Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
0
votes
1answer
26 views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
0
votes
0answers
20 views

How is it guaranteed that a SSL certificate issuer doesn't issue a fake certificate? [duplicate]

How is it guaranteed that a SSL certificate issuer doesn't issue cerificates without verifing that the user holds the specified domain name or even that the issuer himself doesn't issue a certificate ...
0
votes
1answer
50 views

PKI or Digitally signed certificate

Please do mind, its a long read. I just confused myself again with how the CA server helps with the digital signature and the pki working flow. Please let me know if what I am describing below is the ...
0
votes
0answers
13 views

What if there is a “man in the middle” between the client and the certification authority and the same MITM is also between Client and server? [duplicate]

I've read other some articles (including this: https://medium.com/@technospace/tls-handshake-under-the-hood-79d20c0020de) and similar questions but none exactly like this hypothetical scenario. What ...
0
votes
2answers
81 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
2
votes
1answer
99 views

What is Trusted Credentials in mobile phones?

My phone is encrypted and i was just playing with the configuration and just found a Trusted Credentials that got me curious on what it is and specially in one called Government Root Certification ...
1
vote
1answer
83 views

Has Fortinet issued a TLS cert for my domain?

I run a web site and email server for purely personal purposes on a VPS. I created a self-signed cert for the server and installed the relevant CA cert as a profile on my iPhone as well as on desktop ...
0
votes
1answer
94 views

How to update certificates/CRL on Windows 7 systems that are without support contracts?

A quality answer to this question mentions: "System is regularly updated with latest patch specifically certificate/CRL from trusted source such as Microsoft." How does one update ...
0
votes
1answer
101 views

What is the workflow from client to server for SSL enabled sites?

I have a basic question on workflow of SSL enabled sites from client browser to server. My understanding is when the browser has to access some https enabled site, the browser contacts some CAs. I am ...
0
votes
2answers
153 views

What prevents an attacker from registering a TLS certificate for an existing site?

This would be used in a phishing attack for example - coffee shop attack where google.com becomes a website controlled by the attacker completed with the magic lock next to the URL. Can I use ...
0
votes
1answer
54 views

Why would device manufacturer refuse to publish root CA that signs devices but provides the CA via support ticket attachment

Background: We got a few new model SIP phones. Each phone has built-in unique certificate issued by the manufacturer. Previous models had certs issued by a different CA and that CA cert was published, ...
0
votes
1answer
148 views

Obtaining .p12 certificate from PEM file and CRT file provided by GoDaddy

A few months ago a colleague who left generated a CA certificate from GoDaddy. I am not sure the exact steps he took but currently we would like to install the CA certificate on a server to fully ...
7
votes
1answer
778 views

Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP

Given the scenario that: Victim rents VM1 from a cloud provider, and points his/her DNS record to that VM1's IP address Victim deletes VM1 and switches to a different cloud provider, and creates VM2 ...
1
vote
1answer
50 views

AWS Private CM and FedRamp compliance for TLS

Is the use of a private, auto-signed certificate, created and managed by AWS Private CM, and use in internal TLS communication, for endpoints that do not require external verification, and do not have ...
0
votes
0answers
48 views

“Certificate Revocation Unknown” strange error from Remote Desktop - Windows server 2019 CA

I've recently attempted to set up a certificate authority on my small server environment (Windows server 2019). When attempting to connect to the server from my laptop using remote desktop, I get an ...
2
votes
3answers
340 views

What differentiates a CA cert from a server cert? [duplicate]

From what I can gather, as long as a client trusts a particular CA root, and a server produces a valid chain that leads up to it, the client will trust the server's cert. This only makes sense if the ...
0
votes
0answers
41 views

Self-Signed Certificates on Management Interfaces - Cyber Security Standards

We have dozens of internal management interfaces on our appliances that use self-signed certificates - ILO, DRAC, switch management, etc. These certificates display a warning in the browser, but their ...
0
votes
4answers
62 views

Ingress client certificate authenticate requires CA certificate to be stored in secret?

I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...
0
votes
0answers
32 views

Validate that CA really signed certificate [duplicate]

What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust? What is the part of the certificate (The one I try to validate) is the one cant be faked? ...
-2
votes
1answer
116 views

Certificates Do Nothing [duplicate]

Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...
0
votes
0answers
32 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
0
votes
1answer
60 views

Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)

I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time. I understand that both methods require to prove that the certificate (...
0
votes
0answers
29 views

TLS: should a server return the complete certificate chain? [duplicate]

I'm running a private CA for testing purposes. I have my root CA cert, an intermediate CA cert, and some server certificates. Clients have the root CA cert installed as trusted. It's not clear to me ...
0
votes
1answer
54 views

What are requirements of Key Usage extension of parent and child certificates?

This question is about validating certificates. Imagine some machine gets a leaf certificate (i.e. a certificate signed by the certificate of some CA) with specific Key Usage attributes. Example #1: ...
1
vote
2answers
96 views

openssl certificate chain - windows

I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities. ...
0
votes
0answers
40 views

How does https block the man in the middle from just forwarding the certificate chain? [duplicate]

Suppose I have a client : Alice and a server: Bob A ---- B There is a Charles in between. A ----- C ----- B When Alice asks for bob's public key and certificate. Charles can intercept this and form a ...
0
votes
1answer
65 views

Company VPN (tunnelblick), https, root CA and privacy

My company provided me with a MacBook for work. I was the one that took the laptop out of the sealed box and I was the one to set it up. I only had to install the tunnelblick VPN client and use the ...
0
votes
2answers
44 views

SSL certificate signature creation

I have some queries regarding SSL certifcate chain. I have tried searching documents online, but none has mentioned clearly. When a chain of trust is established, below would be how it works. Domain ...
3
votes
1answer
368 views

Why does Firefox no longer recognise certificates issued by Multicert / Camerfirma?

Today I noticed that Firefox 88.0 beta (on macOS) is rejecting TLS certificates for many Portuguese websites – including most government websites – with the error SEC_ERROR_UNKNOWN_ISSUER. Example ...
1
vote
0answers
49 views

Are there any options for Root CA eIDAS compliant HSMs? [closed]

Building the eIDAS compliant certification authority in hierarchy, meaning that the Root CA will issue Subordinate CAs. Root CA will be offline almost whole year and Subordinate CA is online providing ...
1
vote
1answer
64 views

Are long-lived SSL/TLS certificates acceptable for non-public resources?

Our organization maintains a private certificate authority to issue SSL/TLS certificates to non-public backend services running on our cloud infrastructure. For example, Postgres and Elasticsearch ...
0
votes
1answer
59 views

When do I need to install root certificate on the client trust store?

I have a https server with following the certificate chain : Root CA -> Intermediate CA -> server certificate I noticed that for the client (eg. browser) trusts the server I need to install in ...
0
votes
1answer
134 views

NET::ERR_CERT_INVALID in Chrome/Opera on Linux [duplicate]

I have set up a self-signed CA in a development environment and have issued a server certificate to a test website. The issue I'm having is that the certificate is being rejected by the browser with ...
3
votes
0answers
80 views

What are the risks of trusting a certificate that is not logged in CT logs?

A website that I do banking on has a login page on a different subdomain than their main website, and this login page is secured with an Amazon-issued domain-validation certificate (their main website ...
2
votes
1answer
81 views

Trying to create cert for RSA and Not ECDH

I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key....
23
votes
2answers
4k views

Are we gossiping in Certificate Transparency?

Ben Laurie's original paper on Certificate Transparency proposed that clients (browsers) should "gossip". In particular, it proposed that when a browser connects to a web server, it should ...
7
votes
1answer
631 views

Certificate Pinning Best Practice or Alternative

I'm looking for the "best practice" to use in Certificate Pinning or an Alternative. Scenario:  I have a native mobile app and I have pinned the certificate so that the app can validate ...
0
votes
1answer
39 views

CT logs for non browser applications

Most what I read on CT logs is about browsers checking the logs for websites. But what about normal applications or updates for operating systems (like apt-get over https, windows/osx updates ...) Is ...
2
votes
2answers
69 views

Is it possible to create a certificate for a key pair which I do not possess?

Perhaps the answer is no, and perhaps this is a dumb question. However I am trying to understand the underlying principles better. My understanding of certificate signing process. I generate a key ...
27
votes
5answers
6k views

How does having a custom root certificate installed from school or work cause one to be monitored?

I was reading an article which said that if you install custom root cert from a third party then they can decipher all communication between you and others. But that doesn't make sense. What I ...
0
votes
1answer
86 views

Can my Root, Intermediate and SAN certificates have the same serial number?

Can my Root, Intermediate and SAN certificates have the same serial number? The serial number is 00. If the Root, Intermediate and SAN should not have same serial numbers, then should I use the random ...
-2
votes
1answer
119 views

Can a Certification Authority self-sign his certificate?

I recently updated the certificate on my site and after a few days and a checked with Security Scorecard, I noticed that the certificate is self-signed. Is that legal and permitted? As you can see, ...
0
votes
1answer
54 views

Site use weak cipher and TLS older version

I just tested a site and it looks like the certificate uses weak ciphers but the certificate is new. Can this issue be related to the Certification Authority that provides the certificate? Or this ...
0
votes
0answers
30 views

Certbot on GKE for automating SSL certificates with CAs other than Let's Encrypt

Is it possible to install Certbot on Google Kubernetes Engine (GKE) for installing and renewing the SSL certificates on Load Balancers (LB) but with CAs other than Let's Encrypt?
1
vote
1answer
41 views

Which attribute in DN is commonly used to specify the class/type/usage of certificate/end-entity?

I have a private CA which provides certificates for three types of IoT devices (Type1, Type2 and Type3). On the IoT device certificate's subject DN, which attribute can be used for specifying this ...
0
votes
1answer
64 views

Is it possible to additionally sign a Let's Encrypt certificate with another self-signed root certificate? [duplicate]

I have a certificate for my web service issued with Let's Encrypt. Another service that communicates with my web service requires that my certificate must be signed with theirs, otherwise their client ...
1
vote
1answer
52 views

Intermediate CA authenticity in an embedded device

My company are using an offline embedded device, that must encrypt connections to its client (a PC connected with USB). We have chosen to use TLS with both PC and device authentification to encrypt ...
0
votes
2answers
60 views

Investigating a downloaded certificate

I used the below command to open a certificate of a website that I downloaded from Firefox. What part of the downloaded certificate indicates that it is a CA's certificate? openssl x509 -in ca.crt -...
5
votes
1answer
73 views

Is it possible to use Certbot for automating SSL certificates with CAs other than Let's Encrypt?

Is it possible to use Certbot for automating the renewal process of the SSL certificates with CAs other than Let's Encrypt?
26
votes
2answers
4k views

How is HTTPS protected against MITM attacks by other countries?

HTTPS relies on server certificates to ensure you are connected to the correct server and thus thwart man-in-the-middle attacks. Nowadays, there are countless certification authorities in many ...

1
2 3 4 5
24