Tag Info

New answers tagged

1

Key Usage error The key usage field shows exclamation mark because this field is marked as critical. This is not an error. why is it showing "Thumbprint alogrithm as "sha1" Beacuse the certificate thumbprint (the field below it) is created using SHA1.


2

To answer the first two bullet points: Firefox has its own list of trusted CAs. You can add certificates in Menu Button>Options>Advanced>Certificates(tab)>View Certificates>Authorities(tab). This is for Firefox version 38. Yes Google is trying to shame people into moving from SHA1 to a more secure hash such as SHA2. Here is the chromium blog post about it. ...


7

This is not for "certificates above the end-entity" but for "root certificates" only. In pure X.509, there is no such thing as a "root certificate". There are certificates, and there are trust anchors. A certificate contains a public key, the name of the entity that owns that key, and is signed by another entity (an "upper certification authority"). This ...


1

Isn't identity proven by the advocate (higher authority) signing a hash of the certificate? Root certificates are built into the system (or shipped with the browser). They are the end of the trust chain and there is no higher authority which signed them. They are self-signed, but only because there has to be some signature. The signature does not need ...


4

As noted by StackzOfZtuff, the SHA1-signature is in the long-lived¹ intermediate CA «Google Internet Authority G2». This key pair is stored in a FIPS 140-2 Level 3 certified Hardware Security Module, where it was generated.² The HSM itself is able to sign using SHA1, SHA-256, SHA-384 or SHA-512.³ However, the signature for the HSM certificate was done by ...


19

Meta-answer/comment. Re. Thomas' answer: I just ran an SSL Labs scan on a Google.com server and it seems that the end entity cert is in fact SHA256withRSA. But the (single) intermediate is only SHA1withRSA. No idea why. Screenshot:


93

This may be a case of "do what I say, not what I do". Note that Chrome complains about use of SHA-1 for signing certificates whose validity extends beyond the end of year 2015. In this case, Google's certificate is short-lived (right now, the certificate they use was issued on June 3rd, 2015, and will expire on August 31st, 2015) and thus evades Chrome's ...



Top 50 recent answers are included