Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

3
votes
1answer
135 views

Why does SSL EV certification have a range of encryption (40-128 bit)?

I would like to get SSL-EV certification for my company website. After comparing a list of providers, I am confused by their advertisements. Why do all providers say that their certifications support ...
4
votes
3answers
2k views

When should I renew certification authority?

What is best practice in renewing certification authorities? I mean when should I renew certification authority? For example, suppose I have the following setup: 1. Root CA with validity of 30 years ...
0
votes
1answer
81 views

Do I need my own server for signing certificates?

Sorry for any confusion with this question. I'm not even sure exactly what I'm asking. So what I'm trying to do is reverse-engineer an android app, and then building a python program on my Windows PC ...
1
vote
0answers
56 views

implementing a CA and a CSP

We are in the process of implementing a CA and a CSP for our organization. I came across these issues while implementing. Can the CA and CSP be owned by the same party? Will there be a conflict of ...
1
vote
1answer
176 views

How is a certificate extension different from a certificate file name extension?

The following article has explained both differently. X.509 wiki Now my question is: Can we use more than one extension in a certificate? Is it how there can be more than one use of extensions in a ...
0
votes
1answer
225 views

ACME protocol without LetsEncrypt, using dedicated CA [closed]

I have a question about the ACME protocol without using LetsEncrypt, and using our dedicated CA instead. Can anyone enlighten me what should I consider in my client-server application which ...
0
votes
2answers
91 views

How can we trust a CA?

During the SSL/TLS handshake we are checking the authentication of the client and the server. During this process certificate chain also comes into the picture to trust/complete the certificate chain....
2
votes
1answer
53 views

Is it OK to set SSL fullchain to service

Imagine service with SSL-server authentication. There are 3 certificates in chain: Root CA certificate; Intermediate CA certificate; Host certificate. Is it ok to put all 3 certificates (fullchain) ...
1
vote
1answer
391 views

Android Root Certificate Issue

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But ...
0
votes
2answers
2k views

How does a client use the Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service?

According to a the technet articles: The Certificate Enrollment Web Service is an Active Directory Certificate Services (AD CS) role service that enables users and computers to perform ...
3
votes
1answer
250 views

Symantec rooted certificates trust and Oracle Java trust store, is Oracle planing to remove trust as well?

We are using Symantec CA rooted certs to sign JARs. Since Google and Mozilla have indicated that they are not trusting Symantec CA, should I be concerned that Oracle will remove trust from Symantec CA ...
0
votes
1answer
29 views

ADCS two tier PKI

Planning a two tier ADCS PKI infrastructure as follows: ORCA ____________|____________ | | | SCA1 SCA2 SCA3 one.int two.int three.int ...
2
votes
1answer
137 views

Why do VPN Providers ask for installation of Root CA?

I've seen a lot of VPN providers and they all seem to agree on one thing: ask user to install their own Root CA. I don't get why they do it. A legit server should have a certificate generated by ...
-1
votes
1answer
136 views

Why don't CAs sell certificates as files, instead of hardware or as a service?

I'm trying to purchase multiple certificates, some just signing, some just encrypting, and some a combination of the two. I wanted to purchase one signed by a CA, rather than using a self-signed one. ...
2
votes
1answer
81 views

Duplicate subject names for intermediate and root certificates

I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates. They issue multiple root certificates and intermediate ...
0
votes
0answers
26 views

authenticating SSL client certificates on server

current setup: i have a pki setup which issues client certificates to the users (so that only clients with the certificate can access the web application). was looking for ways to implement this and i ...
0
votes
1answer
32 views

How to make sure certifi python package is up to date

In python's requests module documentation, I find this important recommendation: For the sake of security we recommend upgrading certifi frequently! Q: How can I make sure that my system's certifi ...
7
votes
3answers
11k views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
0
votes
1answer
47 views

Should CRLs be published for Standalone Offline Root CA?

I'm setting up a two tier PKI Hierarchy in our Windows Server 2012 R2 domain. A number of tutorials suggest that the root CA should publish its CA certificate and CRL in Active Directory and via HTTP,...
3
votes
1answer
86 views

When accepting an SSL certificate, can I limit for which domains I accept it?

Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
0
votes
2answers
66 views

Signing webhooks with asymmetric keys

I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography). What is the recommended or ...
0
votes
1answer
29 views

How to automate publication of CRL and CRT files to CDP and AIA location?

I'm setting up Two-Tier PKI for the first time in our Windows Server 2012 R2 environment and I've read several tutorials on setting this up. Some of the methodology is very different, but I've chosen ...
0
votes
1answer
58 views

PKI - CRL and OCSP

I've done quite a bit of reading about PKI in ADCS and CRL/OCSP, but I can't seem to find an answer to a small couple of questions I still have: It is clear to me that even with OCSP in place, you ...
0
votes
2answers
502 views

Should all Server Certificates from one CA have the same CRL

I am setting up my own PKI, and I came across a question to which I couldn't find an answer. I want to specify CRLDistributionPoints in my server certificates but I am curious whether to use the same ...
1
vote
0answers
40 views

CA signature Algorithm: sha256WithRSAEncryption or ecdsa-with-SHA256

I need to update a CA that is about to expire, currently is using Signature Algorithm 256WithRSAEncryption and I am thinking in using ecdsa-with-SHA256 with something like: openssl req -x509 -nodes -...
1
vote
2answers
76 views

What are the risks of installing a CA on the same machine as OpenVPN server?

Digital Ocean states in one of it's tutorial about OpenVPN server : While it’s technically possible to use your OpenVPN server or your local machine as your CA, this is not recommended as it ...
2
votes
1answer
52 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
38
votes
3answers
20k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
10
votes
2answers
2k views

How can a domain be impersonated with a fraudulent SSL certificate?

I was reading this article about the fraudulent certificates from Comodo back in 2011. It talks about domain impersonation. I understand that a fake website could be secured with the fraudulent ...
2
votes
1answer
66 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
0
votes
0answers
24 views

Whether cipher suites is related to public key certificate? [duplicate]

I want to use TLS version 1.2 and Authenticated Encryption with Associated Data (AEAD). Can a public key certificate obtained from a certification authority specify which of the ciphers I can use? ...
2
votes
1answer
52 views

Why CA's baseline requirement have 22 on Authorized ports while there is no allowed way to use it?

while reading Baseline Requirement for Public CA I noticed something. 1. Authorized Ports: One of the following ports: 80 (http), 443 (http), 25 (smtp), 22 (ssh). this includes port 22 and ...
45
votes
4answers
81k views

How does the digital signature verification process work?

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
1
vote
1answer
45 views

Getting VPN users to trust a non-global Root Certificate Authority on Windows in order to use TLS on intranet websites

Consider the following scenario, keeping in mind the restrictions: Your goal is to secure intranet-only web applications to start using https - so you need a certificate issued, so you can bind ...
2
votes
3answers
68 views

SSL authentication unexpectedly failing - could this be caused by SSL Inspection/Fortinet?

I'm dealing with an SSL issue that's been plaguing me for several days. I know relatively little about security, so if anyone here could lend a helping hand I would be extremely grateful. Ultimately ...
0
votes
0answers
201 views

Specify Subject Alt Names in OpenSSL CA

I know you can use -addext with openssl req..... but, are you able to do that with openssl ca....? I would like to be able to add Subject Alternative Names with only one command without having to edit ...
0
votes
1answer
33 views

truststore and intermediate certificates

We have a situation where our on premise product talks to a third party external API over SSL. This API has a certificate which is issued by an intermediate. We use the default java cacerts truststore,...
9
votes
1answer
2k views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
1
vote
0answers
82 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
0
votes
0answers
37 views

How can I create a self-signed certificate with a custom field? [duplicate]

For experiment, I want to add a custom field in a TLS certificate then validate it. Because it is experiment, it will be a self-signed certificate. I use OpenSSL 1.1.0g and Ubunut 18.04. Any hint will ...
0
votes
0answers
42 views

How to check if installed Trusted CAs are not dangerous? [duplicate]

I've checked my Windows 7 installed Trusted Certificate Authorities using MMC tool as below: Questions are: How can I be sure that they are genuine and are installed by Microsoft and not by a third-...
1
vote
1answer
96 views

How do I validate a certificate by hand?

I have a website, which has a signed certificate file (website.crt) from a certificate authority (CA). How do I make sure exactly, that this certificate is valid? I know, that browsers do it ...
1
vote
0answers
243 views

Use self-signed certificate inside of Docker Container for localhost

I've created a self-signed certificate for localhost to use https. I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
0
votes
0answers
105 views

What is a reasonable default_crl_days value for OpenVPN CLR? Why?

I am having trouble finding a definitive answer (with a rationale) on what a reasonable default value for default_crl_days (in openssl.cnf) for use with OpenVPN. The current default is 30 days. But ...
2
votes
1answer
92 views

Is it more secure to set a DNS CAA record to a non-existing CA?

A CAA allows specifying which Certificate Authorities are authorized to issue a certificate for my domain. For example example.com. CAA 0 issue "symantec.com" will only allow Symantec to issue ...
2
votes
1answer
77 views

What does a Let's Encrypt (or other DV) certificate prove?

This is a follow-up to other questions like "What makes Let's Encrypt secure?". When I first run the Let's Encrypt (certbot) client on my server, it obtains a certificate by publishing a certain file ...
0
votes
2answers
63 views

How to approach 2 tier PKI RSA Root CA with subordinates that should support ECDSA

I have a situation for which I am not sure how to approach it. Basicialy I need to find out if it is possible how to issue ECDSA Certificates with a RSA Root Certificate. Is this possible? and how ...
0
votes
0answers
60 views

Windows CA with HSM

Having some trouble finding documentation open on the web on this so I’m asking for help here. When using a HSM (Gemalto G5) for a windows CA is the private key ever exposed to the windows server at ...
0
votes
2answers
58 views

Is the root certificate issued from one Certificate Authority is same for all the requesting organisation?

Let me please explain the question a bit more through an example: There are lots of companies who have their certificates signed by Verisign (or any CA). I understand that Verisign signs these certs ...
0
votes
0answers
38 views

Renewing self signed SSL cert without updating client

I have a server and a single client. I have full control of both, the client is not a distributed application used by the public. For various reasons, I'm having the client use HTTPS to communicate ...