Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
0answers
30 views

What are the risks of a client application not verifying the server's certificate in an internal network?

Suppose the following: I have a domain controller (DC) in my corporate network (ACME.local). The domain controller has a self-signed/internally generated certificate, obtained through ACME's PKI. I ...
-1
votes
0answers
51 views

How does a Certificate Authority read your Certificate Signing Request? [closed]

My understanding is that a Certificate Authority uses an applicant's CSR to issue the applicant's server a signed certificate. However, the CSR is encrypted, so how is the CA able to use it?
0
votes
1answer
32 views

Is there any additional overhead over using Oauth vs Client Certificates?

I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. ...
0
votes
1answer
53 views

Do certificates contain private keys or other sensitive data?

Generally speaking, are certificates always non-sensitive? In the form of x509 certs, it's really just a public key and some metadata right? I see some things that call "certificates" the ...
0
votes
0answers
33 views

register a X.509 self-signed certificate

I have two parts that need to perform mutual authentication. However, the certificates are self-signed and so the parts must register their certificates each other. Does anyone know how this procedure ...
1
vote
1answer
63 views

Which factor of authentication is an X.509 certificate

Given 3 factors of authentication: Type 1: something you know Type 2: something you have Type 3: something you are Which factor of authentication would be an X.509 certificate, assuming this ...
0
votes
0answers
37 views

Finding certificate and chain of certificate from cer files

I have 3 certificates, 1) A.cer a) Subject CN = A Gateway b) Issuer CN = B CA 2) B.cer a) Subject CN = B CA b) Issuer CN = TCA 3) TCA.cer a) Subject CN = TCA b) Issuer CN = TCA All .cer files ...
4
votes
1answer
59 views

Is it possible to use Certbot for automating SSL certificates with CAs other than Let's Encrypt?

Is it possible to use Certbot for automating the renewal process of the SSL certificates with CAs other than Let's Encrypt?
1
vote
1answer
56 views

Sending the client certificate with the client hello to the server

With client authentication the client sends the certificate after the client and server hello. Is it possible to send it already with the client hello, so the server does not even answer with a hello ...
0
votes
2answers
146 views

How can I determine if my employer is using their security certificate to MITM employees' HTTPS connections?

My employer recently changed their WiFi network set up, and they now require accepting a certificate in order to connect. Is there any way that I can check if they are performing a MITM attack to spy ...
-1
votes
0answers
16 views

How To Generate An OV - Extended validation certificate using OpenSSL [duplicate]

I Want To Generate A Ov Cert With The Authority PmzDevENV But I Cant Find Out How (I Want To Use OpenSSL) I Want To Do This So That PADLOCK PmzDevENV [US] Will Appear In The Browser
3
votes
0answers
72 views

Is this nginx config suitable to enforce proper authorization?

Scenario I have a website secret.example.com, which contains information which must not be disclosed to third parties. In order to protect the information, TLS client authentication was chosen. ...
14
votes
1answer
3k views

How does this unsigned exe launch without the windows 10 SmartScreen warning?

So, I have been working on my own project for which I have been looking into certificates and such. While browsing reddit I found a game which I can launch the exe file, expecting to get a Windows 10 ...
5
votes
1answer
67 views

Why install a certificate in the Trusted Root CA of the server?

As part of configuration tasks I am doing at work I am having to learn more about how https works and how to set things up. One bit that I am not sure about is the need to install a certificate in the ...
16
votes
5answers
2k views

Why does HTTPS not support non-repudiation?

I stumbled into this recently for a specific project I had in mind. I thought HTTPS would prove that a given content actually came from the origin, by having its contents always signed before transfer....
1
vote
1answer
65 views

Make openssl list root CA certificate

I want openssl to list entire cert chain, including root CA, when executing: openssl s_client -showcerts -connect host:443 However, this is not the case. Depth 2 cert root CA cert is not included: ...
0
votes
1answer
48 views

Difference between private key exposure and tampering in mutual authentication

Consider a remote and local system doing mutual authentication either by TLS through server/client certificates or similarly wireguard. What are the differences when the private keys (in particular ...
3
votes
3answers
171 views

What capabilities does the Kazakhstan root CA have which other “trusted” CA's don't?

Kazakhstan recently tried to force users again to install a root CA. This has been rejected again by numerous western tech companies. https://www.engadget.com/tech-giants-browsers-block-kazakhstan-web-...
2
votes
2answers
59 views

Practical usage of CRL(Certificate Revocation List)

Does the CA need to mandatorily publish the new CRL file even though there are no new certificates that have been compromised since the last CRL published? If CA needs to publish the CRL's ...
6
votes
0answers
259 views

SolarWinds Orion SAML compromise mass cert update

SolarWinds Orion customers have suffered some network compromises according to news reports. One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
0
votes
1answer
47 views

How can I locate and purchase SSL certificates that contain a specific trust chain?

I am dealing with a unique scenario where I have a mobile app that is unable to be updated on the App Store and has implemented SSL pinning. The issue is that the app pins against Lets Encrypt, which ...
1
vote
1answer
43 views

Deletion of trusted root certificate store folders in a product

I'm developing a headless linux based industrial safety product. It is very much limited to work with only known sources/hosts. Can I safely delete the trusted root certificates provided by the OS and ...
0
votes
1answer
73 views

offline root CA workflow

I have reviewed several discussions here regarding offline root CA management. While useful, none quite capture my question. Firstly it presumably would not be generally assessed as an 'offline' root ...
0
votes
1answer
56 views

Spoof publisher info on Windows applications

Let me start by acknowledging that I have absolutely no experience with Windows development and this is purely for academic purposes. I apologize for incorrect terminology and welcome corrections or ...
0
votes
1answer
43 views

How to generate a config file from a .csr using OpenSSL (or other)?

I want to export the configuration details from an existing CSR or Certificate to a config file which I can use with OpenSSL to generate a new CSR. Background Our CA has changed. For the old one, I ...
8
votes
2answers
1k views

Chrome allow insecure localhost

I have just stumbled upon what is a very helpful flag in chrome (for developers): chrome://flags/#allow-insecure-localhost The flag is described as: Allow invalid certificates for resources loaded ...
3
votes
2answers
94 views

x509 restrict the intermediate CA to sign only end user certificates

I am trying to restrict the intermediate CA to sign only end user certificates. However, I am not able to do so. Man page of x509v3_config says basicConstraints=critical,CA:TRUE, pathlen:0 A CA ...
0
votes
1answer
43 views

How do I avoid the initial text portion when creating a PEM certificate with openssl? [closed]

I've created my own CA with openssl. The problem I'm having is that when I sign a CSR and generate a PEM certificate with it, there is an initial text portion in the certificate where I was only want ...
0
votes
1answer
60 views

Trust store management best practice

A typical scenario: a big company with lots of servers in all shapes and colors (on-premise, private and public cloud) Each server (or rather each service) needs to maintain a trust store (a file in ...
0
votes
3answers
81 views

Does a X.509 Certificate contain an ID of the Private Key?

Does a X.509 Certificate contain some kind of ID that is associated with the Private Key that was used to create the Certificate? So if i had a database of all my Private Key IDs, i could then look at ...
1
vote
2answers
118 views

How do you get a CA trusted by Certificate Transparency logs?

How would one go about getting in contact with a popular CT logs operator's, let's say Google Pilot, and how would one get a CA root included in their log? Are there open CT logs that allow untrusted ...
1
vote
0answers
106 views

OpenSSL OCSP Responder “Cert Status: good” -> “Cert Status: unknown”

Summary: Certificates calling to OCSP Responder (OCSPr) have their "Cert Status" change from "good" to "unknown" with no known to changes to environment. Completely lost ...
37
votes
2answers
7k views

Why do SSL certificates have country codes (or other metadata)?

Is there an effect of a certificate, or the request for, having the wrong country code? How about the other metadata? Effects can be legal, technological, anything. I could almost imagine a web ...
-1
votes
1answer
47 views

securing certificate based authentication for linux and windows applications

I am wondering what are the possible options for the following: Let's say you have a software-agent you want to deploy on systems running both on Windows and Linux, e.g. an agent written in C++. Let's ...
0
votes
2answers
60 views

What does the HTTPS server verify when it asks for a client certificate?

I assume that the only thing the server checks is whether the IP on the certificate matches the one for the current TCP/IP connection and that the certificate is signed by an authority the server ...
0
votes
1answer
66 views

Why must I send certificate and private key when make HTTPS requests? [duplicate]

In my company, we are issued .p12 files and extract the certificate and private key like so: openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys openssl pkcs12 -in path.p12 -out newfile....
0
votes
1answer
60 views

Is an IP not being redirected to it's associated domain considered unsecure?

I've got a server that has domain and an SSL Certificate issued to that domain. It's expected behavior that when an IP address is browsed, it redirects to the domain name of the server and the SSL ...
0
votes
1answer
43 views

Client Cert Authentication: Accept cert in request or retrieve from host?

Is it more secure to retrieve a client cert from their host rather than accept the cert presented in request? Example: B2B Client pre-shares public cert with me I store public cert in database Later, ...
0
votes
1answer
31 views

Can lower level intermediate cert declare SAN that broader than higher level cert?

Suppose 1st level intermediate cert specifies DNS=www.dev.com Can 2nd level intermediate cert which is signed by the 1st level specify DNS=*.dev.com or maybe DNS=*.dev2.com? Does certificate level ...
2
votes
2answers
156 views

Certificates(CA certificate and EE/Local certiificate)

There is a small confusion related to CA certificate and Local certificate. I had asked a similar question before. This time, its a little specific. For authentication using PKI, below are the steps. -...
0
votes
1answer
30 views

Separate certificates on a local machine for each service

I'd like to know if it's possible to have a separate certificate on a local machine, one for a heavy client and the another one for the web browser to be sure the correct client communicate with the ...
2
votes
0answers
36 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
19
votes
7answers
4k views

Is there a protocol that provides data integrity, but not encryption for HTTP?

HTTP I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed. HTTPS On the other hand, HTTPS sends encrypted text over the network that can ...
2
votes
1answer
73 views

Any disadvantages to long-lived self-signed certificates for personal use?

I run my own IMAP server on my own machine, and am the only user of it. The server uses a self-signed certificate that I generated with OpenSSL. I don't use the certificate for any other purpose. I ...
6
votes
2answers
2k views

How to block requests in web app when certificate is insecure?

I am developing a web app and wanted it to be secure from attacks from the application layer. Currently, my website is allowing interception from Burpsuite like certificate proxy software. Is there a ...
2
votes
1answer
291 views

What is the correct terminology for a private key corresponding to a public key certificate?

I have learned that the certificate is something that contain information about a public key. An article on wikipedia says Public Key Certificate as well. If we are talking about private key, it's not ...
0
votes
1answer
45 views

CA cert with many Subject Alternative Name (SAN) entries, versus individual certs in public production?

I'm looking into creating a CA certificate strategy where i work. And i was wondering if anyone had any points of interest to raise around the difference of a model where our .com and key subdomains ...
0
votes
2answers
75 views

How does encryption, certificates in an end to end SSO flow?

So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
0
votes
0answers
43 views

How to pin public keys in current browsers

Public key pinning is deprecated. Is there still some way to pin keys on browsers like chrome, edge, firefox? For chrome I can add sites to a hsts or expect-ct list. But there is no way to pin keys or ...
0
votes
1answer
50 views

MFA using PKI certificates [closed]

I'm trying to set up a multi factor authentication using PKIs certificates. A PKI infrastructure is ready to use and i'm planning to put these certificates on smart cards. I was looking for a smart ...

1
2 3 4 5
51