Questions tagged [certificate-authority]

A Certificate Authority is the collection of hardware, software, and people responsible for issuing certificates in a hierarchical PKI. CAs may be public, as in SSL / TLS and government IDs, or private, as in corporate infrastructures. The primary responsibility of a public CA is to verify the identity of an applicant before issuing them a certificate.

Filter by
Sorted by
Tagged with
5
votes
1answer
256 views

Google certificate and CAA

I am fiddling around with certificates, trying to harden my own sites. When doing so, I noticed that Google have some weird configuration of their CAA. Looking at their ssllabs results, or using ...
4
votes
3answers
2k views

How to Check for Dangerous Authority root Certificates and what to do with them?

I started my exploration after I saw that one program adds some lines to certmgr.msc (PC wasn't connected to the Internet, so, I don't think, that this cert can be downloaded by MS). Installer of the ...
4
votes
1answer
308 views

Is it a good idea to generate certificate-specific CRLs? What is this technique called?

Suppose I create 3 certificates with the following CRLs Cert1 http://crl.server.com/batch1/root1.crl Cert2 http://crl.server.com/batch2/root2.crl Cert3 http://crl.server.com/batch3/root3....
4
votes
1answer
2k views

What happens to a certificate's Basic Constraints when a policy map is used?

One feature of a Basic Constraint when applied to a certificate (CA or end certificate) is that I can specify the maximum number of CAs that are permitted in the chain. I'm planning on having a 2 ...
4
votes
1answer
112 views

How are root CA revocations handled?

Considering some CA certificates are hardcoded into operating systems, I was wondering what happens when one of these hardcoded certificates is revoked (put on a revocation list for example) because ...
4
votes
1answer
1k views

Check root certificates and certificate authorities on new PC

First Lenovo was caught shipping Superfish with new PCs, which included a universal self-signed certificate authority, and now Dell has been caught shipping PCs with a similar root certificate. What ...
4
votes
1answer
3k views

Different SSL states as seen by Safari, Chrome and Firefox

Today, I visited some sites of the German DHL group. While Chrome and Safari complain about an invalid certificate of Firefox accepts it. Which one is right, which one is wrong? Which decision ...
4
votes
1answer
359 views

Should my company change the internal Root CA hash method from SHA-1 to SHA-2?

My company have a Root Certificate Authority which is installed on a Windows Server 2003 and uses SHA-1 as hash method. We will migrate to Windows Server 2012. Checking the root certificates of my ...
3
votes
2answers
225 views

SSL Certificate Signing by a CA

Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return. What I don't understand is what, exactly,...
3
votes
2answers
530 views

Can a CN-only certificate bypass a name constraint if the CA goes rogue?

I am trying to cross-certify an internal issuer certificate, adding a name constraint for our domain. However, it seems that an attacker could bypass this protection by putting the desired host name ...
3
votes
3answers
1k views

Employer wants me to install root certificate to work remotely - privacy concerns?

My new employer wants me to install a root certificate on my computer as trusted in order to work remotely. I believe it is to use Cisco AnyConnect vpn. I don't really have a clear understanding of ...
2
votes
1answer
3k views

How do I get a third-party-signed ssl client certificate?

I've been given a requirement of providing a client certificate to authenticate between two application's web services. The other application (that I don't host) is requiring an SSL client certificate ...
2
votes
2answers
596 views

How is intercepting my own HTTPS traffic possible?

I have a slight misunderstanding in the way TLS works. I know that I can use Burpsuite Proxy to intercept HTTPS traffic coming from my browser. How is this possible when the server is going to see the ...
2
votes
1answer
9k views

How do I use OpenSSL with the Java Keytool?

I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
1
vote
1answer
3k views

Certificate validation to multiple Root Certificates?

I found this article and stumbled upon the part: So if a client trusts either of the G5 certificates as a trusted root, it will trust any certificate issued by a subordinate CA such as the G3. As ...
1
vote
2answers
408 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
1
vote
1answer
198 views

Is or was it possible to register a wildcard certificate to third level subdomain?

The use of a null byte in a certificate cn is very well known… and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of ...
6
votes
1answer
19k views

OpenSSL “unable to get local issuer certificate” even when passing in the Certificate Authority

I've attempted to setup a certificate authority, and issue a certificate from that authority (with no intermediate inbetween The authority covers *.node.consul, and the certificate is underneath that ...
5
votes
2answers
157 views

How do I prepare for Certificate Authority end of business?

We are deploying a security solution which uses certificates to validate documents. These certificates are issued by our government-authorized CA. What if in a distant future, the CA who provided us ...
5
votes
2answers
412 views

Why do Symantec not believe their customers will be affected by Google distrusting this root certificate?

So Google will be moving to distrust the “Class 3 Public Primary CA” root certificate operated by Symantec Corporation, across Chrome, Android, and Google products, because it is no longer going to ...
5
votes
3answers
1k views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
5
votes
1answer
896 views

Why would Amazon include an already trusted Root CA in the bug report they filed to get into Mozilla's truststore?

Amazon will soon be a trusted Root CA. To this end Mozilla Bug #1172401 was filed a while back to get into Mozilla's trust store. Along with 4 of their own Root CAs they've included a fifth one (...
5
votes
1answer
112 views

Why does the issuance speed of a CA depend on the number of certs they have already issued?

I have seen proprietary testing results of pummelling a CA for a long time and measuring its throughput (certs issued / second). It was found that CAs become slower to issue new certificates as the ...
4
votes
2answers
208 views

Does client send request to CA when SSL handshaking?

In other words, if Certificate Authority goes down, does this mean that all HTTPS sites that purchased SSL certs from this CA will also become unavailable?
3
votes
2answers
99 views

What access does installing custom certificate file give?

I recently installed a custom CA certificate from a trusted authority to access some blocked resources. Android popped up with a message "The network can be monitored" This made me question what can ...
3
votes
1answer
3k views

OpenSSL: How to set default_crl_days to infinite / never expiring?

How can I set default_crl_days for my OpenVPN CLR to infinite days? I'm planning to issue certificates to employees and if an employee leaves the company I just revoke their certificate in my CLR. ...
3
votes
1answer
3k views

How to add AltName from csr file to crt file using “openssl x509 -req”?

I'm a webdeveloper and want to test my websites locally with a self signed SSL certificate. Everything was working great until a few days ago, when chrome started complaining about a missing AltName ...
3
votes
2answers
160 views

CSR Signing simulation

Tried a lot get my test csr signed from root CA(trial versions option), somehow i am not getting it dues to some of their internal check. Few questions that cropped up Can i somehow signed that ...
3
votes
2answers
214 views

Isn't this the same as using a certification authority?

Taken from Wikipedia, here is the pretext to my question: A certificate authority (CA) is an organization that stores public keys and their owners and every party in a communication trusts this ...
3
votes
1answer
566 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
3
votes
1answer
2k views

How do CAs generate public keys without the private keys?

When creating a CSR so you can later paste it to a CA to generate a signed TLS certificate, you first generate a private key: openssl genrsa -out your-key.key 2048 With the private key, you can then ...
3
votes
2answers
519 views

Subdomains on a multidomain EV SSL [closed]

I have a domain https://joshmurray.eu/ which has a Standard SSL certificate. I also have two subdomains: http://one.joshmurray.eu/ and http://two.joshmurray.eu/. I wish to upgrade my SSL certificate ...
3
votes
1answer
419 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
3
votes
1answer
479 views

Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?

WoSign has been in the media for offering free server and client certificates. Since one of my (free) S/MIME certificate from another CA is about to expire soon after one year and WoSign offers ...
2
votes
1answer
4k views

Generate CSR with 2 OU Names

I have to create an application which generates a CSR. While generating a CSR we are required to fill in several details like CN, OU, etc. The problem is that the Certifying Authority to which I have ...
2
votes
1answer
575 views

Signature and Timestamp for Long Term Document Archival Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity. As far as I understand, I ...
2
votes
1answer
379 views

Can we use one CA to revoke certificates generated by another CA?

I have a hierarchy of certificates which contains: root-cert server1-CA (issued from root-CA) client1-cert (issued from server1-CA) server2-CA (issued from root-CA) client2-cert (issued from ...
2
votes
1answer
512 views

If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies?

Ref: How do I report a security vulnerability about a trusted certificate authority? This question involved a serious security vulnerability at WoSign. Here's the finder's blog: http://webcache....
2
votes
1answer
1k views

Will two intermediate CAs signed by the same root CA trust each other's signed client certs?

I have two intermediate CAs that each sign certificates for their client users, like this: ROOT CA / \ / \ / \ Intermediate ...
1
vote
1answer
134 views

OCSP, CRLs, crlset - Revocation Delivery and Attacks

OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the ...
1
vote
1answer
2k views

are organizations that receive certificates considered “end entities” in a PKI?

I am trying to understand the term end-entity. Does this term just mean anybody that plays a role in a PKI system that is not a CA? So if I request a certificate from A who is a CRL issuer for ...
1
vote
1answer
306 views

Private CA and client server authentication

I have a private application - that has one server and many clients and I want to use two way authentication(AKA client auth) I use Tomcat server and java keytool to create TLS certificates. If I ...
1
vote
0answers
508 views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
1
vote
1answer
121 views

For SSL certs, is some sort of connection to the issuing CA (or other network resource) required for the SSL connection to be established?

I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL". Background: I am deploying ...
1
vote
1answer
4k views

What is the difference between a certificate, a signature and a thumbprint in case of windows exe/binaries?

I am trying to understand the difference between signature , thumbprint and certificate in context of windows executable and binaries. I looked up on internet before posting this question but I did ...
0
votes
1answer
289 views

OCSP doubts about CA and OCSP Responder

My question is about this image. Suppose that client is Alice and Server is Bob. So, basically, I'm trying to setup a scenario... I have a remote Server (Bob) that has an https website. I make: ...
0
votes
1answer
716 views

Should I be concerned if my employer is performing man-in-the-middle HTTPS attacks? [duplicate]

I have reason to believe that my employer may be performing HTTPS man-in-the-middle attacks on company-issued work laptops, as Java's SSL Certificate lists my employer as the Certificate Authority. ...
0
votes
1answer
210 views

If I have a valid certificate for xxxxx.target.com, can't I read *.target.com's cookies?

Follow up: If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies? I was asked to ask this as a separate question. This isn't a duplicate question. Okay, so ...
0
votes
1answer
1k views

Missing 'Key Usage' on a CA certificate: can sign certificates?

In Windows certificate store, an intermediate CA certificate without Key Usage extension is considered eligible (as long as it has isCA flag from Basic Constraints of course) for singing end entity ...
0
votes
1answer
551 views

Self Signed SSL Certificate - How to verify it correctly on the client side?

For our current implementation we are using a self signed root certificate, which then is used to sign ssl certificates for our secure http connection. My question relates to the verification logic ...