Tag Info

New answers tagged

1

The "right" way to think about renewals is to ask yourself why you want to renew. As I understand it, you have a root CA which is hardcoded in some application installed in the clients. Moreover, the clients themselves own certificates, presumably issued (directly, or indirectly through an intermediate CA) by that root CA. This hints at some mutual ...


2

There is no really well-established command known as "mkcert" (there is apparently one under that name in some IBM systems). Since you are talking about IIS, I suppose that you mean MakeCert. Certificates follow a standard called "X.509"(*). There are several tools out there who can create certificates. The main virtue of a certificate is to be signed by a ...


1

Certificate "class" is essentially a marketing terminology. Each CA is free to call some of the certificates "class 0" or "class 1" or whatever, roughly meaning "I issued that but I did not bother to check" or "this time I did some checks because the owner paid me enough for that". Theoretically, as per X.509 rules, the "class" should be encoded in the ...


0

By "Classes" I think you mean "Extended Key Usages", and that attribute in particular is used by applications (email, web browsers, smart cards, IPSec, etc) to determine what that certificate is permitted to do. An EKU can be specified on the root CA or any subCA below it. Wherever that EKU is defined, then all usages below should inherit that ...


6

Theoretically you can put anything you want in a certificate; for instance, this certificate actually contains a video file as "Subject Alt Name" (surprisingly, Windows has no trouble decoding a 1.2 MB certificate -- but it does not show the video, alas). However, in practice, certificates "for SSL" just contain the intended server name, as specified in RFC ...


1

Faced with this question, Microsoft answered the way they are accustomed to: with a Microsoft-specific extension. They defined the User Principal Name, which is actually an OtherName element, the UPN being identified by a Microsoft OID (1.3.6.1.4.1.311.20.2.3) and encoded as an UTF8String (as succinctly specified there). The format of the string mimics that ...



Top 50 recent answers are included