Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
1 vote
1 answer
16 views

What are the security implications of storing a CA password for local development only in a repository?

During local development of our website we need some features that are restricted to secure contexts, meaning we need a self signed certificate for 'localhost' for some things to work. To make things ...
1 vote
2 answers
74 views

Why would a company choose to use different SSL providers for different subdomains

Recently, I happened to notice that a site I was looking at had different certificate providers for different subdomains. Whilst looking around, I found that seems to be somewhat common (or at least ...
0 votes
0 answers
31 views

How does Certificate Transparency protect from hacked CA server [duplicate]

I was able to grasp how CT works by reading this explanation, but one thing remains unclear for me - how CT may protect ecosystem from hacked CA server. For example, someone hacked Digicert, and now ...
0 votes
0 answers
40 views

Verify self signed certificate

My plan is to create rootCA.crt and sign newly created server.crt. Later server.crt should sign newly created child.crt. As result I will get small chain. Now I would like to test if child certificate ...
  • 259
0 votes
0 answers
30 views

EAP-TTLS and certificates

Wi-Fi user is getting autheticated via RADIUS server using EAP-TTLS by providing username and password. User needs to have X.509 CA certificate on their device. I am having problem understanding how ...
  • 129
0 votes
1 answer
74 views

How to create and embed Signed Certificate Timestamp (SCT) in certificate

I have deployed a Certificate Transparency (CT) log server that uses Google's CTFE (named "certificate-transparency-go" on Github) and Trillian Projects. And I have issued a pre-certificate, ...
1 vote
2 answers
59 views

Is it a good idea to reuse certificate issued by public CA for internal database client authentication?

Let's say we have: Publicly available HTTPS API (e.g. api.example.com). The web server that runs it uses a certificate from a publicly trusted CA (e.g. Let's Encrypt) with both server auth and client ...
0 votes
1 answer
57 views

Browsers don't trust SSL certificates of network-local host signed by own CA

I've got a Mayan EDMS running on a computer on the local network. The Web App is exposed via HTTPS on the non-standard port 8001 and it uses an SSL certificate that is signed by our own CA. The CA is ...
1 vote
0 answers
63 views

How to renew intermediate Sub CA certificate? [closed]

The intermediate sub-CA certificate is expiring mid 2023 and the root CA certificate is expiring in 2028. How to renew the intermediate Sub CA? Or is it auto-renewed? If Yes then how and where do I ...
3 votes
1 answer
54 views

Name Constraints, empty sets in permitted subtree (RFC 3280 vs RFC 5280)

I'm trying to understand the effect of empty sets in permittedSubtrees in both, RFC 5280 and RFC 3280. There is something that doesn't compile in my head. Scenario: We have a CA certificate with the ...
  • 5,759
5 votes
1 answer
107 views

What is the best practice for relying parties to selectively trust certificates in a corporate pki hierarchy?

I have a pki infrastructure for internal company use. In this pki there are multiple registration authorities whose responsibility is to. receive certificate issuance requests verify the identity of ...
2 votes
1 answer
189 views

How to make 3 separate issuing Certificate Authorities aware when a certificate has been revoked on 1 Certificate Authority?

There is one offline Root CA. There are 3 issuing CAs, each on their own domain. There are domain trusts in place, but these domains are not in the same forest. All 3 domains and CAs are managed by ...
  • 121
0 votes
0 answers
22 views

Is there a way to find out which certificates came preinstalled with Windows and which ones installed afterwards? [duplicate]

I'm looking for a way to find out which certificates, whether machine level or user level, came preinstalled with Windows (when using official Microsoft ISO file to clean install the OS) and which ...
user avatar
8 votes
2 answers
2k views

Could intermediate certificate authority loop back to itself?

Excuse me in advance since I'm new to this. From what I understand, when the client receive the server certificate, client would verify the cert/ cert chain against its trust list. It would follow the ...
0 votes
0 answers
38 views

How can I request a certificate from an internal CA if my machine is Azure AD joined?

I'm using Ghostpak's Certify to discover vulnerable certificate templates on an internal certificate authority named certauth.megacorp.local. I've found a vulnerable template and was successfully able ...
0 votes
1 answer
110 views

Why is my website certificate not verified by all browsers. Is this related to my CA or just misconfiguration?

I have a certificate signed by https://www.noip.com which I'm using in my website (https://angola.sytes.net), but the certificate is only recognized by some browsers in some places. If you take a look ...
  • 203
0 votes
0 answers
31 views

Examples of private key leakage / compromised keypair resulting in certificate revocation

I am looking for some examples of private key leakage or compromised keypair (via insider attack, configuration mistake, etc.) that lead to certificate revocation. I am particularly looking for cases ...
0 votes
2 answers
67 views

What is CA response after giving them the CSR?

I'm trying to understand the logical flow of SSL certificate. Suppose I have a website running on a machine. I generate a CSR file that contains information (e.g. common name, organization, country, .....
  • 103
0 votes
2 answers
62 views

Corporate Root CA - How does it work and what does it do?

This has always puzzled me: I am working again at a company where there is a corporate certificate authority. When browsing certain websites (e.g. this one) and looking at the certification path in ...
0 votes
1 answer
32 views

Should Subordinate CAs on separate domains point to one location for CDP and AIA?

I'm a bit confused with how CRLs and AIAs work. I am on a domain B and I have been tasked with building a Subordinate CA that has an offline Root CA located in Domain A perimeter. These domains are ...
  • 121
0 votes
1 answer
50 views

HAProxy Trust only specific client certs for mutual

I am using HAProxy to perform Mutual TLS termination for my API. HAProxy has Mutual TLS enabled with "verify required" and a cert-auth file to restrict access to the Apache service that ...
0 votes
0 answers
60 views

How to trust CA chain with sub-CA intermediate

I have a development web server that I need to add trust certificates on my local machine. Http connections to server https://machine-name.a.b.local/ show an SSL issue. This is the cert chain: ABCD-...
0 votes
1 answer
36 views

Recommendations on PKI roles as per ETSI EN 319 401 - V2.3.1

I want to configure roles (least privilege) on my CA instance (EJBCA) and I'm trying to find what are the best practices to do this. I've tried to read the ETSI EN 319 401 - V2.3.1 standard and try to ...
  • 93
1 vote
2 answers
109 views

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Here is the scenario, just wanted confirmation that I am understanding it correctly. I have a TLS certificate that will expire soon; Upon renewal, I paid the CA, and they reissued me with a new public ...
  • 307
1 vote
1 answer
47 views

Adobe uses CA signature type as identifier on signatures created with user certificates

I am testing several PKCS12 keystores with ECC type keys, generated by a CA with RSA key, to sign PDF documents. I have also tested with my own certificates from a demo CA certificate. I use Adobe ...
0 votes
1 answer
81 views

Are self-signed certificates better for local usage?

When generating a certificate what would more secure - generating a self-signed certificate using PGP or using a public CA like Let's Encrypt? We are using it for signing and encrypting. What are the ...
  • 212
0 votes
0 answers
98 views

I was asked to install an SSL .cert in my server, should I do this?

I am trying to connect to a company's internal API (I am working on a project for them). This company has an API that has an SSL certificate from Sectigo. From what I have gathered is a pretty well ...
  • 101
-1 votes
1 answer
58 views

Modifying cacerts at runtime

I have an containerized JVM application (multiple actually) running on kubernetes, which needs to trust additional custom/private CAs (which are not known beforehand, the application will be deployed ...
  • 1
1 vote
0 answers
40 views

Is it must to have "Key Usage" extension in the selfsigned root certificate?

I have gone through multiple questions but still I am confused. RFC X.509 also does not clarify it. Conforming CAs MUST include this extension in certificates that contain public keys that are ...
2 votes
2 answers
97 views

How to add extension to existing TLS certficate?

We have our own root certificate authority which is used to sign the certificates for the agents connected to our server. We have generated the root certificate authority using keytool command as ...
2 votes
2 answers
96 views

How to determine what Certificate Authorities to keep on my computer?

I read this article at Electronic Frontier Foundation on how Russian government wants the residents there to install a specific "Trusted Root CA" certificate. According to the article, this ...
  • 135
1 vote
2 answers
89 views

How can I prevent non-SAN TLS certificates from bypassing name constraints?

I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints. However, even if I create the CA with restrictions on DNS names as well as ...
  • 113
0 votes
0 answers
50 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
  • 101
1 vote
3 answers
56 views

Auto-certification of internal services, does it make sense?

I work for a big insurance company, they have created a certification authority to generate certificates for their internal webservices. These webservices are accessible from their intranet only and ...
  • 113
0 votes
0 answers
43 views

What prevents an SSL certificate holder to issue new 'valid' certificates [duplicate]

I am new to SSL certificates and trying to wrap my head around this concept. As per my understanding when a valid certificate is signed (by one of the many official CAs) it can also sign a certificate ...
  • 101
1 vote
1 answer
79 views

Why include the root certficiate in the chain, if it is already in receiving parts' truststore?

If I have a self-signed CA certificate in my truststore, and I am sent a chain of certificates where the root CA is missing, is this a problem and if so why? Say that the last certificate in the chain ...
0 votes
1 answer
36 views

Does the wildcard certificates registered late?

I've been trying to understand the process how the certificates are being registered and wildcard certificates got my attention. For some companies that offer free hosting in their site, I noticed ...
56 votes
7 answers
8k views

Can a CA decrypt HTTPS traffic?

My state has made a statement that in case my country will be disconnected from the world's CAs, it is necessary to install its own state certificates. In many forums, information has flashed that in ...
0 votes
2 answers
70 views

Can any field in a CSR be overwritten in the issued cert?

Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
0 votes
1 answer
52 views

Exposing ADCS OCSP on the Public Internet

I am building a Certificate Authority using Windows Server ADCS as a 'Standalone' CA but my application would be greatly improved if I can utilise OCSP. Is the ADCS Online Responder Role Service ...
  • 1
0 votes
1 answer
79 views

How to distinguish between Wifi certificate and certificate usable for MITM?

I know that similar questions has been asked several times, but this question focuses on one aspect I did not found answered yet. Recently when I was connecting my iPhone to my school wifi (eduroam), ...
  • 3
0 votes
1 answer
369 views

Difference between trust anchors and certificate authorities

Trust anchors and (root) certificates authorities are often used interchangeably and it's easy to think that they are the same thing. The answer in Can an intermediate CA be trusted like a self-signed ...
4 votes
1 answer
674 views

Difference between -CAfile and -trusted in OpenSSL verify

openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual: -CAfile <FILE> A file of trusted certificates. The file ...
1 vote
2 answers
488 views

How can I make an SSL certificate for an IoT device trusted on all browsers?

I have a web server running on an IoT device, more specifically, on an ESP32. This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
0 votes
1 answer
103 views

Client authentication using X509 certificates behind the scenes

In my application I've successfully implemented client authentication using X509 certificates Here's what I've done: Issued a self-signed CA root certificate with a private key Issued a web-server ...
  • 143
0 votes
0 answers
30 views

Google Cloud and Private CM on Microsoft Windows and FedRamp compliance for TLS

Is it possible to use Private Certificate Authority based on Microsoft Windows Servers for protection SSL/TLS connections in FedRAMP environment on Google Cloud?
0 votes
1 answer
162 views

create a fake ssl certificate

Say I create a certificate with some content and then sign it with my private key. Now, I decrypt the sign with a trusted CA's public key and somehow come up with content that can match the decrypted ...
13 votes
1 answer
4k views

SSL Trust Seal of "https://www.ebay.co.uk"

when I visit "https://www.ebay.co.uk", I can see a trust seal at the bottom right of the page that says the certificate is issued by DigiCert. It is a clickable trust seal, so when I click ...
  • 241
0 votes
2 answers
140 views

Authorising client (mTLS) based on distinguished name

I am working on a deployment where the customer is requesting to do things differently from our standard process for client authentication. Usually we generate a CA for a customer project, get them to ...
  • 103
7 votes
2 answers
3k views

How to prevent HTTPS man-in-the-middle with self-signed certificates?

I came across this issue when we implemented a new security solution. Said solution has its own root CA certificate and will create certificates for HTTPS web pages "on the fly". Each HTTPS ...
  • 79

1
2 3 4 5
25