Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
259 votes
7 answers
48k views

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
user avatar
  • 10.6k
176 votes
4 answers
24k views

Is there anything preventing the NSA from becoming a root CA?

There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference. While there have been attempts ...
user avatar
  • 2,051
142 votes
14 answers
47k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
user avatar
140 votes
8 answers
15k views

How do I report a security vulnerability about a trusted certificate authority?

I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers. Specifically, I am able to get a valid signed certificate for a domain ...
user avatar
104 votes
3 answers
16k views

Why do we trust US Certificate Authorities? [closed]

Why do people trust companies in countries with big surveillance programs like the US? Many US Certificate Authorities secure the web for live SSL/TLS connections. Still, a NSL would be enough for ...
user avatar
94 votes
5 answers
53k views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
user avatar
93 votes
10 answers
36k views

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
user avatar
  • 2,151
90 votes
12 answers
17k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
user avatar
88 votes
4 answers
18k views

What prevents me from buying a SSL certificate for a domain I don't control?

Can I simply build a webserver, make its hostname "google.com", create a CSR off that server, and send that to a Certificate Authority for signing? Let's say I pick the cheapest and dodgiest outfit I ...
user avatar
  • 859
87 votes
5 answers
38k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
user avatar
  • 3,955
87 votes
4 answers
81k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?

(Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
user avatar
75 votes
7 answers
16k views

What makes Let's Encrypt secure?

Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every ...
user avatar
  • 3,875
74 votes
1 answer
17k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
user avatar
  • 2,101
68 votes
4 answers
104k views

How does the digital signature verification process work?

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
user avatar
  • 869
61 votes
4 answers
10k views

Is there a way to make sure my government does not swap out SSL certificates?

I was recently wondering whether there exists a way to make sure my government is not swapping out SSL certificates in order to intercept the traffic. I know almost all browsers are complaining in ...
user avatar
  • 681
60 votes
1 answer
19k views

How does my browser inherently trust a CA?

I am reading this post and not understanding the answer. The answer ends with the words ...your browser can verify one cert against the next, all the way to the root CA, which your browser ...
user avatar
  • 621
60 votes
2 answers
6k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
user avatar
  • 949
58 votes
2 answers
14k views

Can I restrict a Certification Authority to signing certain domains only?

Is it possible to create a CA certificate (even unsigned), which is only allowed to sign certificates for specific limited domain(s), so that it can't be misused for other domains?
user avatar
  • 1,709
56 votes
8 answers
114k views

Why are self signed certificates not trusted and is there a way to make them trusted?

I have locally made a Root CA certificate. I used the CA cert to sign the IA cert and used the IA cert to sign the server certificate. When I try to access the local server which uses the server ...
user avatar
  • 585
56 votes
7 answers
7k views

Can a CA decrypt HTTPS traffic?

My state has made a statement that in case my country will be disconnected from the world's CAs, it is necessary to install its own state certificates. In many forums, information has flashed that in ...
user avatar
47 votes
5 answers
21k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
user avatar
  • 2,878
45 votes
3 answers
4k views

Why do we not require websites to have several independent certificates?

It is often cited as a primary point of concern that a single compromised CA can make for significant damage, as all websites (and other entities) that rely on this CA cannot be trusted anymore. ...
user avatar
  • 705
41 votes
7 answers
5k views

Is there any legitimate reason to install yourself as a root CA?

Follow up from comments on another question. Is there any reason as to why you might install yourself as a root CA on your own network? The only reason I can think of is forcing computers in the ...
user avatar
  • 759
41 votes
3 answers
6k views

Why is the issuer certificate different at my workplace and at home?

I have viewed Gmail's certificate chain at my workplace, and I realised it's different. It looks like this: Root CA Operative CA1 ___________.net mail.google.com When I get the ...
user avatar
  • 655
41 votes
2 answers
62k views

What is the actual value of a certificate fingerprint?

In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
user avatar
  • 1,597
41 votes
4 answers
12k views

What alternatives are there to the existing Certificate Authority system for SSL?

Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
user avatar
  • 132k
40 votes
9 answers
38k views

How does SSL/TLS PKI work?

We have lots of questions that address portions of SSL/TLS as it relates to PKI, but none of them seem to bring everything together. A canonical answer that we can point people to I think would be ...
user avatar
  • 12.3k
38 votes
2 answers
28k views

Is it safe to send SSL certificates via email?

I just ordered a cheap Comodo PositiveSSL Certificate via a UK reseller, and I was rather surprised to find that the following files were emailed to me automatically, in a zip file: Root CA ...
user avatar
  • 811
38 votes
2 answers
8k views

Why do SSL certificates have country codes (or other metadata)?

Is there an effect of a certificate, or the request for, having the wrong country code? How about the other metadata? Effects can be legal, technological, anything. I could almost imagine a web ...
user avatar
  • 491
38 votes
3 answers
22k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
user avatar
  • 2,088
37 votes
3 answers
11k views

How does a client know an SSL cert has been signed by a CA if the client doesn't have the CA's public key?

I'm still learning how SSL/TSL works, so apologies if this question is very basic. I understand that the server offers the client its SSL certificate, which contains the signature of a CA. I also ...
user avatar
37 votes
4 answers
7k views

Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?

By my admittedly limited understanding of how HTTPS/TLS works, the end user (me) initiates a connection with a remote server which signs every one of its messages with a public key. This public key ...
user avatar
  • 759
37 votes
4 answers
61k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
user avatar
37 votes
1 answer
3k views

Why are some websites seemingly immune to self-signed certificate MitM attacks?

I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and ...
user avatar
  • 473
37 votes
2 answers
3k views

Is there any security risk when a certificate authority is used more than all others?

According to NetTrack, Let's Encrypt is now used on more than 50% of domains (51.21% as of April 2018). I know Let's Encrypt helped a lot of people to get free certificates for their websites, so I ...
user avatar
36 votes
7 answers
7k views

Could governments and banks become CAs?

When you apply for a passport, driver's license, home mortgage, bank account, credit card, etc., the issuing organization must verify your identity. In the course of doing so, would it be feasible for ...
user avatar
36 votes
6 answers
30k views

Where to get an SSL certificate for personal website?

I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
user avatar
  • 3,272
36 votes
5 answers
25k views

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
user avatar
  • 2,657
36 votes
4 answers
10k views

Why can't a hacker just obtain a new SSL certificate for your website?

SSL is meant to protect your website from a man-in-the-middle attack. But if someone is able to do that, couldn't that just request a new certificate from a CA and then modify the traffic sent from ...
user avatar
35 votes
4 answers
6k views

Can any CA sign any domain?

Can any CA sign any cert for any domain? If the answer is yes, what prevents having two different CAs creating a valid cert for the same domain? Does that mean that the whole TLS security has the ...
user avatar
34 votes
4 answers
77k views

How to know if certificate is self-signed

How do I find out if a certificate is self-signed or authorized by CA? Somewhere I read that self-signed subject and issuer will be same, is it correct?
user avatar
34 votes
3 answers
13k views

Why is it more secure to use intermediate CA certificates?

I've read that using Intermediate CA certificates is more secure because this way the Root CA is offline. So, if the Intermediate is compromised it does not impact the Root CA. What I understand is ...
user avatar
  • 459
34 votes
1 answer
72k views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
user avatar
  • 2,657
34 votes
5 answers
8k views

Are self-signed certificates actually more secure than CA signed certificates now?

Are self-signed certificates actually more secure than CA signed certificates now? I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government ...
user avatar
  • 341
34 votes
6 answers
10k views

Does it matter which Certificate Authority I source my SSL Certificate from?

To secure my web site with HTTPS, does it matter which company I source my SSL certificate from, or just that the browser recognizes it? From the Area51 proposal.
user avatar
  • 72.1k
33 votes
4 answers
8k views

Why are SSL certificates an annual expense?

I understand SSL certificates cost money because of reputation: most/all web browsers have a limited list of companies that demonstrated they are trusted sources of SSL certificates and therefore don'...
user avatar
  • 2,392
33 votes
3 answers
22k views

Which CA issued certificate for https://www.google.com

I installed Kaspersky internet Security 2016 on my laptop; in Firefox and Edge the root issuer is Kaspersky Anti-Virus Personal Root Certificate. but in chrome the root issuer is GeoTrust. in my ...
user avatar
33 votes
3 answers
87k views

How can you check the installed Certificate Authority in windows 7/8?

And know which are not default ones installed by Microsoft?
user avatar
33 votes
4 answers
13k views

HTTPS but NOT encrypted?

I'm accessing Bing (https://www.bing.com) from within China. I got the following information: How could this happen? HTTPS but not encrypted, and with SSL certificate? Here is the packet capture ...
user avatar
  • 451
33 votes
1 answer
12k views

How does OCSP stapling work?

I've been looking into OCSP stapling for HTTPS, which looks pretty interesting. From what I can tell, it's essentially a way of offloading CRLs from the CA to the server, allowing for everything to be ...
user avatar
  • 132k

1
2 3 4 5
25