Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

0
votes
0answers
28 views

Line jump with openssl s_client -connect command when using CAfile

I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect ...
0
votes
1answer
115 views

Why isn't free software signed with self-signed certificates? [duplicate]

A majority of free software (in particular, Linux ports for Windows) are not signed. As I understand it, it is quite easy to create a self-signed CA, and sign the software. Distribution would be ...
1
vote
1answer
60 views

Where do TLS clients fetch intermediate CA certificates from? [duplicate]

When I use my browser (a TLS client) to navigate to a secure web page (e.g. https://example.com), during the TLS handshake, the browser will receive an end-entity certificate from the web server of ...
0
votes
0answers
65 views

Government Root CA installed on computer/browser and Man-In-The-Middle [duplicate]

Some countries already have their government Root CA installed on computer/browsers. Is it possible for these countries to read Google etc. mails by using Man-In-The-Middle or similar technique(s)?
0
votes
0answers
58 views

SSL handshake: Client Hello and Server Hello

I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy. This is my topology:...
1
vote
1answer
92 views

Can you whitelist a single CA for a domain?

Simply: For my domain (say example.com), I want my computer to only trust HTTPS certs signed by my personal CA, and ONLY my personal CA. Otherwise any one of the CAs I have on my computer could ...
2
votes
1answer
60 views

SSL/TLS certifcate secure on Chrome but not on Firefox

My organization have emitted TLS certificate for Https. It appears as secure when I access the page with Chrome but non secure with FireFox. Is there a difference between these two browsers about how ...
0
votes
1answer
80 views

Signature of a root certificate - CA authority

Created a root certificate(cacert.pem) and tried viewing the content to primarily understand the contents of certificate, mainly the signature appended to certificate. Below is the text output of ...
1
vote
0answers
88 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
-8
votes
2answers
125 views

Why does everyone assume 'https' is secure? [duplicate]

Why are they certificate authorities? What do they do that ensures the information is 'secure'? I know that they verify if a 'certificate' is from a 'trusted' source but who decides which sources are '...
2
votes
2answers
113 views

Why is openssl complaining that my certificate chain is self-signed?

I am trying to set up a certificate chain for a lab server. I have created my own root CA, an intermediate CA and a server certificate. I supplied these certificates along with the server key to the ...
1
vote
2answers
130 views

How are UUIDs assigned in P2P protocols

I am learning about P2P in general (mainly blockchain). I know many P2P protocols uses a distributed hash table for node lookup (kademlia) that maps UUIDs of nodes to their addresses. I am curious ...
0
votes
0answers
25 views

How to map the “CA issued certificate” to a user in AD?

I'm trying to perform certificate-based WiFi authentication. I've set up the CA and by using the SCEP Challenge Password, I'm able to get the certificate. But I need to map this issued certificate to ...
0
votes
0answers
24 views

CA issued certificates maps to the wrong user in AD

I'm doing certificate-based authentication using windows server 2012. I've set up the CA, NDES and now, when I request a certificate using the SCEP Challenge password, I'm able to receive the ...
4
votes
2answers
73 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
1
vote
1answer
75 views

What happens if the private key of a Trusted Timestamp Authority is compromised?

what happens if the private key certificate of a Trusted Timestamp Authority used to sign the timestamps is compromised? If this private key certificate is changed, should all timestamps be re-signed ...
0
votes
1answer
44 views

Risk of issuing a client-certificate for every user in application level

I'm currently working on a project that includes client-authorization using client certificates, where my app is the Certificate Authority. Doing that, every user that registers to my web server gets ...
1
vote
1answer
48 views

Windows certificate manager imports a SHA256 root CA certificate as SHA1

I generated the root CA test cert using: makecert -a sha256 -n "CN=RootCATest" -r -sv RootCATest.pvk RootCATest.cer I've imported this root CA certificate on another machine (Win Server 2019, ...
0
votes
2answers
73 views

Can a DV CA issue IP certificate

I understand that according to CA/B, CA can issue certificate to a public IP address if the validation challenge is satisfied. But can a DV CA issue IP certificates? (If their CA policy allows) Does ...
0
votes
0answers
18 views

Certificate Validation with SDS enabled on Ingress Gateway and mode set to MUTUAL

I have been having some difficulty understanding the mechanism by which certificates are validated by either party in a mutual TLS handshake. I have SDS enabled on my ingress gateway(s) and the ...
1
vote
0answers
39 views

same CA, same CN [duplicate]

Can you order several certs from the same CA, in which only the DN differs, but the CN is the same? Will they accept a second request for the same CN or maybe then put the first cert on the ...
0
votes
2answers
105 views

How can we trust a CA?

During the SSL/TLS handshake we are checking the authentication of the client and the server. During this process certificate chain also comes into the picture to trust/complete the certificate chain....
2
votes
1answer
60 views

Is it OK to set SSL fullchain to service

Imagine service with SSL-server authentication. There are 3 certificates in chain: Root CA certificate; Intermediate CA certificate; Host certificate. Is it ok to put all 3 certificates (fullchain) ...
0
votes
1answer
45 views

ADCS two tier PKI

Planning a two tier ADCS PKI infrastructure as follows: ORCA ____________|____________ | | | SCA1 SCA2 SCA3 one.int two.int three.int ...
3
votes
1answer
234 views

Why do VPN Providers ask for installation of Root CA?

I've seen a lot of VPN providers and they all seem to agree on one thing: ask user to install their own Root CA. I don't get why they do it. A legit server should have a certificate generated by ...
-1
votes
1answer
287 views

Why don't CAs sell certificates as files, instead of hardware or as a service?

I'm trying to purchase multiple certificates, some just signing, some just encrypting, and some a combination of the two. I wanted to purchase one signed by a CA, rather than using a self-signed one. ...
2
votes
1answer
117 views

Duplicate subject names for intermediate and root certificates

I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates. They issue multiple root certificates and intermediate ...
0
votes
0answers
29 views

authenticating SSL client certificates on server

current setup: i have a pki setup which issues client certificates to the users (so that only clients with the certificate can access the web application). was looking for ways to implement this and i ...
0
votes
1answer
51 views

How to make sure certifi python package is up to date

In python's requests module documentation, I find this important recommendation: For the sake of security we recommend upgrading certifi frequently! Q: How can I make sure that my system's certifi ...
0
votes
1answer
78 views

Should CRLs be published for Standalone Offline Root CA?

I'm setting up a two tier PKI Hierarchy in our Windows Server 2012 R2 domain. A number of tutorials suggest that the root CA should publish its CA certificate and CRL in Active Directory and via HTTP,...
0
votes
1answer
43 views

How to automate publication of CRL and CRT files to CDP and AIA location?

I'm setting up Two-Tier PKI for the first time in our Windows Server 2012 R2 environment and I've read several tutorials on setting this up. Some of the methodology is very different, but I've chosen ...
3
votes
1answer
95 views

When accepting an SSL certificate, can I limit for which domains I accept it?

Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
0
votes
1answer
150 views

PKI - CRL and OCSP

I've done quite a bit of reading about PKI in ADCS and CRL/OCSP, but I can't seem to find an answer to a small couple of questions I still have: It is clear to me that even with OCSP in place, you ...
1
vote
0answers
55 views

CA signature Algorithm: sha256WithRSAEncryption or ecdsa-with-SHA256

I need to update a CA that is about to expire, currently is using Signature Algorithm 256WithRSAEncryption and I am thinking in using ecdsa-with-SHA256 with something like: openssl req -x509 -nodes -...
1
vote
2answers
149 views

What are the risks of installing a CA on the same machine as OpenVPN server?

Digital Ocean states in one of it's tutorial about OpenVPN server : While it’s technically possible to use your OpenVPN server or your local machine as your CA, this is not recommended as it ...
2
votes
1answer
56 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
2
votes
1answer
73 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
0
votes
0answers
24 views

Whether cipher suites is related to public key certificate? [duplicate]

I want to use TLS version 1.2 and Authenticated Encryption with Associated Data (AEAD). Can a public key certificate obtained from a certification authority specify which of the ciphers I can use? ...
2
votes
1answer
53 views

Why CA's baseline requirement have 22 on Authorized ports while there is no allowed way to use it?

while reading Baseline Requirement for Public CA I noticed something. 1. Authorized Ports: One of the following ports: 80 (http), 443 (http), 25 (smtp), 22 (ssh). this includes port 22 and ...
2
votes
3answers
113 views

SSL authentication unexpectedly failing - could this be caused by SSL Inspection/Fortinet?

I'm dealing with an SSL issue that's been plaguing me for several days. I know relatively little about security, so if anyone here could lend a helping hand I would be extremely grateful. Ultimately ...
0
votes
0answers
570 views

Specify Subject Alt Names in OpenSSL CA

I know you can use -addext with openssl req..... but, are you able to do that with openssl ca....? I would like to be able to add Subject Alternative Names with only one command without having to edit ...
0
votes
1answer
39 views

truststore and intermediate certificates

We have a situation where our on premise product talks to a third party external API over SSL. This API has a certificate which is issued by an intermediate. We use the default java cacerts truststore,...
1
vote
1answer
65 views

Getting VPN users to trust a non-global Root Certificate Authority on Windows in order to use TLS on intranet websites

Consider the following scenario, keeping in mind the restrictions: Your goal is to secure intranet-only web applications to start using https - so you need a certificate issued, so you can bind ...
1
vote
0answers
141 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
0
votes
0answers
37 views

How can I create a self-signed certificate with a custom field? [duplicate]

For experiment, I want to add a custom field in a TLS certificate then validate it. Because it is experiment, it will be a self-signed certificate. I use OpenSSL 1.1.0g and Ubunut 18.04. Any hint will ...
0
votes
0answers
49 views

How to check if installed Trusted CAs are not dangerous? [duplicate]

I've checked my Windows 7 installed Trusted Certificate Authorities using MMC tool as below: Questions are: How can I be sure that they are genuine and are installed by Microsoft and not by a third-...
1
vote
1answer
101 views

How do I validate a certificate by hand?

I have a website, which has a signed certificate file (website.crt) from a certificate authority (CA). How do I make sure exactly, that this certificate is valid? I know, that browsers do it ...
1
vote
0answers
488 views

Use self-signed certificate inside of Docker Container for localhost

I've created a self-signed certificate for localhost to use https. I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
0
votes
2answers
75 views

Signing webhooks with asymmetric keys

I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography). What is the recommended or ...
0
votes
0answers
170 views

What is a reasonable default_crl_days value for OpenVPN CLR? Why?

I am having trouble finding a definitive answer (with a rationale) on what a reasonable default value for default_crl_days (in openssl.cnf) for use with OpenVPN. The current default is 30 days. But ...