Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

1
vote
0answers
37 views

Is Mobile ID secure? Certificates on SIM card (Mobile identity management)

In Switzerland Mobile ID is popular. It looks like it's international known as Mobile identity management. Mobile identity is a development of online authentication and digital signatures, where ...
2
votes
1answer
53 views

Is it OK to set SSL fullchain to service

Imagine service with SSL-server authentication. There are 3 certificates in chain: Root CA certificate; Intermediate CA certificate; Host certificate. Is it ok to put all 3 certificates (fullchain) ...
0
votes
1answer
29 views

ADCS two tier PKI

Planning a two tier ADCS PKI infrastructure as follows: ORCA ____________|____________ | | | SCA1 SCA2 SCA3 one.int two.int three.int ...
2
votes
1answer
137 views

Why do VPN Providers ask for installation of Root CA?

I've seen a lot of VPN providers and they all seem to agree on one thing: ask user to install their own Root CA. I don't get why they do it. A legit server should have a certificate generated by ...
-1
votes
1answer
135 views

Why don't CAs sell certificates as files, instead of hardware or as a service?

I'm trying to purchase multiple certificates, some just signing, some just encrypting, and some a combination of the two. I wanted to purchase one signed by a CA, rather than using a self-signed one. ...
0
votes
1answer
68 views

Is there any standard that encrypts domain name of the certificate?

I guess widely used protocols today don't encrypt the domain names in TLS certificates. Does HTTP/3 and TLS 1.3 encrypt domain names of web sites?
0
votes
1answer
33 views

No certificate found alert in nodejs https server in mobile

I have created a website using nodejs . And using ssl certificate from sslforfree.com . It is working fine on desktop and i checked it in SSL Checker it is working fine . But in mobile it is showing ...
2
votes
1answer
81 views

Duplicate subject names for intermediate and root certificates

I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates. They issue multiple root certificates and intermediate ...
0
votes
0answers
20 views

Securing a large application with multiple services and endpoints

Without getting too deep into the architecture, I would like to get suggestions / good reads on applying encryption to a large scale application with multiple endpoints. There are internal and ...
0
votes
0answers
26 views

authenticating SSL client certificates on server

current setup: i have a pki setup which issues client certificates to the users (so that only clients with the certificate can access the web application). was looking for ways to implement this and i ...
0
votes
1answer
32 views

How to make sure certifi python package is up to date

In python's requests module documentation, I find this important recommendation: For the sake of security we recommend upgrading certifi frequently! Q: How can I make sure that my system's certifi ...
1
vote
1answer
40 views

Finding the reason behind an RDP Certificate Change (man in the middle attack?)

I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions. Right after doing this, I ...
2
votes
2answers
124 views

Does client have to send the CA chain along with the client certificate after ServerHello?

During the MTLS handshake, after ServerHello is done client sends the client certificate back to the server, I need to know if the client should only send the client certificate or is it required to ...
4
votes
1answer
79 views

Should TLS clients put a limit on certificate chain depth?

Specifcally, when configuring nginx to validate proxy target SSL certificates (which it mystifyingly does not do by default), a maximum cert chain depth must be specified in the proxy_ssl_verify_depth ...
0
votes
1answer
32 views

how do optional device certificates work?

i am trying to achieve this: i have a bunch of users who log in to my website. some of the user can opt to be allowed to log in using their selected devices. for this i am planning to use ssl based ...
0
votes
1answer
33 views

What could cause Location not to transfer from CSR to final certificate?

I'm using the Win32 port of OpenSSL from Shining Light Productions to operate a small personal CA, and I'm running into a weird problem. These are the commands I use to generate a client key/...
3
votes
1answer
86 views

When accepting an SSL certificate, can I limit for which domains I accept it?

Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
0
votes
1answer
57 views

PKI - CRL and OCSP

I've done quite a bit of reading about PKI in ADCS and CRL/OCSP, but I can't seem to find an answer to a small couple of questions I still have: It is clear to me that even with OCSP in place, you ...
0
votes
1answer
60 views

Certificate Matching Fields

I have imported a CA into Chrome, and I am signing my own cert with the CA's private key. Obviously, I need the Common Name of the Issuer on my Cert to be the same as the Common Name of the subject of ...
0
votes
0answers
26 views

Is Azure Key Vault more secure than the machine certificate store?

I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on ...
7
votes
1answer
1k views

A workplace installs custom certificates on personal devices, can this be used to decrypt HTTPS traffic? [duplicate]

So another engineer buddy of mine and I were having a drink the other night. He mentioned that you're allowed to use personal devices on the office wifi, but that they install a custom certificate so ...
1
vote
0answers
12 views

Client authentication (certificate + private key) using WinInet [migrated]

I'm trying to communicate in https with a server using WinInet (from the Win32 API). Here is a very minimalist code : HINTERNET ses = InternetOpenA("test",INTERNET_OPEN_TYPE_DIRECT,NULL,NULL,0) ; ...
0
votes
1answer
101 views

Why does Amazon verify a TLS certificate?

Show site information, then Connection for https://support.mozilla.org indicates Verified by: Amazon Why is this? Is Amazon spying on me?
1
vote
1answer
72 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...
1
vote
1answer
72 views

Are self signed certs safe to a developer use in local debug?

The same computer I use for work in home, is the same for personal uses (gamimg, social medias) and of course, internet banking. I'm back-end developer and recently, I started to work with fiddler to ...
0
votes
0answers
51 views

See data sent by application over https

Let's say I have an application (A) installed on my PC that communicates with some server over https. What would another application (B) on my machine need to do to be able to read the unencrypted ...
0
votes
1answer
62 views

Two message key agreement and mutual authentication protocol?

I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS. If we assume ...
1
vote
1answer
38 views

What's the correct way to handle a failure with Client Certificate Authentication

I'm adding Client Certificate Authentication to my application - what is the correct way to handle an invalid certificate, untrusted certificate or an un-mapped user ID?
0
votes
1answer
54 views

What CA signed my certificate?

I'm trying to set up a Docker image that has our internal CA certificates installed so that users across the organization can make secure requests to intranet sites. We have a few different CAs that ...
1
vote
1answer
18 views

How to use Windows User Certificate (S/MIME) to sign data

I am working on an internal ERP for my company. The portal is written in PHP and the current purchasing process is the following: Create a new order on the ERP portal Print the order (PDF) Ask for ...
1
vote
2answers
76 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
1
vote
2answers
111 views

Is accessing by IP address without CA certificate secure?

If my server doesn't have a public domain name, and users access it via IP address, is using a self signed certificate (ignoring the warning) secure enough for https/ sftp? I am talking only from ...
1
vote
1answer
167 views

Insufficient serial number entropy in GoDaddy certificate

I came across this article last night regarding SSL certificates and issues with the serial number not being long enough. Here is a status report from GoDaddy. According to their csv file, our sites ...
0
votes
1answer
60 views

Send a redirect after HTTPS certificate rejection

I would like to create a chain of HTTPS 302 redirects to a series of domains (for research purposes). I want also to make sure that I can do a redirect if one of the certificates in my chain has been ...
1
vote
1answer
40 views

Distinguish the end-entity cert in a PKCS#7 (P7B) cert chain

Is there a standard/definitive way to distinguish the end-entity cert in a PKCS#7 (P7B) cert chain? I believe the PKCS#7 standard doesn't not specify sequence when ordering the certs in the chain, ...
2
votes
1answer
52 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
0
votes
1answer
30 views

Usage of SSL_CTX_use_certificate

While building a context through openssl, if I do not provide a certificate by using the function SSL_CTX_use_certificate, would all the connections from that context default to anonymous diffie-...
2
votes
1answer
66 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
0
votes
0answers
23 views

Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?

I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
0
votes
0answers
28 views

Proving that a certain site had given page at certain time [duplicate]

Lets someone opens https://foo.com and saves the page using "save page as". Is there any way to prove later that the locally saved files have not been altered assuming that we trust the server public ...
0
votes
1answer
124 views

Windows Server: Import HSM-backed certificate into second server

Scenario: Using Amazon CloudHSM with CloudHSM Windows Client installed and configured. Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider. Submitted ...
0
votes
1answer
48 views

Explanation of the authentication procedure when using signed certificates [duplicate]

I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT. On my device side, I have a device certificate ( deviceCert.crt ) and the device ...
0
votes
0answers
63 views

Am I safe after importing Bitdefender's fake certificate?

I installed Bitdefender today and suddenly I couln't navigate to numerous websites that I used to visit (I use Mozilla Firefox). I got the error: SEC_ERROR_UNKNOWN_ISSUER. I searched a bit and found ...
2
votes
3answers
68 views

SSL authentication unexpectedly failing - could this be caused by SSL Inspection/Fortinet?

I'm dealing with an SSL issue that's been plaguing me for several days. I know relatively little about security, so if anyone here could lend a helping hand I would be extremely grateful. Ultimately ...
1
vote
0answers
57 views

Why is digital signature enforcement on webservers not common practice?

Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
0
votes
1answer
33 views

truststore and intermediate certificates

We have a situation where our on premise product talks to a third party external API over SSL. This API has a certificate which is issued by an intermediate. We use the default java cacerts truststore,...
1
vote
0answers
82 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
1
vote
0answers
63 views

Replying to a digitally signed email using thunderbird

So Basically I sent a digitally signed email using a certificate issued by Sectigo RSA Client Authentication and Secure Email CA. Now the recipient of the email replied to me with a certificate ...
2
votes
2answers
98 views

Server certificate proving client identity

When we look at StackExchange's server certificate (by clicking on the Lock icon), it says: This certificate is intended for the following purposes: Ensures the identity of a remote computer. ...
0
votes
1answer
65 views

TLS certificate decoding

Anyone familiar with certificate decoding? I seem to have 3 more bytes at the end of a certificate than the length indicates. I have 3 certificates in the chain. The first one is 0x645 bytes, ...