Linked Questions
12 questions linked to/from How do certification authorities store their private root keys?
3
votes
1
answer
11k
views
How to store openssl CA private key securely [duplicate]
We are in the phase of implementing SSL certificates for UI access to our components (we have an internal Root CA to whom we send the CSR generated in openSSL) and we're wondering where would be the ...
- 1,558
90
votes
12
answers
18k
views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
- 50.7k
116
votes
6
answers
33k
views
I can't access websites that use HTTPS, instead getting the message "your connection is not private"!
I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But ...
- 1,073
86
votes
6
answers
82k
views
How do large companies protect their source code?
I recently read the canonical answer of our ursine overlord to the question on How do certification authorities store their private root keys?
I then just had to ask myself:
How do large companies (e....
- 9,720
15
votes
3
answers
2k
views
Trying to understand why signatures in root certs "are not used"?
Taken from here:
Don't worry if the root certificate uses SHA1; signatures on roots are
not used (and Chrome won't warn about them.
Why are the signatures not used?
Are not root certificates ...
- 2,727
18
votes
2
answers
9k
views
When you buy a certificate, does the certificate authority have (a copy of) the private key?
I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this:
You generate a public and private key pair
From this key pair you generate a ...
- 283
7
votes
2
answers
3k
views
Is cacert.org more harmful than self-signing?
I don't understand the https security model attempted upon me by The OpenBSD Journal (undeadly.org).
Instead of using self-signed certificates for https like they did in the past, they for a while ...
- 1,924
15
votes
2
answers
2k
views
How do large companies protect their private (code-signing) keys?
Some time ago I read the canonical answer of our ursine overlord concerning CAs and their private (root) keys.
More recently I stumbled across the question on the question on how to manage code ...
- 9,720
2
votes
2
answers
742
views
What is the point of certification authorities that are not trusted by browsers (=trusted by Root CAs)?
See here: https://www.cacert.org/index.php?id=1
Chrome, Firefox and Internet Explorer warn that it is not trusted, essentially making the entire thing useless. If I want some kind of ssl certificate, ...
- 165
5
votes
2
answers
342
views
Why do so many browsers show sites with revoked certificates?
Everyone seems to agree that it is REALLY important to protect private keys so the encrypted Internet can remain just that (see for example at How do certification authorities store their private root ...
- 2,042
2
votes
1
answer
285
views
CA storing root key in a bank safe deposit box. Concern?
The CP/CPS of SwissSign Gold Certificate state that:
5.1 "...Two identical clones of the SwissSign Gold CA keys are stored off
line in Swiss bank safe deposit boxes."
They even put in their Why ...
- 413
0
votes
2
answers
165
views
Local certification authority and certificate chain
I know that I can set up a local certification authority for a local network. I can issue certificates for all the devices in my network, and as long as they trust me, they can use such certificates ...
- 11