Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the ...

1
vote
1answer
37 views

remove untrustworthy CAs from firefox

There are so many CAs in firefox, that are impossible to approve the reliability of all of them. How do I remove all CAs but the biggest ones like Lets Encrypt, Google Trust Services, GlobalSign and ...
1
vote
0answers
28 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
1
vote
0answers
17 views

Best way to back up locally stored Certificates

What is the best way to back-up all the locally stored certificates on Windows 7? An adware Trojan has installed fraudulent certificates as part of its payload. Before I alter anything, I want to ...
0
votes
0answers
33 views

Which CA has clear instructions and way to become a Certificate Issuer ( cross signing ) [on hold]

I was wondering if anyone know of any Root Certificate Issuers that has a program which would allow my company to generate certificate ourselves signed by their root for our customers. I have tried ...
2
votes
1answer
33 views

Can you point out the flaws in the stated approach of adding a new device to an existing ssl certificates secured system?

I'm trying to add new devices into a secure system. A secure system where a webserver is identified by custom CA and all clients individually are too. That is, every client connecting to the server ...
3
votes
2answers
83 views

What is the difference between digital notary and certification authority?

Is the difference purely legal or is there a technical difference between a notary notarizing the document signer's identity and a certification authority certifying a signer's certificate?
0
votes
1answer
34 views

Need to process certificates from 2 different CA's across 1 connection

I have a single HTTPS connection. I am using SSL / TLSv1.2 We are changing to a new CA. For the interim, I wanted to concatenate the old CA and the new CA in my CA file. Load the new cert for the ...
0
votes
1answer
27 views

How to set up a two-tier CA hierarchy in Windows 2012R2 certificate authority?

My apologies if the answer is everywhere but I can't seem to find what I'm looking for. My goal is to sign the CSR with an intermediate ca then root ca. So it looks like this. Server_cert > ...
3
votes
2answers
68 views

Best practices for design of mutual-auth TLS certificate chains?

I am looking for best-practice advice for building a mutually-authenticated system using certificates. I would like to create a system with multiple IoT devices reporting data to a web server, in ...
0
votes
1answer
28 views

How to add a custom CA to androids trusted root system folder

As of Android 7.0 no custom certificate will be used by android apps. App developers need to specifically write codes and change app settings to follow a custom CA. But this is difficult while ...
0
votes
1answer
50 views

Root CA or Intermediate CA in firewall trust store

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and ...
0
votes
2answers
39 views

How do cert authorities set and determine subjectAltNames if not provided by end user?

Let's say as an end user I generate a CSR (for a server cert) to send over to a CA and I don't include a subject alternative name. How or what would they do in order to include that information on the ...
2
votes
2answers
155 views

How is intercepting my own HTTPS traffic possible?

I have a slight misunderstanding in the way TLS works. I know that I can use Burpsuite Proxy to intercept HTTPS traffic coming from my browser. How is this possible when the server is going to see the ...
2
votes
1answer
88 views

When to rotate a client TLS certificate?

What is the recommended rotation period of a TLS/client certificate? I have seen organizations rotating at half life and some that rotate only 30-50 days before expiry. For example, for a certificate ...
1
vote
0answers
48 views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
-2
votes
1answer
113 views

why certification authority?

As I understand it, CAs have the job to make sure that the encryption via a passphrase used when visiting a website (https://) stems from the website itself and nobody else. Or that if I exchange ...
8
votes
1answer
1k views

Creating sub CA signed with Let's Encrypt certificate

I have a certificate issued from Let's Encrypt. Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the ...
0
votes
1answer
36 views

What is the difference between certificates held by intermediate CAs and those issued by them?

Given that one CA can issue another a certificate so that they can go on and do the same, what would stop someone from using the certificate for their website to issue certificates and become an ...
25
votes
7answers
5k views

Why do browsers allow custom root CAs?

At my work all browsers have a custom root CA installed, which then allows them to snoop on all https traffic while the users get the false impression that they are browsing a secure https page. Why ...
0
votes
0answers
17 views

How many CAA record entries should be given/provided as a response?

If there are around 30 CAA record entries of a particular domain in the CAA record, should we return all as a response ? I did not find any info on this in RFC6844. Please advise. Thanks
1
vote
1answer
171 views

How will Certificate Transparency be enforced?

The Chrome team has announced that "[they]’ll be moving forward with our plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018." It's ...
1
vote
0answers
24 views

MITM over TLS trust via convergence

I see some of the great benefits of (the now old) Moxie's Convergence or CM's Perspective. However, how do they fight the attack of a MITM sat in a common network path of both client and notary on the ...
0
votes
1answer
86 views

Trustworthiness of Let’s Encrypt and ZeroSSL within browsers and OS [duplicate]

With regard to Are there technical disadvantages in using free ssl certificates? it has been highlighted by some that StartSSL is not a trustworthy CA, and I was wondering if Let’s Encrypt is the same....
2
votes
2answers
86 views

Where to get all the root CA certs?

Is there a common place where we can download all the root CA certs and get frequent updates for changes? This is one place where we can find the CAs, but we need to keep on checking for the updates. ...
3
votes
0answers
84 views

What happened with Kazakhstan's Root CA MITM policy?

In 2015 there were news that Kazakhstan was going to start intercepting all HTTPS traffic via "man-in-the-middle attack" starting Jan 1, 2016, by requiring kazakhstanis to install their root CA. ...
1
vote
1answer
62 views

Found Wildcard AlphaSSL Cert Private Key of large Webhoster - what now?

I just stumbled upon the wildcard ssl certificate private key protecting the control panels of my (rather large) webhoster - it was world readable inside a common directory accessible by all tenants ...
-1
votes
1answer
52 views

Sign a User certificate with CA.key :openssl

I've a user certificate (certname.pem) and user key (keyname.pem) which I've generated using the command below. openssl req -newkey rsa:2048 -nodes -keyout keyname.pem -x509 -days 365 -out certname....
0
votes
2answers
78 views

Certifying Authority for this certificate is not permitted to issue a certificate with this name

I have setup a private Certificate Authority (CA), where I have a 'Root CA', and 'Intermediate CA' for signing website certificates, and a Certificate generated for my website. I have added my 'Root ...
1
vote
2answers
65 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
1
vote
1answer
66 views

OpenSSL unable to verify certificate issued by local CA

We have an application that issues (and maintains) SSL certificates for various uses. It does this using the Bouncycastle library in .NET. We create a CA cert, and then use this certificate to ...
2
votes
1answer
75 views

Is there a way to use private certs for accessing private websites that doesn't require installing a root cert?

I recently started a new consulting contract. The company I'm going the work for asked me to manually install a root certificate followed by a client certificate in order to connect to their work ...
2
votes
0answers
35 views

Why CA certificate can't be spoofed? [duplicate]

I was trying to learn TLS in depth. Probably my understanding is wrong. This is what I understood: At the end of client handshake, the server will send the CA certificate to the client which contains ...
1
vote
1answer
117 views

Trust in mutual TLS on chain of certificates in multi-intermediate-CA configuration

Could you please help me to understand whether a client's certificate will be accepted by a server as valid during mutual TLS challenge based on diagram below? The client side knows nothing about ...
1
vote
1answer
44 views

is it possible for an attacker to change a csr in x509?

Is it possible for an attacker to forge a certificate signing request so he will be able to impersonate someone else ? (by stealing the csr before it gets signed and changing it)
1
vote
2answers
165 views

For CA-signed ssh keys, how to see various attributes: principals, identity, serial number, options, validity time, etc

I am looking to implement access controls through CA-signed public ssh keys, as described in the article Scalable and secure access with SSH. I am trying to conceive how our security team will manage ...
3
votes
1answer
68 views

Self-signed certs on LAN shared with others [duplicate]

My WiFi is shared with my family, and my siblings have friends come over sharing the WiFi password carelessly. Anyone of those guests could have a rogue device and not even know it. My brother has ...
2
votes
1answer
134 views

Can I get a HTTPS certificate for mymachine.cs.superuniversity.ca from “Let's Encrypt” [duplicate]

I'm trying to set up a HTTPS certificate for mymachine.cs.superuniversity.ca (free or paid). Before I jump in, is it even possible to set up such a certificate using Let's Encrypt? The domain is for ...
-2
votes
1answer
142 views

Is there a fix to the ongoing security issues with ssl / tls? [closed]

Seems like the methods we use to ensure secure information exchange with servers continually fail. Given the ongoing issues with SSL / TLS and the ever changing methods to fix issues such as: HTTP ...
0
votes
0answers
44 views

Mostly offline CA HSM

I am looking at deploying some PKIs for a couple different clients, some big and some small. For cost savings (and other reasons) we are contemplating hosting one or more of the issuing CAs in AWS ...
1
vote
1answer
100 views

PKI: why is leaked CA certificate a threat?

According to the SSL/TLS threat model from ssllabs: https://www.ssllabs.com/downloads/SSL_Threat_Model.png Why is "Leaked CA Certificates" a threat? (In the "Trust (PKI)" branch) Isn't the purpose ...
1
vote
1answer
69 views

somewhat complex dev domain https on local network cert problems

I was trying to mirror my setup to prod as much as possible so I only serve my dev site over https. The setup goes like this... I have a trusted CA on my machine made by devcert I generated some ...
1
vote
0answers
160 views

Android Root Certificate Issue

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But ...
0
votes
1answer
131 views

Risk of man in the middle attack on AWS S3 due to wildcard SSL certs

I see that using AWS S3 with https, it comes with a wildcard SSL cert. Does that mean man-in-the-middle attack is possible by DNS/network rogue and redirect users into another S3 link (having the ...
0
votes
1answer
129 views

Why do some root and intermediate certificate authorities have “G2” or “G3” in the name? [duplicate]

I have noticed that some root and intermediate CAs have things like "G2" or "G3" in the name. For example, take the certificate for amazon.com. The intermediate CA is DigiCert Global CA G2, and the ...
1
vote
1answer
45 views

How to find out whether a state has its own CA?

Occasionally, I've seen the following: Adding debian:Staat_der_Nederlanden_EV_Root_CA.pem Adding debian:Staat_der_Nederlanden_Root_CA_-_G2.pem Adding debian:Staat_der_Nederlanden_Root_CA_-_G3.pem If ...
-2
votes
1answer
100 views

How do I detect if the public key in a digital certificate is modified?

I know how the basic process of digital certificate, but how do I detect if the public key in a digital certificate is modified?
0
votes
1answer
134 views

Why I get “Invalid certificate” error when I use school network?

Why I get "Invalid certificate" error when I use school network? This error usually appears on sites about programming, Linux and about security, privacy or anonymity. Sometimes I receive error "...
0
votes
1answer
71 views

Creating self-signed root CA using MacOS Keychain

I'd like to use MacOS keychain to create a basic Root CA, which will be able to sign CSRs and/or Intermediate CA which will be able to do that. For knowledge purpose, I'd like to create a Root, and ...
37
votes
2answers
3k views

Is there any security risk when a certificate authority is used more than all others?

According to NetTrack, Let's Encrypt is now used on more than 50% of domains (51.21% as of April 2018). I know Let's Encrypt helped a lot of people to get free certificates for their websites, so I ...
3
votes
2answers
577 views

How do I know if a Certificate Authority is not fake?

Recently I detected this CA on my phone: It shocked me that the CA itself is called "Packet Capture CA" and so much information are blank. Why does Android allowed such weird CA to exists? ...