Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

1
vote
0answers
30 views

How does my computer actually validate a certificate? [duplicate]

Let's say I receive an email from my friend, X. The email is attached with the digital certifciate of X. Suppose this digital certificate is issued by a company called DS, and my computer does not ...
0
votes
0answers
20 views

SSL routines:ssl3_read_bytes:sslv3 alert bad certificate

Running the following command: curl -v --key client_key.key --cert client_cert.crt <some url> -u <username> I get the following response: * Trying XX.XXX.XXX.X... * TCP_NODELAY set * ...
0
votes
0answers
19 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
0
votes
2answers
47 views

How to detect if X.509 certificate belongs to CA or regular end user (host)

If I understand correctly in SSL/TLS authenticity validation there are 2 (maybe more) types of certificates according to the following: the ones that belong to CA (these contain the public key that ...
2
votes
2answers
233 views

Can Certificate be validated locally [duplicate]

When I establish TLS/SSL with some server he sends me the certificate in the process. The certificate is signed by a certificate authority. In my PC/browser I have a list of trusted certificate ...
-2
votes
0answers
49 views

Are commercial certs more secure than free ones? [duplicate]

Commercial certificate signing services have existed for a long time, where companies charge a fee for signing a certificate so that it's trusted by root programs. But recently Let's Encrypt claims it ...
1
vote
0answers
35 views

CA on LAN server ( no access to internet ) [closed]

I got a problem on a LAN that isnt connected to the internet ( neither server or clients are ) and the connections needs to run SSL. I tried to make a selfsigned certificate but the browser comes up ...
1
vote
3answers
88 views

is spoofing CA to sign application possible?

Is it possible to spoof the CA of any server to sign some application? As like as what CarbonCopy claims?
1
vote
0answers
12 views

Root CA and Intermediate CA security [duplicate]

I'm confused how intermediate CA's adds to the security of the PKI. I realize the compromise of root CA key is catastrophic as it would've to be consequently purged from the trust store of every ...
1
vote
2answers
90 views

Until what point can I rely on HTTPS for client-server communications?

I'd like to know until what point and under what circumstances it is fine to rely on HTTPS for client-server communications. In the previous years, there has been some news about hacks of Certificates ...
0
votes
1answer
51 views

Root cert lacks CN

A company's internal CA has issued a root signer cert (there's no intermediate cert acting as signer) in which the DN contains only the C=US and O=company_name and no other DN fields. The cert signed ...
2
votes
1answer
36 views

Server secured with a Certificate from a Custom CA Root: OK on Firefox but KO on Chrome? [duplicate]

The Setup In order to protect the very small intranet of the ACME company, which contains two private servers, foo-server and bar-server, I've created with OpenSSL: The Root CA Certificate The ...
1
vote
1answer
58 views

Are all SSL domain validation basically the same technically speaking? [duplicate]

I've googled this and haven't really been able to find a straight answer and this question which I have read is a bit different and is a bit outdated considering the landscape has changed a lot ...
0
votes
1answer
66 views

How is revoking a CA cert possible? [duplicate]

From what I understand, the cert is created using a private key ONLY ONCE, and once it's issued to a website, it stays on that website's server. As a retrospective measure, how can a CA make this cert ...
3
votes
1answer
62 views

Concepts of PKI Encryption and Digital Signature Authentication [duplicate]

I am trying to understand how SSL uses PKI and Digital Signature authentication to ensure secure and verified communications. I've read various sources online and from what I can tell the basic ...
0
votes
0answers
56 views

Browser resolving wrong certificate

When I visited google.com using Chrome, the browser said: "Your connection is not private" I checked the certificate, it's a certificate for *.atlassolutions.com which belongs to Facebook. The same ...
4
votes
1answer
69 views

How to check if Certificate from Certificate Log is revoked?

I have a DB with certs from CTL. (using 'certstream' utility). Here's an example of one set of certificate data: { "all_domains" : [ "benesseresalus.com", "benesseresalus.it", "...
0
votes
1answer
74 views

Authenticating Certificate for School Wifi [duplicate]

My school wifi, which requires me to login using ny username and password, is requiring that I accept a certificate in order to connect. I don’t know if this is a trusted root certification but what ...
2
votes
1answer
107 views

How does server use session key after tls handshake?

After TLS handshake both server and client agreed about session key to use as symmetric key. So server must store several session keys which each one belongs to a specific client. How server ...
0
votes
1answer
48 views

OCSP, CRLs, crlset - Revocation Delivery and Attacks

OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the ...
2
votes
2answers
154 views

Root CA with Extended Key Usage fields

I recently started using AWS's Certificate Manager to get free TLS certificates for my load balancer. When I was inspecting the certificate chain I noticed that the Root CA, Starfield Class 2 ...
1
vote
1answer
56 views

remove untrustworthy CAs from firefox

There are so many CAs in firefox, that are impossible to approve the reliability of all of them. How do I remove all CAs but the biggest ones like Lets Encrypt, Google Trust Services, GlobalSign and ...
1
vote
0answers
36 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
1
vote
0answers
17 views

Best way to back up locally stored Certificates

What is the best way to back-up all the locally stored certificates on Windows 7? An adware Trojan has installed fraudulent certificates as part of its payload. Before I alter anything, I want to ...
2
votes
1answer
35 views

Can you point out the flaws in the stated approach of adding a new device to an existing ssl certificates secured system?

I'm trying to add new devices into a secure system. A secure system where a webserver is identified by custom CA and all clients individually are too. That is, every client connecting to the server ...
3
votes
2answers
85 views

What is the difference between digital notary and certification authority?

Is the difference purely legal or is there a technical difference between a notary notarizing the document signer's identity and a certification authority certifying a signer's certificate?
0
votes
1answer
52 views

Need to process certificates from 2 different CA's across 1 connection

I have a single HTTPS connection. I am using SSL / TLSv1.2 We are changing to a new CA. For the interim, I wanted to concatenate the old CA and the new CA in my CA file. Load the new cert for the ...
0
votes
1answer
40 views

How to set up a two-tier CA hierarchy in Windows 2012R2 certificate authority?

My apologies if the answer is everywhere but I can't seem to find what I'm looking for. My goal is to sign the CSR with an intermediate ca then root ca. So it looks like this. Server_cert > ...
4
votes
2answers
140 views

Best practices for design of mutual-auth TLS certificate chains?

I am looking for best-practice advice for building a mutually-authenticated system using certificates. I would like to create a system with multiple IoT devices reporting data to a web server, in ...
1
vote
1answer
50 views

How to add a custom CA to androids trusted root system folder

As of Android 7.0 no custom certificate will be used by android apps. App developers need to specifically write codes and change app settings to follow a custom CA. But this is difficult while ...
0
votes
1answer
85 views

Root CA or Intermediate CA in firewall trust store

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and ...
0
votes
2answers
44 views

How do cert authorities set and determine subjectAltNames if not provided by end user?

Let's say as an end user I generate a CSR (for a server cert) to send over to a CA and I don't include a subject alternative name. How or what would they do in order to include that information on the ...
2
votes
2answers
170 views

How is intercepting my own HTTPS traffic possible?

I have a slight misunderstanding in the way TLS works. I know that I can use Burpsuite Proxy to intercept HTTPS traffic coming from my browser. How is this possible when the server is going to see the ...
2
votes
1answer
121 views

When to rotate a client TLS certificate?

What is the recommended rotation period of a TLS/client certificate? I have seen organizations rotating at half life and some that rotate only 30-50 days before expiry. For example, for a certificate ...
1
vote
0answers
138 views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
-2
votes
1answer
120 views

why certification authority?

As I understand it, CAs have the job to make sure that the encryption via a passphrase used when visiting a website (https://) stems from the website itself and nobody else. Or that if I exchange ...
8
votes
1answer
2k views

Creating sub CA signed with Let's Encrypt certificate

I have a certificate issued from Let's Encrypt. Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the ...
0
votes
1answer
44 views

What is the difference between certificates held by intermediate CAs and those issued by them?

Given that one CA can issue another a certificate so that they can go on and do the same, what would stop someone from using the certificate for their website to issue certificates and become an ...
25
votes
7answers
5k views

Why do browsers allow custom root CAs?

At my work all browsers have a custom root CA installed, which then allows them to snoop on all https traffic while the users get the false impression that they are browsing a secure https page. Why ...
0
votes
0answers
17 views

How many CAA record entries should be given/provided as a response?

If there are around 30 CAA record entries of a particular domain in the CAA record, should we return all as a response ? I did not find any info on this in RFC6844. Please advise. Thanks
1
vote
1answer
206 views

How will Certificate Transparency be enforced?

The Chrome team has announced that "[they]’ll be moving forward with our plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018." It's ...
1
vote
0answers
26 views

MITM over TLS trust via convergence

I see some of the great benefits of (the now old) Moxie's Convergence or CM's Perspective. However, how do they fight the attack of a MITM sat in a common network path of both client and notary on the ...
0
votes
1answer
106 views

Trustworthiness of Let’s Encrypt and ZeroSSL within browsers and OS [duplicate]

With regard to Are there technical disadvantages in using free ssl certificates? it has been highlighted by some that StartSSL is not a trustworthy CA, and I was wondering if Let’s Encrypt is the same....
2
votes
2answers
96 views

Where to get all the root CA certs?

Is there a common place where we can download all the root CA certs and get frequent updates for changes? This is one place where we can find the CAs, but we need to keep on checking for the updates. ...
4
votes
1answer
135 views

What happened with Kazakhstan's Root CA MITM policy?

In 2015 there were news that Kazakhstan was going to start intercepting all HTTPS traffic via "man-in-the-middle attack" starting Jan 1, 2016, by requiring kazakhstanis to install their root CA. ...
1
vote
1answer
63 views

Found Wildcard AlphaSSL Cert Private Key of large Webhoster - what now?

I just stumbled upon the wildcard ssl certificate private key protecting the control panels of my (rather large) webhoster - it was world readable inside a common directory accessible by all tenants ...
-1
votes
1answer
135 views

Sign a User certificate with CA.key :openssl

I've a user certificate (certname.pem) and user key (keyname.pem) which I've generated using the command below. openssl req -newkey rsa:2048 -nodes -keyout keyname.pem -x509 -days 365 -out certname....
0
votes
2answers
124 views

Certifying Authority for this certificate is not permitted to issue a certificate with this name

I have setup a private Certificate Authority (CA), where I have a 'Root CA', and 'Intermediate CA' for signing website certificates, and a Certificate generated for my website. I have added my 'Root ...
2
votes
2answers
84 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
1
vote
1answer
78 views

OpenSSL unable to verify certificate issued by local CA

We have an application that issues (and maintains) SSL certificates for various uses. It does this using the Bouncycastle library in .NET. We create a CA cert, and then use this certificate to ...