Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
0
votes
2answers
62 views

Can MitM spoof a signed certificate by imitating the Certificate Authority?

I understand that a signed certificate is a server public key signed by the private key of a certificate authority. As a result, a client allegedly rest assured that the signed public key is for the ...
1
vote
1answer
37 views

why use a CA-signed key pair to encrypt SAML2 assertions?

I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions. In this use case, I hold the private key in my Service Provider, and ...
0
votes
0answers
22 views

Verifying Public Key Using The Digital Signature on Mac

I have just started with encryption and stuff, so please bear with me. Just playing around. I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
0
votes
0answers
40 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
9
votes
2answers
990 views

Trying to understand how Digital Certificates and CA are indeed secure

I understand that Digital Certificates and Certificate Authorities (trusted 3rd parties) help prevent man in the middle attacks during HTTPS connections. However, I am confused on a few details. Let'...
1
vote
0answers
36 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
0
votes
3answers
96 views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
2
votes
1answer
50 views

Wildcard certificate generated for local CA do not work for the subdomains

I have created Makefile to simplify generation certificates for local development: DOMAIN ?= localhost NAME ?= ${DOMAIN} CAKEY ?= CAkey.key CACERT ?= CAcert.pem SIGN_REQ ?= ${NAME}.csr ...
2
votes
1answer
136 views

Is it dangerous to add a custom cert authority to a browser?

For example if my friend develops a webapp with a custom cert and I add them as CA to my browser, can they do any damage? I mean for example somehow faking certs and stealing my banking password, etc.?...
1
vote
2answers
81 views

Can I get an SSL certificate even if external DNS does not resolve

I have an intranet website that requires an SSL Certificate. From what I've seen it seems like this is difficult to accomplish or cumbersome. Would I be able to buy an SSL certificate if there is an ...
72
votes
1answer
15k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
1
vote
1answer
89 views

Self Signed Certificate in Certificate of Chain [closed]

I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers. When I did the "openssl s_client -connect :443" it shows the error ...
0
votes
0answers
37 views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
6
votes
2answers
218 views

State forces installation of SSL root CA, how to evade / mitigate?

Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker ...
0
votes
1answer
42 views

Update letsencrypt certificates without changing the private key

I want to renew the letsencrypt certificate on my webserver but want to keep the private key same. I've installed the certificate using certbot 0.35.1 How can I update the certificate (preferably ...
0
votes
1answer
74 views

Cross sign two self signed root CA

I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster. However, one of the ...
0
votes
2answers
173 views

Why does pinning a CA root certificate not present a security risk?

AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
-1
votes
2answers
81 views

SSL/TLS Extended Validation implemented in fraudulent domains

People trust green bars, because it is proven to not to be of malicious origin. This seems to be the questions of hundreds and many are concerned about it, picture that; a team of fraudsters(or at ...
2
votes
1answer
39 views

Does the CT system “enforce” CA's to log issued certificates?

If a CA, who is otherwise acting good and participating in the Certificate Transparency system, were to issue a certificate without reporting it to any log, would this be noticed somehow? I'm ...
10
votes
4answers
4k views

What are the differences of checking a self-signed certificate vs ignore it?

I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors: Exception in thread "main" ...
1
vote
0answers
53 views

Can my company see my network traffic if their certificate doesn't appear in the web browser? [duplicate]

I have a work-issued Mac, when I go to keychain access right now these are the following certificates: AddTrust External CA Root (Root certificate authority) COMODO RSA Certification Authority (Root ...
2
votes
1answer
90 views

Revoking a Certificate

I'm looking for a bit more details on how the chain of ownership works when it comes to service providers requesting SSL certificates on behalf of another organization. The Who is responsible for ...
0
votes
0answers
48 views

Line jump with openssl s_client -connect command when using CAfile

I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect ...
0
votes
1answer
149 views

Why isn't free software signed with self-signed certificates? [duplicate]

A majority of free software (in particular, Linux ports for Windows) are not signed. As I understand it, it is quite easy to create a self-signed CA, and sign the software. Distribution would be ...
1
vote
1answer
77 views

Where do TLS clients fetch intermediate CA certificates from? [duplicate]

When I use my browser (a TLS client) to navigate to a secure web page (e.g. https://example.com), during the TLS handshake, the browser will receive an end-entity certificate from the web server of ...
0
votes
0answers
71 views

Government Root CA installed on computer/browser and Man-In-The-Middle [duplicate]

Some countries already have their government Root CA installed on computer/browsers. Is it possible for these countries to read Google etc. mails by using Man-In-The-Middle or similar technique(s)?
0
votes
0answers
115 views

SSL handshake: Client Hello and Server Hello

I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy. This is my topology:...
1
vote
1answer
105 views

Can you whitelist a single CA for a domain?

Simply: For my domain (say example.com), I want my computer to only trust HTTPS certs signed by my personal CA, and ONLY my personal CA. Otherwise any one of the CAs I have on my computer could ...
2
votes
1answer
72 views

SSL/TLS certifcate secure on Chrome but not on Firefox

My organization have emitted TLS certificate for Https. It appears as secure when I access the page with Chrome but non secure with FireFox. Is there a difference between these two browsers about how ...
0
votes
1answer
90 views

Signature of a root certificate - CA authority

Created a root certificate(cacert.pem) and tried viewing the content to primarily understand the contents of certificate, mainly the signature appended to certificate. Below is the text output of ...
2
votes
0answers
113 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
-9
votes
2answers
152 views

Why does everyone assume 'https' is secure? [duplicate]

Why are they certificate authorities? What do they do that ensures the information is 'secure'? I know that they verify if a 'certificate' is from a 'trusted' source but who decides which sources are '...
2
votes
2answers
361 views

Why is openssl complaining that my certificate chain is self-signed?

I am trying to set up a certificate chain for a lab server. I have created my own root CA, an intermediate CA and a server certificate. I supplied these certificates along with the server key to the ...
1
vote
2answers
135 views

How are UUIDs assigned in P2P protocols

I am learning about P2P in general (mainly blockchain). I know many P2P protocols uses a distributed hash table for node lookup (kademlia) that maps UUIDs of nodes to their addresses. I am curious ...
0
votes
0answers
28 views

How to map the “CA issued certificate” to a user in AD?

I'm trying to perform certificate-based WiFi authentication. I've set up the CA and by using the SCEP Challenge Password, I'm able to get the certificate. But I need to map this issued certificate to ...
0
votes
0answers
25 views

CA issued certificates maps to the wrong user in AD

I'm doing certificate-based authentication using windows server 2012. I've set up the CA, NDES and now, when I request a certificate using the SCEP Challenge password, I'm able to receive the ...
4
votes
2answers
91 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
1
vote
1answer
80 views

What happens if the private key of a Trusted Timestamp Authority is compromised?

what happens if the private key certificate of a Trusted Timestamp Authority used to sign the timestamps is compromised? If this private key certificate is changed, should all timestamps be re-signed ...
0
votes
1answer
45 views

Risk of issuing a client-certificate for every user in application level

I'm currently working on a project that includes client-authorization using client certificates, where my app is the Certificate Authority. Doing that, every user that registers to my web server gets ...
1
vote
1answer
51 views

Windows certificate manager imports a SHA256 root CA certificate as SHA1

I generated the root CA test cert using: makecert -a sha256 -n "CN=RootCATest" -r -sv RootCATest.pvk RootCATest.cer I've imported this root CA certificate on another machine (Win Server 2019, ...
0
votes
2answers
78 views

Can a DV CA issue IP certificate

I understand that according to CA/B, CA can issue certificate to a public IP address if the validation challenge is satisfied. But can a DV CA issue IP certificates? (If their CA policy allows) Does ...
0
votes
0answers
37 views

Certificate Validation with SDS enabled on Ingress Gateway and mode set to MUTUAL

I have been having some difficulty understanding the mechanism by which certificates are validated by either party in a mutual TLS handshake. I have SDS enabled on my ingress gateway(s) and the ...
1
vote
0answers
42 views

same CA, same CN [duplicate]

Can you order several certs from the same CA, in which only the DN differs, but the CN is the same? Will they accept a second request for the same CN or maybe then put the first cert on the ...
0
votes
2answers
120 views

How can we trust a CA?

During the SSL/TLS handshake we are checking the authentication of the client and the server. During this process certificate chain also comes into the picture to trust/complete the certificate chain....
2
votes
1answer
62 views

Is it OK to set SSL fullchain to service

Imagine service with SSL-server authentication. There are 3 certificates in chain: Root CA certificate; Intermediate CA certificate; Host certificate. Is it ok to put all 3 certificates (fullchain) ...
0
votes
1answer
54 views

ADCS two tier PKI

Planning a two tier ADCS PKI infrastructure as follows: ORCA ____________|____________ | | | SCA1 SCA2 SCA3 one.int two.int three.int ...
5
votes
1answer
328 views

Why do VPN Providers ask for installation of Root CA?

I've seen a lot of VPN providers and they all seem to agree on one thing: ask user to install their own Root CA. I don't get why they do it. A legit server should have a certificate generated by ...
-1
votes
1answer
295 views

Why don't CAs sell certificates as files, instead of hardware or as a service?

I'm trying to purchase multiple certificates, some just signing, some just encrypting, and some a combination of the two. I wanted to purchase one signed by a CA, rather than using a self-signed one. ...
2
votes
1answer
190 views

Duplicate subject names for intermediate and root certificates

I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates. They issue multiple root certificates and intermediate ...
0
votes
0answers
35 views

authenticating SSL client certificates on server

current setup: i have a pki setup which issues client certificates to the users (so that only clients with the certificate can access the web application). was looking for ways to implement this and i ...