Questions tagged [certificate-authority]
A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.
1,280
questions
0
votes
0
answers
11
views
How to renew the Root CA Certificate on Microsoft Active Directory Enterprise CA [migrated]
How to renew the Root CA certificate on Microsoft Active Directory Enterprise Root Certificate Authority Windows Server 2012 R2?
The certificate expired on 27 Aug. 2023, getting the error below while ...
0
votes
1
answer
46
views
What is default_crl_days in OpenSSL and recommended days?
I'm new and I'm trying to understand default_crl_days. The default is 30 days thus does it mean after 30 days, the CRL list can no longer be trusted? If so, do we need to generate a new list before 30 ...
0
votes
0
answers
23
views
Are sections in openssl config file case sensitive?
I'm reading this and it has the below (excerpt).
# Certificate Authority Section
[ ca ]
default_ca = CA_default # The default CA section
# Default CA configuration to ...
0
votes
0
answers
52
views
How does automatic SSL certificate renewal work without having access to the private key?
From GoDaddy's Renewing my SSL Certificate docs (emphasis mine):
If you’re using a Domain Validation (DV) certificate with the primary domain for your account, and you’ve set the certificate to auto-...
- 129
-1
votes
1
answer
31
views
Detect invalid cert Android client if URL being redirected to a fake server [duplicate]
Here is the scenario:
Server A is an authentic server (A.com).
Server F is a fake server (F.com) that also has a valid cert for
F.com has a copy of A.com certificate to it (to fake as A.com).
Client ...
0
votes
0
answers
46
views
Unexpected certificate authority installation on an android
Last week I received a notification pop-up on my galaxy s10 phone stating a certificate authority has been installed on this device. There was no information as to what authority was installed and ...
0
votes
1
answer
56
views
Can we move a PKI-as-a-service to own managed PKI server? [closed]
I'm a noob in PKI stuff. But if we were to subscribe to a PKI cloud service, could we move our root CA and other PKI stuff to our own PKI infrastructure once I'm ready to manage it ourselves?
0
votes
0
answers
28
views
Can you sign a TLS root certificate that already exists? [duplicate]
Alice and Bob have TLS certificate authorities. My device trusts Alice's CA, and connects to servers that present a certificate rooted at Alice's CA. It does not explicitly trust Bob's CA, or the ...
- 163
0
votes
1
answer
90
views
Is setting up a CA server necessary when all I want is to test HTTPS for a web project on localhost?
This freeCodeCamp article recommends
setting up a CA server,
installing the CA root certificate file into the system's trust store, and
generating a leaf certificate for the project's web server.
...
- 129
1
vote
0
answers
35
views
Best practice of x.509 client certificates accross multiple systems
I have several MongoDB's where I use x.509 Certificates to Authenticate Clients
Let's say I create certificate and user for admin:
subject: CN=admin
issuer: CN=MongoDB Issuing CA
-> db.createUser({...
0
votes
0
answers
34
views
How do certificate authorities choose which private/public keys to use to encrypt each SSL certificate so a browser can know that they're legit? [duplicate]
My understanding is that for each SSL certificate, there is a private and public key that web browsers use to confirm that it is a valid certificate signed by a trusted Certificate Authority.
How does ...
0
votes
1
answer
85
views
How do TLS clients validate intermediate CA certificates?
I have read many posts related to the intermediate CA certificates and I do hope my question is not a duplication.
Where do TLS clients fetch intermediate CA certificates from?
In SSL server handshake,...
- 1,479
0
votes
1
answer
44
views
what is the difference between the two openssl commands below
what is the difference between the commands below :
command 1:
openssl x509 -req -in certs/server_csr.pem -CA certs/intermediate_cert.pem -CAkey private/intermediate_key.pem -out server_cert.pem -...
0
votes
0
answers
47
views
Error when validating certificate
I created a certificate signed by an intermediate CA that is signed by root CA following an online tutorial.
Reference to tutorial that I followed: https://www.golinuxcloud.com/openssl-create-...
0
votes
1
answer
267
views
How to identify certificate package type?
I am trying to identify a certificate CA distributed on https://acraiz.icpbrasil.gov.br/repositorio/Cadeia_FIREFOX.der (which is served signed by itself, while all pages leading to it are signed by a ...
- 213
24
votes
4
answers
6k
views
What's the point of certificates in SSL/TLS?
A valid certificate cannot guarantee that I'm not being MITM'd right now, as either the private key or CA may have been compromised. For this reason, I have to contact a CA through CRL/OCSP to check ...
- 549
0
votes
0
answers
89
views
What would happen if root CA get hacked? [duplicate]
What would happen if PKI for root CA is insecure? Let's say that one of the root Certificate Authorities was hacked and nobody noticed it yet.
Are all websites insecure or only those that were signed ...
0
votes
1
answer
105
views
what is the difference between the root CA certificate and the intermediate CSR certificate
I tried to search online for the difference between both CSR certificate and a certificate but I couldn't find a concrete asnwer.
I am doing my own lab using this tutorial https://www.golinuxcloud.com/...
8
votes
3
answers
3k
views
.exe with Digital Signature, showing SHA1 but the Certificate is SHA384, is it secure?
For this file it shows SHA1:
But going into details the certificate looks like this:
I know SHA1 is an outdated algorithm but I'm not sure about this nested construction. Is this insecure? Which of ...
- 183
2
votes
1
answer
34
views
Can you use AD CS to generate certificates for service users with the computer name in the certificate details?
I am working on seeing if Active Directory Certificate Services can be used to manage the trust infrastructure for a data center environment. I have a series of different services that are run on web ...
- 42k
0
votes
2
answers
106
views
What prevents certificate authorities from issuing fraudulent TLS certificates?
There have been reports of attacks against certificate authorities resulting in the issuance of fraudulent TLS certificates for sites such as google.com, yahoo.com, and skype.com. These attacks seem ...
- 21
1
vote
2
answers
107
views
How does a CA-backed signature works?
I would like to understand how certificate-based signature works, I understand the standard asymmetric key signature where one party signs using their private key, and anyone else can validate this is ...
- 43
0
votes
0
answers
86
views
TPM tss2 certificate signing request sign by CA
I am trying to sign certificate by CA which generated by CA. But I am facing below error code while singing.
Generate certificate:
# tpm2tss-genkey -a rsa -s 2048 mykey
# openssl req -new -engine ...
- 113
0
votes
0
answers
33
views
Limiting TFS Server Access using Certificates
I am attempting to lock down our on-prem TFS server using client certificate authentication. I am being asked to ensure that no user has access to the server using Certificates rather than just log in ...
- 1
0
votes
0
answers
60
views
Why does Firefox use unsecured port 80 to download certs? [duplicate]
When firefox (v111 2023) is opened for the first time it connects to ocsp.digicert.com on port 80 in cleartext. Isn't this a terrible security vulnerability. Can someone help me understand why this ...
- 1,515
0
votes
2
answers
705
views
What is the difference between a signed CSR and a leaf certificate?
When creating certificates with the step CLI I have the option to create a leaf certificate for a certain subject or sign a certificate signing request (CSR). I could not really determine a difference ...
- 175
0
votes
2
answers
155
views
Does a certificate revocation list (CRL) keep it's entries at least as long as the certificate would have been valid?
This question is specifically about certificates that should have had a long lifetime, but were revoked quickly.
Is every CRL issued by this CA guaranteed to include its revocation, as long as the ...
- 3
0
votes
1
answer
42
views
Misuse of trusted certificate authority [duplicate]
Currently I'm working with mitmproxy and intercepting some HTTPs traffic using it. Before I could use it in my browser, I had to trust the certificate via my OS settings. After that, the certificate ...
- 41
2
votes
1
answer
202
views
Added root authority certificate for firefox, but still not trusting certificate
I don't know if what I'm asking is even possible, but I'll ask anyway.
I'm trying to get FireFox or Chrome to trust a self-signed certificate used on a website I'm running locally. I started up an ...
- 177
1
vote
1
answer
416
views
How to practice making self-signed certificates with intermediate CAs
I am trying to learn how ssl chain of trust works with practical examples. I thought maybe openssl would be a good education tool. But I'm running into a few problems while practicing, and I'm at a ...
- 177
0
votes
1
answer
160
views
Over what fields is the X509 hash computed over? [duplicate]
Is this how X509 certificates are verified to be valid?
The receiver receives the certificate
Look at the issuer of the cert, and find the public key of that CA (its hardcoded in the application or ...
0
votes
0
answers
105
views
Is Self-Signed certificate sufficient for Production environments exposed to the Internet to secure our Azure Function
We have created an Azure Function which runs on a scheduled basis to update Sharepoint Online sites (each 10 minutes).
Now for this Azure Function to integrate with SharePoint, we have created an ...
1
vote
1
answer
77
views
Does defining "a minimum path length" for certification validation have any security benefit?
As you may know, Common Criteria (AKA ISO/IEC15408: A standard for IT Security Evaluation) have provided some security base-line documents named "Protection Profile" for software developers ...
- 314
1
vote
1
answer
137
views
What problem does "max_path_length" attribute in certificates are going to solve?
I'm trying to understand the purpose of defining pathLenConstraint and max_path_length in RFC5280 (Internet X509 PKI Certificate and CRL Profile):
For pathLenConstraint The above mentioned RFC states:
...
- 314
2
votes
1
answer
170
views
Can an Intermediate CA extend its "Certificate Key Usage" by issuing a new certificate for itself?
I'm trying to understand the purpose of defining self-issued certificate concept in RFC5280 (Internet X509 PKI Certificate and CRL Profile):
Regarding this concept the RFC states:
This specification ...
- 314
0
votes
1
answer
1k
views
Renewing Enterprise CA certificate
I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate.
My setup is the Root CA is offline with online issuing CA server.
When I do the renewal nothing ...
0
votes
1
answer
109
views
How to get a CA into a Trust Chain
I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service).
I intend to send the attestation bundle alongside public keys and ...
- 1
0
votes
1
answer
199
views
Why installing a root certificate on the client opens a door for MitM attack?
Most internet communication is now end-end encrypted using TLS. In the TLS process, the TLS server sends a PKI certificate to the user which then gets authenticated using the CA's root certificate ...
- 3
0
votes
0
answers
194
views
client side certificate installed on ios 16 are not being sent by browsers on that device when a server requests for a identity cert
I have a client side certificate from cloudflare (non-root) that i install on our devices in order to gain access to our sites that ask for a client side certificate from browsers. This works ...
1
vote
1
answer
91
views
Automatic Certificate Signing Request (CSR) Validation
I was wondering if there are papers or well-known algorithms to automate the validation of a Certificate Signing Request (CSR).
Suppose I have a group of trusted services where I expose a "CA ...
- 13
0
votes
2
answers
191
views
A DNS that has been eliminated is still resulting in X.509 Certificate Subject CN Does Not Match the Entity Name
I ran a Nexpose scan on a DNS that no longer resolves and a vulnerability was found : X.509 Certificate Subject CN Does Not Match the Entity Name
I don't know why it's still producing a vulnerability ...
11
votes
3
answers
4k
views
Why create a CSR on my own server to have it signed by a 3rd party?
I am looking into our current website certificate-management process and am looking for steps that may be unnecessary and can be simplified. The current process was created by our sysadmin who now ...
- 375
12
votes
3
answers
6k
views
How do we know that our SSL certificates are to be trusted?
On Linux, the /etc/ssl/certs folder includes all the necessary public keys for Certificate Authorities. If I have not misunderstood something, this makes it possible to verify public keys received ...
- 175
0
votes
1
answer
823
views
Client CA certificate & RADIUS
when my client tries to authenticate with Radius servers it gives following error:
unable to get local issuer certificate
As per my understanding, this is a trust chain problem or, in other words, my ...
- 131
3
votes
1
answer
254
views
TrustCor root CA not in Windows 10
Just saw a piece of news about potential issues with TrustCor root CA.
I don't see the TrustCor root CA in windows certificate manager.
I do see it in Firefox cert store.
Browsing to trustcor.com in ...
- 35
1
vote
1
answer
118
views
Root CA best practice
We are planning a new PKI for our company.
Existing structure is a single root CA and two issuing CA's. One for test, one for production.
We can keep the new PKI design the same or we can use another ...
- 11
0
votes
0
answers
410
views
Self-signed certificate chain verified by OpenSSL but Windows says leaf is invalid
Let's say I have rootCA.crt, intermediateCA.crt and leaf.crt. I used openssl to veriy leaf.crt:
cat rootCA.crt intermediate.crt > chain.crt
openssl verify -CAfile chain.crt leaf.crt
and it said ...
0
votes
0
answers
88
views
How do operating systems trust public CAs? [duplicate]
Based on my understanding, a tls client trusts a server because the server sends its certificate which has been signed by the CA. How does my computer/os know which CAs are publicly trusted? Do all ...
- 1
1
vote
1
answer
195
views
Extremely strange and concerning SSL issues. MITM attack?
While not particularly knowledgeable on public key infrastructure, I've noticed strange issues with SSL and TLS lately that I'm unable to diagnose. As these issues have currently left me dumbfounded I'...
- 11
6
votes
1
answer
819
views
Same domain, same local network, different certificate chain
I was doing some security checks in some devices in my local network and I noticed that I obtain two different certificate chains for the same domain (www.google.com) from two different devices (...
- 63