Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
93 votes
4 answers
86k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?

(Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
SecurityNoob's user avatar
  • 1,041
90 votes
12 answers
18k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
makerofthings7's user avatar
40 votes
9 answers
40k views

How does SSL/TLS PKI work?

We have lots of questions that address portions of SSL/TLS as it relates to PKI, but none of them seem to bring everything together. A canonical answer that we can point people to I think would be ...
RoraΖ's user avatar
  • 12.5k
38 votes
3 answers
23k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
Novice User's user avatar
  • 2,108
144 votes
14 answers
48k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
Luke Sheppard's user avatar
262 votes
7 answers
51k views

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
lynks's user avatar
  • 10.7k
97 votes
10 answers
38k views

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
sharptooth's user avatar
  • 2,241
87 votes
5 answers
39k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
Kyle Rosendo's user avatar
  • 4,025
77 votes
7 answers
16k views

What makes Let's Encrypt secure?

Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every ...
user253751's user avatar
  • 4,901
22 votes
6 answers
19k views

Is it possible for corporation to intercept and decrypt SSL/TLS traffic? [duplicate]

I found there are some companies claim that they offer service that can eliminate SSL/TLS blind spot, such as Blue Coat and Gigamon. Are they talking about some way of decipher the https content (...
Peter Li's user avatar
  • 321
69 votes
4 answers
110k views

How does the digital signature verification process work?

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
n92's user avatar
  • 881
48 votes
5 answers
22k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
IMB's user avatar
  • 2,968
31 votes
3 answers
9k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
makerofthings7's user avatar
30 votes
4 answers
26k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
makerofthings7's user avatar
9 votes
3 answers
2k views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude lower&...
cnst's user avatar
  • 1,964
61 votes
2 answers
17k views

Can I restrict a Certification Authority to signing certain domains only?

Is it possible to create a CA certificate (even unsigned), which is only allowed to sign certificates for specific limited domain(s), so that it can't be misused for other domains?
Smit Johnth's user avatar
  • 1,781
27 votes
4 answers
3k views

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
Caesar's user avatar
  • 484
19 votes
1 answer
8k views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
Simon Fromme's user avatar
14 votes
5 answers
11k views

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
AnonSmith's user avatar
  • 141
2 votes
1 answer
308 views

If an adversary took over a major Certificate Authority, what bad things could they do?

If an adversary took over a major Certificate Authority, what bad things could they do? Aside from the obvious attacks, what could they do in the context of the Public Key Infrastructure as a whole?
Brooney's user avatar
  • 63
22 votes
2 answers
2k views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
unor's user avatar
  • 1,779
22 votes
3 answers
6k views

What are the risks of a Certificate Authority hack for 'the average user'?

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
beetstra's user avatar
  • 415
18 votes
5 answers
9k views

Multiple CAs signing a single Cert/CSR?

Just saw this suggested on Slashdot So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea to ...
scuzzy-delta's user avatar
  • 9,343
8 votes
2 answers
2k views

Why is it fine for certificates above the end-entity certificate to be SHA-1 based?

I have heard about the phasing out of SHA-1 based certificates for end entity use, and the steps that are outlined for Google Chrome to display progressively more aggressive warnings for SHA-1 ...
Breakhty's user avatar
  • 367
5 votes
2 answers
2k views

Are there other roots of trust on my computer aside from these 46 root certificates?

I've heard many people imply that modern browsers and OSes trust a myriad of root certificates. The implication is that it is impossible to ensure the private keys of all of the root certificates ...
alx9r's user avatar
  • 569
41 votes
5 answers
28k views

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
user53029's user avatar
  • 2,737
41 votes
4 answers
62k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
Imran Azad's user avatar
19 votes
2 answers
29k views

SSL certificate chain verification

After reading many articles and watching many tutorials I decided to be specific because there are some things about SSL certificate chain verification and SSL cetificate verification in general that ...
Aviel Fedida's user avatar
4 votes
3 answers
4k views

What differentiates a CA cert from a server cert? [duplicate]

From what I can gather, as long as a client trusts a particular CA root, and a server produces a valid chain that leads up to it, the client will trust the server's cert. This only makes sense if the ...
A_P's user avatar
  • 143
178 votes
4 answers
25k views

Is there anything preventing the NSA from becoming a root CA?

There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference. While there have been attempts ...
user2813274's user avatar
  • 2,071
142 votes
8 answers
16k views

How do I report a security vulnerability about a trusted certificate authority?

I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers. Specifically, I am able to get a valid signed certificate for a domain ...
MotorStoicLathe's user avatar
57 votes
8 answers
150k views

Why are self signed certificates not trusted and is there a way to make them trusted?

I have locally made a Root CA certificate. I used the CA cert to sign the IA cert and used the IA cert to sign the server certificate. When I try to access the local server which uses the server ...
Praz's user avatar
  • 595
47 votes
2 answers
81k views

What is the actual value of a certificate fingerprint?

In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
Ashwin's user avatar
  • 1,657
37 votes
6 answers
31k views

Where to get an SSL certificate for personal website?

I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
tkit's user avatar
  • 3,352
26 votes
1 answer
34k views

Configure SSL Mutual (Two-way) Authentication

A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
SafeY's user avatar
  • 371
23 votes
2 answers
4k views

How much of a problem is it that Windows "hides" some of the trusted root CA certs?

Based on information on this page, Windows actually trusts many more root CA certificates than what are displayed when a user launches certmgr.msc and navigates to Trusted Root Certification ...
SherlockEinstein's user avatar
20 votes
8 answers
25k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
sudhacker's user avatar
  • 4,320
19 votes
3 answers
2k views

Why are CA-issued certificates considered so much more secure than self-signed certificates

I looked at other Stack Exchange posts explaining why self-signed certificates are not as secure as CA-issued certificates, and most of these pages say the same thing: If it's self-signed, and the ...
elipoultorak's user avatar
14 votes
2 answers
11k views

How to become an internationally recognized certificate authority (CA)?

What's the procedure a certificate authority (CA) must follow to get internationally recognized, like Verisign or GlobalSign?
musashi's user avatar
  • 157
13 votes
3 answers
4k views

What kind of certificate do I need to be able to sign my own subdomain certificates?

We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...). ...
johndodo's user avatar
  • 1,905
11 votes
3 answers
22k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (...
user avatar
10 votes
3 answers
7k views

How can CloudFlare provide a valid SSL certificate for domains not under its control?

CloudFlare provides a reverse proxy, and it offers SSL support ("flexible", "full", "strict full", and "keyless"). How does CloudFlare manage to get a valid certificate for domains it does not own? ...
Flimm's user avatar
  • 1,280
10 votes
1 answer
23k views

Should the thumbprint be SHA2 in addition to the Signature Hash Algorithm?

I'm looking at a Windows PKI and see that the Thumbprint is SHA1, while the Signature is SHA2 (SHA256). Is this an acceptable configuration? Should I recommend that the client update to SHA2 for a ...
makerofthings7's user avatar
7 votes
2 answers
3k views

Can a SSL Certificate dictate protocol?

I know you can set the protocol/cipher via your web server: Nginx: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; Apache: SSLProtocol all -SSLv2 SSLCipherSuite ...
Arian Faurtosh's user avatar
75 votes
1 answer
17k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
microwth's user avatar
  • 2,473
40 votes
2 answers
32k views

Is it safe to send SSL certificates via email?

I just ordered a cheap Comodo PositiveSSL Certificate via a UK reseller, and I was rather surprised to find that the following files were emailed to me automatically, in a zip file: Root CA ...
halfer's user avatar
  • 831
39 votes
3 answers
15k views

Why is it more secure to use intermediate CA certificates?

I've read that using Intermediate CA certificates is more secure because this way the Root CA is offline. So, if the Intermediate is compromised it does not impact the Root CA. What I understand is ...
sebelk's user avatar
  • 509
36 votes
4 answers
7k views

Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?

By my admittedly limited understanding of how HTTPS/TLS works, the end user (me) initiates a connection with a remote server which signs every one of its messages with a public key. This public key ...
Dan's user avatar
  • 769
35 votes
5 answers
8k views

Are self-signed certificates actually more secure than CA signed certificates now?

Are self-signed certificates actually more secure than CA signed certificates now? I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government ...
elysium7's user avatar
  • 351
33 votes
3 answers
9k views

Can a wildcard SSL certificate be issued for a second level domain?

Something like *.com or *.net? How about *.edu.au? The RFC 2818 does not say anything about this topic.
Nam Nguyen's user avatar
  • 1,470

1
2 3 4 5