Linked Questions

3 votes
1 answer

How to store openssl CA private key securely [duplicate]

We are in the phase of implementing SSL certificates for UI access to our components (we have an internal Root CA to whom we send the CSR generated in openSSL) and we're wondering where would be the ...
cyzczy's user avatar
  • 1,558
90 votes
12 answers

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
makerofthings7's user avatar
116 votes
6 answers

I can't access websites that use HTTPS, instead getting the message "your connection is not private"!

I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But ...
Tarek's user avatar
  • 1,073
86 votes
6 answers

How do large companies protect their source code?

I recently read the canonical answer of our ursine overlord to the question on How do certification authorities store their private root keys? I then just had to ask myself: How do large companies (e....
SEJPM's user avatar
  • 9,720
15 votes
3 answers

Trying to understand why signatures in root certs "are not used"?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
user53029's user avatar
  • 2,727
18 votes
2 answers

When you buy a certificate, does the certificate authority have (a copy of) the private key?

I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this: You generate a public and private key pair From this key pair you generate a ...
Stijn de Witt's user avatar
7 votes
2 answers

Is more harmful than self-signing?

I don't understand the https security model attempted upon me by The OpenBSD Journal ( Instead of using self-signed certificates for https like they did in the past, they for a while ...
cnst's user avatar
  • 1,924
15 votes
2 answers

How do large companies protect their private (code-signing) keys?

Some time ago I read the canonical answer of our ursine overlord concerning CAs and their private (root) keys. More recently I stumbled across the question on the question on how to manage code ...
SEJPM's user avatar
  • 9,720
2 votes
2 answers

What is the point of certification authorities that are not trusted by browsers (=trusted by Root CAs)?

See here: Chrome, Firefox and Internet Explorer warn that it is not trusted, essentially making the entire thing useless. If I want some kind of ssl certificate, ...
Blub's user avatar
  • 165
5 votes
2 answers

Why do so many browsers show sites with revoked certificates?

Everyone seems to agree that it is REALLY important to protect private keys so the encrypted Internet can remain just that (see for example at How do certification authorities store their private root ...
Stone True's user avatar
  • 2,042
2 votes
1 answer

CA storing root key in a bank safe deposit box. Concern?

The CP/CPS of SwissSign Gold Certificate state that: 5.1 "...Two identical clones of the SwissSign Gold CA keys are stored off line in Swiss bank safe deposit boxes." They even put in their Why ...
Victor's user avatar
  • 413
0 votes
2 answers

Local certification authority and certificate chain

I know that I can set up a local certification authority for a local network. I can issue certificates for all the devices in my network, and as long as they trust me, they can use such certificates ...
ssnape's user avatar
  • 11