Tag Info

New answers tagged

1

Its not clear to me if you're using Azure VM or PaaS but you may want to consider a flow using SAS tokens. On Azure you have a built-in mechanism called SAS -shared access signatures. You can read more about SAS here https://azure.microsoft.com/en-us/documentation/articles/storage-dotnet-shared-access-signature-part-1/ Your flow would be like this Pass ...


0

SSL termination or SSL proxy products like Bluecoat need to be on your network and considering the cost, the installation procedures involved and the normal security policy any organization would have who installs these products - the threats of a malicious attacker using a commercial SSL termination product is almost zero. OTOH - a trusted insider with ...


3

On the surface this sounds like a fine idea - if you're trying to provide a buffer against: Version control (git / svn hosting) compromise Theft of a physical machine containing the codebase / credentials Malware on one of your developers machines leaking the credentials in some way. Any other way in which the files containing credentials are stolen by an ...


1

Section 6.4.3 in the RFC heavily implies that *.*.example.com should validate, I read this section differently. In my opinion it clearly says that matches SHOULD only be done against the left-most label (6.4.3.1) and that if a wildcard is the only character in the label like in your case then it SHOULD only be matched against the left-most part of the ...


5

What browsers do is subject to change at the whims of whoever maintains them, and they do so without any proper documentation. The treatment of wildcards in dNSName entries in certificates is formally defined in RFC 2818, which would imply that, e.g., *.*.example.com would match a subdomain name that's two levels down example.com; it also says that f*.com ...


0

The "auth" in question is authentication, not authorization. serverAuth indicates that the certificate can be used to authenticate the server (that is, the certificate allows a server to prove its identity to the client); clientAuth certificates are intended to allow a client to prove its identity (that is, authenticate itself) to the server.


0

When a user access a website, in order to encrypt communication between the the user and the website, a symmetric key is to be use. Yes. *In order for the symmetric key to be used by both the client and server, information about the creation of the symmetric key must be encrypted using the asymmetric key Yes, unless it is diffie-hellman. ...


0

Best way seems to use a code signing certificate from a well-known CA. Since well-known CA certificates are already trusted by Client (browser, OS), there is no need for additional maintenance with this setup. Java Applet & Web Start - Code Signing states that ...Users will be better protected by maintaining up-to-date versions of the JRE on ...


2

A certificate is your public key and some information about the site and then a lifetime. All this is signed by the issuer CA. The certificate is public and thus also the public key, but the private key is not published. One of our SSL certificates has expired and along with that so has the keys. While the certificate will expire the public and ...


1

I know that browsers show no difference to the user between OV and DV certificates, but what is a sure way to find out if a certificate IS or ISNT an OV certificate? Also, are there any technical differences in the cert? Another answer partly answers your question: How does an end user differentiate between OV and DV certificates? DV ...


1

First, I think that you're confusing some terms. The term is "digital certificate", "certificate", or simply "cert". Not "digital certification". If you really mean "digital certification" then this answer is likely wrong. Yes. Symmetric keys are used for bulk encryption because symmetric encryption algorithms are much faster than asymmetric ones. No. This ...


5

From the first paragraph of the link you've provided: As a result, apps that don't support SHA-2 certificate signatures will no longer be able to connect to Facebook starting on October 1, 2015. I would read this differently to your interpretation. This is not a requirement to the apps to have certificates signed with SHA-2 but it is a requirement to ...


4

There is no standard way to do what you envision and I'm not aware of any proposals of relevance. The currently established PKI structure allows only for a single certificate chain (i.e. a single issuer for a certificate) and the TLS protocol like used allows only for a single leaf certificate. In theory one might create a certificate with multiple issuers ...


0

There are unfortunately still many large sites that still make use of an SHA-1 cert, and chrome / firefox don't complain because the cert expires before the end of this year. See this question about the same situation on Google. That being said, don't concern yourself too much. I can see the same thing: I'm sure they'll upgrade it soon. (Not soon enough!) ...


5

The other answers are right that in practice Cloudflare can't provide their full services as effectively without introducing this kind of security risk. Roughly speaking, Cloudflare does two things: They mirror your site, and can serve it from their own servers (their CDN). This way, if your site is getting hit with a DDoS, they can absorb the traffic ...


5

Potentially Cloudflare could work in a pass-thru SSL mode. However, it would not be as good at protecting against DDoS attacks. In pass-thru mode, clients would make a TCP connection on port 443 to Cloudflare, which is forwarded to your web server. The SSL setup takes place between the client and your web server, so while the connection goes through ...


8

It can't work any other way because the way cloudflare works is that they mirror your files for your users on their own servers. To request the files, clients connect to Cloudflare instead of your server. That means their browsers expect that the connection is encrypted with a valid TLS certificate from cdn.cloudflare.com, not from your website. End-to-end ...


23

From what I understand, no, Cloudflare couldn't work any other way. Cloudflare analyses the connection before passing it to your webserver to ensure that it's correct and coming from a legitimate client. In order to do this, it needs to be able to see the contents of each packet from and to your server. With SSL/TLS, each packet is encrypted and therefore ...


0

If I understand your question properly you are asking whether when a certificate (and private key) is used to sign or encrypt data, does that certificate contain the allowed algorithms for that signing or encrypting? The answer is not really. Outside the specific type of public-key crypto implemented in the certs (usually RSA), you can integrate them with ...


0

In TLSv1.2, and only in TLSv1.2 - if the client hello include an extension called "signature_algortithm", the server may sign the certificate with any of the methods mentioned in the extension, regardless the cipher-suite it choose to work with.


0

Why do certificates need to be renewed in the first place? That happens because: You lost your private key Your private key is stolen You want yourself to revoke the old instance of your certificate Your certificate reached its expiration day The password that protects your private key has been compromised You have misused somehow your actual ...


0

What I can see, is that the main difference is not about "SHA1" but about the certificate chain. See the icons. Both "SHA1" messages are locked with a green icon, but the part about about the identity of the website is different. GOOD: *.mail.live.com . Certification owned by Microsoft, verified by Symantec Class 3. According to digicert.com, no error or ...


0

I have just established an IPSEC site-to-site VPN that required some ExtendedKeyUsage and I did some research on it. The ExtendedKeyUsage for Internet Key Exchange were deprecated by RFC4945 The CA SHOULD NOT include the ExtendedKeyUsage (EKU) extension in certificates for use with IKE. Note that there were three IPsec- related object identifiers ...


1

There are a few different reasons. There isn't any one single answer, but they can all be grouped together as: because you're not supposed to use the same key for multiple things. In this case it's more of a practical issue. You have to time rekeying the TLS cert with the SAML cert, which can be painful. Revoking one key means revoking the other. If ...


1

In reply to the Added 2 part. Yes. It will be the same after 1 Jan 2016 and even after 1 Jan 2017. You can always click through this warning and tell the browser to ignore it (it is somewhat harder with HSTS, but thats another story).


4

This answer will depend on which PKI software you're using and how it's configured to handle revocation information. Certificate errors have a precedence; you want to check the most severe first. The general procedure for validating a certificate is: Check that the Root Cert is in your trust store (or some complicated path-building for a big corporate CA, ...


2

The article you linked to is only relevant for CAs participating in the Windows Root CA Program, not self-signed certs. Self-signed certs only work if you put them as a trusted CA root in OS or browser. These will continue to work indefinitely. Windows Root CA Program certs signed with SHA1 are good to 1 Jan 2017. 1 Jan 2016 is the last issue day that ...


0

You will need to replace it before January 2017 with a SHA-2 in order for Windows/browser clients to accept the certificate.


1

No. Apple does not support this. Apple's Secure Transport library does not support X.509's nameConstraints. There is a bug in Chromium's bug database about this. And it's been closed as WontFix. Developer Ryan Sleevi had this to say on Aug 25, 2014 (archived here): Chrome defers to the OS cryptographic stack for verification. It's a well-known, ...


1

It can be done with openssl. In a terminal type: openssl pkcs12 -in myfile.p12 -nokeys -nomacver And just press ENTER when the import key is requested. The certificates contained in the PKCS12 file should be printed (en PEM format) on the standard output. NOTE: even if the certificates are present in plain text in the PCKS12 file, the file full content ...


2

EDIT: You nailed it. Among them only C# cert uses sha512 and in Client Hello's cipher suites there is no sha512 specified. So maybe Server found client does not support SHA512 used in C# cert so reset the connection? Yup. Details below. SHA-512 confusion? One striking difference between the certs is the signature algorithms: C-Sharp certificate: ...


1

All an authenticated HTTPS connection does is validate that if https://www.example.com is shown in the address bar, that you are in fact connected to www.example.com. The certificate does not certify that www.example.com is not malicious in any way. An Extended Validation Certificate with a green highlight shown around the address bar will allow you to know ...


0

The communication between you (your browser) and the server using HTTPS is secure in that case (of course, we suppose you are not a victim of some scenarii like MITM attack). The certificate ensures you are communicating with the right website, nothing more. But HTTPS is not responsible of the nature of the content of this communication: by nature of the ...


0

if the website use https you can theorically be sure (day 0 exploit excluded) that you are visiting the website you see in the url and that nobody can see your exchange . This doesn't mean the site isn't malicious, corrupted or insecure in the way that can harm you.


0

All an authenticated HTTPS connection does is validate that if https://www.example.com is shown in the address bar, that you are in fact connected to www.example.com. The certificate does not certify that www.example.com is not malicious in any way. An Extended Validation Certificate with a green highlight shown around the address bar will allow you to know ...


10

There is no magic in there: the user will see what the web server sends, and the web server will send what you tell it to send. You said that both URLs will share the same IP using a DNS CNAME entry, so you will encounter a different behavior depending on the browser supports SNI or not. SNI is supported by all decently recent browsers and allows them to ...


3

In short: You can just start using CertA again, until its expiry date, as the CA is not directly involved when certificates are used. The CA is not directly involved in your use of certificates, unless you revoked the certificate CertA. Revocation means that you go to the CA and explicitly tell them "The certificate CertA was compromised.". There is usually ...


7

The authors of the page you are referring to fail to understand some basic concepts and make otherwise false statements. Because of that I don't think that you should take any statements or conclusions from this article for real. Some examples: This certificate identifies itself (via CN field) as *.google.com despite being served during a putative ...


1

I don't see anything particularly out of the ordinary. IPv4 adresses move around. Google doesn't use EV-certification as EV doesn't allow wildcards. This person doesn't know that a certificate can contain multiple domain names in the subjectAlternativeName field, he only looks at the canonical name, which is indeed google.com for Google domains.


3

The green lock indicates that an Extended Validation Certificate is being used. This means that the organisation has gone through some extended checks before the certificate is issued for their domain. You should be right to be suspicious if this suddenly changes to a DV or OV certificate (Domain Validated or Organisation Validated), which are easier to ...


0

One more thought on expiration of a certificate is addressing the question of asymmetric key algorithm itself. From a public key is it possible to determine the private key? Well the answer it is improbable rather than impossible. Generally it is assumed it would take a million years to for a computer to find the private key from a public key. But what if ...


4

TLS handshake protocol in brief: All the exchange you see before the step 9 (including the certificate exchange) is vulnerable because only after it the channel is secured. P.S. You may be interested in reading this.


7

Yes, the client certificate is sent in the clear if the server sent a certificate request. Some servers (IIRC, Microsoft IIS) first perform handshake with no user authentication and then start a renegotiation asking for client certificate. The renegotiation is thus encrypted using the cipher suite negotiated in step 1 and the client certificate is encrypted ...


4

The EBICS financial protocol (European alternative to SwiftNet) can be a pertinent real life example. It uses three certificates respectively for authentication, signature and encryption. Most (if not all) banks use three different certificates. However the official protocol specifications allows the use of the same certificate for authentication and ...


7

Is it OK to create a new SSL certificate before the old one expires? Yes. There is nothing to technically prevent you from doing this. And if you are large company, then you may want to do generally do this as an insurance against CA-failure. If for example your CA of choice is hacked and suddenly revokes all its certificates, then you can just deploy ...


0

Yes you can do that without needing to revoke the old one as long as they have (both) the same domain name on them.


2

Https is http via TLS/SSL. TLS provides three things: Data encryption Server authentication (the server is who they say they are) Client authentication (the client is who they say they are) To achieve 1) a self-signed certificate is enough, but for 2) you need a certificate that is signed by a certificate authority known to the client (your browser). ...


18

Even if you see a message saying the connection is not trusted does not mean it is not an HTTPS connection. In order to display or not such error messages, browsers try to validate certificates using following criteria: Does the certificate common name match the domain name entered in the URL bar? Is the current date between validity start date and ...


12

The error message you got is the normal behavior of browsers when dealing with self-signed certificates because your self signed certificate can not say who the recipient of the data (your server) really is (trust), so you got that message asking you if you are sure you trust your website (serever). Anyway since your browser can't verify that you are ...


3

One possible solution for you is to install your self signed certificate as a Trusted Root CA on your notebook. See, https://technet.microsoft.com/en-us/library/cc754841.aspx#BKMK_addlocal This will fix the problem you are describing (on that laptop only and only for browsers/other software that uses roots trusted by the OS, i.e. Firefox will still ...



Top 50 recent answers are included