Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
2
votes
1answer
49 views

Is it ok to skip validation of TLS validation if the request's host is targeting localhost?

I'm writing a canary for monitoring which will be deployed to the same host as the monitored application. The underlying application validates certificates for incoming requests and validates that the ...
1
vote
1answer
41 views

Is providing a "Acceptable client certificate CA names" list a security vulnerability for a server?

The certificate list I am referring to can be found using the openssl command, and is displayed under the "Acceptable client certificate CA names" heading. I am wondering if by exposing this ...
0
votes
0answers
20 views

Hot to validate X.509 Certificate [duplicate]

A client wants to show a stream of his Motobix Webcam on his website. Its easy to show a jpg stream. But the problem is: The stream source is not protected with a valid ssl certificate. On the camera ...
0
votes
1answer
42 views

Is it possible for the public key of the issuer to be stored in a subject's certificate?

For example, assume stackoverflow.com used a certificate issued by Google who is trusted. In the stackoverflow.com certificate, its own public key would be stored. However, is it also possible for ...
1
vote
1answer
83 views

What does it mean to create a Let's Encrypt certificate "automatically" rather than manually?

I am getting the error below in trying to renew my certificate from the command line (and thus too from cron). From searching similar error reports, I understand that it means that I initially ...
1
vote
0answers
19 views

Does Java cache intermediate certificates fetched via AIA?

Java supports AIA chasing via the system property com.sun.security.enableAIAcaIssuers (which is disabled per default). There is some documentation available but it is pretty slim regarding details. I ...
2
votes
3answers
102 views

Can a SHA2 x509 cert thumbprint be spoofed/specified?

Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control. Supposing someone was able to view the thumbprint of a cert ...
1
vote
2answers
91 views

What happens if one certificate path is valid while the other one is not?

I have recently figured out that Lets Encrypt provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it ...
0
votes
0answers
52 views

Can we double encrypt VPN traffic with a custom certificate?

I want to forward VPN traffic to an Internal Proxy that uses client certificates to authenticate users. Can we add this second encryption at the VPN Configuration file for example? Or what is the best ...
2
votes
1answer
81 views

What is the security advantage of requiring the CN to be in the SAN list?

For quite a while, it has been common that the CN of a web server certificate also needs to be present in the SAN list, and new versions of browsers enforce this. So, if my CN is www.example.com, and ...
1
vote
1answer
92 views

Firewall is blocking OCSP (Online Certificate Status Protocol) check

I have a certificate issued by lets encrypt and one of the certificate in the path has this information: [1]CRL Distribution Point Distribution Point Name: Full Name: URL=...
0
votes
0answers
56 views

Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?

We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate. With help of old article oscp-must-staple I managed to create CRA with ...
0
votes
1answer
49 views

Why does length of Signatures in two certificates using same Signature Algorithm sha256WithRSAEncryption is different?

I have this recent Wikipedia certificate issued by intermediate CA Let's encrypt: Certificate: Data: Version: 3 (0x2) Serial Number: 03:95:2f:46:69:de:e4:d2:19:35:7f:f0:...
1
vote
1answer
60 views

How should I securely rsync to a host with a self-signed certificate on a private network?

I have a backup server that has a self-signed certificate (x509) and another server on the same network. I would like to rsync data to the backup server from the other server. However, I prefer not to ...
1
vote
3answers
87 views

Stolen server key on TLS intercepting proxy

TLS intercepting proxies create fake server public and private keys on the fly and sign them with a root CA. Depending on the software the keys might be cached or regenerated on each new connection. ...
0
votes
1answer
60 views

Risk Assessment of Windows Cert Store

We all know that SmartCards protect private keys much better than any software-based solution. However, when it comes to the Windows Cert Store to be compared to SmartCards: how difficult is it for ...
0
votes
1answer
82 views

Could having intermediate CA not installed to trust store be a vulnerability?

I've read through several articles and posts here and on other resources and I'm still confused. Say I have a key pair, and I got a server certificate for my public key from some trusted CA. Now I'm ...
0
votes
2answers
130 views

How does a site use the wrong certificate?

I click a link with good content (this doesn't guarantee the site isn't compromised) and Firefox gives me this error: Websites prove their identity via certificates. Firefox does not trust this site ...
1
vote
1answer
71 views

Is a OCSP request verified via TLS?

I was wondering if the connection towards the ocsp responder/server is TLS encrytped itself. Meaning that the client requesting a validity check for a certificate verifies the OCSPs server certificate?...
1
vote
1answer
74 views

problems to verify ecdsa certificate

I'm working on an application which uses ECDSA certificates. After the cert generation, they should be verified but currently the following error is received: C = CA, ST = BC, L = City, O = Corp, OU = ...
1
vote
1answer
112 views

Ramifications of including "localhost" in the subject alternative field of a x509 certificate?

Are we inviting any problems if we add localhost and 127.0.0.1 to the subject alternative name field of an x509 certificate? We are still trusting the appropriate root CA, but relaxing the rules of ...
1
vote
1answer
66 views

Wifi: Added Security Certificate After the Fact?

I'm a freshman in university, and I recently moved into residence. Pretty quickly, I logged into campus wifi so I can actually do classes and things. My laptop and primary phone logged in with minimal ...
0
votes
1answer
66 views

How can I find the list of certificates present in a set of CA stores

Someone is running an automated scan on our SSL setup and they insist that our root certificate be included in all the following CA stores: "Mozilla NSS - 01/2014" "Apple - OS X 10.9.2&...
0
votes
0answers
57 views

Using SMIME with Azure Information Protection and OME

As far as I know, SMIME encryption is more user-friendly than AIP, but there is the need to know the recipients public key (well, and even the need for them to have a public key). I would like to ...
0
votes
0answers
64 views

eIDAS qualified timestamp on email

Every document that needs to be eIDAS compliant needs to have a qualified timestamp. If we take an email as a document, then the email, based on eIDAS regulations, needs to have an qualified timestamp ...
1
vote
0answers
52 views

What's the best practice for server certificate issuance protocols in mixed environments?

In mixed Windows/Linux environments what's the best practice for issuing server certificates? If you use Windows MSCA PKI, you're kind of stuck with using previous certificates to authenticate the ...
3
votes
1answer
90 views

What can I do if I spot an EV certificate being misused?

While helping my family with their computer problems, I found a malicious executable signed by a valid EV certificate. The executable is flagged as malicious by a majority of engines on VirusTotal, ...
0
votes
1answer
113 views

Is there a reason to renew host SSH certificates?

tl;dr: In certificate based SSH authorization, is there any benefit to keeping host certificates lifespan short? Do you gain anything by renewing them periodically? Full Story Recently I have been ...
0
votes
1answer
85 views

Are problems expected when a subdomain CNAME target has no CAA record?

Consider the following DNS setup of example.com: A 89.41.169.49 # this is for redirect.pizza CAA 0 issue "letsencrypt.org" www CNAME ghs....
0
votes
1answer
202 views

Why are there no modern web browsers that allow extension access to SSL information about the site you are browsing?

In all my Googling, I found one version of FireFox that allowed it temporarily a long time ago, it has been discussed on the Chromium development forums for years, but yet, as of today, there is still ...
2
votes
2answers
172 views

Can certificates be blocked temporarily by CAs?

I am an Open Banking enthusiast and I'm studying the Berlin Group's XS2A framework these days. There, it has an error code called CERTIFICATE_BLOCKED. As the description of it, it states, "...
0
votes
1answer
107 views

I installed internet certificates on my android to connect to uni wifi, can they see what I'm doing at home?

I wouldn't have thought that certificates could be used to track my history, I thought they were essentially login credentials, but I installed some to use my Uni wifi and now my google pixel 3 has a ...
8
votes
2answers
1k views

Is SNI always used in TLS connections?

I know that even with DoT or DoH the target of the connection is leaked due to the use of SNI in the client hello (and that ESNI/ECH are proposed solutions), but what I can't figure out is does SNI ...
0
votes
0answers
42 views

Query on CMP POPO, encrypted cert and certhash

I am reading RFC4210 and trying to understand the CMP protocol. I will use the sample capture cmp_IR_sequence_OpenSSL-Cryptlib.pcap from https://wiki.wireshark.org/SampleCaptures to put forth my ...
0
votes
1answer
50 views

Relative security of using on https connection over http when the site does not have a cert implemented [duplicate]

I have a site that I would like to remotely monitor purely for the uptime status of my home network. I don't want to expose my router sign-on page to the internet, so instead, I point to the login ...
0
votes
0answers
71 views

As of August 2021, does the Expect-CT header provide any security benefit?

The MDN article on the Expect-CT header states that it is "likely to become obsolete" by June 2021 (two months ago): Note: The Expect-CT will likely become obsolete in June 2021. Since May ...
5
votes
1answer
243 views

Impact of having more X509v3 Key Usage fields than required?

I was wondering if having an "oversubscription" of "Key usage fields" inside a X509v3 certificate can negatively impact the performance and/or the security of a server. For example ...
0
votes
1answer
88 views

Do I need root access to install a certificate?

I need to have security certificates renewed soon on several RedHat servers. Will I need root access to install them?
1
vote
1answer
88 views

What are the benefits of using different certificates to identify the same service to different audiences?

Recently I was having a discussion with a team which uses a separate certificate for each different backend service that it interacts with. The backend services do client auth as well so that is what ...
0
votes
2answers
76 views

PCI DSS Compliance and Firewalling Dynamic Hosts with MITM Certificates

Question Would using a firewall MITM capability to inspect all HTTPS web requests be against PCI compliance/rules? Further Info We have an issue where we need to allow access to some HTTPS sites on ...
0
votes
0answers
45 views

How Does it Work - User Authentication using Yubico Smart Card (Yubico PIV) on Mac

Background: I have setup my macOS Catalina so that I can authenticate my user account using my Yubico (set up as a Smart Card) and its PIN After setting this up I can see that there are now 2 ...
1
vote
1answer
104 views

OpenSSH AuthorizedPrincipalsFile Allows Any User

I am bewildered as to the below config and subsequent behaviour. /etc/ssh/sshd_config: AuthorizedPrincipalsFile /etc/ssh/principals /etc/ssh/principals: all host.example.com dev This allows me to ...
0
votes
0answers
61 views

Using DPAPI in order to extract a certificate private key and create a pfx file

What is the reason to use DPAPI in order to decrypt the certificate private key and create a pfx file like explained here howto-~-decrypt-EFS-files over using the Crypt functions like Mimikatz uses (...
0
votes
2answers
85 views

How can I install a self-signed star cert with a self-generated root CA that openssl will verify against?

I'm trying to test some services and they need to talk to each other over https ( and they can't talk over http). I want to: create a Root CA that I can install in my Ubuntu-based docker images sign ...
1
vote
0answers
308 views

"Failed connecting to the YubiKey. Make sure the application has the required permissions." [closed]

I have a Yubikey version 5.2.7 and I can't generate any new certificates on yubikey manager app, which is weird since I have already generated two certs (on 9d slot) and they worked fine. Now the ...
1
vote
1answer
58 views

Software signing : multiple certificates

I'm quite new to the cryptography field, and I'm trying to understand a few things: I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below: I'm ...
0
votes
1answer
85 views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
0
votes
2answers
140 views

What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?

While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command: openssl req -new -addext &...
0
votes
0answers
50 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
1
vote
1answer
140 views

How may I check if an expired certificate was valid at the time?

I have an old let's encrypt (but disregard that, it could be any) certificate that is no longer active. How may I check if it was valid at the time?

1
2 3 4 5
54