Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

4
votes
3answers
9k views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...
0
votes
0answers
32 views

Line jump with openssl s_client -connect command when using CAfile

I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect ...
0
votes
1answer
122 views

Why isn't free software signed with self-signed certificates? [duplicate]

A majority of free software (in particular, Linux ports for Windows) are not signed. As I understand it, it is quite easy to create a self-signed CA, and sign the software. Distribution would be ...
1
vote
1answer
62 views

Where do TLS clients fetch intermediate CA certificates from? [duplicate]

When I use my browser (a TLS client) to navigate to a secure web page (e.g. https://example.com), during the TLS handshake, the browser will receive an end-entity certificate from the web server of ...
0
votes
0answers
67 views

Government Root CA installed on computer/browser and Man-In-The-Middle [duplicate]

Some countries already have their government Root CA installed on computer/browsers. Is it possible for these countries to read Google etc. mails by using Man-In-The-Middle or similar technique(s)?
0
votes
1answer
45 views

Risk of issuing a client-certificate for every user in application level

I'm currently working on a project that includes client-authorization using client certificates, where my app is the Certificate Authority. Doing that, every user that registers to my web server gets ...
1
vote
1answer
49 views

Windows certificate manager imports a SHA256 root CA certificate as SHA1

I generated the root CA test cert using: makecert -a sha256 -n "CN=RootCATest" -r -sv RootCATest.pvk RootCATest.cer I've imported this root CA certificate on another machine (Win Server 2019, ...
0
votes
0answers
64 views

SSL handshake: Client Hello and Server Hello

I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy. This is my topology:...
1
vote
1answer
94 views

Can you whitelist a single CA for a domain?

Simply: For my domain (say example.com), I want my computer to only trust HTTPS certs signed by my personal CA, and ONLY my personal CA. Otherwise any one of the CAs I have on my computer could ...
0
votes
1answer
83 views

Signature of a root certificate - CA authority

Created a root certificate(cacert.pem) and tried viewing the content to primarily understand the contents of certificate, mainly the signature appended to certificate. Below is the text output of ...
2
votes
1answer
64 views

SSL/TLS certifcate secure on Chrome but not on Firefox

My organization have emitted TLS certificate for Https. It appears as secure when I access the page with Chrome but non secure with FireFox. Is there a difference between these two browsers about how ...
2
votes
2answers
116 views

Why is openssl complaining that my certificate chain is self-signed?

I am trying to set up a certificate chain for a lab server. I have created my own root CA, an intermediate CA and a server certificate. I supplied these certificates along with the server key to the ...
1
vote
0answers
90 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
-9
votes
2answers
131 views

Why does everyone assume 'https' is secure? [duplicate]

Why are they certificate authorities? What do they do that ensures the information is 'secure'? I know that they verify if a 'certificate' is from a 'trusted' source but who decides which sources are '...
1
vote
2answers
132 views

How are UUIDs assigned in P2P protocols

I am learning about P2P in general (mainly blockchain). I know many P2P protocols uses a distributed hash table for node lookup (kademlia) that maps UUIDs of nodes to their addresses. I am curious ...
3
votes
1answer
615 views

Certificate Transparency Android

For iOS-Apps, it is possible to use Certificate Transparency as stated here. We are developing native Apps for the different mobile platforms and are discussing to establish a more secure way of ...
4
votes
1answer
239 views

Why do VPN Providers ask for installation of Root CA?

I've seen a lot of VPN providers and they all seem to agree on one thing: ask user to install their own Root CA. I don't get why they do it. A legit server should have a certificate generated by ...
72
votes
5answers
29k views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
0
votes
0answers
25 views

How to map the “CA issued certificate” to a user in AD?

I'm trying to perform certificate-based WiFi authentication. I've set up the CA and by using the SCEP Challenge Password, I'm able to get the certificate. But I need to map this issued certificate to ...
0
votes
0answers
24 views

CA issued certificates maps to the wrong user in AD

I'm doing certificate-based authentication using windows server 2012. I've set up the CA, NDES and now, when I request a certificate using the SCEP Challenge password, I'm able to receive the ...
4
votes
2answers
80 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
1
vote
1answer
75 views

What happens if the private key of a Trusted Timestamp Authority is compromised?

what happens if the private key certificate of a Trusted Timestamp Authority used to sign the timestamps is compromised? If this private key certificate is changed, should all timestamps be re-signed ...
1
vote
1answer
65 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
0
votes
2answers
73 views

Can a DV CA issue IP certificate

I understand that according to CA/B, CA can issue certificate to a public IP address if the validation challenge is satisfied. But can a DV CA issue IP certificates? (If their CA policy allows) Does ...
0
votes
1answer
98 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
0
votes
0answers
20 views

Certificate Validation with SDS enabled on Ingress Gateway and mode set to MUTUAL

I have been having some difficulty understanding the mechanism by which certificates are validated by either party in a mutual TLS handshake. I have SDS enabled on my ingress gateway(s) and the ...
1
vote
1answer
71 views

Certificate Policies & Certificate Practice Statements - Destroying Vs. Archiving CA's Private Keys (HSMs)

Please Consider: English is my second language. Background I have been looking at different CP/CPS on the web. They all seem to roughly follow the same practices. However, two different policies ...
5
votes
1answer
379 views

What happened with Kazakhstan's Root CA MITM policy?

In 2015 there were news that Kazakhstan was going to start intercepting all HTTPS traffic via "man-in-the-middle attack" starting Jan 1, 2016, by requiring kazakhstanis to install their root CA. ...
5
votes
2answers
8k views

TLS-RSA vs TLS-ECDHE-RSA vs static DH

I understand there are a lot of articles explaining this subject and, before I post my question, this is my current understanding about it: ECDHE-RSA = The server randomly generates a DH-key pair ...
2
votes
2answers
115 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
2
votes
1answer
568 views

How to add a custom CA to androids trusted root system folder

As of Android 7.0 no custom certificate will be used by android apps. App developers need to specifically write codes and change app settings to follow a custom CA. But this is difficult while ...
6
votes
1answer
16k views

OpenSSL “unable to get local issuer certificate” even when passing in the Certificate Authority

I've attempted to setup a certificate authority, and issue a certificate from that authority (with no intermediate inbetween The authority covers *.node.consul, and the certificate is underneath that ...
1
vote
0answers
39 views

same CA, same CN [duplicate]

Can you order several certs from the same CA, in which only the DN differs, but the CN is the same? Will they accept a second request for the same CN or maybe then put the first cert on the ...
3
votes
1answer
139 views

Why does SSL EV certification have a range of encryption (40-128 bit)?

I would like to get SSL-EV certification for my company website. After comparing a list of providers, I am confused by their advertisements. Why do all providers say that their certifications support ...
4
votes
3answers
2k views

When should I renew certification authority?

What is best practice in renewing certification authorities? I mean when should I renew certification authority? For example, suppose I have the following setup: 1. Root CA with validity of 30 years ...
0
votes
1answer
81 views

Do I need my own server for signing certificates?

Sorry for any confusion with this question. I'm not even sure exactly what I'm asking. So what I'm trying to do is reverse-engineer an android app, and then building a python program on my Windows PC ...
1
vote
0answers
62 views

implementing a CA and a CSP

We are in the process of implementing a CA and a CSP for our organization. I came across these issues while implementing. Can the CA and CSP be owned by the same party? Will there be a conflict of ...
1
vote
1answer
192 views

How is a certificate extension different from a certificate file name extension?

The following article has explained both differently. X.509 wiki Now my question is: Can we use more than one extension in a certificate? Is it how there can be more than one use of extensions in a ...
0
votes
1answer
236 views

ACME protocol without LetsEncrypt, using dedicated CA [closed]

I have a question about the ACME protocol without using LetsEncrypt, and using our dedicated CA instead. Can anyone enlighten me what should I consider in my client-server application which ...
0
votes
2answers
108 views

How can we trust a CA?

During the SSL/TLS handshake we are checking the authentication of the client and the server. During this process certificate chain also comes into the picture to trust/complete the certificate chain....
2
votes
1answer
60 views

Is it OK to set SSL fullchain to service

Imagine service with SSL-server authentication. There are 3 certificates in chain: Root CA certificate; Intermediate CA certificate; Host certificate. Is it ok to put all 3 certificates (fullchain) ...
1
vote
1answer
420 views

Android Root Certificate Issue

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But ...
0
votes
2answers
3k views

How does a client use the Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service?

According to a the technet articles: The Certificate Enrollment Web Service is an Active Directory Certificate Services (AD CS) role service that enables users and computers to perform ...
3
votes
1answer
260 views

Symantec rooted certificates trust and Oracle Java trust store, is Oracle planing to remove trust as well?

We are using Symantec CA rooted certs to sign JARs. Since Google and Mozilla have indicated that they are not trusting Symantec CA, should I be concerned that Oracle will remove trust from Symantec CA ...
0
votes
1answer
46 views

ADCS two tier PKI

Planning a two tier ADCS PKI infrastructure as follows: ORCA ____________|____________ | | | SCA1 SCA2 SCA3 one.int two.int three.int ...
-1
votes
1answer
289 views

Why don't CAs sell certificates as files, instead of hardware or as a service?

I'm trying to purchase multiple certificates, some just signing, some just encrypting, and some a combination of the two. I wanted to purchase one signed by a CA, rather than using a self-signed one. ...
2
votes
1answer
127 views

Duplicate subject names for intermediate and root certificates

I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates. They issue multiple root certificates and intermediate ...
0
votes
0answers
30 views

authenticating SSL client certificates on server

current setup: i have a pki setup which issues client certificates to the users (so that only clients with the certificate can access the web application). was looking for ways to implement this and i ...
0
votes
1answer
55 views

How to make sure certifi python package is up to date

In python's requests module documentation, I find this important recommendation: For the sake of security we recommend upgrading certifi frequently! Q: How can I make sure that my system's certifi ...
7
votes
3answers
12k views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...