Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

certificate autorities for asus chromebook [closed]

what certificates are built into an asus chromebook? Does anyone else have these on their chromebooks? UNTRUSTED Security Communication RootCA2 (hardware-backed) UNTRUSTED QuoVadis Root CA 3 G3 (...
1
vote
1answer
51 views

Is the ACME HTTP-01 challenge secure against MITMs?

Many certificate authorities these days use the ACME protocol to automate the process of certificate issuance. This includes verifying that the applicant is the owner of the domain. And the most ...
0
votes
0answers
32 views

Why is /cacerts request necessary in RFC 7030 Enrollment Over Secure Transport?

In RFC 7030 Enrollment Over Secure Transport (EST) https://tools.ietf.org/html/rfc7030, the /cacerts request (Section 4.1 of RFC 7030) is used by the client to request the current CA certificates. The ...
0
votes
0answers
55 views

TLS handshake failure (40) solved by removing intermediate certificate from server?

I'd like to better understand my workaround, and confirm that it's secure. Problem I have a crt file containing a root and intermediate certificate installed on my server (I have limited access to ...
1
vote
1answer
70 views

Can I pre-register an SSL certificate with validity in the near future?

Can I register an SSL certificate that will only start to be valid in the near future and not right away?
4
votes
2answers
91 views

Generate digital certificates for employees using the organization's certificate

I live in Peru and we have a small problem in the organization where I work. Dozens of documents are physically signed daily but this is a waste of time since there are documents that must be signed ...
4
votes
2answers
133 views

Why is the root in an Online CA model not a Single Point of Failure?

My textbook for CompTIA Security+ has the following practice question: In which one of following PKI Trust Models is the root NOT a single point of failure? Single CA Hierarchical CA ...
0
votes
0answers
47 views

What does “sample minimal CA application” mean?

I'm reading openssl manuals, and in the man openssl-ca I've found a note, that "openssl ca is a sample minimal CA application" What does it mean? I don't understand. If it is only a sample, what do I ...
0
votes
0answers
27 views

How does a web browser obtain the public key of a certificate author? [duplicate]

As far as I know, when a web browser verifies the signature in a SSL certificate, it uses the public key of the certificate author (CA) which has signed the certificate. Does the web browser contacts ...
0
votes
0answers
13 views

Certificate check works with root but fails with Intermediate CA [duplicate]

I have 3 certificates, server.crt issued by Intermediate CA which is issued by Root. The server.crt is configured on apache2 (version 2.4.29-1) on Ubuntu 18.04. However when I am trying to connect to ...
0
votes
1answer
61 views

How does a web client check the signing authority of a server certificate? [duplicate]

In HTTP The Definitive Guide When you establish a secure web transaction through HTTPS, modern browsers automatically fetch the digital certificate for the server being connected to. If the ...
0
votes
1answer
96 views

CA certificate and Local certificate

There is something which is bothering me when i think about the CA cert and Local cert. Below are my queries which pertains to juniper but may be generic as well. 1) "request security pki ca-...
0
votes
0answers
59 views

Is this a valid equation for determining certificate lifetimes in a PKI infrastructure?

I have an intuitive sense of how certificate lifetimes should work in a PKI infrastructure, but I don't consider myself an expert in this field so I would like someone to validate or critique my ...
0
votes
2answers
67 views

Do CAs issue intermediate Certificate for each new certificate request?

Do CAs issue intermediate Certificate for each new certificate? I am new to certificates and asking this to understand if the CAs have a ready set of intermediate certificates they use to issue leaf ...
0
votes
1answer
43 views

Does moving Root CA server require reissue and reinstall all server certificate?

In our environment we have three type of machines: Root CA (Microsoft CA), web servers and user PCs. We need to move our Root CA to another site, there are many guidelines on how to migrate Root CA ...
0
votes
0answers
59 views

CA Root Certificate with same subject

Let's assume I have issued two root certificates for my domain - a RSA and a ECDSA one. Both have the same subject. As far as I know, the subject does not have to be unique. Do crypto libraries such ...
0
votes
2answers
68 views

Who/what maintains the CRL for a web server's client certs?

In the instance of a web server that requires client certificates to log in, what exactly is creating and updating the CRL? From all of the examples I see, it is a manual process. Is it really a ...
0
votes
1answer
111 views

Differences in certificate verification between ssl libraries

I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
1
vote
2answers
181 views

Does the “Key Encipherment” key usage make sense when using ECDH P384?

I configured a Windows CA and created a certificate template to issue certificates with ECDH_P384 keys: Then I noticed that it's not possible to set the "Key Encipherment" key usage in the "...
0
votes
1answer
98 views

Why generate dedicated issuer CA for TSU certificates?

I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME ...
4
votes
1answer
210 views

Certficate pinning: should I pin the leaf or intermediate?

I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp. As our app clients do not update their app regulary I don't want to take the risk ...
1
vote
1answer
141 views

Generate certificate v3 instead of v1

Trying to get certificate v3, but getting v1. I'm using following commands: openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config san_server.cnf openssl ca -config san_server....
5
votes
3answers
505 views

Why are many US Department of Defense certificates not trusted by Firefox?

There are a number of US Department of Defense (DoD) websites that I need to access on a regular basis (e.g., https://ataaps.csd.disa.mil/ and https://web.mail.mil) that Firefox issues a Warning: ...
1
vote
1answer
57 views

Can I test ssl connection locally with a valid certificate (CA) with local dns?

I have a wildcard valid certificate signed by Certificate Authority. Is it possible to test the https locally from the server without a registered DNS? My idea is to bind the domain name with 127.0....
1
vote
1answer
214 views

How to identify which certificate I'm missing to produce HTTPS calls?

I posted a question similar to this one on Stack Overflow, but that has not produced any answers so far, so I'm hoping someone here will be able to help me out. Somewhat simplified, I'm trying to do ...
1
vote
1answer
33 views

key usage attributes and enhanced key usage attributes overwritten with CA template properties

I have generated a csr with key usage attributes and enhanced key usage attribute but when we sign with the computer template in Microsoft CA, it overwrites the attributes in the CSR, how do i ...
1
vote
0answers
57 views

Self-signed SSL certificates vs CA-signed certificates [duplicate]

While reading about certificates, I came across this article. It says: The point of a CA-signed certificate is to give slightly stronger verification that you are actually using the key that ...
2
votes
1answer
109 views

Trusted CA SSL certificates and embedded devices

There is an embedded device which should connect to the server over HTTPS and MQTTS. A server certificate is issued by a trusted CA (for example, Let's Encrypt). But there is a problem with server ...
0
votes
0answers
35 views

Latest CA Certificate Authorities List [duplicate]

I am posting this question after checking this question Where can I find all SSL CA certificates I need to verify couple of CA authorities.(below) CloudFlare NameCheap AWS commodo Where can in ...
1
vote
1answer
46 views

How Digital Certificate is bound to a particular identity?

I'm trying to understand the following: Let's say Alice wants to encrypt a message with Bob's public key. There can be a man-in-the-middle attack who impersonates Bob. So Alice uses digital ...
2
votes
1answer
88 views

How does an offline Root CA sign OCSP Response?

As Root CA are kept offline for security purposes, how does it sign OCSP Response sent by Client for Intermediate Certificate Status Check?
0
votes
1answer
216 views

Purpose of Decrypting & Scanning HTTPS traffic

Navigating to the below URL link from the Mozilla Firefox and entering some website link and clicking on View, displays certificate Viewer chrome://pippki/content/exceptionDialog.xul After enabling ...
0
votes
0answers
40 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
0
votes
0answers
59 views

Implementing PKI with Blockchain

In many current researches, ways of decentralizing PKI are proposed in which one of them is to implement PKI on blockchain but there is still a certification authority so isn't PKI still centralized ? ...
1
vote
0answers
36 views

Certificate generation using Advanced Electronic Signature (AdES)

For a mobile application I would like to be so compliant as possible with the AdES standard. The mobile application will perform operations on behalf of the user, signing them first. A backend ...
1
vote
1answer
95 views

Does it serve any purpose to have a CRL with the next update scheduled for 25 years in the future?

What purpose does it serve to have a CRL with nextUpdate set to +25 years? A CRL issued by the root of an operating Certificate Authority Certificate Revocation List (CRL): Version 2 (0x1) ...
9
votes
3answers
3k views

What websites can be protected by a particular SSL certificate?

What websites (URLs) can be protected by one SSL certificate? For example, www.security.hsbc.co.uk has a SSL certificate. Can this certificate be used to protect other websites (URLs)? Something that ...
0
votes
1answer
120 views

Is using trusted CA to issue certificate for a VPN server insecure?

I’d like to have an AlgoVPN server that uses a trusted CA to issue a certificate for the VPN server. I am currently using an AlgoVPN server, which is completely setup via Ansible scripts and ...
0
votes
1answer
41 views

Need for additional verification in mutual TLS authentication with own CA

Say, the goal is to facilitate secure communication between two parties. The definition of secure is that both parties can be sure that they are actually talking to a trusted party, not somebody else ...
0
votes
1answer
75 views

Cross-signing certificates for Windows Driver Signing

For testing purposes I want to test cross-signing certificates for Windows driver signing. I understand the general concept: Two root CAs, one root CA cross-signs the other root CA's public key. ...
1
vote
0answers
56 views

Is SmartCard-HSM 4K good enough for WebTrust level Certificate Authority ROOT KEY storage?

Is SmartCard-HSM 4K USB token good enough for a WebTrust category CA's ROOT KEY storage or is a FIPS 140-2 level 3 certified device required? Are there any FIPS 140-2 level 3 certified USB token with ...
1
vote
2answers
63 views

Use bidirectional SSL with CAC from phone

Is it possible to extract the certificate from a CAC (DOD common access card) and install it on a phone so that access to websites using bidirectional SSL can be done from a user phone. Ideally, the ...
2
votes
1answer
114 views

Does a CAA record on a local hostname in a LAN offer additional security?

A CAA DNS record limits the certificate authorities that may issue a certificate for a domain and its subdomains. Do CAA records make sense in a LAN environment? Assume internal hostnames such as ldap....
5
votes
2answers
148 views

How can I verify my browser/OS's top level certificate?

I have a basic understanding of how the certificate authority ecosystem works. I know that when I'm connecting to a site, and they provide me with a certificate, my computer verifies the certificate's ...
0
votes
1answer
98 views

Is there any way to mitigate against a compromised CA as a client on Firefox?

If I, as a client, connect to a server and there is a malicious certificate authority, how can the client protect against this CA and still connect to the site? If this isn't possible, how can the ...
-6
votes
2answers
166 views

Revoke Let's Encrypt CA for all devices in my organization?

If I disagree with Let's Encrypt's cavalier attitude about SSL certificate issuance, and their indifference to their auto-generated certificates potentially being using for widespread criminal ...
13
votes
1answer
735 views

Does HSTS protect against a rogue CA issuing a illegitimate valid certificate?

Does HSTS protect a domain from a publicly trusted CA that has gone rogue issuing a illegitimate valid certificate? Examples of publicly trusted CA's would be any of the members of the Mozilla CA ...
0
votes
1answer
59 views

How can I authenticate the certifcate of a Private CA while I'm not on that network i.e. offline

I want my application to verify that it is being run on a computer with a certificate issued by my Private CA. How can I do this when the computer is not on the network?
0
votes
0answers
40 views

Just came to know about Digital Certificates. But did't understand the way clients can verify CA [duplicate]

So I just came to know about Digital certificates, and this is what I understand. Public Key, Message + PK_encrypt(Hash(message))/Message Signing, And other identifiers is what a digital signature is....
3
votes
1answer
197 views

what is the usage of extendedkeyusage in a CA certificate?

we have a CA certificate template to verify, which contains an extendedkeyusage extension with the following values "clientAuthentication" "emailProtection" and "id-kp-OCSPSigning" Is this a ...

1
2 3 4 5
22