Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

0
votes
1answer
22 views

Can I adjust the X509v3 Name Constraints on my internal CA after I have issued certificates?

We have generated an internal root Certificate Authority for our organization and added X509v3 Name Constraints for our domain (example.com) We issued a number of certificates for servers under that ...
1
vote
1answer
22 views

Active Directory Certificate authentication trust

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...
2
votes
1answer
22 views

Sub-domains TLS certificates and wildcard certificate [duplicate]

1) Is it a good security practice to have a separate TLS certificate for each sub-domain? 2) Is wildcard certificate (i.e. one certificate for many/every sub-domains) a bad practice?
1
vote
1answer
32 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...
13
votes
2answers
342 views

Let's Encrypt is based in the US and subject to US laws

Let's Encrypt is based in the United States and subject to the laws of the United States, including National Security Letters. What are the implications for foreign sites that use Let's Encrypt? Here'...
3
votes
1answer
58 views

Can cURL block a rogue CA?

I know which Certificate Authority (CA) my server uses for its TLS certs. My client system also knows who the CA is. When I use cURL, I can specify --cacert to specify a custom CA file to use, but ...
0
votes
2answers
39 views

Can certificate signing requests be stored at the server to prolong existing certificates?

I want to build a PKI (public key infrastructure) to host certificates for users. My use case is, that I want to use the certificates for e2e encryption between the users. Users must be able to ...
57
votes
4answers
9k views

Is there a way to make sure my government does not swap out SSL certificates?

I was recently wondering whether there exists a way to make sure my government is not swapping out SSL certificates in order to intercept the traffic. I know almost all browsers are complaining in ...
0
votes
1answer
18 views

CSR verification process by certificate authority

Can some one help me understand the step by step process on CSR signature verification process by Certificate Authority? Is the contents of the CSR hashed and signed by the server's private key? Is ...
2
votes
2answers
51 views

Use combination of digital certificates and symmetric key cryptography

Assuming that: - A have CertA and secret key KsA - B have CertB and secret key KsB A need to transfer data M to B with the requirement of confidentiality and authenticity, BUT Data encryption must ...
0
votes
2answers
56 views

What is being verified in OpenSSL's SSL_get_verify_result

In OpenSSL the following function is used to verify certs. SSL_get_verify_result I looked at the manual here. But it does not detail what is being verified. Can you clarify to me what does this ...
0
votes
1answer
30 views

Is this CA store related to Ubuntu or OpenSSL

I am checking TLS certificates chain validity against CA sore in this path: etc/ssl/certs/ca-certificates.crt I use Ubuntu 18.04 and OpenSSL 1.1.0g. I need to know whether this CAs store is from ...
1
vote
1answer
141 views

Certificate serial and thumbprint number spacing

We have a Microsoft PKI setup at our organization. As per just about all certificates I've ever seen, new certificates issued by our issuing CAs will put the serial number and thumbprint in a HEX ...
0
votes
1answer
55 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
1
vote
0answers
26 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
2
votes
1answer
42 views

Do openssl CA certificates get updated with apt-get upgrade?

I use Ubunut 18.04. I need to know if OpenSSL CA certificates that are in this file: /etc/ssl/certs/ca-certificates.crt get updated when I upgrade my system using: apt-get upgrade? I have a ...
3
votes
1answer
73 views

How can I use X.509 cross signing to replace a CA?

I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate. I'...
0
votes
1answer
63 views

How to securely store and use a password for certificate authority

Other than purely memorizing a password in your head, I'm wondering what the next best thing is for storing a password and using it in a very secure environment without internet connection like a ...
0
votes
1answer
52 views

Is it more secure to set a DNS CAA record to a non-existing CA?

A CAA allows specifying which Certificate Authorities are authorized to issue a certificate for my domain. For example example.com. CAA 0 issue "symantec.com" will only allow Symantec to issue ...
2
votes
3answers
122 views

Can I completely trust CA?

When a software company sends me 1 file and asks me to install it then I check the signature and it is valid under the Cert (issued by Thwate CA). So is installing that file sent by that company safe? ...
0
votes
0answers
17 views

How to securely initialize a private key from several parts

This explains a lot about how certificate authorities store their private keys. I read somewhere else that the key is broken down into as much as 20-something parts, and stitched together from those ...
1
vote
1answer
59 views

Self-signed CA certificates - Can we throw away the private keys

I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion. I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
0
votes
1answer
103 views

If I have a valid certificate for xxxxx.target.com, can't I read *.target.com's cookies?

Follow up: If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies? I was asked to ask this as a separate question. This isn't a duplicate question. Okay, so ...
2
votes
1answer
217 views

If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies?

Ref: How do I report a security vulnerability about a trusted certificate authority? This question involved a serious security vulnerability at WoSign. Here's the finder's blog: http://webcache....
1
vote
0answers
62 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
0
votes
1answer
33 views

What are the differences between a qualified CA and a simple CA

Simple CAs are mostly the ones issuing certificates for webserver or email addresses. At least in the EU they have something called qualified CA issuing qualified certificates. The question is: What ...
2
votes
1answer
219 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
1
vote
0answers
33 views

How does my computer actually validate a certificate? [duplicate]

Let's say I receive an email from my friend, X. The email is attached with the digital certifciate of X. Suppose this digital certificate is issued by a company called DS, and my computer does not ...
1
vote
0answers
321 views

SSL routines:ssl3_read_bytes:sslv3 alert bad certificate

Running the following command: curl -v --key client_key.key --cert client_cert.crt <some url> -u <username> I get the following response: * Trying XX.XXX.XXX.X... * TCP_NODELAY set * ...
1
vote
1answer
46 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
0
votes
2answers
64 views

How to detect if X.509 certificate belongs to CA or regular end user (host)

If I understand correctly in SSL/TLS authenticity validation there are 2 (maybe more) types of certificates according to the following: the ones that belong to CA (these contain the public key that ...
2
votes
2answers
241 views

Can Certificate be validated locally [duplicate]

When I establish TLS/SSL with some server he sends me the certificate in the process. The certificate is signed by a certificate authority. In my PC/browser I have a list of trusted certificate ...
1
vote
0answers
45 views

CA on LAN server ( no access to internet ) [closed]

I got a problem on a LAN that isnt connected to the internet ( neither server or clients are ) and the connections needs to run SSL. I tried to make a selfsigned certificate but the browser comes up ...
1
vote
3answers
110 views

is spoofing CA to sign application possible?

Is it possible to spoof the CA of any server to sign some application? As like as what CarbonCopy claims?
1
vote
0answers
17 views

Root CA and Intermediate CA security [duplicate]

I'm confused how intermediate CA's adds to the security of the PKI. I realize the compromise of root CA key is catastrophic as it would've to be consequently purged from the trust store of every ...
1
vote
2answers
94 views

Until what point can I rely on HTTPS for client-server communications?

I'd like to know until what point and under what circumstances it is fine to rely on HTTPS for client-server communications. In the previous years, there has been some news about hacks of Certificates ...
0
votes
1answer
52 views

Root cert lacks CN

A company's internal CA has issued a root signer cert (there's no intermediate cert acting as signer) in which the DN contains only the C=US and O=company_name and no other DN fields. The cert signed ...
2
votes
1answer
38 views

Server secured with a Certificate from a Custom CA Root: OK on Firefox but KO on Chrome? [duplicate]

The Setup In order to protect the very small intranet of the ACME company, which contains two private servers, foo-server and bar-server, I've created with OpenSSL: The Root CA Certificate The ...
1
vote
1answer
60 views

Are all SSL domain validation basically the same technically speaking? [duplicate]

I've googled this and haven't really been able to find a straight answer and this question which I have read is a bit different and is a bit outdated considering the landscape has changed a lot ...
0
votes
1answer
67 views

How is revoking a CA cert possible? [duplicate]

From what I understand, the cert is created using a private key ONLY ONCE, and once it's issued to a website, it stays on that website's server. As a retrospective measure, how can a CA make this cert ...
3
votes
1answer
78 views

Concepts of PKI Encryption and Digital Signature Authentication [duplicate]

I am trying to understand how SSL uses PKI and Digital Signature authentication to ensure secure and verified communications. I've read various sources online and from what I can tell the basic ...
4
votes
1answer
91 views

How to check if Certificate from Certificate Log is revoked?

I have a DB with certs from CTL. (using 'certstream' utility). Here's an example of one set of certificate data: { "all_domains" : [ "benesseresalus.com", "benesseresalus.it", "...
0
votes
1answer
101 views

Authenticating Certificate for School Wifi [duplicate]

My school wifi, which requires me to login using ny username and password, is requiring that I accept a certificate in order to connect. I don’t know if this is a trusted root certification but what ...
2
votes
1answer
120 views

How does server use session key after tls handshake?

After TLS handshake both server and client agreed about session key to use as symmetric key. So server must store several session keys which each one belongs to a specific client. How server ...
1
vote
1answer
69 views

OCSP, CRLs, crlset - Revocation Delivery and Attacks

OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the ...
2
votes
2answers
416 views

Root CA with Extended Key Usage fields

I recently started using AWS's Certificate Manager to get free TLS certificates for my load balancer. When I was inspecting the certificate chain I noticed that the Root CA, Starfield Class 2 ...
2
votes
1answer
71 views

remove untrustworthy CAs from firefox

There are so many CAs in firefox, that are impossible to approve the reliability of all of them. How do I remove all CAs but the biggest ones like Lets Encrypt, Google Trust Services, GlobalSign and ...
1
vote
0answers
42 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
1
vote
0answers
17 views

Best way to back up locally stored Certificates

What is the best way to back-up all the locally stored certificates on Windows 7? An adware Trojan has installed fraudulent certificates as part of its payload. Before I alter anything, I want to ...
2
votes
1answer
35 views

Can you point out the flaws in the stated approach of adding a new device to an existing ssl certificates secured system?

I'm trying to add new devices into a secure system. A secure system where a webserver is identified by custom CA and all clients individually are too. That is, every client connecting to the server ...