Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
3 votes
1 answer
198 views

Certificate Policies & Certificate Practice Statements - Destroying Vs. Archiving CA's Private Keys (HSMs)

Please Consider: English is my second language. Background I have been looking at different CP/CPS on the web. They all seem to roughly follow the same practices. However, two different policies ...
2 votes
2 answers
1k views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
1 vote
2 answers
347 views

Why infamous Addtrust certificate is still not expired (same private key) for code signing?

As many of you know Addtrust certificate https://crt.sh/?id=1 expired 30 May 2020 as well as many other intermediate certs and now we have to update certs on many servers to either root cert https://...
1 vote
1 answer
104 views

Certification path building for 509 certificates

To this date, is there a specification or a de-facto industry standard or how applications are supposed to perform certification path building in the context of X.509? I am specifically asking about ...
0 votes
1 answer
163 views

Exposing ADCS OCSP on the Public Internet

I am building a Certificate Authority using Windows Server ADCS as a 'Standalone' CA but my application would be greatly improved if I can utilise OCSP. Is the ADCS Online Responder Role Service ...
1 vote
1 answer
618 views

Unexpected certificate authority installation on an android

Last week I received a notification pop-up on my galaxy s10 phone stating a certificate authority has been installed on this device. There was no information as to what authority was installed and ...
5 votes
1 answer
9k views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
2 votes
2 answers
419 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
1 vote
1 answer
360 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
1 vote
1 answer
684 views

HAProxy Trust only specific client certs for mutual

I am using HAProxy to perform Mutual TLS termination for my API. HAProxy has Mutual TLS enabled with "verify required" and a cert-auth file to restrict access to the Apache service that ...
0 votes
0 answers
65 views

Openssl command to verify authenticity of CA Issuer? And the "magic" behind it? [duplicate]

I am not confident in my understanding of Certificate Authority and signing certificates. I'm wondering how do you verify the authenticity of an issuer when inspecting an entity certificate. Here's ...
0 votes
0 answers
54 views

Making CA certificates with `-subj` vs. `openssl-ca.cnf`?

I read through the answers from this question here: https://stackoverflow.com/questions/21297139/how-do-you-sign-a-certificate-signing-request-with-your-certification-authority But my comprehension on ...
0 votes
1 answer
433 views

offline root CA workflow

I have reviewed several discussions here regarding offline root CA management. While useful, none quite capture my question. Firstly it presumably would not be generally assessed as an 'offline' root ...
1 vote
2 answers
128 views

How is issuing a certificate revocation response different from re-issuing the certificate itself?

I am reading about how certificates work in the context of X.509, SSL/TLS/HTTPS. According to Wikipedia, the client (e.g. a browser) is supposed to check the revocation status for each non-root ...
0 votes
1 answer
202 views

Criteria for Common Name of Certificate Authority and how it affects SSL certificates

It is not clear to me how the Common Name affects a certificate authority and the certificates that are ultimately created. For example, I have this simple script that creates some files for a ...
1 vote
2 answers
3k views

Move a user CA cert to a trusted root cert in Android 13

I am using Fiddler, and I have to insert a CA Cert to decrypt the SSL certificate coming out of my device. My device running Android 13 is rooted, and when I installed my cert, it went into the user's ...
1 vote
0 answers
56 views

Other benefits of creating my certificate authority aside from the firefox issue and centralized management of certificates?

I've been trying to read more about self-signed SSL certificates versus creating my own certificate authority to sign SSL certificates. I am still not completely clear on this. I'll start by ...
0 votes
2 answers
279 views

Will Users of Intermediate CA1 trust Users of intermediate CA2?

I have my own CA(CA) and 2 intermediate(ICA1 & ICA2) CA's(generated using the root CA). Using ICA1, generated a server cert(for server S1) and 2 user cert(for user U1 & U2). Now, user certs is ...
3 votes
2 answers
562 views

Is it a good idea to reuse certificate issued by public CA for internal database client authentication?

Let's say we have: Publicly available HTTPS API (e.g. api.example.com). The web server that runs it uses a certificate from a publicly trusted CA (e.g. Let's Encrypt) with both server auth and client ...
0 votes
1 answer
143 views

Why openssl verify does not work for the certificate chain of a correctly configured site?

I download its certificates. To do that, I used the openssl debug output of the command openssl s_client -connect security.stackexchange.com:443 -servername security.stackexchange.com -showcerts -...
30 votes
4 answers
26k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
1 vote
0 answers
209 views

SSL Certificates signed by our CA show as invalid in browser

We're experiencing an issue, where SSL server-certificates issued by our own internal PKI will show as invalid in the browser, when accessing the site. The error is NET::ERR_CERT_INVALID (Tested in ...
3 votes
1 answer
976 views

How to set up certificate architecture for on-premise server-client application

We are currently shipping a product to our customers that is server-client-based running on Windows server 2016 (server) and Windows 10 (clients). The server is installed on-premise in our customer's ...
0 votes
2 answers
188 views

Is there a tool for auditing my root certificates?

Is there any tool out there that will monitor my system's use of root CAs? So far I have not found anything, and so I am hoping that this community will know if such a tool exists. For background, I ...
2 votes
2 answers
1k views

Android Root Certificate Issue

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But ...
1 vote
0 answers
69 views

Support for domain-specific root CAs in X.509 certificate format, OS and browsers

Chance is one gets an invalid certificate warning when one follows this link https://www.cnss.gov. As explained there (same warning) this is on purpose, and the solution is supposed to be to install1 ...
2 votes
0 answers
50 views

Requesting an user-specific certificate in a tiered domain

Environment: A multi-tiered Active Directory (AD) where tier-specific admin accounts are restricted to log on to only their tier servers. Microsoft's Certificate Services (CS). Let's say the CA tier ...
-1 votes
2 answers
209 views

What happens to the key pair once the CSR has been enrolled?

I have a key pair which I used to generate a CSR. Once I enrolled that CSR PKCS10, I get from the PKI (or CA) a certificate signed with the PKI private key. From here, I would like to know if my ...
2 votes
1 answer
105 views

How to feasibly digital sign high volume documents with CA issued digital certificate?

My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
0 votes
1 answer
120 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
0 votes
0 answers
80 views

Godaddy automatic renewals (Powershell & alternatives)

how are you? My orgazation is transitioning to using GoDaddy certificates, and I'm exploring if there's an established automated process to download and apply renewed certificates from GoDaddy to our ...
3 votes
2 answers
13k views

What Enhanced Key Usages are required for PKI infrastructure tasks? (OIDs for OSPF and CRL signing, etc)

I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks. I understand that clients may not validate the ...
1 vote
1 answer
2k views

Renewing Enterprise CA certificate

I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate. My setup is the Root CA is offline with online issuing CA server. When I do the renewal nothing ...
77 votes
7 answers
16k views

What makes Let's Encrypt secure?

Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every ...
0 votes
1 answer
1k views

Certificate Revocation with intermediate CAs - combine CRLs?

I use Nginx for client-side authentication. Only the SSL-certificates from the User CA should have access to the application. The CA hierarchy: Root CA | Intermediate CA | User CA So ...
3 votes
2 answers
3k views

What is Trusted Credentials in mobile phones?

My phone is encrypted and i was just playing with the configuration and just found a Trusted Credentials that got me curious on what it is and specially in one called Government Root Certification ...
0 votes
1 answer
100 views

How to resolve an issue with potential mismatch between device certificate and CA certificate?

I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
0 votes
2 answers
3k views

What is the difference between a signed CSR and a leaf certificate?

When creating certificates with the step CLI I have the option to create a leaf certificate for a certain subject or sign a certificate signing request (CSR). I could not really determine a difference ...
0 votes
1 answer
557 views

What is default_crl_days in OpenSSL and recommended days?

I'm new and I'm trying to understand default_crl_days. The default is 30 days thus does it mean after 30 days, the CRL list can no longer be trusted? If so, do we need to generate a new list before 30 ...
0 votes
0 answers
81 views

Are sections in openssl config file case sensitive?

I'm reading this and it has the below (excerpt). # Certificate Authority Section [ ca ] default_ca = CA_default # The default CA section # Default CA configuration to ...
1 vote
2 answers
148 views

Can certificate signing requests be stored at the server to prolong existing certificates?

I want to build a PKI (public key infrastructure) to host certificates for users. My use case is, that I want to use the certificates for e2e encryption between the users. Users must be able to ...
0 votes
0 answers
978 views

How does automatic SSL certificate renewal work without having access to the private key?

From GoDaddy's Renewing my SSL Certificate docs (emphasis mine): If you’re using a Domain Validation (DV) certificate with the primary domain for your account, and you’ve set the certificate to auto-...
0 votes
1 answer
109 views

Detect invalid cert Android client if URL being redirected to a fake server [duplicate]

Here is the scenario: Server A is an authentic server (A.com). Server F is a fake server (F.com) that also has a valid cert for F.com has a copy of A.com certificate to it (to fake as A.com). Client ...
7 votes
3 answers
3k views

How do I actually air gap my CA computer?

I remember reading about the necessity of air gapping the CA computer (never connecting it to any network whatsoever, no USB dongles etc). I am preparing for setting up a number of certificates (...
0 votes
1 answer
126 views

Can we move a PKI-as-a-service to own managed PKI server? [closed]

I'm a noob in PKI stuff. But if we were to subscribe to a PKI cloud service, could we move our root CA and other PKI stuff to our own PKI infrastructure once I'm ready to manage it ourselves?
0 votes
0 answers
67 views

Can you sign a TLS root certificate that already exists? [duplicate]

Alice and Bob have TLS certificate authorities. My device trusts Alice's CA, and connects to servers that present a certificate rooted at Alice's CA. It does not explicitly trust Bob's CA, or the ...
0 votes
1 answer
146 views

Is setting up a CA server necessary when all I want is to test HTTPS for a web project on localhost?

This freeCodeCamp article recommends setting up a CA server, installing the CA root certificate file into the system's trust store, and generating a leaf certificate for the project's web server. ...
1 vote
4 answers
228 views

Ingress client certificate authenticate requires CA certificate to be stored in secret?

I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...
1 vote
1 answer
208 views

What is the role of a CA server in a PKI?

I'm confused how the CA server helps with the digital signature and the PKI workflow. Here's an example topology: A and B are the 2 devices using PKI to authenticate each other for VPN, and then there ...
48 votes
5 answers
102k views

How to know if certificate is self-signed

How do I find out if a certificate is self-signed or authorized by CA? Somewhere I read that self-signed subject and issuer will be same, is it correct?

1
2 3 4 5
26