Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

A central server with Data that will work as a virtual safe [closed]

The main implementation would be a dedicated Server with Data stored on it that will be shared like a drive and only authorised personal with the dedicated server IP and Account login info like a VPN ...
0
votes
0answers
33 views

Latest CA Certificate Authorities List [duplicate]

I am posting this question after checking this question Where can I find all SSL CA certificates I need to verify couple of CA authorities.(below) CloudFlare NameCheap AWS commodo Where can in ...
1
vote
0answers
11 views

AD CS Configuration Using Install-AdcsCertificationAuthority Cmdlet [migrated]

I am trying to configure a subordinate CA using a .PFX file with PowerShell. I am using the below parameters: $params = @{ CAType = "EnterpriseSubordinateCA" Credential = $credential ...
0
votes
1answer
12 views

How Digital Certificate is bound to a perticular identity?

I'm trying to understand the following: Lets say Alice wants to encrypt a message with the public key of bob. There can be a man-in-the-middle attack who impersonates bob. So we uses digital ...
2
votes
1answer
61 views

How does an offline Root CA sign OCSP Response?

As Root CA are kept offline for security purposes, how does it sign OCSP Response sent by Client for Intermediate Certificate Status Check?
0
votes
1answer
160 views

Purpose of Decrypting & Scanning HTTPS traffic

Navigating to the below URL link from the Mozilla Firefox and entering some website link and clicking on View, displays certificate Viewer chrome://pippki/content/exceptionDialog.xul After enabling ...
0
votes
0answers
37 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
0
votes
0answers
57 views

Implementing PKI with Blockchain

In many current researches, ways of decentralizing PKI are proposed in which one of them is to implement PKI on blockchain but there is still a certification authority so isn't PKI still centralized ? ...
1
vote
0answers
26 views

Certificate generation using Advanced Electronic Signature (AdES)

For a mobile application I would like to be so compliant as possible with the AdES standard. The mobile application will perform operations on behalf of the user, signing them first. A backend ...
1
vote
1answer
76 views

Does it serve any purpose to have a CRL with the next update scheduled for 25 years in the future?

What purpose does it serve to have a CRL with nextUpdate set to +25 years? A CRL issued by the root of an operating Certificate Authority Certificate Revocation List (CRL): Version 2 (0x1) ...
9
votes
3answers
3k views

What websites can be protected by a particular SSL certificate?

What websites (URLs) can be protected by one SSL certificate? For example, www.security.hsbc.co.uk has a SSL certificate. Can this certificate be used to protect other websites (URLs)? Something that ...
0
votes
1answer
69 views

Is using trusted CA to issue certificate for a VPN server insecure?

I’d like to have an AlgoVPN server that uses a trusted CA to issue a certificate for the VPN server. I am currently using an AlgoVPN server, which is completely setup via Ansible scripts and ...
0
votes
1answer
31 views

Need for additional verification in mutual TLS authentication with own CA

Say, the goal is to facilitate secure communication between two parties. The definition of secure is that both parties can be sure that they are actually talking to a trusted party, not somebody else ...
0
votes
1answer
42 views

Cross-signing certificates for Windows Driver Signing

For testing purposes I want to test cross-signing certificates for Windows driver signing. I understand the general concept: Two root CAs, one root CA cross-signs the other root CA's public key. ...
1
vote
0answers
43 views

Is SmartCard-HSM 4K good enough for WebTrust level Certificate Authority ROOT KEY storage?

Is SmartCard-HSM 4K USB token good enough for a WebTrust category CA's ROOT KEY storage or is a FIPS 140-2 level 3 certified device required? Are there any FIPS 140-2 level 3 certified USB token with ...
1
vote
2answers
61 views

Use bidirectional SSL with CAC from phone

Is it possible to extract the certificate from a CAC (DOD common access card) and install it on a phone so that access to websites using bidirectional SSL can be done from a user phone. Ideally, the ...
2
votes
1answer
101 views

Does a CAA record on a local hostname in a LAN offer additional security?

A CAA DNS record limits the certificate authorities that may issue a certificate for a domain and its subdomains. Do CAA records make sense in a LAN environment? Assume internal hostnames such as ldap....
5
votes
2answers
146 views

How can I verify my browser/OS's top level certificate?

I have a basic understanding of how the certificate authority ecosystem works. I know that when I'm connecting to a site, and they provide me with a certificate, my computer verifies the certificate's ...
0
votes
1answer
90 views

Is there any way to mitigate against a compromised CA as a client on Firefox?

If I, as a client, connect to a server and there is a malicious certificate authority, how can the client protect against this CA and still connect to the site? If this isn't possible, how can the ...
-6
votes
2answers
136 views

Revoke Let's Encrypt CA for all devices in my organization?

If I disagree with Let's Encrypt's cavalier attitude about SSL certificate issuance, and their indifference to their auto-generated certificates potentially being using for widespread criminal ...
13
votes
1answer
716 views

Does HSTS protect against a rogue CA issuing a illegitimate valid certificate?

Does HSTS protect a domain from a publicly trusted CA that has gone rogue issuing a illegitimate valid certificate? Examples of publicly trusted CA's would be any of the members of the Mozilla CA ...
0
votes
1answer
55 views

How can I authenticate the certifcate of a Private CA while I'm not on that network i.e. offline

I want my application to verify that it is being run on a computer with a certificate issued by my Private CA. How can I do this when the computer is not on the network?
0
votes
0answers
40 views

Just came to know about Digital Certificates. But did't understand the way clients can verify CA [duplicate]

So I just came to know about Digital certificates, and this is what I understand. Public Key, Message + PK_encrypt(Hash(message))/Message Signing, And other identifiers is what a digital signature is....
3
votes
1answer
82 views

what is the usage of extendedkeyusage in a CA certificate?

we have a CA certificate template to verify, which contains an extendedkeyusage extension with the following values "clientAuthentication" "emailProtection" and "id-kp-OCSPSigning" Is this a ...
0
votes
2answers
104 views

I work with a company and another developer posted this and wanted us all to run it. i'm noob with things like this [closed]

I don't really trust the guy and i'm trying to take my time to learn everything about it, but what do you guys think? generate_ssl.sh #!/bin/bash name=ourwebdomain.local openssl req \ -new \ -...
0
votes
0answers
33 views

Company CAs, what are the privacy risks for the employees? [duplicate]

The company I work in as an intern is using CA spoofing. When I check the certificate I have : Issued to : security.stackexchange.com Issued by : name of my company CA So here I'm sure that this is ...
0
votes
2answers
93 views

Can MitM spoof a signed certificate by imitating the Certificate Authority?

I understand that a signed certificate is a server public key signed by the private key of a certificate authority. As a result, a client allegedly rest assured that the signed public key is for the ...
2
votes
1answer
42 views

why use a CA-signed key pair to encrypt SAML2 assertions?

I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions. In this use case, I hold the private key in my Service Provider, and ...
0
votes
0answers
27 views

Verifying Public Key Using The Digital Signature on Mac

I have just started with encryption and stuff, so please bear with me. Just playing around. I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
0
votes
1answer
82 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
10
votes
2answers
1k views

Trying to understand how Digital Certificates and CA are indeed secure

I understand that Digital Certificates and Certificate Authorities (trusted 3rd parties) help prevent man in the middle attacks during HTTPS connections. However, I am confused on a few details. Let'...
1
vote
0answers
66 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
0
votes
3answers
100 views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
2
votes
1answer
89 views

Wildcard certificate generated for local CA do not work for the subdomains

I have created Makefile to simplify generation certificates for local development: DOMAIN ?= localhost NAME ?= ${DOMAIN} CAKEY ?= CAkey.key CACERT ?= CAcert.pem SIGN_REQ ?= ${NAME}.csr ...
2
votes
1answer
144 views

Is it dangerous to add a custom cert authority to a browser?

For example if my friend develops a webapp with a custom cert and I add them as CA to my browser, can they do any damage? I mean for example somehow faking certs and stealing my banking password, etc.?...
1
vote
2answers
105 views

Can I get an SSL certificate even if external DNS does not resolve

I have an intranet website that requires an SSL Certificate. From what I've seen it seems like this is difficult to accomplish or cumbersome. Would I be able to buy an SSL certificate if there is an ...
73
votes
1answer
15k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
1
vote
1answer
125 views

Self Signed Certificate in Certificate of Chain [closed]

I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers. When I did the "openssl s_client -connect :443" it shows the error ...
1
vote
0answers
127 views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
6
votes
2answers
238 views

State forces installation of SSL root CA, how to evade / mitigate?

Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker ...
0
votes
1answer
59 views

Update letsencrypt certificates without changing the private key

I want to renew the letsencrypt certificate on my webserver but want to keep the private key same. I've installed the certificate using certbot 0.35.1 How can I update the certificate (preferably ...
0
votes
1answer
81 views

Cross sign two self signed root CA

I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster. However, one of the ...
0
votes
2answers
338 views

Why does pinning a CA root certificate not present a security risk?

AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
-1
votes
2answers
85 views

SSL/TLS Extended Validation implemented in fraudulent domains

People trust green bars, because it is proven to not to be of malicious origin. This seems to be the questions of hundreds and many are concerned about it, picture that; a team of fraudsters(or at ...
2
votes
1answer
46 views

Does the CT system “enforce” CA's to log issued certificates?

If a CA, who is otherwise acting good and participating in the Certificate Transparency system, were to issue a certificate without reporting it to any log, would this be noticed somehow? I'm ...
11
votes
4answers
4k views

What are the differences of checking a self-signed certificate vs ignore it?

I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors: Exception in thread "main" ...
1
vote
0answers
54 views

Can my company see my network traffic if their certificate doesn't appear in the web browser? [duplicate]

I have a work-issued Mac, when I go to keychain access right now these are the following certificates: AddTrust External CA Root (Root certificate authority) COMODO RSA Certification Authority (Root ...
2
votes
1answer
98 views

Revoking a Certificate

I'm looking for a bit more details on how the chain of ownership works when it comes to service providers requesting SSL certificates on behalf of another organization. The Who is responsible for ...
0
votes
0answers
107 views

Line jump with openssl s_client -connect command when using CAfile

I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect ...
0
votes
1answer
155 views

Why isn't free software signed with self-signed certificates? [duplicate]

A majority of free software (in particular, Linux ports for Windows) are not signed. As I understand it, it is quite easy to create a self-signed CA, and sign the software. Distribution would be ...