Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
0 votes
0 answers
58 views

Making CA certificates with `-subj` vs. `openssl-ca.cnf`?

I read through the answers from this question here: https://stackoverflow.com/questions/21297139/how-do-you-sign-a-certificate-signing-request-with-your-certification-authority But my comprehension on ...
learningtech's user avatar
0 votes
0 answers
68 views

Openssl command to verify authenticity of CA Issuer? And the "magic" behind it? [duplicate]

I am not confident in my understanding of Certificate Authority and signing certificates. I'm wondering how do you verify the authenticity of an issuer when inspecting an entity certificate. Here's ...
learningtech's user avatar
1 vote
2 answers
131 views

How is issuing a certificate revocation response different from re-issuing the certificate itself?

I am reading about how certificates work in the context of X.509, SSL/TLS/HTTPS. According to Wikipedia, the client (e.g. a browser) is supposed to check the revocation status for each non-root ...
paperskilltrees's user avatar
0 votes
1 answer
213 views

Criteria for Common Name of Certificate Authority and how it affects SSL certificates

It is not clear to me how the Common Name affects a certificate authority and the certificates that are ultimately created. For example, I have this simple script that creates some files for a ...
learningtech's user avatar
1 vote
0 answers
59 views

Other benefits of creating my certificate authority aside from the firefox issue and centralized management of certificates?

I've been trying to read more about self-signed SSL certificates versus creating my own certificate authority to sign SSL certificates. I am still not completely clear on this. I'll start by ...
learningtech's user avatar
0 votes
1 answer
149 views

Why openssl verify does not work for the certificate chain of a correctly configured site?

I download its certificates. To do that, I used the openssl debug output of the command openssl s_client -connect security.stackexchange.com:443 -servername security.stackexchange.com -showcerts -...
peterh's user avatar
  • 3,023
1 vote
0 answers
216 views

SSL Certificates signed by our CA show as invalid in browser

We're experiencing an issue, where SSL server-certificates issued by our own internal PKI will show as invalid in the browser, when accessing the site. The error is NET::ERR_CERT_INVALID (Tested in ...
AssistantTOtheCA's user avatar
2 votes
0 answers
53 views

Requesting an user-specific certificate in a tiered domain

Environment: A multi-tiered Active Directory (AD) where tier-specific admin accounts are restricted to log on to only their tier servers. Microsoft's Certificate Services (CS). Let's say the CA tier ...
Ramil's user avatar
  • 21
1 vote
0 answers
72 views

Support for domain-specific root CAs in X.509 certificate format, OS and browsers

Chance is one gets an invalid certificate warning when one follows this link https://www.cnss.gov. As explained there (same warning) this is on purpose, and the solution is supposed to be to install1 ...
fgrieu's user avatar
  • 1,231
2 votes
1 answer
108 views

How to feasibly digital sign high volume documents with CA issued digital certificate?

My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
BambiBundle's user avatar
0 votes
2 answers
192 views

Is there a tool for auditing my root certificates?

Is there any tool out there that will monitor my system's use of root CAs? So far I have not found anything, and so I am hoping that this community will know if such a tool exists. For background, I ...
Cogitative's user avatar
-1 votes
2 answers
215 views

What happens to the key pair once the CSR has been enrolled?

I have a key pair which I used to generate a CSR. Once I enrolled that CSR PKCS10, I get from the PKI (or CA) a certificate signed with the PKI private key. From here, I would like to know if my ...
MoBe's user avatar
  • 21
0 votes
1 answer
124 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145
0 votes
0 answers
83 views

Godaddy automatic renewals (Powershell & alternatives)

how are you? My orgazation is transitioning to using GoDaddy certificates, and I'm exploring if there's an established automated process to download and apply renewed certificates from GoDaddy to our ...
JustToKnow's user avatar
1 vote
1 answer
107 views

Certification path building for 509 certificates

To this date, is there a specification or a de-facto industry standard or how applications are supposed to perform certification path building in the context of X.509? I am specifically asking about ...
Nope's user avatar
  • 11
1 vote
2 answers
3k views

Move a user CA cert to a trusted root cert in Android 13

I am using Fiddler, and I have to insert a CA Cert to decrypt the SSL certificate coming out of my device. My device running Android 13 is rooted, and when I installed my cert, it went into the user's ...
Jason Chan's user avatar
0 votes
1 answer
104 views

How to resolve an issue with potential mismatch between device certificate and CA certificate?

I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
monkey's user avatar
  • 103
0 votes
1 answer
579 views

What is default_crl_days in OpenSSL and recommended days?

I'm new and I'm trying to understand default_crl_days. The default is 30 days thus does it mean after 30 days, the CRL list can no longer be trusted? If so, do we need to generate a new list before 30 ...
ratib90486's user avatar
0 votes
0 answers
84 views

Are sections in openssl config file case sensitive?

I'm reading this and it has the below (excerpt). # Certificate Authority Section [ ca ] default_ca = CA_default # The default CA section # Default CA configuration to ...
ratib90486's user avatar
0 votes
0 answers
1k views

How does automatic SSL certificate renewal work without having access to the private key?

From GoDaddy's Renewing my SSL Certificate docs (emphasis mine): If you’re using a Domain Validation (DV) certificate with the primary domain for your account, and you’ve set the certificate to auto-...
toraritte's user avatar
  • 129
0 votes
1 answer
112 views

Detect invalid cert Android client if URL being redirected to a fake server [duplicate]

Here is the scenario: Server A is an authentic server (A.com). Server F is a fake server (F.com) that also has a valid cert for F.com has a copy of A.com certificate to it (to fake as A.com). Client ...
Tung D. Nguyen's user avatar
1 vote
1 answer
641 views

Unexpected certificate authority installation on an android

Last week I received a notification pop-up on my galaxy s10 phone stating a certificate authority has been installed on this device. There was no information as to what authority was installed and ...
Janne Möttölä's user avatar
0 votes
1 answer
131 views

Can we move a PKI-as-a-service to own managed PKI server? [closed]

I'm a noob in PKI stuff. But if we were to subscribe to a PKI cloud service, could we move our root CA and other PKI stuff to our own PKI infrastructure once I'm ready to manage it ourselves?
ratib90486's user avatar
0 votes
0 answers
70 views

Can you sign a TLS root certificate that already exists? [duplicate]

Alice and Bob have TLS certificate authorities. My device trusts Alice's CA, and connects to servers that present a certificate rooted at Alice's CA. It does not explicitly trust Bob's CA, or the ...
Danya02's user avatar
  • 373
0 votes
1 answer
149 views

Is setting up a CA server necessary when all I want is to test HTTPS for a web project on localhost?

This freeCodeCamp article recommends setting up a CA server, installing the CA root certificate file into the system's trust store, and generating a leaf certificate for the project's web server. ...
toraritte's user avatar
  • 129
1 vote
0 answers
97 views

Best practice of x.509 client certificates accross multiple systems

I have several MongoDB's where I use x.509 Certificates to Authenticate Clients Let's say I create certificate and user for admin: subject: CN=admin issuer: CN=MongoDB Issuing CA -> db.createUser({...
Wernfried Domscheit's user avatar
0 votes
0 answers
34 views

How do certificate authorities choose which private/public keys to use to encrypt each SSL certificate so a browser can know that they're legit? [duplicate]

My understanding is that for each SSL certificate, there is a private and public key that web browsers use to confirm that it is a valid certificate signed by a trusted Certificate Authority. How does ...
user8497118's user avatar
0 votes
1 answer
442 views

How do TLS clients validate intermediate CA certificates?

I have read many posts related to the intermediate CA certificates and I do hope my question is not a duplication. Where do TLS clients fetch intermediate CA certificates from? In SSL server handshake,...
Michael's user avatar
  • 1,469
0 votes
1 answer
95 views

what is the difference between the two openssl commands below

what is the difference between the commands below : command 1: openssl x509 -req -in certs/server_csr.pem -CA certs/intermediate_cert.pem -CAkey private/intermediate_key.pem -out server_cert.pem -...
ethicalhacker's user avatar
0 votes
0 answers
103 views

Error when validating certificate

I created a certificate signed by an intermediate CA that is signed by root CA following an online tutorial. Reference to tutorial that I followed: https://www.golinuxcloud.com/openssl-create-...
ethicalhacker's user avatar
1 vote
1 answer
1k views

How to identify certificate package type?

I am trying to identify a certificate CA distributed on https://acraiz.icpbrasil.gov.br/repositorio/Cadeia_FIREFOX.der (which is served signed by itself, while all pages leading to it are signed by a ...
gcb's user avatar
  • 233
24 votes
4 answers
6k views

What's the point of certificates in SSL/TLS?

A valid certificate cannot guarantee that I'm not being MITM'd right now, as either the private key or CA may have been compromised. For this reason, I have to contact a CA through CRL/OCSP to check ...
David Davidson's user avatar
0 votes
0 answers
403 views

What would happen if root CA get hacked? [duplicate]

What would happen if PKI for root CA is insecure? Let's say that one of the root Certificate Authorities was hacked and nobody noticed it yet. Are all websites insecure or only those that were signed ...
user22055059's user avatar
0 votes
1 answer
691 views

what is the difference between the root CA certificate and the intermediate CSR certificate

I tried to search online for the difference between both CSR certificate and a certificate but I couldn't find a concrete asnwer. I am doing my own lab using this tutorial https://www.golinuxcloud.com/...
ethicalhacker's user avatar
8 votes
3 answers
3k views

.exe with Digital Signature, showing SHA1 but the Certificate is SHA384, is it secure?

For this file it shows SHA1: But going into details the certificate looks like this: I know SHA1 is an outdated algorithm but I'm not sure about this nested construction. Is this insecure? Which of ...
Strah Behry's user avatar
2 votes
1 answer
107 views

Can you use AD CS to generate certificates for service users with the computer name in the certificate details?

I am working on seeing if Active Directory Certificate Services can be used to manage the trust infrastructure for a data center environment. I have a series of different services that are run on web ...
AJ Henderson's user avatar
  • 42.1k
0 votes
2 answers
200 views

What prevents certificate authorities from issuing fraudulent TLS certificates?

There have been reports of attacks against certificate authorities resulting in the issuance of fraudulent TLS certificates for sites such as google.com, yahoo.com, and skype.com. These attacks seem ...
Gilgamesh's user avatar
1 vote
2 answers
159 views

How does a CA-backed signature works?

I would like to understand how certificate-based signature works, I understand the standard asymmetric key signature where one party signs using their private key, and anyone else can validate this is ...
felartu's user avatar
  • 43
0 votes
2 answers
3k views

What is the difference between a signed CSR and a leaf certificate?

When creating certificates with the step CLI I have the option to create a leaf certificate for a certain subject or sign a certificate signing request (CSR). I could not really determine a difference ...
Paul K's user avatar
  • 175
0 votes
2 answers
330 views

Does a certificate revocation list (CRL) keep it's entries at least as long as the certificate would have been valid?

This question is specifically about certificates that should have had a long lifetime, but were revoked quickly. Is every CRL issued by this CA guaranteed to include its revocation, as long as the ...
Towdo's user avatar
  • 3
0 votes
1 answer
112 views

Misuse of trusted certificate authority [duplicate]

Currently I'm working with mitmproxy and intercepting some HTTPs traffic using it. Before I could use it in my browser, I had to trust the certificate via my OS settings. After that, the certificate ...
TrueStar's user avatar
3 votes
1 answer
605 views

Added root authority certificate for firefox, but still not trusting certificate

I don't know if what I'm asking is even possible, but I'll ask anyway. I'm trying to get FireFox or Chrome to trust a self-signed certificate used on a website I'm running locally. I started up an ...
learningtech's user avatar
1 vote
1 answer
2k views

How to practice making self-signed certificates with intermediate CAs

I am trying to learn how ssl chain of trust works with practical examples. I thought maybe openssl would be a good education tool. But I'm running into a few problems while practicing, and I'm at a ...
learningtech's user avatar
0 votes
1 answer
336 views

Over what fields is the X509 hash computed over? [duplicate]

Is this how X509 certificates are verified to be valid? The receiver receives the certificate Look at the issuer of the cert, and find the public key of that CA (its hardcoded in the application or ...
user289431's user avatar
1 vote
1 answer
138 views

Does defining "a minimum path length" for certification validation have any security benefit?

As you may know, Common Criteria (AKA ISO/IEC15408: A standard for IT Security Evaluation) have provided some security base-line documents named "Protection Profile" for software developers ...
Ebrahim Ghasemi's user avatar
1 vote
1 answer
382 views

What problem does "max_path_length" attribute in certificates are going to solve?

I'm trying to understand the purpose of defining pathLenConstraint and max_path_length in RFC5280 (Internet X509 PKI Certificate and CRL Profile): For pathLenConstraint The above mentioned RFC states: ...
Ebrahim Ghasemi's user avatar
2 votes
1 answer
298 views

Can an Intermediate CA extend its "Certificate Key Usage" by issuing a new certificate for itself?

I'm trying to understand the purpose of defining self-issued certificate concept in RFC5280 (Internet X509 PKI Certificate and CRL Profile): Regarding this concept the RFC states: This specification ...
Ebrahim Ghasemi's user avatar
1 vote
1 answer
2k views

Renewing Enterprise CA certificate

I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate. My setup is the Root CA is offline with online issuing CA server. When I do the renewal nothing ...
Julian Haines's user avatar
0 votes
1 answer
261 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
Vlad A.'s user avatar
0 votes
1 answer
579 views

Why installing a root certificate on the client opens a door for MitM attack?

Most internet communication is now end-end encrypted using TLS. In the TLS process, the TLS server sends a PKI certificate to the user which then gets authenticated using the CA's root certificate ...
lll's user avatar
  • 3

1
2 3 4 5
26