Tag Info

New answers tagged

0

My solution was to pass subjectAltName via an environment variable. First have this added to openssl.conf: [ san_env ] subjectAltName=${ENV::SAN} Then set the environment variable before invoking openssl: export SAN=DNS:value1,DNS:value2 openssl req -extensions san_env -subj '/CN=value1' ... Note: the -extensions san_env parameter needs to be present ...


-3

If you can't make it, just fake it. ;-) http://www.code-wizards.com/projects/libfaketime/ libfaketime (FakeTime Preload Library) - report faked system time to programs without having to change the system-wide time By faking the system time you can set "Not Before" to any value you like.


3

Just let them buy a new one. You may be thinking of a process like in DNS ownership transfer. But there is no such thing for certificates. Anyone who can answer an email for admin@example.com will get a certificate for example.com. It's as simple as that.


0

Sounds like a very cool project. It seems that you have rediscovered the very problem that Kerberos was designed to solve. Looking at your example, why would you not just use PKI both ways? Or can you not control the certificates at both ends? You could look at SSL session initialization to see how you could transfer a confidential message under the gaze ...


1

Considering its trivial to get a free signed SSL cert, I wouldn't even mess with self-signed certs. It builds bad habits in users and is just asking for trouble. http://www.startssl.com/


1

When you have secure(!) contact with all of your users over a different medium, you can send them the root certificate of your own certificate authority which you used to sign the certificate of your website and give them instructions how to add it to the list of trusted certificates of their web browser (or maybe even a handy install script which does it ...


1

Edit: The question author made significant edits to their question after this answer was posted. This answer is based on an earlier version of the question which gave the impression that they were asking about a usual public website. You can not explain that a self-signed certificate is fine, because on a public website it is not! The other question you ...


3

So how can I ensure that when I send a user to my server, and they are confronted with the "self-signed certificate" warning, they are able to decide for themselves whether to trust it or not, instead of having to believe the skewed picture that their software paints for them? If you are not using pre-defined trust anchors (e.g. the root CA of the ...


-4

The Best approach (for the use case of a limited user group and a personal website) I use is to have a non secured page somewhere where my users can download the root certificate (my own CA) and find instructions how to install that into there trust store. this way the computer can trust my 'self-signed' certificate. one of the headaches with this approach ...


10

First of, CRL do not cover root CA. By definition, a root CA is a root: it has no issuer except itself. A CRL conveys revocation information, which is a way for a certificate issuer to announce that a previously issued certificate should be considered as invalid even though it looks fine and its signature is correct and everything. Thus, a CRL that talks ...


0

What exactly does it mean when Chrome reports a certificate 'does not have public audit records'? I think Tyler did a great job of explaining the message and CT, so there's no need in rehashing it. Based on @Colonel Panic's comment for a test site, here's what the end entity (server) certificate looks ike. Note: you must use TLS 1.0 (or above) and ...


1

Trusting a CA means that you trust the CA for all certificates issued by this CA. But because all CAs are treated the same by the browser (except for EV certificates) any CA could create a certificate for any site. This means it is enough if a single trusted CA is not as trustworthy as needed and this kind of trust problems happened several times in the ...


2

The PKI model works on the trust you can give to the initial third party. Namely, the root CA. If you trust the root CA, you should import their root certificate, so that any certificate they issue (sign) will be automatically accepted by your system. If you do not trust the CA, well there is nothing more you can do. So why would you trust CAcert.org ? ...


2

Chrome 42 has now been released, and I can answer my own question: yes, they must have slowed down. 42 has the behavior that was expected in 41. I'm still not aware of any official explanation or acknowledgement of the delay.


0

I've found the answer for this in another post: Why is 'avast! Web/Mail Shield Root' listed as CA for google.com? The problem was that my Antivirus that was creating it's certificate (not that secure, but irrelevant because it's between Avast and the Browser only) and making chrome say that. Everything is fine with the certificate. Thanks for ...


-3

Your website is secured with the SHA-1 algorithm. The SHA-1 algorithm is now outdated and Google Chrome & other web browsers have already quit their support for it. The lower hash value and key length lets hackers crack the website easily. Chrome 38.x users see the website as secured without any warning message, but Chrome 39, 41, 42, .... users will ...


7

You don't need to get another new certificate. In order to resolve this issue, you need to just reissue your certificate with SHA-2 signature. That's it.


15

Google blogged about flagging Certificates using SHA-1 here -> Gradually sunsetting SHA-1 There's no reason to get a new certificate yet as Chrome won't be actually blocking the certificate just treated as “secure, but with minor errors”, I believe that some issuers are offering to reissue certificate but as always, YMMV.


1

I found a solution as I was looking for; http://blog.engelke.com/2015/03/03/creating-x-509-certificates-with-web-crypto-and-pkijs/ But I'll try pem modulus at first. Because it works on back-end and seems more simple.


2

This would have been better here. However we can still answer your question. I inspected the site you referred to and the reason, why chrome shows you a security warning is because the intermediate certificate of StartSSL uses SHA-1 for signature-hashing. Your certificate is in fact SHA-256/RSA-4096 as claimed, but because one certificate in the chain (the ...


0

Indeed, Microsoft Technet lists MITM prevention as the sole use of this setting. And a digital signature does just that: to prove the authenticity of a digital message. If your network is trusted and MITM scenarios are really (!) not possible, it can be disabled. Apparently there's also a performance decrease involved when it's enabled. So, if you're ...


0

Would this be considered a low risk vulnerability? Yes. If an attacker can force the use of an IP address, then surely the certificate is no longer of any value at this point (unless installed on a client machine)? I'm not quite sure I understand the question. Even if an IP address is forced by an attacker and the IP address is not defined as ...


2

They are doing a man-in-the-middle attack which needs the user to either ignore security warnings or to explicit import the CA used by fiddler. For more discussion about this topic have a look at How can I prevent a man-in-the-middle (MITM) attack on my Android app API?


-1

Yes, the certificate is of value. If the attacker can "force the use of an IP address" then as you've stated the user will be notified that there is something wrong and they should not proceed.


0

From what I read in the comments and in chat I think this is related to timestamping. The driver has been signed at a time the certificate was valid. That signing time was confirmed by a certified timestamp server. In that case, the driver is considered as trustworthy, since everything was fine at the time of signing. To check for a timestamp, open the ...


1

They're the same. Note that signature doesn't contain the data shown in grey - rather, it's a signature of that data.


2

No, you cannot use the same certificate for both server- and client-side SSL authentication. (Well, technically, you can - it won't break anything - but it means that the server private key will be known to N clients, each of which can then impersonate it, so that's just not going to work out.) If you wanted to do Client SSL authentication, you'd want to ...


0

The clients (eg browsers) while sending the extended clientHello during ssl handshake, are supposed to provide the OCSP responderIDs they trust. If the client doesn't provide the responderID, the responders known to the server will be used. check "certificate status request" in rfc 6066.


2

Short answer: you can't, because they are two different and incompatible key+certificate systems. Longer answer: Windows Certificate Manager uses X.509 certificates, each of which must be signed by a Certification Authority whose root certificate is considered valid by Windows. Thunderbird will use the public key stored in your recipient's certificate to ...


2

Actually, there is an often unused (at least on the web) optional part of SSL/TLS that allows for client authentication. It is generally not used on the web because the server doesn't really care if the client is who they say they are - they just need to have the proper credentials. Additionally, imagine the nightmare of having to verify every client in the ...


3

It is hard to tell you exactly what is going on because we don't know what request actually triggered the message and you do. What it looks like, however, is that for some reason, a secure request intended for Toshiba's update server went to www.bcrea.bc.ca. There can be many reason for this but few are really encouraging: Something in your DNS resolution ...


0

I'd like to to rephrase your question as this: "Is there a way to make sure, in a cryptographic way, that two different views of some data are, in effect, related the same information ?" I would see two approaches to that problem. The first one starts with the data, the second one, with the final view. Data-centric In order to implement this, you need to ...


0

Theory This is the usual process in theory: Your client establishes a connection to the server. The server presents its certificate. The client then makes sure that: (1) the cert is valid, (2) the server is in possession of the matching private key via a challenge and response mechanism, (3) that "serverAuth" is set in the certificate. Then the server may ...


1

"fakebook.com has acquired a certificate from on the trusted CAs" : Normally (and I said normally, because to say it so "the world isn't perfect") this step should not happen. A really trustable CA should benefit from specific services from third-party societies (like Netcraft) so, when you try to register a new domain name, they will automatically check it ...


5

is it trust-worthy because the CA authority did a background check on them? No. A SSL certificate is comparable to a passport: it says who the person is and which country the passport issued. But it does not say how trustworthy the person is. The main use of the certificate is to make end-to-end encryption possible, that is protecting against ...



Top 50 recent answers are included