Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Setting up OID for the CSR and the CA [duplicate]

I am currently trying to setup a Apache2 Server with the prompt to have a specific OID which is this one: The CSR generation with the OID works with the -addext flag: But i have Problems with the ...
0 votes
0 answers
23 views

Which is more secure: Certificate or Secret inside our Azure Active Directory App, and why? [duplicate]

Inside our Azure Active Directory, we have 2 options to secure our calls to the Active Directory App: Secret Certificate Which option is more secure and why? Inside our applications which will be ...
  • 237
0 votes
1 answer
69 views

HTTPS/TLS security with an invalid certificate

I'm trying to use a site that's https but has it's own certificate, and when I add an exception it still shows it as unsecure, with an exclamation on the padlock and when I click the padlock it says &...
  • 13
1 vote
1 answer
48 views

Does defining "a minimum path length" for certification validation have any security benefit?

As you may know, Common Criteria (AKA ISO/IEC15408: A standard for IT Security Evaluation) have provided some security base-line documents named "Protection Profile" for software developers ...
1 vote
1 answer
35 views

What problem does "max_path_length" attribute in certificates are going to solve?

I'm trying to understand the purpose of defining pathLenConstraint and max_path_length in RFC5280 (Internet X509 PKI Certificate and CRL Profile): For pathLenConstraint The above mentioned RFC states: ...
2 votes
1 answer
59 views

Can an Intermediate CA extend its "Certificate Key Usage" by issuing a new certificate for itself?

I'm trying to understand the purpose of defining self-issued certificate concept in RFC5280 (Internet X509 PKI Certificate and CRL Profile): Regarding this concept the RFC states: This specification ...
0 votes
2 answers
49 views

Keys vs Certificate & x509 vs GPG

I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG. Where I get lost is how the certificate comes into play and what ...
  • 3
0 votes
1 answer
38 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
1 vote
2 answers
54 views

How do I create a Client Authentication Certificate without a domain signed by a commercial CA?

For sending soap messages to a webservice we need to include a client authentication certificate with these messages. Normally we simply created a self signed client auth. certificate (with as a ...
0 votes
1 answer
56 views

What mechanisms exist to detect compromised default certificate private signing keys?

This is partially a follow-up to the these questions: Is visiting HTTPS websites on a public hotspot secure? Can free Wi-Fi hotspot providers snoop on HTTPS communications? I understand of course ...
  • 101
0 votes
0 answers
20 views

client side certificate installed on ios 16 are not being sent by browsers on that device when a server requests for a identity cert

I have a client side certificate from cloudflare (non-root) that i install on our devices in order to gain access to our sites that ask for a client side certificate from browsers. This works ...
0 votes
0 answers
24 views

What security risks would arise from someone else using my certificate without my knowledge? [duplicate]

Apologies if this has already been asked but i couldn't find a clear cut answer. Please keep in my mind i'm not very technical but am learning. So let's take scenario where i have a subdomain "...
0 votes
0 answers
17 views

X509 Client certificate - before - XEnroll / Certenroll / KEYGEN

Short story... IBM(now HCL) Domino have since way back a complete procedure to issue X509 client certificate as a login option to webserver. Back in 2010-ish it worked fine in both Firefox and ...
5 votes
1 answer
814 views

Can Namecheap get certificates issued for my domain without my knowledge?

I bought a domain on Namecheap a few weeks back and now that I want to set it up, I visited my domain on the web and discovered that it had a valid cert issued and was pointing to an unknown site. The ...
  • 153
2 votes
2 answers
86 views

Can a client script (running within a webpage) provide to the browser a certificate to accept in a wss:// connection?

Can a client script provide to the browser a certificate to accept in a wss:// connection? The WebSocket constructor does not seem to have many options. (I am designing an IoT server that lets the ...
0 votes
1 answer
52 views

Man in the middle attack on response from server [duplicate]

Let's assume that I am logging into my Gmail account from my browser using my username and password. I know that my input will be encrypted using Google's private key and the only one who can decrypt ...
2 votes
1 answer
67 views

Determine if the client certificate comes from a smarcard in mTLS [closed]

I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
  • 31
0 votes
1 answer
79 views

Privacy related to company VPN

Last week my employer sent me a root cert to access the company’s VPN on my personal iMac. When I am connected to the VPN, I’m aware the VPN server can encrypt/decrypt the traffic, but I have some ...
  • 9
1 vote
0 answers
46 views

Any vulnerability of OCSP for proof of concept

I have an assignment in which I have to implement OCSP and do a proof of concept of a vulnerability. My idea was to implement OCSP without using a nonce (this is done) and then perform a replay attack....
  • 11
11 votes
3 answers
4k views

Why create a CSR on my own server to have it signed by a 3rd party?

I am looking into our current website certificate-management process and am looking for steps that may be unnecessary and can be simplified. The current process was created by our sysadmin who now ...
-3 votes
1 answer
52 views

Hiding a certificate [duplicate]

Is it possible to embed a TLS certificate into an application or hide it somehow so that it’s not so easy for a user to just export it from cert manager on Windows? Or does all certificates have to be ...
13 votes
3 answers
5k views

How do we know that our SSL certificates are to be trusted?

On Linux, the /etc/ssl/certs folder includes all the necessary public keys for Certificate Authorities. If I have not misunderstood something, this makes it possible to verify public keys received ...
  • 185
0 votes
0 answers
35 views

Help understanding PKI MTLS and digital signature architecture

I'm building an identity service using PKI and MTLS for authentication where users are supposed to be able to sign data e.g. a json string or a document. Where I am now I have implemented working MTLS ...
1 vote
1 answer
27 views

Is there a way to enforce a user password challenge for a certificate every single time in Windows Security Policy?

In Local Security Policy configuration, I have set System cryptography: Force strong key protection for user keys stored on the computer to value User must enter a password each time they use a key. ...
0 votes
1 answer
124 views

Can VPN protect me against MITM attacks if my device is already compromised by having a malicious root certificate installed?

Let's say my device is already compromised without my knowledge by my ISP, it has a malicious root certificate installed which allows my ISP to view all of my HTTPS traffic as plain text. now if I use ...
user avatar
0 votes
1 answer
147 views

Connecting to company VPN issues a failed certificate verification

As one can see on the screenshot below, connecting to the company VPN via FortiClient issues a X509 verify certificate failed. I have informed the CIO who is the security person as well but it is not ...
  • 101
3 votes
1 answer
755 views

Is NordVPN changing my security cerificates? Could this be a MiTM attack?

I noticed that when it comes to some websites (e.g. Twitter), the security certificate is changed when I log in and out of NordVPN - the SHA-1 digest is visibly different. Keep in mind that not only I ...
  • 185
0 votes
0 answers
33 views

Encrypting SNI and establishing TLS with two certificates

While looking at the proposed "solutions" for encrypting the SNI, I find that both ESNI and Encrypted ClientHello seem inadequate. Why can't there be two different certificates used, so that ...
1 vote
1 answer
42 views

Confusion Regarding TLS Handshake and Key Exchanges

I know much has been written on this topic, but I am still stuck on some on the details of TLS handshake and I would like to have a better understanding of what happens. I've been using several ...
1 vote
5 answers
99 views

How does a digital certificate prove authenticity?

Imagine the following scenario: We have Bob that wants to send a message to Alice. Both have a public/private key. Bob uses his private key to sign the digest (hash of the message) with it's private ...
  • 13
1 vote
1 answer
122 views

What's the use of HMAC or hashing in TLS or SSL inspection

In the Server hello, I got the below Cipher suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 Now, I know that we are using DHE for the key exchange, we are using RSA for the authentication, and AES for the ...
0 votes
2 answers
123 views

Is it bad idea to upload SSL Certificate as base64 encoded string?

I have to create an API for uploading a certificate file. Unfortunately, the library that I'm using (graphQL) does not support file upload. It only supports primitive types like string, int, float etc....
0 votes
0 answers
118 views

Self-signed certificate chain verified by OpenSSL but Windows says leaf is invalid

Let's say I have rootCA.crt, intermediateCA.crt and leaf.crt. I used openssl to veriy leaf.crt: cat rootCA.crt intermediate.crt > chain.crt openssl verify -CAfile chain.crt leaf.crt and it said ...
0 votes
0 answers
52 views

Extracting a Bit String from a .pfx file's private key

I'm currently working on a website backend program for a client, that scrapes info from a South Korean website. The login system is certificate based, and I'm currently testing things out with a .pfx ...
1 vote
1 answer
100 views

How safe is a certificate on a smart card in terms of microscopy?

I wonder if it is possible for an attacker to dump the certificate of a smart card using microscopy. For example an electron microscope. Please do not blame me if there is nothing to see because the ...
  • 133
0 votes
0 answers
19 views

How does client data encryption work in HTTPS? [duplicate]

When you connect to a HTTPS server the server encrypts its data using the private key of its private certificate. The client decrypts it using the server's public key of the server's public ...
  • 133
6 votes
1 answer
529 views

Same domain, same local network, different certificate chain

I was doing some security checks in some devices in my local network and I noticed that I obtain two different certificate chains for the same domain (www.google.com) from two different devices (...
  • 63
1 vote
1 answer
79 views

In this Facebook article, how do they prevent the engineers from copying SSH certificates from bastion hosts to personal laptops?

These days I'm reading this Facebook engineering article Scalable and secure access with SSH. Most of the article makes sense to me but I am not experienced enough to understand the paragraph about ...
  • 141
1 vote
0 answers
22 views

PKI Structure with multiple intermediates [duplicate]

is there a possibility to create a 2-Tier PKI with multiple CA's for redundancy? The scenario would if, if CA1 becomes unavailable, CA2 could be used to verify certificates and/or the complete ...
  • 11
1 vote
2 answers
96 views

Why would a company choose to use different SSL providers for different subdomains

Recently, I happened to notice that a site I was looking at had different certificate providers for different subdomains. Whilst looking around, I found that seems to be somewhat common (or at least ...
3 votes
3 answers
203 views

Is it OK to use client TLS certificate for site login instead of username/password?

Is it OK to just use a client's TLS certificate as a way of logging in to a website? What are the drawbacks? Is there any real system doing it? Normally, there is mutual client/server TLS ...
0 votes
0 answers
317 views

The request contains no certificate template information

I am trying to create a CSR from MMC on one of our servers. I have previously submitted a lot of requests without any issues by going to MMC. Certificate folder > Select "Personal" > ...
  • 415
1 vote
1 answer
190 views

Host header is preferred by OpenSSL over SNI

As I understand a webserver shall serve SNI first and ignore HOST header from HTTP 1.1 as TLS handshakes occurs before HTTPS, to test I came up with this example: two domain names under the same IP ...
18 votes
2 answers
4k views

Why doesn't a TLS certificate with a domain name mask that doesn't match the site name trigger a warning in the browser?

I visited stackoverflow.com and found in Chrome that its certificate is valid and has Common Name (CN) *.stackexchange.com. After that I checked a fingerprint for stackexchange.com and it matched ...
0 votes
0 answers
33 views

How does Certificate Transparency protect from hacked CA server [duplicate]

I was able to grasp how CT works by reading this explanation, but one thing remains unclear for me - how CT may protect ecosystem from hacked CA server. For example, someone hacked Digicert, and now ...
0 votes
0 answers
69 views

Verify self signed certificate

My plan is to create rootCA.crt and sign newly created server.crt. Later server.crt should sign newly created child.crt. As result I will get small chain. Now I would like to test if child certificate ...
  • 269
0 votes
2 answers
198 views

How does the option to “use system certificates” for a wifi login vary from choosing a specific certificate?

This is concerning an android device (not sure if that information helps, since Apple works differently). When logging into a wifi network, there will be sections that ask for different information. ...
  • 27
0 votes
1 answer
113 views

What are the implications of the “do not validate” message for wifi network certificate?

I know a year ago when signing into school wifi there were a few options. First time I had to sign into a school wifi, so I did not understand the difference. Ended up choosing a wireless option. One ...
user avatar
0 votes
1 answer
110 views

CA-signed certificate for localhost / production app

I have developed an application that consists of various parts, each part communicating either via http and / or gRPC to one another. All communication has been switched over to TLS using a self-...
0 votes
0 answers
26 views

System audit of hardened device regarding certificate handling

I am tasked with auditing the default configuration (system configuration, default applications...) that is set for some computers before they are given to users. Though I have never seen it anywhere, ...
  • 1

1
2 3 4 5
56