Tag Info

Hot answers tagged

10

First, it's not a URL, it's a host name or domain name. The host name is one part of the URL. http://security.stackexchange.com/questions/92838/is-it-neccessary-the-website-certificate-must-have-site-url is a URL, and the host name is security.stackexchange.com. Next, yes, at least one host name in the certificate must match the exact host name used to ...


7

You cannot reconstruct an OpenPGP key based on it's fingerprint. The fingerprint is a hash value of the public key, so calculating the fingerprint of a key is a one-way operation. But: if somebody only distributes his key's fingerprint, he will almost certainly have distributed his public key on the key server network, from where you can pull it. Given you ...


6

If the entity is supposed to sign CRL but not certificates, then it is not a CA -- it is a CRL issuer. It is often called an indirect CRL issuer because, by definition, it is distinct from the CA that issued the certificates whose revocation status is specified by the CRL. A certificate may be validated as a CA only if (among other things) it has a Basic ...


5

An HTTPS connection encompasses both directions; server->client data is encrypted just like client->server data is. The private key is important in securing the session key setup, and the session key is used by both sides to encrypt the conversation.


3

No, new root certificates are added on a regular basis. Microsoft have a Trusted Root Certificate programme enabling CAs to enroll. This happens with most products that handle certificate verification. For example, this is Mozilla's list where you can see that there are several added per year. For Microsoft's list you can simply check your Windows OS's ...


3

Yes the hostname on the cert must match the hostname portion of the url the cert is requested from. That is a requirement because there is an expectation that SSL not only secure the communication (encryption) but also ensure the user is connecting to the proper server (authentication). Without that requirement it would be trivial to spoof users with a ...


3

short answer: yes long answer: when using https everything is encrypted, when using http nothing is and you can do both in the same web page. most browsers warn about unsecure content in secure pages, but there is nothing to stop you from putting secure resources in unencrypted pages. It used to be common to use secure forms (that posted to secure pages) on ...


2

What you describe is https with self-signed certificates, i.e. Setup a new server with SSH, it makes it's own keys. Setup a https server with a self-signed certificate. ssh to a new server and get a new fingerprint: "This is new, accept?" Connect to the new server with the browser. You get a warning but can tell he browser to add an ...


2

The simple answer is no you can't have an RSA cert which has a ECC public key. By definition an RSA cert is a cert which has an RSA public key. The CA could sign your ECC cert with their RSA key but that wouldn't make it a RSA cert it would make it a ECC cert signed with an RSA key. Likewise a CA could sign a RSA cert with their ECC key but that wouldn't ...


1

Well the issue here is that Microsoft should have updated their Root Certificate Program member list PDF document and notified their corporate and government customers at the very least, which they haven't. Also, SilverlightFox is wrong: you cannot "simply check your Windows OS's certificate store for root certs.", as this only provides a list of currently ...


1

When SSL is established, a symmetric key is established that is use by both sises (client and server) to encrypt traffic. So to answer your question, no, they can nott simply "see" inbound traffic.


1

An HTTPS connection is encrypted in both directions. Your download will be encrypted if it is over a HTTPS connection. Keep in mind that while the connection to the website may be encrypted, the download link may not be. Check the URL of the download, if it starts with https:// it is encrypted. By the way, HTTPS is HTTP over SSL. Read how it works here: ...


1

The personal-digest-preferences option does not set preferred digest algorithms for creating keys, but during signing (if also encrypting at the same time, the most preferred algorithm supported by the recipient is chosen). From man gpg: --personal-digest-preferences string Set the list of personal digest preferences to string. Use gpg ...


1

It indicates whether the key is DSA or RSA. You can read more about the differences between the two here. You can determine which type your key is using gpg --list-keys at the CLI. I'm not sure what GUI you'd use on a Mac so I can't speak to that. C:\>gpg --list-keys -------------------------------- pub 4096R/2C55AF0B 2014-10-28 [expires: ...


1

I think you cannot authenticate the client using mutual SSL/TLS handshake with GAE. To achieve this in Java EE you should put this into web.xml <login-config> <auth-method>CLIENT-CERT</auth-method> </login-config> Source: https://docs.oracle.com/javaee/6/tutorial/doc/glien.html However, AppEngine docs says: App Engine ...


1

A bit of a painful workaround but it works for use with BurpSuite / Charles / Fiddler etc is to revert to Firefox 3 when you want to proxy the connection to HSTS sites: https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/3.0/win32/en-GB/



Only top voted, non community-wiki answers of a minimum length are eligible