Linked Questions

0
votes
1answer
2k views

How to store openssl CA private key securely [duplicate]

We are in the phase of implementing SSL certificates for UI access to our components (we have an internal Root CA to whom we send the CSR generated in openSSL) and we're wondering where would be the ...
113
votes
6answers
30k views

I can't access websites that use HTTPS, instead getting the message “your connection is not private”!

I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But ...
79
votes
12answers
13k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
68
votes
6answers
41k views

How do large companies protect their source code?

I recently read the canonical answer of our ursine overlord to the question on How do certification authorities store their private root keys? I then just had to ask myself: How do large companies (e....
15
votes
3answers
2k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
13
votes
2answers
5k views

When you buy a certificate, does the certificate authority have (a copy of) the private key?

I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this: You generate a public and private key pair From this key pair you generate a ...
7
votes
2answers
2k views

Is cacert.org more harmful than self-signing?

I don't understand the https security model attempted upon me by The OpenBSD Journal (undeadly.org). Instead of using self-signed certificates for https like they did in the past, they for a while ...
14
votes
2answers
918 views

How do large companies protect their private (code-signing) keys?

Some time ago I read the canonical answer of our ursine overlord concerning CAs and their private (root) keys. More recently I stumbled across the question on the question on how to manage code ...
2
votes
2answers
557 views

What is the point of certification authorities that are not trusted by browsers (=trusted by Root CAs)?

See here: https://www.cacert.org/index.php?id=1 Chrome, Firefox and Internet Explorer warn that it is not trusted, essentially making the entire thing useless. If I want some kind of ssl certificate, ...
5
votes
2answers
239 views

Why do so many browsers show sites with revoked certificates?

Everyone seems to agree that it is REALLY important to protect private keys so the encrypted Internet can remain just that (see for example at How do certification authorities store their private root ...
2
votes
1answer
138 views

CA storing root key in a bank safe deposit box. Concern?

The CP/CPS of SwissSign Gold Certificate state that: 5.1 "...Two identical clones of the SwissSign Gold CA keys are stored off line in Swiss bank safe deposit boxes." They even put in their Why ...
0
votes
2answers
97 views

Local certification authority and certificate chain

I know that I can set up a local certification authority for a local network. I can issue certificates for all the devices in my network, and as long as they trust me, they can use such certificates ...