Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
10
votes
2answers
2k views

How can a domain be impersonated with a fraudulent SSL certificate?

I was reading this article about the fraudulent certificates from Comodo back in 2011. It talks about domain impersonation. I understand that a fake website could be secured with the fraudulent ...
8
votes
3answers
10k views

Is it required to have the same Domain Name and Common Name for SSL Certificate?

I have an SSL cert in which CN is "abc.xyz.com". But the url shared to 3rd party organization to access a web app on our server is: "def.stu.com/what-ever". When this arrangement is working for ...
8
votes
1answer
302 views

Browser blacklists & the Symantec-Google Certification Debacle

Background: As explained e.g. on this Google company blog, Google writes that: On September 14, around 19:20 GMT, Symantec’s Thawte-branded CA issued an Extended Validation (EV) pre-certificate ...
6
votes
2answers
1k views

How practical is a certificate's “basic constraint” property in protecting my HTTPS / SSL session?

Suppose a leaf node creates a certificate for a different domain, acting as a CA. Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be ...
6
votes
1answer
32k views

What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?

What root certificates are/are not updated when the following checkbox is checked? Additional questions If I manually remove a root certificate, will this service replace that very certificate? What ...
6
votes
3answers
3k views

How to Check for Dangerous Authority root Certificates and what to do with them?

I started my exploration after I saw that one program adds some lines to certmgr.msc (PC wasn't connected to the Internet, so, I don't think, that this cert can be downloaded by MS). Installer of the ...
6
votes
3answers
1k views

“Web of trust” for self-signed SSL certificates?

SSL certificates, generally speaking, use a "chain of trust" model - a trusted certificate authority (CA) gets proof that a company such as Amazon owns amazon.com and issues an SSL certificate. ...
6
votes
2answers
4k views

What tools exist to help me monitor OCSP certificate validation failures?

The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online ...
5
votes
1answer
916 views

'Trusted CA Certificates' and 'Trusted remote Certificates'

What is the difference between Trusted CA Certificates and Trusted remote Certificates?
5
votes
1answer
291 views

Google certificate and CAA

I am fiddling around with certificates, trying to harden my own sites. When doing so, I noticed that Google have some weird configuration of their CAA. Looking at their ssllabs results, or using ...
5
votes
1answer
3k views

Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA

I would like to ask if it is possible to use different CA for the client certificate and the web certificate? For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
4
votes
1answer
3k views

Different SSL states as seen by Safari, Chrome and Firefox

Today, I visited some sites of the German DHL group. While Chrome and Safari complain about an invalid certificate of Firefox accepts it. Which one is right, which one is wrong? Which decision ...
4
votes
1answer
116 views

How are root CA revocations handled?

Considering some CA certificates are hardcoded into operating systems, I was wondering what happens when one of these hardcoded certificates is revoked (put on a revocation list for example) because ...
4
votes
1answer
2k views

What happens to a certificate's Basic Constraints when a policy map is used?

One feature of a Basic Constraint when applied to a certificate (CA or end certificate) is that I can specify the maximum number of CAs that are permitted in the chain. I'm planning on having a 2 ...
4
votes
1answer
408 views

Should my company change the internal Root CA hash method from SHA-1 to SHA-2?

My company have a Root Certificate Authority which is installed on a Windows Server 2003 and uses SHA-1 as hash method. We will migrate to Windows Server 2012. Checking the root certificates of my ...
4
votes
1answer
316 views

Is it a good idea to generate certificate-specific CRLs? What is this technique called?

Suppose I create 3 certificates with the following CRLs Cert1 http://crl.server.com/batch1/root1.crl Cert2 http://crl.server.com/batch2/root2.crl Cert3 http://crl.server.com/batch3/root3....
3
votes
3answers
2k views

Employer wants me to install root certificate to work remotely - privacy concerns?

My new employer wants me to install a root certificate on my computer as trusted in order to work remotely. I believe it is to use Cisco AnyConnect vpn. I don't really have a clear understanding of ...
3
votes
2answers
227 views

SSL Certificate Signing by a CA

Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return. What I don't understand is what, exactly,...
3
votes
2answers
589 views

Can a CN-only certificate bypass a name constraint if the CA goes rogue?

I am trying to cross-certify an internal issuer certificate, adding a name constraint for our domain. However, it seems that an attacker could bypass this protection by putting the desired host name ...
2
votes
1answer
9k views

How do I use OpenSSL with the Java Keytool?

I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
1
vote
1answer
4k views

Certificate validation to multiple Root Certificates?

I found this article and stumbled upon the part: So if a client trusts either of the G5 certificates as a trusted root, it will trust any certificate issued by a subordinate CA such as the G3. As ...
1
vote
1answer
203 views

Is or was it possible to register a wildcard certificate to third level subdomain?

The use of a null byte in a certificate cn is very well known… and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of ...
1
vote
2answers
423 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
8
votes
1answer
26k views

OpenSSL “unable to get local issuer certificate” even when passing in the Certificate Authority

I've attempted to setup a certificate authority, and issue a certificate from that authority (with no intermediate inbetween The authority covers *.node.consul, and the certificate is underneath that ...
7
votes
4answers
366 views

State forces installation of SSL root CA, how to evade / mitigate?

Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker ...
6
votes
1answer
121 views

Why does the issuance speed of a CA depend on the number of certs they have already issued?

I have seen proprietary testing results of pummelling a CA for a long time and measuring its throughput (certs issued / second). It was found that CAs become slower to issue new certificates as the ...
5
votes
3answers
1k views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
5
votes
2answers
159 views

How do I prepare for Certificate Authority end of business?

We are deploying a security solution which uses certificates to validate documents. These certificates are issued by our government-authorized CA. What if in a distant future, the CA who provided us ...
5
votes
1answer
927 views

Why would Amazon include an already trusted Root CA in the bug report they filed to get into Mozilla's truststore?

Amazon will soon be a trusted Root CA. To this end Mozilla Bug #1172401 was filed a while back to get into Mozilla's trust store. Along with 4 of their own Root CAs they've included a fifth one (...
5
votes
2answers
438 views

Why do Symantec not believe their customers will be affected by Google distrusting this root certificate?

So Google will be moving to distrust the “Class 3 Public Primary CA” root certificate operated by Symantec Corporation, across Chrome, Android, and Google products, because it is no longer going to ...
4
votes
2answers
235 views

Does client send request to CA when SSL handshaking?

In other words, if Certificate Authority goes down, does this mean that all HTTPS sites that purchased SSL certs from this CA will also become unavailable?
3
votes
2answers
174 views

CSR Signing simulation

Tried a lot get my test csr signed from root CA(trial versions option), somehow i am not getting it dues to some of their internal check. Few questions that cropped up Can i somehow signed that ...
3
votes
2answers
221 views

Isn't this the same as using a certification authority?

Taken from Wikipedia, here is the pretext to my question: A certificate authority (CA) is an organization that stores public keys and their owners and every party in a communication trusts this ...
3
votes
2answers
548 views

Subdomains on a multidomain EV SSL [closed]

I have a domain https://joshmurray.eu/ which has a Standard SSL certificate. I also have two subdomains: http://one.joshmurray.eu/ and http://two.joshmurray.eu/. I wish to upgrade my SSL certificate ...
3
votes
1answer
655 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
3
votes
1answer
3k views

How do CAs generate public keys without the private keys?

When creating a CSR so you can later paste it to a CA to generate a signed TLS certificate, you first generate a private key: openssl genrsa -out your-key.key 2048 With the private key, you can then ...
3
votes
2answers
5k views

Root CA with Extended Key Usage fields

I recently started using AWS's Certificate Manager to get free TLS certificates for my load balancer. When I was inspecting the certificate chain I noticed that the Root CA, Starfield Class 2 ...
3
votes
1answer
449 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
3
votes
1answer
484 views

Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?

WoSign has been in the media for offering free server and client certificates. Since one of my (free) S/MIME certificate from another CA is about to expire soon after one year and WoSign offers ...
3
votes
1answer
5k views

How to add AltName from csr file to crt file using “openssl x509 -req”?

I'm a webdeveloper and want to test my websites locally with a self signed SSL certificate. Everything was working great until a few days ago, when chrome started complaining about a missing AltName ...
2
votes
2answers
452 views

Why not to use the same subordinate issuer CA for generating certificates that will be used for different things?

Microsoft has recommended my organization to use different subordinate issuer CAs in order to issue certificates that will be used for different things. For example, they recommend to use a CA for ...
2
votes
1answer
607 views

Signature and Timestamp for Long Term Document Archival Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity. As far as I understand, I ...
2
votes
1answer
1k views

Will two intermediate CAs signed by the same root CA trust each other's signed client certs?

I have two intermediate CAs that each sign certificates for their client users, like this: ROOT CA / \ / \ / \ Intermediate ...
2
votes
1answer
5k views

Generate CSR with 2 OU Names

I have to create an application which generates a CSR. While generating a CSR we are required to fill in several details like CN, OU, etc. The problem is that the Certifying Authority to which I have ...
2
votes
1answer
589 views

If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies?

Ref: How do I report a security vulnerability about a trusted certificate authority? This question involved a serious security vulnerability at WoSign. Here's the finder's blog: http://webcache....
2
votes
1answer
557 views

Can we use one CA to revoke certificates generated by another CA?

I have a hierarchy of certificates which contains: root-cert server1-CA (issued from root-CA) client1-cert (issued from server1-CA) server2-CA (issued from root-CA) client2-cert (issued from ...
1
vote
2answers
118 views

How can I work around the expired Sectigo certificate on my old mobile device?

As you may know, a CA certificate issued by Sectigo expired recently. This is affecting certain mobile apps and possibly websites, rendering them unable to connect to required network resources. This ...
1
vote
0answers
79 views

CA certificate somehow not taken by browsers on android

This is a follow up question related to this answer. In short: I am importing the self signed Root CA certificate into android system via Settings -> Security -> Trusted Credentials -> ...
1
vote
2answers
325 views

Does the “Key Encipherment” key usage make sense when using ECDH P384?

I configured a Windows CA and created a certificate template to issue certificates with ECDH_P384 keys: Then I noticed that it's not possible to set the "Key Encipherment" key usage in the "...
1
vote
1answer
319 views

Private CA and client server authentication

I have a private application - that has one server and many clients and I want to use two way authentication(AKA client auth) I use Tomcat server and java keytool to create TLS certificates. If I ...