Linked Questions

2
votes
2answers
261 views

Can Certificate be validated locally [duplicate]

When I establish TLS/SSL with some server he sends me the certificate in the process. The certificate is signed by a certificate authority. In my PC/browser I have a list of trusted certificate ...
2
votes
3answers
992 views

How does the Certificate Authority work [duplicate]

I'm learning how the Certificate Authority work and have a question. As my understanding, the Certificate Authority can guarantee that the client get the true public-key: Saying that I'm a server and ...
0
votes
1answer
1k views

How does browser verify if SSL certificate is issued by CA? [duplicate]

As I'm studying how HTTPS works, one thing baffled me a lot, that is - How does browser verify if SSL certificate is issued by trusted CA? Do browser verify this by ask CA's server? Or it's just the ...
0
votes
2answers
117 views

What is the rationale of binding SSL certificates to a domain name? [duplicate]

As I understand them, SSL certificates contain a domain name, a public key and the giving CA. Why is it important to include a domain name? Why isn't it enough that the CA considers the public key as ...
0
votes
1answer
63 views

Can a site with HTTPS be impersonated if it's visited for the first time? [duplicate]

From https://doesmysiteneedhttps.com/: "Attackers can still impersonate my site, even if I use HTTPS." They can try, but as long as your private key stays private, browsers will show ...
1
vote
1answer
57 views

HTTPS flow clarification [duplicate]

I have done a small test and result is as expected, but I am trying to understand more. I have configured a fake DNS server to resolve all names to the IP of my VPS. On my VPS, I installed a web ...
0
votes
0answers
45 views

Is a trusted device, on a public network, still vulnerable to a man in the middle attack? [duplicate]

For example, if I am using my personal laptop on a public wifi, and type in the website I want to go to that includes HTTPS, (lets assume https://www.google.com/gmail/) can I reasonably trust that I'm ...
1151
votes
3answers
616k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
35
votes
3answers
8k views

How does a client know an SSL cert has been signed by a CA if the client doesn't have the CA's public key?

I'm still learning how SSL/TSL works, so apologies if this question is very basic. I understand that the server offers the client its SSL certificate, which contains the signature of a CA. I also ...
44
votes
2answers
8k views

Digital Certificate deployment: using two certs for each user?

At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs: One for signing documents, emails, etc. that is ...
57
votes
1answer
14k views

How does my browser inherently trust a CA?

I am reading this post and not understanding the answer. The answer ends with the words ...your browser can verify one cert against the next, all the way to the root CA, which your browser ...
17
votes
2answers
26k views

SSL certificate chain verification

After reading many articles and watching many tutorials I decided to be specific because there are some things about SSL certificate chain verification and SSL cetificate verification in general that ...
10
votes
2answers
1k views

How are digital certificates compared?

I have read about SSL and TLS; I know how RSA works and why digital certificates are necessary (more or less), but I am curious about how we prevent a fake digital certificate. The operating system ...
12
votes
2answers
3k views

Trying to understand RSA and it's terminology?

I get the gist of RSA but I'm mostly self taught so sometimes the phrases I picked to describe something don't match up with the widely accepted terminology. I'm trying to remedy this. I'm working ...
6
votes
3answers
5k views

Is encrypting data with a private key dangerous?

I have been reviewing code for various internal apps that handle secure transmission of data with external systems. These follow the following process: RSA encrypt data with 3rd party public key RSA ...

15 30 50 per page