143,013 reputation
22290491
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 9 months
seen 1 hour ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Aug
12
answered Why is it a good idea that X.509 digital certificates have an expiry date?
Aug
12
answered Inspecting a TLS Certificate to determine RSA Key Usage restrictions
Aug
12
answered New gTLDs are coming. How will browsers handle cookies, SOP and certificates?
Aug
12
answered I see two different sets of certificates for Google websites when I am at work and when I am at home
Aug
12
answered Can a wildcard SSL certificate be issued for a second level domain?
Aug
12
answered How are possible uses for X.509 (SSL) certificates denoted?
Aug
12
awarded  Revival
Aug
12
answered Is it possible to force a new SSL session
Aug
12
answered Is off-the-record style encryption possible with email?
Aug
12
reviewed Reject suggested edit on Javascript containing a long hexadecimal string and eval: is this suspicious?
Aug
11
answered Is PGP combined with a regular web-based email service secure?
Aug
10
awarded  Good Answer
Aug
9
answered How protective should we be of an SSL client certificate?
Aug
9
answered Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]
Aug
9
answered SSL verification of host name of https server
Aug
9
answered Are local firewalls necessary
Aug
8
awarded  Nice Answer
Aug
8
answered backdoors in hardware (ie. intel/amd cpu) possible?
Aug
8
comment Why IE/Windows forces you to install self-signed certificates as root CA to make them work?
On Windows systems, each user has its own set of "certificate stores". There is also an extra set attached to "the local machine". Only Administrator can write in the latter, but every user can add certificates in his own "root CA" store and this will work for his process. As for the lack of Basic Constraints, this is equivalent to an extension stating that the certificate is not a CA, so as long as the certificate is v3, this is fine (if the certificate has an extension, it is v3: v1 and v2 format don't have extensions).
Aug
8
awarded  Nice Answer