Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
0
votes
0answers
38 views

What are various mechanisms for establishing secure channels [closed]

By Wikipedia definition of secure channel is one that protects from overhearing and tampering. I know we can use certificates to establish a secure channel via TLS/SSL. This is possible if there is ...
-1
votes
0answers
38 views

Few basic questions on CA [closed]

Which problem does it solve - AuthN or AuthZ or something else? If a client is attempting to talk to a large pool of servers and I want to individually establish the identity of each server host, is ...
0
votes
2answers
46 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
2
votes
1answer
46 views

Why is my RADIUS Certificate not automatically signed with the root CA Certificate on my iPhone

I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method. I have used this old tutorial for setting up my own CA and generating the certificates and ...
1
vote
0answers
77 views

CA certificate somehow not taken by browsers on android

This is a follow up question related to this answer. In short: I am importing the self signed Root CA certificate into android system via Settings -> Security -> Trusted Credentials -> ...
4
votes
1answer
72 views

Smooth root certificate rotation

I am surprised that I couldn't find one concrete example of how to do root certificate rotation. For example: Root CA has 2 years validity period Intermediate CA has 9 months validity period leaf ...
0
votes
1answer
42 views

Error Loading extension 'copy_extensions' in Openssl

While running the following command on Ubuntu 19.10, with OpenSSl 1.1.1c 28 May 2019: openssl req -config ${CNF_FILE} -key ${PRIVATE_FILE} -new -x509 -days 10950 -sha384 -extensions v3_ca -out ${...
2
votes
1answer
65 views

Restrict CA to issue certficates for one domain or to be able to sign just one server certificate

I have a server and I want my iPhone to connect to it securely. However, I cannot just install the self-signed server certificate on my iPhone. When I install the profile (that's what they call the ...
-1
votes
2answers
45 views

Can SSL certificate (domain verification) process be eliminated?

Noob question alert. I understand SSL certificates help mitigate MITM attacks, but I see the process to be so badly designed. Basically the client needs to verify that it is talking to the particular ...
1
vote
5answers
142 views

How to explain the upcoming Root Certificate Expiration period without technical terms?

A lot of users on older devices or IoT devices that don't or can't get updates will encounter problems in the coming year or two because a lot of the original long-lasting CA root certificates will ...
1
vote
1answer
112 views

Could a certificate authority and a ISP preform a MITM attack on HTTPS traffic?

I'm just wondering if it is technically possible for your ISP to work with a certificate authority (either compelled by a government agency or otherwise) to create a MITM attack to see into your https ...
2
votes
2answers
78 views

Can public keys in digital certificates be used to verify name of certificate holder?

I recently had a conversation with a teacher who argued that in a digital certificate (x509), the public key is used to verify the name of the certificate holder. From my understanding, there are ...
0
votes
0answers
42 views

Is it safe to install a trusted CA certificate from another source?

As you may know, a CA certificate issued by Sectigo expired recently. This is affecting certain mobile apps and possibly websites, rendering them unable to connect to required network resources. In ...
0
votes
3answers
110 views

Why do we need to sign the self-signed certificate?

When we add a self-signed certificate to a device's list of trusted root certificates, we're already trusting it. So, why should it be signed with the server's private key? Signatures only ensure ...
1
vote
2answers
113 views

How can I work around the expired Sectigo certificate on my old mobile device?

As you may know, a CA certificate issued by Sectigo expired recently. This is affecting certain mobile apps and possibly websites, rendering them unable to connect to required network resources. This ...
0
votes
3answers
59 views

While importing certificates in keystore, do we treat these like CA root certificates?

When we need to call an internal domain via HTTPS, Java doesn't allow it because it doesn't recognize the certificate that those domain web servers are sending (probably because those certificates are ...
0
votes
1answer
65 views

why CA use private key to sign a digital certificate? What is the logic behind sign a digital certificate with CA private key?

In general(PKI), encryption happens with public key and decryption happens with private key. But, how Certificate Authority sign a digital certificate with private key? How this can be validated using ...
1
vote
2answers
61 views

What is the benefit of public Certificate Authority when using SSL mutual authentication?

I was working the other day and I had a question come up, that I want to ask here to make sure my assumptions are correct. In terms of SSL Mutual Authentication a self signed CA and a public CA ...
3
votes
1answer
84 views

Is macOS installing known bad Certificate Authorities by default?

Today I was checking out macOS security and privacy guide, and when I looked at my keychain, I was surprised to find Startcom CA and Symantec CA trusted by default. Isn't this supposed to be ...
0
votes
2answers
47 views

How to establish a secure channel with authenticated and authorized access to a remote entity

I have the following problem: There are 3 parties A, B and X. X is holding 2 entities on behalf of A and B. A communicates with X to operate it's own entity. B also communicates with X to operate ...
0
votes
1answer
67 views

How do I identify, characterize and detect if trusted CAs compromised?

What is the best approach to use in identifying, characterizing and detecting compromised CAs? I do not mean an invalid certificate or invalid CA that can be identified by an X.509 during validation ...
0
votes
1answer
75 views

How to generate a CSR (certificate signing request) for creating a limited CA (Certificate Authority) using LibreSSL?

Related to this (too broad) question: How to implement my PKI? I have a self-signed CA (ca0) I would like to create a CA (ca1) with limited power derived from that first CA. ca1 should only be able ...
0
votes
2answers
60 views

Getting a “so-called valid” certificate to work inside the application

There's is a python client app connecting to a java server app via a secure socket. The connection works great with a self-signed certificate, however, it fails when I attempt to utilize a given valid ...
1
vote
2answers
83 views

What stops a malicious DNS subdomain provider from impersonating my website?

First, some background: The DNS-01 verification method of Let's Encrypt requires you to add a TXT record to a special subdomain your domain name to prove your identity. With ACMEv2, this can allow you ...
0
votes
1answer
42 views

Mutual TLS authentication (mTLS) – what can happen if the clients Certification Authority (CA) gets compromised?

I would like to establish a secure connection between two servers (Alice and Bob) via Mutual TLS authentication. That means: Alice provides Bob a certificate signed by CA Bob provides Alice a self-...
0
votes
2answers
65 views

HTTP Public Key Pinning vs Certificate Transparency, which is better and why?

We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well. The ...
0
votes
2answers
54 views

Authentication Certificates in Embedded System (Microcontroller)

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices. In order to have a proper security I´m thinking about using Authentication Certificates ...
2
votes
2answers
99 views

keyUsage Extensions on a Certificate Authority

I have a question about what key usage should I choose when creating a private CA (root or subordinate). I have inspected some root and issuing web certificate authorities and they tend to use ...
2
votes
2answers
106 views

Certificates and keys for mass production devices

I have a number of devices which need to connect to a server via TLS. In order to make sure that only known devices connect to the server mutual authentication should be used. Similar the client ...
0
votes
0answers
30 views

Certificate Revocation with intermediate CAs - combine CRLs?

I use Nginx for client-side authentication. Only the SSL-certificates from the User CA should have access to the application. The CA hierarchy: Root CA | Intermediate CA | User CA So ...
-1
votes
2answers
97 views

How can I create a new root CA and sign existing intermediate CAs without their private keys?

Is it possible to create a new root CA (just for myself) and use it to sign a set of existing intermediate CAs which I'd like to trust? If so, which tool can be used to accomplish this? The private ...
1
vote
1answer
59 views

If an adversary took over a major Certificate Authority, what bad things could they do?

If an adversary took over a major Certificate Authority, what bad things could they do? Aside from the obvious attacks, what could they do in the context of the Public Key Infrastructure as a whole?
0
votes
0answers
56 views

Why does Kaspersky blocks a website saying untrusted root center

Why does Kaspersky antivirus blocks the website saying that it has untrusted root center when the root CA is Kasperksy itself and also the certificate status seems to be "OK". Figure-1 shows the ...
1
vote
0answers
49 views

I need to make a PKI infrastructure, but i don't now how to segment my CA

I'm currently working on a project where we have to rethink a PKI architecture, but we don't know how to segment the different CA_SUBs, do you have any recommendations?
1
vote
1answer
56 views

Is the _acme-challenge subdomain protected?

I was looking into the DNS-01 challenge of Let's Encrypt, and I had a question about the subdomain process [1]. Let's say, the website example.com gives away free subdomains; what stops me to request ...
0
votes
0answers
43 views

Which CAs is more vulnerable to compromise or misbehave in the trust chain (Root, Intermediate or Issuing CA)?

From the academic and real-world scenarios which CAs are more prone to misbehavior or compromise by attackers (Root, Intermediate or issuing CAs)? What are the consequences after compromise? Are the ...
1
vote
1answer
63 views

Is the ACME HTTP-01 challenge secure against MITMs?

Many certificate authorities these days use the ACME protocol to automate the process of certificate issuance. This includes verifying that the applicant is the owner of the domain. And the most ...
0
votes
0answers
42 views

Why is /cacerts request necessary in RFC 7030 Enrollment Over Secure Transport?

In RFC 7030 Enrollment Over Secure Transport (EST) https://tools.ietf.org/html/rfc7030, the /cacerts request (Section 4.1 of RFC 7030) is used by the client to request the current CA certificates. The ...
0
votes
0answers
129 views

TLS handshake failure (40) solved by removing intermediate certificate from server?

I'd like to better understand my workaround, and confirm that it's secure. Problem I have a crt file containing a root and intermediate certificate installed on my server (I have limited access to ...
1
vote
1answer
78 views

Can I pre-register an SSL certificate with validity in the near future?

Can I register an SSL certificate that will only start to be valid in the near future and not right away?
4
votes
2answers
137 views

Generate digital certificates for employees using the organization's certificate

I live in Peru and we have a small problem in the organization where I work. Dozens of documents are physically signed daily but this is a waste of time since there are documents that must be signed ...
4
votes
2answers
165 views

Why is the root in an Online CA model not a Single Point of Failure?

My textbook for CompTIA Security+ has the following practice question: In which one of following PKI Trust Models is the root NOT a single point of failure? Single CA Hierarchical CA ...
0
votes
0answers
48 views

What does “sample minimal CA application” mean?

I'm reading openssl manuals, and in the man openssl-ca I've found a note, that "openssl ca is a sample minimal CA application" What does it mean? I don't understand. If it is only a sample, what do I ...
0
votes
0answers
27 views

How does a web browser obtain the public key of a certificate author? [duplicate]

As far as I know, when a web browser verifies the signature in a SSL certificate, it uses the public key of the certificate author (CA) which has signed the certificate. Does the web browser contacts ...
0
votes
0answers
14 views

Certificate check works with root but fails with Intermediate CA [duplicate]

I have 3 certificates, server.crt issued by Intermediate CA which is issued by Root. The server.crt is configured on apache2 (version 2.4.29-1) on Ubuntu 18.04. However when I am trying to connect to ...
0
votes
1answer
102 views

How does a web client check the signing authority of a server certificate? [duplicate]

In HTTP The Definitive Guide When you establish a secure web transaction through HTTPS, modern browsers automatically fetch the digital certificate for the server being connected to. If the ...
0
votes
1answer
118 views

CA certificate and Local certificate

There is something which is bothering me when i think about the CA cert and Local cert. Below are my queries which pertains to juniper but may be generic as well. 1) "request security pki ca-...
0
votes
0answers
60 views

Is this a valid equation for determining certificate lifetimes in a PKI infrastructure?

I have an intuitive sense of how certificate lifetimes should work in a PKI infrastructure, but I don't consider myself an expert in this field so I would like someone to validate or critique my ...
0
votes
2answers
72 views

Do CAs issue intermediate Certificate for each new certificate request?

Do CAs issue intermediate Certificate for each new certificate? I am new to certificates and asking this to understand if the CAs have a ready set of intermediate certificates they use to issue leaf ...
0
votes
1answer
102 views

Does moving Root CA server require reissue and reinstall all server certificate?

In our environment we have three type of machines: Root CA (Microsoft CA), web servers and user PCs. We need to move our Root CA to another site, there are many guidelines on how to migrate Root CA ...

1
2 3 4 5
22