Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

98 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
0 answers
586 views

How does Chrome distrust Symantec Certificates?

Sometime back Google Chrome had announced plans to distrust Symantec certificates. I am trying to figure out how this is done for a POC. When I visit chase.com on Google Chrome, I get the following ...
Krishnaraj's user avatar
4 votes
0 answers
2k views

Use self-signed certificate inside of Docker Container for localhost

I've created a self-signed certificate for localhost to use https. I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
kloppo's user avatar
  • 43
3 votes
2 answers
562 views

Is it a good idea to reuse certificate issued by public CA for internal database client authentication?

Let's say we have: Publicly available HTTPS API (e.g. api.example.com). The web server that runs it uses a certificate from a publicly trusted CA (e.g. Let's Encrypt) with both server auth and client ...
Alexander's user avatar
3 votes
1 answer
976 views

How to set up certificate architecture for on-premise server-client application

We are currently shipping a product to our customers that is server-client-based running on Windows server 2016 (server) and Windows 10 (clients). The server is installed on-premise in our customer's ...
Juergen's user avatar
  • 31
3 votes
0 answers
692 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
feluna's user avatar
  • 31
3 votes
0 answers
609 views

How does a Sign tool work?

My basic understanding of how a sign tool works is: Load the zip-file (may be exe, jar, ddl, apk, etc.) which has to be signed to its memory (cache memory of the sign tool). Verify it and unzip the ...
Goutham Nithyananda's user avatar
3 votes
1 answer
198 views

Certificate Policies & Certificate Practice Statements - Destroying Vs. Archiving CA's Private Keys (HSMs)

Please Consider: English is my second language. Background I have been looking at different CP/CPS on the web. They all seem to roughly follow the same practices. However, two different policies ...
user avatar
2 votes
0 answers
50 views

Requesting an user-specific certificate in a tiered domain

Environment: A multi-tiered Active Directory (AD) where tier-specific admin accounts are restricted to log on to only their tier servers. Microsoft's Certificate Services (CS). Let's say the CA tier ...
Ramil's user avatar
  • 21
2 votes
0 answers
217 views

What are the risks of trusting a certificate that is not logged in CT logs?

A website that I do banking on has a login page on a different subdomain than their main website, and this login page is secured with an Amazon-issued domain-validation certificate (their main website ...
huanglx's user avatar
  • 175
2 votes
0 answers
5k views

SSL routines:ssl3_read_bytes:sslv3 alert bad certificate

Running the following command: curl -v --key client_key.key --cert client_cert.crt <some url> -u <username> I get the following response: * Trying XX.XXX.XXX.X... * TCP_NODELAY set * ...
Hurricane's user avatar
  • 121
2 votes
2 answers
1k views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
bretonics's user avatar
  • 121
2 votes
2 answers
1k views

Android Root Certificate Issue

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But ...
Leroy Tam's user avatar
2 votes
0 answers
928 views

ways to check a certificate fingerprint against known logs

Suppose I have a certificate sha-256 fingerprint, which I can obtain say visiting the relevant domain in firefox or from a shell script using openssl, and i want to verify this fingerprint. one option ...
jj_p's user avatar
  • 379
2 votes
0 answers
127 views

How can I create a verifiable signature for a digital transaction?

I am currently working on creating a digital signature pad that customers can sign instead of a traditional paper receipt for credit card transactions. Currently I have the ability for them to sign a ...
Trent Walls's user avatar
2 votes
0 answers
158 views

Windows NPS: Policy should check Issuing CA

I have some trouble in configuring a Windows NPS, maybe anybody of you have an idea. Is it possible for NPS to check whether a client certificate was signed by a specific issuing CA? I have two ...
Rene's user avatar
  • 81
2 votes
0 answers
332 views

Security Concerns of importing SharePoint Root Authority to Trusted Root Certification Authorities store

We are experiencing slowness because of SharePoint's STS certificate CRL checking. This is a known issue and there is a Microsoft Workaround for it: https://support.microsoft.com/en-us/kb/2625048 The ...
A. Uriarte's user avatar
2 votes
0 answers
809 views

Client authentication using the pfx not working

I have a requirement to generate the client certificates(pfx) files from another server certificate which are provided by a CA. Firstly I tested the following based on http://www.jayway.com/2014/09/...
rahulmr's user avatar
  • 121
2 votes
0 answers
213 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
Tinclon's user avatar
  • 121
2 votes
1 answer
1k views

Chrome Internal Certificate Authority List for SSL + EV

Chrome specifies that it maintains a internal "hard-coded" list of root certificates that are "EV-Qualified". https://www.chromium.org/Home/chromium-security/root-ca-policy#TOC-Extended-Validation-...
Matt Klooster's user avatar
1 vote
0 answers
56 views

Other benefits of creating my certificate authority aside from the firefox issue and centralized management of certificates?

I've been trying to read more about self-signed SSL certificates versus creating my own certificate authority to sign SSL certificates. I am still not completely clear on this. I'll start by ...
learningtech's user avatar
1 vote
0 answers
209 views

SSL Certificates signed by our CA show as invalid in browser

We're experiencing an issue, where SSL server-certificates issued by our own internal PKI will show as invalid in the browser, when accessing the site. The error is NET::ERR_CERT_INVALID (Tested in ...
AssistantTOtheCA's user avatar
1 vote
0 answers
69 views

Support for domain-specific root CAs in X.509 certificate format, OS and browsers

Chance is one gets an invalid certificate warning when one follows this link https://www.cnss.gov. As explained there (same warning) this is on purpose, and the solution is supposed to be to install1 ...
fgrieu's user avatar
  • 1,231
1 vote
1 answer
104 views

Certification path building for 509 certificates

To this date, is there a specification or a de-facto industry standard or how applications are supposed to perform certification path building in the context of X.509? I am specifically asking about ...
Nope's user avatar
  • 11
1 vote
0 answers
93 views

Best practice of x.509 client certificates accross multiple systems

I have several MongoDB's where I use x.509 Certificates to Authenticate Clients Let's say I create certificate and user for admin: subject: CN=admin issuer: CN=MongoDB Issuing CA -> db.createUser({...
Wernfried Domscheit's user avatar
1 vote
1 answer
684 views

HAProxy Trust only specific client certs for mutual

I am using HAProxy to perform Mutual TLS termination for my API. HAProxy has Mutual TLS enabled with "verify required" and a cert-auth file to restrict access to the Apache service that ...
ProfessorQuirrellsEarSweat's user avatar
1 vote
0 answers
125 views

Is it must to have "Key Usage" extension in the selfsigned root certificate?

I have gone through multiple questions but still I am confused. RFC X.509 also does not clarify it. Conforming CAs MUST include this extension in certificates that contain public keys that are ...
Ravindra12jan's user avatar
1 vote
2 answers
347 views

Why infamous Addtrust certificate is still not expired (same private key) for code signing?

As many of you know Addtrust certificate https://crt.sh/?id=1 expired 30 May 2020 as well as many other intermediate certs and now we have to update certs on many servers to either root cert https://...
Валерий Заподовников's user avatar
1 vote
0 answers
124 views

I need to make a PKI infrastructure, but i don't now how to segment my CA

I'm currently working on a project where we have to rethink a PKI architecture, but we don't know how to segment the different CA_SUBs, do you have any recommendations?
human_garbage's user avatar
1 vote
0 answers
16k views

TLS handshake failure (40) solved by removing intermediate certificate from server?

I'd like to better understand my workaround, and confirm that it's secure. Problem I have a crt file containing a root and intermediate certificate installed on my server (I have limited access to ...
Jayz7522's user avatar
  • 111
1 vote
0 answers
131 views

Certificate generation using Advanced Electronic Signature (AdES)

For a mobile application I would like to be so compliant as possible with the AdES standard. The mobile application will perform operations on behalf of the user, signing them first. A backend ...
crom87's user avatar
  • 143
1 vote
0 answers
193 views

Is SmartCard-HSM 4K good enough for WebTrust level Certificate Authority ROOT KEY storage?

Is SmartCard-HSM 4K USB token good enough for a WebTrust category CA's ROOT KEY storage or is a FIPS 140-2 level 3 certified device required? Are there any FIPS 140-2 level 3 certified USB token with ...
Glushiator's user avatar
1 vote
0 answers
407 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
Gerhardh's user avatar
  • 111
1 vote
0 answers
896 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
regress's user avatar
  • 19
1 vote
0 answers
866 views

CA signature Algorithm: sha256WithRSAEncryption or ecdsa-with-SHA256

I need to update a CA that is about to expire, currently is using Signature Algorithm 256WithRSAEncryption and I am thinking in using ecdsa-with-SHA256 with something like: openssl req -x509 -nodes -...
nbari's user avatar
  • 223
1 vote
0 answers
635 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
madaoislife's user avatar
1 vote
0 answers
114 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
pGrnd2's user avatar
  • 11
1 vote
0 answers
388 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
Fr_nkenstien's user avatar
1 vote
0 answers
290 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
Adam J. Wong's user avatar
1 vote
0 answers
76 views

Best way to back up locally stored Certificates

What is the best way to back-up all the locally stored certificates on Windows 7? An adware Trojan has installed fraudulent certificates as part of its payload. Before I alter anything, I want to ...
Inerva 's user avatar
1 vote
0 answers
94 views

MITM over TLS trust via convergence

I see some of the great benefits of (the now old) Moxie's Convergence or CM's Perspective. However, how do they fight the attack of a MITM sat in a common network path of both client and notary on the ...
user1156544's user avatar
1 vote
0 answers
175 views

How do I intercept packages in a Facebook application?

I can not listen to HTTPS traffic in the Facebook application through Fiddler and Burp. SSL-Pinning is disabled through SLL Kill Switch 2 (other applications such as Twitter, Snapchat with SSL-Pinning ...
Dmitrii Maslennikov's user avatar
1 vote
0 answers
1k views

Checking Intermediate Certificates Programatically

Nessus is reporting that an "SSL Certificate Cannot Be Trusted". This is due to the intermediate certificate not being in the certificate bundle presented during the TLS/SSL handshake. I've looked ...
SilverlightFox's user avatar
1 vote
0 answers
213 views

implementing a CA and a CSP

We are in the process of implementing a CA and a CSP for our organization. I came across these issues while implementing. Can the CA and CSP be owned by the same party? Will there be a conflict of ...
Techie's user avatar
  • 123
1 vote
0 answers
157 views

What are reasonable expire times for a certificate authority chain?

I'm creating a certificate authority for a network with a three level chain. level 1 level 2 level 3 leaf certs. I'm wondering what appropriate expire times are for each certificate in the chain. ...
Craig Lafferty's user avatar
1 vote
0 answers
810 views

Implementing Internal Certificate Authority

We're considering setting up an internal certificate authority to issue ssl certificates. The certificates would primarily be used to secure internal websites, but I could foresee us potentially ...
Brad's user avatar
  • 613
1 vote
0 answers
268 views

Should leeway be included in the NotBefore date of an X.509 certificate?

Which of these options are actually in line with standards? In software that generates SSL client certificates to hand out to client software for authentication into a closed system, should the ...
antak's user avatar
  • 131
1 vote
0 answers
1k views

Key usage not applied using Microsoft CA

I'm a bit of a newbie to Certificate signing, so please forgive any stupid questions I might have. I have a CSR, when I decode the CSR it cleary request the following key usages: Requested ...
Oliland's user avatar
  • 11
1 vote
0 answers
3k views

JAVA Deployment Ruleset with Self Signed Certificate

I have tried all ways to resolve an issue I have at one of the office sites I look after.The problem is that a deployment rules set was signed previously with a certificate that has now expired so I ...
Gadget1st's user avatar
1 vote
0 answers
474 views

Are GeoTrust SHA-256 intermediate chain and cross-root legacy support, mutually exclusive?

I have purchased a GeoTrust TrueBusiness ID SHA-256 with EV SSL Certificate. According to GeoTrust website, I must also install the corresponding intermediate certificate, which is "GeoTrust EV SSL ...
jotadepicas's user avatar
1 vote
0 answers
219 views

How to provide our customers ability to self service client certificate creation?

We have an API for B2B customers to access our platform. We require each B2B customer to have a client certificate. This is not the URL SSL certificate (https). The CN of each customer's client ...
user62974's user avatar