Hot answers tagged

4

What you are looking for is to modify the certificate in a way that it contains the ability to be a CA, i.e. set the CA flag to true. Fortunately you cannot simply modify a certificate, because any kind of modification invalidates the signature and thus nobody will trust this certificate anymore. This is essential because otherwise everybody could just ...


4

I was wondering whether a CA has different private keys to sign certificates with? A CA will usually have a number of Intermediate Keys for use in signing customers' certificates. These Intermediate Keys are in turn signed by the CA's Root Key, which should be stored "offline" and only used rarely to sign those Intermediate Keys. The matching Root ...


3

Don't be sure that you digitally signed the document. Adobe Reader and related products also include echoSign features. EchoSign is an electronic (not digital) signature system. If you still have the "signed" PDF, then open it in Adobe Reader. If you see a colored bar across the top that includes a button for the "Signature Panel," then the PDF is digitally ...


3

I was wondering whether a CA has different private keys to sign certificates with? In general, no. There is one key pair - and thus private key - per certificate. Certificates can be rolled over to use a new key pair of course. Furthermore, in general, a CA manages multiple certificates for different purposes. The CA may also have different certificates ...


2

Your question boils down to "how can I initially construct a trust chain". No matter how you want to verify the download or individual steps (for example, X.509 certificates for HTTPs), you will have to start trusting somewhere. The most paranoid method of verification would be meeting GnuPG's main author, Werner Koch (and/or others from the core team). But ...


2

Without knowing the prevailing law where you require this, all answers are moot. For last year's Large Renewable Procurement (LRP) in Ontario, Canada, proponents had to prove that a public web page was available on a certain date. After much discussion with proponents, the agency required: a printout of the webpage, showing URL and system clock date and ...


2

I will try to simplify as much as possible The difficulty comes from some "hard to compute" operations in maths. For example, some operations are two-ways easy to compute. If I compute 5*6 = 30, it is easy to calculate x*6 = 30 (30/6 = 5). Some other operations are only one-way easy to compute: 5^6 = 15625. Ok but if I give you x^6 = 15625... how the fuck ...


1

Root certificates don't need to be revoked if they are not compromised. Obviously it's not possible to just create a CRL as there would not be a trusted private key; instead this is a out-of-order operation. In general it's better to create a new root certificate and let the old one expire. Note that the underlying certificates should have an expiration ...


1

It is an arbitrary, administrative decision for the creator of CA what client certificates they want to enable to be signed by the CA. The policy_match in the following configuration line: policy = policy_match is a chosen name that corresponds to a particular section in the configuration file. That section defines in details each of the [ ...


1

You can't do this, you will have to apply for a new certificate. There are special types of certificates that apply for multiple previously specified domains at once.


1

The piece that seems to be missing is that, for some public key crypto algorithms, the public and private keys are cryptographic inverses of one another. So, encrypt with a public key, decrypt with the private key; encrypt with a private key, decrypt with the public key. So, if I encrypt a message, or more likely, a message digest, with my private key, ...



Only top voted, non community-wiki answers of a minimum length are eligible