way to do this, you'll be very rich. or another web page. Eh? I don't understand. ...


1

Clients wouldn't know that there's two certificates for the same domain issued by two different CA's and throw a warning flag? Not usually. They would just see whichever certificate is currently 'active' on the server and as long as it's valid, it should be used? Yes, usually. CAs do not typically publicize their clients and certificates, or ...


1

You are describing a situation in which you have two separate, valid wildcard certificates signed by separate CAs. Unlike what the current title claims it is not the "same wildcard cert". There is nothing that stops you from having multiple certificates for the same domain(s). Clients will verify the validity and trust of the certificate presented by your ...


-1

As per your requirement, A Multi Domain Wildcard is the ideal solution that enables you to secure multiple domains as well as unlimited sub-domains using a single certificate. ComodoSSLStore offers A Comodo Multi Domain Wildcard that comes with 2 SAN it means you can secure your all 3 domains and unlimited subdomains. And in case if you want to add more ...


0

As per your requirement Multi Domain Wildcard SSL Certificate will work fine. Because you need to secure two vary domains and its all sub domains. There are many certificate authorities offer Wildcard + SAN option but there is no meaning to pay more amount if you are not going to add another SAN in future as per your requirement you just want to protect two ...


0

As you mentioned, you want to secure 2 domains and its all sub-domains with a single certificate. Comodo Multi Domain Wildcard SSL certificate is the preeminent option to complete your company necessities. With this certificate, your can secure multiple websites and its unlimited numbers of sub domains. You should request certificate for, *.example.com ...


0

Well, in the final PKCS12 you should encrypt the private key. The pkcs12 utility allows you to specify how you want to encrypt the private key. -aes128, -aes192, -aes256 use AES to encrypt private keys before outputting. -camellia128, -camellia192, -camellia256 use Camellia to encrypt private keys before outputting. I would consider aes256 very secure ...


0

There's nothing inherently wrong with using what you've described. With certificate pinning, and strong user authentication you're going to be on par with most normal TLS web traffic. Ensure that you're restricting communication in your certificates to only secure ciphers, setting a reasonable expiration date, and distributing the certificates in a secure ...


-1

X509 certificate validation is covered in RFC 5280. Look at section 6 (https://tools.ietf.org/html/rfc5280#section-6) Conforming implementations of this specification are not required to implement this algorithm, but MUST provide functionality equivalent to the external behavior resulting from this procedure.


1

If I am not mistaken you can use letsecrypt.org service it is automated and free, you can then generate certificates without the need of using wild cards. At least they are free and you do not have extra expenses and it makes things more secure. You can create multiple sites with multiple domains associated pointing to different paths. You can generate ...


2

You can place wildcards into the Subject Alternative Name (SAN) field of a certificate, so it's entirely possible to wildcard multiple domains. There are many CAs that will issue this under a name like "multiple domain certificate".


1

A few ways. Option 1: A proxy server with authentication. Phone -> proxy (check auth like basic auth if using https proxy, if not https proxy then no real security gain) -> internal-web-server We use these in corporations. You set an automatic proxy file (pac) on your phone to route requests to your domain web page through the proxy and the rest ...


9

Let's Encrypt can only issue certificates for valid DNS names. So if your intranet uses a made-up domain name like intranet.mycompany.local then it won't work. If you have a real DNS name like intranet.mycompany.com (even if it doesn't resolve externally to your intranet), then you can use Let's Encrypt to issue certificates for it. If the domain does ...


0

It is clear that the certificate authority will issue certificate for fully qualify domain name and validate your domain name, which you want to use for website address. In that case, if you wish to continue with two domain names (www.a.com and www.b.com), then you have two choices as below. 1. Get individual certificates for each You can purchase ...


1

The two options you mention are almost correct: However, you can (and should) install self-signed certificates without them being Certificate Authority certificates. The difference between a self signed cert and a CA cert is that a CA certificate is a special self-signed certificate with its "basicConstraints" set to "CA:true" (usually with the critical ...


2

For websites which dynamically generate subdomain (for example, if users can create their own subdomain for some service), installing a certificate for each new subdomain is far from ideal, because you need to verify the ownership of the domain for each domain, followed by the installing of the certificate for each domain (which typically also requires a ...


5

It would be a huge operational cost in environments that don't have automated certificate management in place, which, in reality is the vast majority of the operational environments in the world today. In fact, in most environment little to nothing is automated. We've just started seeing people dip their toes in those waters in the past few years, and most ...


1

SFTP is a subsystem of the SSH protocol. The SSH protocol session comprises several "moments", the key-exchange (or KEX) being the first one. So your SFTP client will: connect to the SSH server perform the key exchange and instantiate session encryption (from this moment on, the session is secure) send an authentication request which only contains the ...


0

You can generate your own certificate. The certificate is then used to digitally sign data, including signing a PDF. This type of certificate is a "self-signed" certificate. Documents signed with a self-signed certificate are usually regarded with mistrust since there is no inherent trust relationship between the signer's certificate and the relying party ...


0

Just to add to the existing answer, if you want to secure multiple domains using a single certificate, you can explore Subject Alternate Name (SAN) certs, which allow you to protect more than one FQDNs. Quoting from the example given in the linked article: With a Multi-Domain (SAN) Certificate, you can secure: 1) www.example.com 2) ...


4

Certificate validation is done against the hostname given in the URL, which means you'll need a certificate for any hostname which you expect to be used inside a URL. Thus, if you want to use both www.a.com and www.b.com in the URL you need a certificate for each, even if they are the same host and if one redirects to the other. DNS settings like same IP ...


3

This is why Microsoft recommends to never remove expired code signing certs from CRLs. An alternative scenario: attacker signs their malware before cert expiry. If they can remain undiscovered past cert expiry, then the cert won't get added to the CRL even on discovery, and their malware will never get blocked. Thus the revocation status of code signing ...


2

On this certificate of yours, it's important to know if you signed it with your own company's root certificate; or did you have a third party sign it? If it's signed by your private root certificate, they won't have a copy so they have no way of validating the connections to you are legitimate. If you give them a copy, they will then have a way to validate ...


2

Installing root certificates on a server causes that server to implicitly trust any future certificates signed by that root. By installing that root cert, you could then use self-generated certificates that are signed be the root that was installed. This adds a layer of security in that your root is not distributed for use by other servers/instances, and ...


1

Properly validating a certificate is a really complex matter. As with many things in crypto, it's best to leave this validation to a library instead of trying to implement it yourself. Typically, you'd ask your library to perform all the hard work and then check for any additional properties you are interested in afterward. As for the details: First, you ...


1

And you should make a lot of checks about the cerificate genuinity, i.e. to avoid MitM or false-issued certificate by "so-called stolen" CA key. Take a look and star at Perspectives Project to have a full picture


4

There is no security impact to either stop or continue the handshake -- the security relies in the tests performed by the client, not the server. This is why the extension is called an indication. What matters is that the client duly verifies that the apparent server public key is really owned by the intended server. The SNI is a way for the client to convey ...


33

This is an historically disputed point. In the validation algorithm from RFC 5280 (that supersedes RFC 2459, by the way), there is no requirement of validity range nesting. However, some historical implementations have insisted on it; see for instance the X.509 style guide of Peter Gutmann: Although this isn't specified in any standard, some software ...


14

Hmm, I agree that I would have expected to find this info in RFC 5280 4.1.2.5. Validity. (By the way, RFC 5280 obsoletes RFC 3280, which obsoletes RFC 2459, so you really shouldn't be looking at 2459 any more). That said, you can figure this one out logically (at least for a standard TLS-like setting): When an end-user validates a cert, they have to follow ...


1

Resolved. The site needed to add the intermediate cert to the PEM file. I was overlooking the trust chain view in the browser that showed it was fetching the intermediate cert, a step that wasn't performed in the other use cases. So to answer my questions: The effective trust chain was in fact visible by calling up the security details by clicking the ...


1

Once you have deployed a private key in a USB Dongle it is impossible to extract it. This is the main reason to use a USB Dongle, to ensure the key is always hardware protected. The only option is to generate a new private key and request a new certificate


2

In X509 the fields making a certificate unique is the combination of issuer and serial number. Only the serial number is not guaranteed to be unique since two CAs may use the same serial. This is the reason both are typically needed for revocation. In practice, if you only have one CA, the serial will be enough of course. But it's not generic. There should ...



Top 50 recent answers are included