Hot answers tagged

3

The pathlen constraint is only valid in subordinate CA certificates. If you followed the first article you linked and generated a trust-anchor with a pathlen constraint then it is not checked. According to RFC5280 section 6.1.4 (k) basicConstraint is only checked in certificate i+1 (where the trust-anchor is the first (i=1) and subsequent certificates in ...


3

Generally speaking, you should be putting the root cert in stuff. The model generally works like this: Clients Have the root cert "pinned" (ie embedded in trust store). Whevever they validate a cert, it needs to trace back to some cert in their trust store, the number of intermediate certs between the end-cert and the pinned cert should be irrelevant, so ...


2

In X509 the fields making a certificate unique is the combination of issuer and serial number. Only the serial number is not guaranteed to be unique since two CAs may use the same serial. This is the reason both are typically needed for revocation. In practice, if you only have one CA, the serial will be enough of course. But it's not generic. There should ...


2

PKCS#10 is a specification defining what and how attributes should be contained in a Certificate Signing Request in order for it to be compliant. It is used as the default specification for most certificate signing authorities. This specification dictates the use of ASN.1. ASN.1, also known as Abstract Syntax Notation One, is a standard that defines rules ...


1

Your answer is partially addressed in the SSH man page: RekeyLimit Specifies the maximum amount of data that may be transmitted before the session key is renegotiated, optionally followed a maximum amount of time that may pass before the session key is renegotiated. The first argument is specified in bytes and may have a suffix of ...


1

how OpenSSL actually handles OCSP stapling response OpensSL does not do anything by its own in this area. You have to explicitly deal with OCSP stapling in your code, both for signaling that you support stapling and for validating and interpreting the response. Does the OpenSSL check the signature, issuer key/name hashes of the response? If the ...


1

The six keys are derived from the master secret, the client random and the server random. You can get the master secret and the client random from the SSLKEYLOGFILE. I suppose you can sniff the server random with Wireshark from the server key exchange message. If you have those, you can call some library function or script on them to get the six keys. The ...



Only top voted, non community-wiki answers of a minimum length are eligible