Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
0 votes
0 answers
40 views

How to trust CA chain with sub-CA intermediate

I have a development web server that I need to add trust certificates on my local machine. Http connections to server https://machine-name.a.b.local/ show an SSL issue. This is the cert chain: ABCD-...
user avatar
0 votes
1 answer
31 views

Recommendations on PKI roles as per ETSI EN 319 401 - V2.3.1

I want to configure roles (least privilege) on my CA instance (EJBCA) and I'm trying to find what are the best practices to do this. I've tried to read the ETSI EN 319 401 - V2.3.1 standard and try to ...
user avatar
  • 83
1 vote
2 answers
45 views

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Here is the scenario, just wanted confirmation that I am understanding it correctly. I have a TLS certificate that will expire soon; Upon renewal, I paid the CA, and they reissued me with a new public ...
user avatar
  • 307
1 vote
1 answer
38 views

Adobe uses CA signature type as identifier on signatures created with user certificates

I am testing several PKCS12 keystores with ECC type keys, generated by a CA with RSA key, to sign PDF documents. I have also tested with my own certificates from a demo CA certificate. I use Adobe ...
user avatar
0 votes
1 answer
67 views

Are self-signed certificates better for local usage?

When generating a certificate what would more secure - generating a self-signed certificate using PGP or using a public CA like Let's Encrypt? We are using it for signing and encrypting. What are the ...
user avatar
  • 200
0 votes
0 answers
91 views

I was asked to install an SSL .cert in my server, should I do this?

I am trying to connect to a company's internal API (I am working on a project for them). This company has an API that has an SSL certificate from Sectigo. From what I have gathered is a pretty well ...
user avatar
  • 101
-1 votes
1 answer
32 views

Modifying cacerts at runtime

I have an containerized JVM application (multiple actually) running on kubernetes, which needs to trust additional custom/private CAs (which are not known beforehand, the application will be deployed ...
user avatar
  • 1
0 votes
0 answers
24 views

Is it must to have "Key Usage" extension in the selfsigned root certificate?

I have gone through multiple questions but still I am confused. RFC X.509 also does not clarify it. Conforming CAs MUST include this extension in certificates that contain public keys that are ...
user avatar
2 votes
2 answers
64 views

How to add extension to existing TLS certficate?

We have our own root certificate authority which is used to sign the certificates for the agents connected to our server. We have generated the root certificate authority using keytool command as ...
user avatar
2 votes
2 answers
68 views

How to determine what Certificate Authorities to keep on my computer?

I read this article at Electronic Frontier Foundation on how Russian government wants the residents there to install a specific "Trusted Root CA" certificate. According to the article, this ...
user avatar
  • 135
2 votes
2 answers
54 views

How can I prevent non-SAN TLS certificates from bypassing name constraints?

I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints. However, even if I create the CA with restrictions on DNS names as well as ...
user avatar
  • 123
0 votes
0 answers
39 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
user avatar
  • 101
1 vote
3 answers
55 views

Auto-certification of internal services, does it make sense?

I work for a big insurance company, they have created a certification authority to generate certificates for their internal webservices. These webservices are accessible from their intranet only and ...
user avatar
  • 113
0 votes
0 answers
40 views

What prevents an SSL certificate holder to issue new 'valid' certificates [duplicate]

I am new to SSL certificates and trying to wrap my head around this concept. As per my understanding when a valid certificate is signed (by one of the many official CAs) it can also sign a certificate ...
user avatar
  • 101
1 vote
1 answer
65 views

Why include the root certficiate in the chain, if it is already in receiving parts' truststore?

If I have a self-signed CA certificate in my truststore, and I am sent a chain of certificates where the root CA is missing, is this a problem and if so why? Say that the last certificate in the chain ...
user avatar
0 votes
1 answer
34 views

Does the wildcard certificates registered late?

I've been trying to understand the process how the certificates are being registered and wildcard certificates got my attention. For some companies that offer free hosting in their site, I noticed ...
user avatar
57 votes
7 answers
7k views

Can a CA decrypt HTTPS traffic?

My state has made a statement that in case my country will be disconnected from the world's CAs, it is necessary to install its own state certificates. In many forums, information has flashed that in ...
user avatar
  • 1,015
0 votes
2 answers
43 views

Can any field in a CSR be overwritten in the issued cert?

Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
user avatar
0 votes
1 answer
36 views

Exposing ADCS OCSP on the Public Internet

I am building a Certificate Authority using Windows Server ADCS as a 'Standalone' CA but my application would be greatly improved if I can utilise OCSP. Is the ADCS Online Responder Role Service ...
user avatar
  • 1
0 votes
1 answer
54 views

How to distinguish between Wifi certificate and certificate usable for MITM?

I know that similar questions has been asked several times, but this question focuses on one aspect I did not found answered yet. Recently when I was connecting my iPhone to my school wifi (eduroam), ...
user avatar
  • 3
0 votes
1 answer
105 views

Difference between trust anchors and certificate authorities

Trust anchors and (root) certificates authorities are often used interchangeably and it's easy to think that they are the same thing. The answer in Can an intermediate CA be trusted like a self-signed ...
user avatar
5 votes
1 answer
430 views

Difference between -CAfile and -trusted in OpenSSL verify

openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual: -CAfile <FILE> A file of trusted certificates. The file ...
user avatar
1 vote
2 answers
260 views

How can I make an SSL certificate for an IoT device trusted on all browsers?

I have a web server running on an IoT device, more specifically, on an ESP32. This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
user avatar
0 votes
1 answer
72 views

Client authentication using X509 certificates behind the scenes

In my application I've successfully implemented client authentication using X509 certificates Here's what I've done: Issued a self-signed CA root certificate with a private key Issued a web-server ...
user avatar
  • 143
0 votes
0 answers
28 views

Google Cloud and Private CM on Microsoft Windows and FedRamp compliance for TLS

Is it possible to use Private Certificate Authority based on Microsoft Windows Servers for protection SSL/TLS connections in FedRAMP environment on Google Cloud?
user avatar
0 votes
1 answer
93 views

create a fake ssl certificate

Say I create a certificate with some content and then sign it with my private key. Now, I decrypt the sign with a trusted CA's public key and somehow come up with content that can match the decrypted ...
user avatar
13 votes
1 answer
4k views

SSL Trust Seal of "https://www.ebay.co.uk"

when I visit "https://www.ebay.co.uk", I can see a trust seal at the bottom right of the page that says the certificate is issued by DigiCert. It is a clickable trust seal, so when I click ...
user avatar
  • 241
0 votes
2 answers
90 views

Authorising client (mTLS) based on distinguished name

I am working on a deployment where the customer is requesting to do things differently from our standard process for client authentication. Usually we generate a CA for a customer project, get them to ...
user avatar
  • 103
7 votes
2 answers
3k views

How to prevent HTTPS man-in-the-middle with self-signed certificates?

I came across this issue when we implemented a new security solution. Said solution has its own root CA certificate and will create certificates for HTTPS web pages "on the fly". Each HTTPS ...
user avatar
  • 79
24 votes
4 answers
3k views

Why are SSL CAs prohibiting double dash in third and fourth characters?

Digicert has disallowed "double dashes" in the third and fourth characters in new certs: Effective October 1, 2021, for publicly trusted TLS/SSL certificates, we no longer allow the use of ...
user avatar
  • 1,343
0 votes
2 answers
80 views

How does a TLS client know the CA certificate?

Assuming the server doesn't send the root CA certificate along with it's certificate and all the intermediates, how does the client know the root CA certificate in order to validate the server's ...
user avatar
  • 115
0 votes
1 answer
61 views

How to update self-signed server certificate on the clients

We are currently shipping a product to our customers that is server-client-based running on Windows server 2016 (server) and Windows 10 (clients). The server is installed on-premise in our customer's ...
user avatar
  • 21
2 votes
1 answer
85 views

How to set up certificate architecture for on-premise server-client application

We are currently shipping a product to our customers that is server-client-based running on Windows server 2016 (server) and Windows 10 (clients). The server is installed on-premise in our customer's ...
user avatar
  • 21
0 votes
1 answer
81 views

Is it possible for the public key of the issuer to be stored in a subject's certificate?

For example, assume stackoverflow.com used a certificate issued by Google who is trusted. In the stackoverflow.com certificate, its own public key would be stored. However, is it also possible for ...
user avatar
1 vote
2 answers
251 views

What happens if one certificate path is valid while the other one is not?

I have recently figured out that Lets Encrypt provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it ...
user avatar
1 vote
1 answer
124 views

Is a OCSP request verified via TLS?

I was wondering if the connection towards the ocsp responder/server is TLS encrytped itself. Meaning that the client requesting a validity check for a certificate verifies the OCSPs server certificate?...
user avatar
  • 65
0 votes
1 answer
106 views

How can I find the list of certificates present in a set of CA stores

Someone is running an automated scan on our SSL setup and they insist that our root certificate be included in all the following CA stores: "Mozilla NSS - 01/2014" "Apple - OS X 10.9.2&...
user avatar
  • 125
0 votes
1 answer
138 views

How to prevent server know what data is being transferred through it between two clients

Imagine a web application in which two computers can communicate with each other by transferring files, through the server linked with some unique password. Every file sent between the clients are ...
user avatar
1 vote
2 answers
134 views

Do certificate issuers perform checks against homograph attack?

I just got a very phishy looking email from Vodafone. It had encoding errors and nothing more than my name in it. It asked me to confirm my email address and in order to do that I had to enter some ...
user avatar
  • 499
0 votes
0 answers
108 views

eIDAS qualified timestamp on email

Every document that needs to be eIDAS compliant needs to have a qualified timestamp. If we take an email as a document, then the email, based on eIDAS regulations, needs to have an qualified timestamp ...
user avatar
0 votes
1 answer
188 views

Is there a reason to renew host SSH certificates?

tl;dr: In certificate based SSH authorization, is there any benefit to keeping host certificates lifespan short? Do you gain anything by renewing them periodically? Full Story Recently I have been ...
user avatar
  • 1
2 votes
2 answers
218 views

Can certificates be blocked temporarily by CAs?

I am an Open Banking enthusiast and I'm studying the Berlin Group's XS2A framework these days. There, it has an error code called CERTIFICATE_BLOCKED. As the description of it, it states, "...
user avatar
  • 23
0 votes
0 answers
75 views

Query on CMP POPO, encrypted cert and certhash

I am reading RFC4210 and trying to understand the CMP protocol. I will use the sample capture cmp_IR_sequence_OpenSSL-Cryptlib.pcap from https://wiki.wireshark.org/SampleCaptures to put forth my ...
user avatar
  • 1
1 vote
1 answer
562 views

OpenSSH AuthorizedPrincipalsFile Allows Any User

I am bewildered as to the below config and subsequent behaviour. /etc/ssh/sshd_config: AuthorizedPrincipalsFile /etc/ssh/principals /etc/ssh/principals: all host.example.com dev This allows me to ...
user avatar
0 votes
1 answer
115 views

Protecting against BGP hijacking

I'm living in a very evil country and don't trust my ISP or the government. Moreover the country has control of several root and probably more intermediate certificate authorities. What options do I ...
user avatar
0 votes
1 answer
197 views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
user avatar
0 votes
0 answers
25 views

How is it guaranteed that a SSL certificate issuer doesn't issue a fake certificate? [duplicate]

How is it guaranteed that a SSL certificate issuer doesn't issue cerificates without verifing that the user holds the specified domain name or even that the issuer himself doesn't issue a certificate ...
user avatar
0 votes
1 answer
141 views

PKI or Digitally signed certificate

Please do mind, its a long read. I just confused myself again with how the CA server helps with the digital signature and the pki working flow. Please let me know if what I am describing below is the ...
user avatar
  • 123
0 votes
0 answers
14 views

What if there is a "man in the middle" between the client and the certification authority and the same MITM is also between Client and server? [duplicate]

I've read other some articles (including this: https://medium.com/@technospace/tls-handshake-under-the-hood-79d20c0020de) and similar questions but none exactly like this hypothetical scenario. What ...
user avatar
0 votes
2 answers
188 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
user avatar
  • 103

1
2 3 4 5
25