I have downloaded numerous certificates to my device. How do I ensure the confidentiality and integrity of the data at rest?

closed as unclear what you're asking by Stephane, Deer Hunter, WhiteWinterWolf, StackzOfZtuff, RoraΖ Nov 9 '15 at 13:48

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    It is quite unclear what you are precisely asking. Do you mean public certificates, privates certificates (or certificates accompanied by their private keys), trusted certification authorities (CA) certificates, or something else? Each of these cases would lead to different answers. – WhiteWinterWolf Nov 9 '15 at 10:27

Certificates are already signed. Furthermore they contain attributes that can be validated, such as the start and end date of the validity period. So when the time comes to use them you can simply verify and then validate the certificates. Removing or altering the certificates may in that case just allow for denial of service attacks.

It's different for trusted certificates. You should not allow an attacker to exchange the certificates in a trust store to be replaced. For that reason you could e.g. store the certificates in a (password) protected key store. The key store should be integrity protected, especially if you cannot verify the certificates in it with a higher level certificate. It often makes sense to check if the system has support for trust / key stores because it may offer higher level protection. If not, you may have to rely on file based stores, e.g. PKCS#12 key stores.

Trust stores are just a common method of handling this, there are of course many other measures that can be thought of to protect data (at rest). You may even get away with just making sure that the access conditions to the certificates are handled correctly. That all depends on the situation.

The certificates are usually public, but there might be instances where the information also contains information that is relevant to privacy. This could be the case for certificates for end users. In that case you might also want to keep certificates confidential, e.g. by encrypting the store.

  • PS I assumed that the certificates do not contain a private keys here, although private keys can certainly present in key/certificate stores. Private keys are linked to specific certificates, but they are not contained within them. – Maarten Bodewes Nov 9 '15 at 17:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.