Tag Info

New answers tagged

2

To answer the first two bullet points: Firefox has its own list of trusted CAs. You can add certificates in Menu Button>Options>Advanced>Certificates(tab)>View Certificates>Authorities(tab). This is for Firefox version 38. Yes Google is trying to shame people into moving from SHA1 to a more secure hash such as SHA2. Here is the chromium blog post about it. ...


2

To be clear, the data to be signed is exactly the contents of a file, XML or otherwise? You can't sign with only a certificate. You must sign with a privatekey and then provide the matching certificate to allow the recipient(s) to verify the message when they receive it. When using a certificate issued by a well-known CA (e.g. Verisign) you usually must ...


2

You need to add the generated CA certificate to your browser as squid is performing MITM on your https connections.


7

This is not for "certificates above the end-entity" but for "root certificates" only. In pure X.509, there is no such thing as a "root certificate". There are certificates, and there are trust anchors. A certificate contains a public key, the name of the entity that owns that key, and is signed by another entity (an "upper certification authority"). This ...


1

Isn't identity proven by the advocate (higher authority) signing a hash of the certificate? Root certificates are built into the system (or shipped with the browser). They are the end of the trust chain and there is no higher authority which signed them. They are self-signed, but only because there has to be some signature. The signature does not need ...


1

I think you cannot authenticate the client using mutual SSL/TLS handshake with GAE. To achieve this in Java EE you should put this into web.xml <login-config> <auth-method>CLIENT-CERT</auth-method> </login-config> Source: https://docs.oracle.com/javaee/6/tutorial/doc/glien.html However, AppEngine docs says: App Engine ...


5

A certification authority is supposed to verify the identity of whoever request a certificate before issuing (signing) that certificate; a certificate containing the name www.example.com shall be awarded only to an entity who indeed "owns" the domain example.com. An Extended Validation Certificate is a certificate where the CA made that identity verification ...


2

A CRL has value, and is acceptable, by virtue of being signed. Since the CRL is signed, how you obtained it is of no consequence whatsoever on its acceptability. That's the point of certificates and CRL: they can be distributed over arbitrary networks, protected or not, even plain HTTP, email, avian carriers... it does not matter. Conversely, that the CRL ...


1

I believe the general name for this is CRL Stapling, which might be a useful google search term for finding your answer. Here is an excellent security.SE question explaining CRL Stapling. Some thoughts on your question: Even if a CA is configured to publish multiple small CRLs, each certificate includes an extension which points to the CRL file in which ...


1

A bit of a painful workaround but it works for use with BurpSuite / Charles / Fiddler etc is to revert to Firefox 3 when you want to proxy the connection to HSTS sites: https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/3.0/win32/en-GB/


0

The certificate has since been fixed by live.com. Previously, the error was only shown after login. As the certificate was not expired, I suspect the transition from http to https didn't meet the standards of HSTS. In any case, I have determined the issue to be consistent across popular browsers and OS, even email accounts. Seems like it's a server side ...


6

If the entity is supposed to sign CRL but not certificates, then it is not a CA -- it is a CRL issuer. It is often called an indirect CRL issuer because, by definition, it is distinct from the CA that issued the certificates whose revocation status is specified by the CRL. A certificate may be validated as a CA only if (among other things) it has a Basic ...


0

Assuming the cert chain is actually valid, it looks like its for bing.com instead of the *.mail.live.com domains. I'd be surprised if anything malicious is going on, but more likely a bad DNS entry, poorly configured certs by Microsoft, or potentially just one part of the browser not realizing another part of the browser is redirecting to the configured ...


1

SFTP is an extension of SSH. The SSH protocol supports: There are several ways to use SSH; one is to use automatically generated public-private key pairs to simply encrypt a network connection, and then use password authentication to log on. That is, the secure connection is created before authentication occurs. In short, username and password are ...


0

Some of these older Root Certificates have been used to generate 'Time Stamping' or 'Code Signing' certificates. This means a piece of executable code has been digitally signed way back. These Root Certs may still be needed, so your PC can validate that the code signing was valid AT THE TIME OF SIGNING. Which can be of course also way back. Deleting these ...


1

Based on link from DarkLighting, here's the command I came up with using nested subshells. openssl req -new -sha256 \ -key domain.key \ -subj "/C=US/ST=CA/O=Acme, Inc./CN=example.com" \ -reqexts SAN \ -config <(cat /etc/ssl/openssl.cnf \ <(printf "[SAN]\nsubjectAltName=DNS:example.com,DNS:www.example.com")) \ -out ...


3

No, the only way to change the validity date is to re-issue. The reason is that the certificate's hash is calculated after the rest of the certificate is written, editing that field would cause the certificate's hash to change. If the hash is changed anyone else checking the certificate will know it has been altered, but won't be able to tell what changed. ...


0

Depends on your browser. Most will let you bypass it. (Unless you've also got HSTS for that domain.) You can try it yourself: Test this bad site: Valid cert, wrong (host)name, HSTS not violated: https://wrong.host.badssl.com (Report here.) Before you test the next bad site: Visit this site to make sure your browser loads the HSTS rule: ...


4

The Web browser is indeed supposed to complain loudly if the intended server name (the one from the target URL) does not appear at a suitable place in the server certificate (normally as a Subject Alt Name extension of type dNSName). See RFC 2818, section 3.1. In practice, modern browsers emit very conspicuous warnings, often scary and red. Some browsers ...


0

Generally speaking, each private key should be unique, and private keys should not travel. If you have several "applications" that expect HTTPS connections (on port 443, SSL/TLS handshake...) and that run on the same machine, then the application are not, actually, doing the SSL. The SSL is handled by the Web server frontend (say, an Apache or IIS): that ...


0

One argument that comes to mind is that often designers want the cluster to be agnostic about which node a user is connected to; ie the user gets the same output regardless of which node did the processing, sessions started on one node can be load-balanced to a different node without the user knowing, etc. Having different certificates for each node would ...


0

For me each application should use own key pair. As app on all cluster nodes is the same they should expose to the client on the same way. From other side i do not see any problem to have one key pair for all servers and applications (if they have something in common, part of big application, etc.)


-1

using a certificate and a password for authentication is NOT considered as a 2FA, since both are utilizing "what you know".


1

Can i assume that if MITM myself and the sites i care with my own certificates i will make impossible to others to the same to me ? In fact it would be probably easier as before for others to MITM you. Since you don't trust the existing CA system I assume that you don't want to use it to check the certificate of the sites before doing an MITM for ...


7

Unfortunately, this won't do anything to fix the problem, and might even make things worse for you if you don't set things up properly. Certificates are designed to provide assurance that the public key your connection is encrypted with actually belongs to the server you are trying to connect to. It does this by using a signature from a third party ...


5

IMHO you miss the idea of CA. You have on your computer/browser root certificates and as CA issue certificate to the bank for example they sign this public key with own key and with your root certificates you can check the validity of bank certificate. If you create own CA and issue certificate to the bank how you think to make them install your certificate. ...


0

PKCS#7 is now standardized by IEFT as CMS, RFC5652.


1

"No user recourse" RFC 6797, section 12.1 states that the user SHOULD not be presented with a "click here to ignore and proceed" dialog. Now this is a "SHOULD" clause and not a "MUST" clause. In RFC speak this means you are free to ignore it. But urged not to. So if your browser honors the RFC's recommendation, then you won't be able to ignore it. And if ...


2

Once C's browser has established that S is a known HSTS host (either via its preload list or by having previously received a valid Strict-Transport-Security header), self-signed certificates and similar security problems produce errors that the user can't simply click through. https://tools.ietf.org/html/rfc6797#section-12.1 So the answer to your question ...


1

This is not currently support (as far as I can tell) by any of the browsers. There is an outstanding bug on Firefox to introduce some kind of support for this but it has not been resolved. You can support this in Javascript by using OpenSSL compiled with Emscripten although that link only provides the bones, you will need to build the JS linkage to your ...


1

A "certificate" by the definition used in cryptography is information about a cryptographic entity in a specific format and signed by a "certificate authority" or CA; X.509 is the most common type of certificate and the one used by PKCS#7 or its updated version CMS (and S/MIME, which is a thin wrapper on CMS). If you want to sign your own data, not special ...


1

if you generate your SSL Certificate by yourself, HTTPS/SSL will work, but a browser will issue a warning encouraging the user to not trust the site, as there is no way to tell if the site you are accessing is really who they say they are. So you need an authentication from a Root CA to avoid this problem. To get this authentication you need to pay. But now ...


3

The disadvantage that makes big companies not consider Let's Encrypt is that visitors that connect to the site can't be sure that it is the actual company that hosts the site. This is because Let's Encrypt issues certificates for any webpage freely, without the need for identity validation (personal or corporate) (Let's Encrypt only offers domain ...


3

The reason to use Let's Encrypt can be the price. Those certificates will be for free. But I see one possible disadvantage for nonsmall web sites. Big CA offer wildcard certificates, Extended Validation certificates which have some advantages (from my point of view). Moreover this program is directed to web servers, but what if you have some application ...


4

In order to perform this task, you typically rely not on a single cert but on an internal certificate authority. You first setup your own , off-line root CA and then immediately setup at least one (usually more) intermediate certificate authority with keys signed by your private root (if you're using a windows AD infrastructure, these ICAs can be setup ...


1

Is my fake certificate now added in her browser's trusted certificate list? Yes, depending on the browser being used. It used to be that ALL browsers behaved this way. Adding a self signed certificate to the trusted certificate store. If she tries to visit my website and I provide the fake certificate again is she warned again or not? In the ...


1

You can use import-req command to import client csr and then sign it. For more info check the documentation of easy-rsa program


4

Is there any merit to the idea of certificate viewing software showing a gravatar/identicon for the hash of an SSL certificate, to aid in identifying it? Yes. At least with OpenSSH this has been done. I don't see why it wouldn't work with SSL as well. But I know of no (live) implementation. There was a thesis from 2004 that showed an implementation of ...



Top 50 recent answers are included