Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0 votes
2 answers
63 views

What can happen if lifetime info is not included into an X.509 certificate?

When a certification authority generates a signature, but if the message to be signed does not include the lifetime information (period of validity), what can happen in terms of security being ...
user avatar
0 votes
0 answers
38 views

How to determine validation process of a certificate used by a website using HTTPS?

When visiting a website that uses HTTPS, we can see its certificate in the browser. But how can we know for sure which validation process the company or domain behind the website has gone through? ...
user avatar
  • 15
0 votes
1 answer
26 views

IdP Personal/Signer Certificates

We are implementing SAML/OIDC-based SSO across our enterprise and wanted to get a feel for best practices when it comes to using Personal/Signer Certificates within our IdP. Historically we've ...
user avatar
0 votes
1 answer
65 views

Why my certificate is still not recognized by some hosts?

My website certificate is not recognized by all hosts. I already scanned here https://www.ssllabs.com/ssltest/analyze.html?d=eleicoesjustas.org. Is that because of Java trust store? Unfortunately some ...
user avatar
  • 203
1 vote
0 answers
39 views

How to renew intermediate Sub CA certificate? [closed]

The intermediate sub-CA certificate is expiring mid 2023 and the root CA certificate is expiring in 2028. How to renew the intermediate Sub CA? Or is it auto-renewed? If Yes then how and where do I ...
user avatar
0 votes
1 answer
57 views

Real time domain verification through DV cert or DNS check?

I want to add an extra layer of security/validation into our app/network. I plan to do some mTLS in which we will provide customers with a certificate to use in the TLS handshake. However, I want the ...
user avatar
  • 101
0 votes
0 answers
18 views

ChaCha Single-Use RNG with All Zero Plaintext + Nonce

I am creating an internal application that will be used to generate and manage self-signed certificates and certificate authorities. Its primary use will be for generating certificates used in SSL ...
user avatar
  • 135
2 votes
1 answer
95 views

How do I ship my SSL keys with my application?

I have an executable, and I have the SSL certificates and keys necessary to establish the secure connection. The application performs self-updating by downloading and replacing itself with an updated ...
user avatar
  • 121
3 votes
1 answer
43 views

Name Constraints, empty sets in permitted subtree (RFC 3280 vs RFC 5280)

I'm trying to understand the effect of empty sets in permittedSubtrees in both, RFC 5280 and RFC 3280. There is something that doesn't compile in my head. Scenario: We have a CA certificate with the ...
user avatar
  • 5,720
0 votes
0 answers
45 views

Database TLS and certificates clarification

Is this behaviour of MongoDB secure? Database TLS is turned on and the client's cert .pem is loaded on the machine. When the client-side app is launched and communicating with the database, the cert ...
user avatar
1 vote
2 answers
52 views

Any security concerns when importing self-signed certificate to Trusted Root certification Authorities store?

I have an ESXi server that is using a self-signed certificate, and the browser gives a warning that SSL certificate cannot be trusted. I want to put that cert into the Trusted Root Certification ...
user avatar
  • 13
0 votes
0 answers
34 views

SSL certificates their public keys and thumbprints

I want to use mTLS, so for testing I created simple API. I wanted to check if I will receive the public key of the certificate after the client sends the certificate to me (the server) as I want to ...
user avatar
0 votes
1 answer
23 views

mTLS with OpenID Connect and validating self-signed certificates

OIDC says mTLS can be used to authenticate the client. But I haven't read anywhere whether the OIDC Provider is supposed to accept self-signed SSL certificates. Are there any dangers to accepting self-...
user avatar
0 votes
0 answers
32 views

How to authenticate a device without users or user input, with changing IP adresses

We have a series of applications that simply show information. In order to fetch this information, these applications need to reach our servers. We block every connection, except connections from a ...
user avatar
1 vote
1 answer
92 views

Is the certificate of this Windows EXE really invalid?

The file can be downloaded from: https://www.vpay.co.kr/eISP/install/VPWSSetup_C.exe This is some stupid "security" ActiveX control that Korean government mandates for web commerce. On ...
user avatar
-1 votes
2 answers
65 views

Why a malicious ISP/government would need to install certificate on users' devices instead of any device in the middle of the data transit route? [duplicate]

Let's say a country or ISP is malicious, forces citizens/users to install trusted root certificate on their devices so they can view all HTTPS traffic, but why is this even necessary? why can't they ...
user avatar
  • 15
0 votes
0 answers
21 views

Is there a way to find out which certificates came preinstalled with Windows and which ones installed afterwards? [duplicate]

I'm looking for a way to find out which certificates, whether machine level or user level, came preinstalled with Windows (when using official Microsoft ISO file to clean install the OS) and which ...
user avatar
  • 15
0 votes
1 answer
74 views

Strange Root CA certificate in Windows Trusted Root CA Store

While reviewing Root CA certificates in Windows Trusted Root CA Store I came across a stange Root CA certificate with Issuer Desktop-XXXXXXX and Subject Desktop-XXXXXXX, enhanced key usage for server ...
user avatar
  • 1
0 votes
0 answers
25 views

How can I request a certificate from an internal CA if my machine is Azure AD joined?

I'm using Ghostpak's Certify to discover vulnerable certificate templates on an internal certificate authority named certauth.megacorp.local. I've found a vulnerable template and was successfully able ...
user avatar
0 votes
1 answer
96 views

What is this certificate I found on my computer and can I delete it?

I noticed an error in my event viewer logs about certificate with specific thumbprint unable to be renewed. After I dug some more, I found that the certificate in question was accompanied by two other ...
user avatar
0 votes
0 answers
30 views

Examples of private key leakage / compromised keypair resulting in certificate revocation

I am looking for some examples of private key leakage or compromised keypair (via insider attack, configuration mistake, etc.) that lead to certificate revocation. I am particularly looking for cases ...
user avatar
0 votes
0 answers
30 views

Retrieve list of trusted server public keys during an application run

I'm trying to implement a mechanism that allows me to maintain a list of SSL server certificate public keys that have been verified as trusted during an application run time. For example: Application ...
user avatar
  • 111
0 votes
0 answers
23 views

Use a remote certificate (on other computer) for mTLS transaction

I have an USB Token (brand 3SKey) containing a certificate "C" with its private key stuck on a machine "A". The certificate's private key is obviously not exportable and I'm not ...
user avatar
  • 101
0 votes
2 answers
57 views

What is CA response after giving them the CSR?

I'm trying to understand the logical flow of SSL certificate. Suppose I have a website running on a machine. I generate a CSR file that contains information (e.g. common name, organization, country, .....
user avatar
  • 103
1 vote
1 answer
42 views

Comparing ACME client logs against Certificate Transparency logs

Inspired by this comment from Can DDNS provider perform a MITM attack?, I was wondering if there is an automated way to check the Certificate Transparency logs for malicious/unexpected certificates. ...
user avatar
  • 531
1 vote
1 answer
45 views

Identification of weak and anonymous ciphers with openssl

I'm doing two tests using the openssl s_client command to identify anonymous. I did two tests: One first test: I'm using the following command to anonymous ciphers: openssl s_client -cipher aNULL -...
user avatar
1 vote
2 answers
57 views

OAuth2 - What is the advantage of using certificate over client secret credentials? (Azure)

When using OAuth2 in Azure, why Certificates are more secure than using Secrets? The Secrets have expiration and are strong, and generated automatically. The application needs to send a JWT containing ...
user avatar
  • 111
0 votes
1 answer
94 views

Make certificate and private key available only to a single app

I want to make a smart card reader app, that sends read data to a server. In order to be certain in the integrity of the data, I want to use a client certificate to communicate with the server and I ...
user avatar
1 vote
1 answer
46 views

Best practice for "stateOrProvinceName" in certificate

In RFC-4519 stateOrProvinceName is abbreviated to ST. Should we assume that it is best practice to put ST=<name-of-state> in the certificate if the state or province is indicated? After all X-...
user avatar
1 vote
2 answers
109 views

Is it a risk to allow security or privacy apps to install a certificate and filter HTTPS?

I recently installed the AdGuard app on Windows and Android. It wants to enable HTTPS filtering and install a certificate. I've seen antivirus do similar things. How exactly does this work and what ...
user avatar
  • 11
0 votes
0 answers
54 views

How to trust CA chain with sub-CA intermediate

I have a development web server that I need to add trust certificates on my local machine. Http connections to server https://machine-name.a.b.local/ show an SSL issue. This is the cert chain: ABCD-...
user avatar
0 votes
1 answer
42 views

Is it possible to trust a certificate authority ONLY when a specific domain is accessed?

I would like to know if there is a way to only trust a CA only when a specific domain is being accessed, eg. wikipedia.org. I'm using Chrome, and I'm not really tech savvy so the simpler the solution ...
user avatar
  • 3
1 vote
2 answers
83 views

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Here is the scenario, just wanted confirmation that I am understanding it correctly. I have a TLS certificate that will expire soon; Upon renewal, I paid the CA, and they reissued me with a new public ...
user avatar
  • 307
1 vote
1 answer
35 views

Export ECDSA certificate from Windows Store

I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
user avatar
0 votes
0 answers
57 views

Client Identification using Self Signed Certificates

Taking the concept from the Gemini protocol that allows clients to identify themselves using their own self-signed certificate - is this a valid concept that could be used in other protocols and what ...
user avatar
1 vote
1 answer
57 views

Certificate warnings on websites with client certificate authentication

I have been operating websites that use client certificates to authenticate the users. To my understanding, you need to make your own CA. First of all, that way an attacker will have huge troubles to ...
user avatar
  • 305
1 vote
1 answer
45 views

Adobe uses CA signature type as identifier on signatures created with user certificates

I am testing several PKCS12 keystores with ECC type keys, generated by a CA with RSA key, to sign PDF documents. I have also tested with my own certificates from a demo CA certificate. I use Adobe ...
user avatar
0 votes
1 answer
74 views

Are self-signed certificates better for local usage?

When generating a certificate what would more secure - generating a self-signed certificate using PGP or using a public CA like Let's Encrypt? We are using it for signing and encrypting. What are the ...
user avatar
  • 212
0 votes
0 answers
95 views

I was asked to install an SSL .cert in my server, should I do this?

I am trying to connect to a company's internal API (I am working on a project for them). This company has an API that has an SSL certificate from Sectigo. From what I have gathered is a pretty well ...
user avatar
  • 101
0 votes
1 answer
135 views

How to perform MitM against SSL/TLS when certificate owned?

Performing a local network man-in-the-middle (MitM) attack is fairly straightforward, especially when the traffic is unencrypted HTTP. There are other approaches to encrypted SSL/TLS HTTPS connections,...
user avatar
0 votes
1 answer
158 views

Check public key certificate [closed]

I have created public, private keys and a self signed certificate with the following commands: openssl genrsa -out private-key.pem 3072 openssl rsa -in private-key.pem -pubout -out public-key.pem ...
user avatar
  • 249
0 votes
1 answer
35 views

Certificate not valid for common name?

I have a certificate with a common name of "myApi.mycompany.com" and 3 SANs: "myApi-dev.mycompany.com", "myApi-uat.mycompany.com" and "myApi-stg.mycompany.com". ...
user avatar
  • 119
0 votes
2 answers
225 views

Local Machine certificate (certlm.msc) Import - Enable strong private key protection

We were trying key export from Windows Certificate Store as part of a certificate module development. The code is in C++ and mostly WinCrypt and openssl APIs are used. I installed a certificate that ...
user avatar
2 votes
2 answers
81 views

How to add extension to existing TLS certficate?

We have our own root certificate authority which is used to sign the certificates for the agents connected to our server. We have generated the root certificate authority using keytool command as ...
user avatar
0 votes
0 answers
47 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
user avatar
  • 101
0 votes
0 answers
1k views

security certificate does not specify Subject Alternative Names

We have a Windows Server 2016 that we use as a web server hosted on premise and we host numerous web applications under the Default Web Site in IIS. All applications are reached by using the server ...
user avatar
  • 101
0 votes
1 answer
45 views

Multi Domain SAN or single SSL certificate

I want to use a multi-domain SAN certificate for 5 of my public-facing domains. All of these domains point to the same ingress server (SSL is terminated at the load balancer), but the backend ...
user avatar
0 votes
0 answers
41 views

Certificate encryption and hash algorithm [duplicate]

I was creating self-signed certificate with OpenSSL and had to choose encryption and hash algorithm. Are those algorithms used for encryption between client and a server? If not, then what are these ...
user avatar
  • 1
7 votes
1 answer
558 views

How can a .exe be modified and still keep a valid digital signature?

When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true. ...
user avatar
1 vote
3 answers
56 views

Auto-certification of internal services, does it make sense?

I work for a big insurance company, they have created a certification authority to generate certificates for their internal webservices. These webservices are accessible from their intranet only and ...
user avatar
  • 113

1
2 3 4 5
55