Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

What is the security impact of disabling certificate check [duplicate]

I have this line of code in a client server project: sslContext.init(null, new TrustManager[]{new TrustAnyManager()}, null); A security guy pointed out that this is skipping the validation of the ...
anonymous's user avatar
0 votes
0 answers
25 views

Given the wide trust of Domain Validated certificates by browsers, is there any reason to get higher validation for Internet/public-facing websites? [duplicate]

Let's Encrypt has made Domain Validated certificate ubiquitous and trusted by mainstream browsers. Against this backdrop, is there any reason for an Internet and general public-facing https website to ...
xuhdev's user avatar
  • 101
0 votes
1 answer
63 views

How can Amazon add its own headers when I make HTTPS requests to a web application?

I was playing with httpbin.org to test a client and discovered that some sites will get an header I did not set (X-Amzn-Trace-Id). If I do a curl https://httpbin.org/headers (which will respond with ...
simondvt's user avatar
  • 101
0 votes
0 answers
77 views

AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment

Let's say we produce IoT devices and want them to access AWS IoT Core. The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
Francesco B.'s user avatar
2 votes
1 answer
149 views

Openpubkey SSH workflow details

Currently looking into OpenPubKey and more specifically into OpenPubkey SSH: https://github.com/openpubkey/openpubkey https://docs.bastionzero.com/openpubkey-ssh Terminology: OPK => OpenPubkey ...
ieggel's user avatar
  • 225
0 votes
2 answers
140 views

What is the impact of disabled TLS hostname verification?

If I have a java client that connects to a server, but in the java client code where the connection is built, it skips hostname verification disabled. When a client tries to connect to serverA.com, ...
anonymous's user avatar
0 votes
0 answers
64 views

Checking Against the CN Of Every Certificate In The Certificate Chain

Is it possible to check against the CN (Common Name) or SAN (Subject Alternative Names) of each and every certificate in the certificate chain for a match ? I have 2 docker containers hosted on my VM, ...
Dhiwakar Ravikumar's user avatar
0 votes
2 answers
113 views

Automatically check if a certificate matches specific ciphers

My nginx backend server supports the following ciphers: ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:...
Shahar G's user avatar
0 votes
0 answers
58 views

Connecting Logstash To Elasticsearch via SSL (Docker Container)

My environment consists of 2 docker containers, one running Logstash and another running Elasticsearch on the SAME host & SAME docker network. I am trying to setup SSL between the 2 of them (this ...
Dhiwakar Ravikumar's user avatar
1 vote
0 answers
66 views

Is it common practice that vendors put own root certificates on customer devices? [closed]

At work, we are deploying a new VoIP solution, and as part of that, we are supposed to install a custom root certificate on our computers and mobile devices. The manufacturer of that VoIP solution ...
Torsten Bronger's user avatar
0 votes
0 answers
51 views

Will this certificate Pinning plan work as expected?

I have a mobile app deployed to millions of user in both Android and iOS. My Security dpto rotates our certs once a year. Our certs are issued by GlobalSign. I would like to pin the certificate ...
Leonardo's user avatar
  • 119
1 vote
0 answers
68 views

Certify using Yubikey

I just started using a Yubikey 5. I've set up GPG according to this excellent guide, and now I have 3 working ECC key pairs on my Yubikey: Sign/S :: ed25519, Encrypt/E :: cv25519, Authentication/A :: ...
telephone's user avatar
  • 111
1 vote
0 answers
56 views

Other benefits of creating my certificate authority aside from the firefox issue and centralized management of certificates?

I've been trying to read more about self-signed SSL certificates versus creating my own certificate authority to sign SSL certificates. I am still not completely clear on this. I'll start by ...
learningtech's user avatar
0 votes
1 answer
82 views

Does EAP TLS benefit from “Verify the server’s identity by validating the certificate” setting

For PEAP it's important to enable the "Verify the server’s identity by validating the certificate" setting in a Windows WiFi profile. Is there any benefit enabling this for EAP TLS? If I ...
JPX's user avatar
  • 101
3 votes
1 answer
2k views

How does the SSL/TLS protocol determine if a certificate is expired or not?

I already tried googling but no luck. All search results always tell you how to check cert expiration manually, but that is not my question. Yes I can use OpenSSL for example, but what I am asking is ...
Noob_Guy's user avatar
  • 139
0 votes
1 answer
145 views

Why openssl verify does not work for the certificate chain of a correctly configured site?

I download its certificates. To do that, I used the openssl debug output of the command openssl s_client -connect security.stackexchange.com:443 -servername security.stackexchange.com -showcerts -...
peterh's user avatar
  • 3,023
0 votes
1 answer
90 views

What file extensions are specific to qualified and advanced seals?

A definition of qualified and advanced seals can be found on this page https://europa.eu/europass/en/how-issue-european-digital-credentials at the section "Advanced or Qualified eSeal" A ...
the common starling's user avatar
0 votes
0 answers
65 views

Help identify the tool generating certificate displays on the EU eIDAS Dashboard

The EU eIDAS Dashboard serves as a repository for trusted "trust providers" in accordance with the eIDAS regulation. The provider's certificates are listed within the dashboard. You can find ...
ARF's user avatar
  • 101
1 vote
0 answers
212 views

SSL Certificates signed by our CA show as invalid in browser

We're experiencing an issue, where SSL server-certificates issued by our own internal PKI will show as invalid in the browser, when accessing the site. The error is NET::ERR_CERT_INVALID (Tested in ...
AssistantTOtheCA's user avatar
2 votes
0 answers
51 views

Requesting an user-specific certificate in a tiered domain

Environment: A multi-tiered Active Directory (AD) where tier-specific admin accounts are restricted to log on to only their tier servers. Microsoft's Certificate Services (CS). Let's say the CA tier ...
Ramil's user avatar
  • 21
1 vote
0 answers
69 views

Support for domain-specific root CAs in X.509 certificate format, OS and browsers

Chance is one gets an invalid certificate warning when one follows this link https://www.cnss.gov. As explained there (same warning) this is on purpose, and the solution is supposed to be to install1 ...
fgrieu's user avatar
  • 1,231
2 votes
1 answer
106 views

How to feasibly digital sign high volume documents with CA issued digital certificate?

My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
BambiBundle's user avatar
0 votes
2 answers
190 views

Is there a tool for auditing my root certificates?

Is there any tool out there that will monitor my system's use of root CAs? So far I have not found anything, and so I am hoping that this community will know if such a tool exists. For background, I ...
Cogitative's user avatar
-1 votes
2 answers
210 views

What happens to the key pair once the CSR has been enrolled?

I have a key pair which I used to generate a CSR. Once I enrolled that CSR PKCS10, I get from the PKI (or CA) a certificate signed with the PKI private key. From here, I would like to know if my ...
MoBe's user avatar
  • 21
1 vote
0 answers
69 views

Is it fine if I share a .pfx self signed certificate generated inside my machine with other users to test and use PnPCore SDK

We want to develop some Azure functions which use PnPCore SDK. For testing purposes, I registered an Azure app which uses self-signed certificate for authentication. Now I configured the Azure app ...
microsoftdeveloperdesigner's user avatar
0 votes
1 answer
121 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145
0 votes
0 answers
151 views

openssl: Not able to verify 3rd in the chain with self-signed certificate [duplicate]

(Disclaimer: Checked all the openssl related topics, no success). OpenSSL version: OpenSSL 1.1.1s 1 Nov 2022 I'm trying to generate the chain of certificates, root -> intermediate -> user1,...
unalignedmemoryaccess's user avatar
0 votes
0 answers
81 views

Godaddy automatic renewals (Powershell & alternatives)

how are you? My orgazation is transitioning to using GoDaddy certificates, and I'm exploring if there's an established automated process to download and apply renewed certificates from GoDaddy to our ...
JustToKnow's user avatar
1 vote
0 answers
152 views

Do code signing certificates build reputation only for Microsoft, and is reputation maintained across releases?

I have a Windows executable file that has been code signed with a certificate from a Certificate Authority. The CA is listed in the official Microsoft Trusted Root Program list of participants. The ...
Ron's user avatar
  • 111
1 vote
2 answers
158 views

Is it possible to get an SSL certificate with a Subject Alternate Name of a different website?

If this is possible, what is stopping a malicious file from adding an entry to \etc\hosts that points example.com to a phishing clone of a website? Usually, the browser warns you that the common name ...
Sam Wilson's user avatar
0 votes
1 answer
262 views

Is it possible to extend the validity of a pem certificate

Please help me understand and solve this problem. Assumptions Let's start with an IoT design. When it is working correctly, a remote device has a pem certificate which is used to validate traffic to ...
monkey's user avatar
  • 103
0 votes
1 answer
481 views

How can one use HTTPS without a domain name, or on a local network?

I was looking at the LXI Device Specification 2022 Version 1.6. For those not familiar with LXI, it is a standard for lab instruments like oscilloscopes, function generators, LCR meters and many more ...
Jack B's user avatar
  • 103
3 votes
0 answers
105 views

Does a signature service provider level digital certificate for electronic signature comply with eIDAS requirement for Advanced Electronic Signatures?

I have some basic questions regarding eIDAS and 'Advanced Electronic Signatures'. Say, if I create a product under my company Acme Inc that offers a simple electronic signature where I sign every ...
BambiBundle's user avatar
0 votes
0 answers
392 views

How to get Certificate's Subject Public Key from CSR

I am currently using this code to have the public key pinning OkHttpClientFactory okHttpClientFactory = () -> { CertificatePinner certificatePinner = new CertificatePinner.Builder() ...
Archie.bpgc's user avatar
0 votes
1 answer
549 views

openssl: genrsa vs req -newkey private keys. What's the difference?

I'm trying to understand the difference between generating a private key using openssl genrsa and adding -newkey to req. I found a 2014 answer saying the underlying code is the same, one from 2015 ...
pollirrata's user avatar
0 votes
1 answer
102 views

How to resolve an issue with potential mismatch between device certificate and CA certificate?

I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
monkey's user avatar
  • 103
0 votes
2 answers
167 views

Website returns different certificate on my home network to mobile hotspot

This is a "should I be worried" question. I access a website on my laptop via my home network/router. My Edge browser gives me a "Your connection isn't private" warning page and ...
Kepboy's user avatar
  • 101
0 votes
1 answer
375 views

crt.sh shows certificates for domains I don't recognize

Today I learned of the existence of crt.sh. I typed one of my domain names into the search box to find out what it returns. I found a lot of certificate entries for domains that I don't recognize, and ...
Scott Severance's user avatar
1 vote
1 answer
302 views

How to set/modify "positive trust attributes" in a certificate for openssl

I'm trying to set positive trust attributes to a certificate, however, in openssl's documenation there is no information about how to set them: From the OpenSSL perspective, a trust anchor is a ...
Cris's user avatar
  • 83
0 votes
0 answers
125 views

CNAME redirection and certificate

As an experiment, I attempted to setup a CNAME for mail.mydomain.com pointing to mail.myisp.com, and using mail.mydomain.com instead of mail.myisp.com in setting up email clients connecting to that ...
fgrieu's user avatar
  • 1,231
1 vote
3 answers
849 views

is mTLS authentication alone considered secure for authentication

We have recently engaged an external party to undertake a pen test on a recently implemented API. The API is considered internal although it itself is on AWS and is consumed from on-prem resources, ...
Kinexus's user avatar
  • 113
0 votes
0 answers
79 views

Is a Certificate Signing Request a concatenation of public key and metadata?

From this question, it is said that when creating a CSR, we attach the public key and fill in other data. When creating a CSR, you attach your public key to it and fill in other needed data; you then ...
JLC's user avatar
  • 101
1 vote
3 answers
244 views

self signed certificate

I read a lot of articles about self signed certificates and I'm not exactly sure if I'm getting near to what I want to actually achieve. I'm trying to implement a self signed certificate so that the ...
Reefo Relaxo's user avatar
0 votes
1 answer
565 views

What is default_crl_days in OpenSSL and recommended days?

I'm new and I'm trying to understand default_crl_days. The default is 30 days thus does it mean after 30 days, the CRL list can no longer be trusted? If so, do we need to generate a new list before 30 ...
ratib90486's user avatar
0 votes
0 answers
82 views

Are sections in openssl config file case sensitive?

I'm reading this and it has the below (excerpt). # Certificate Authority Section [ ca ] default_ca = CA_default # The default CA section # Default CA configuration to ...
ratib90486's user avatar
0 votes
1 answer
669 views

NordVPN Couldn't Estabish a Secure Connection - ISRG Root X2

I'm using NordVPN and it's popped up with this about how it couldn't validate a TLS certificate: I've tried looking up what ISRG is but I don't get much of an explanation on it anywhere. It appears ...
aspanda's user avatar
0 votes
0 answers
990 views

How does automatic SSL certificate renewal work without having access to the private key?

From GoDaddy's Renewing my SSL Certificate docs (emphasis mine): If you’re using a Domain Validation (DV) certificate with the primary domain for your account, and you’ve set the certificate to auto-...
toraritte's user avatar
  • 129
0 votes
1 answer
128 views

Can we move a PKI-as-a-service to own managed PKI server? [closed]

I'm a noob in PKI stuff. But if we were to subscribe to a PKI cloud service, could we move our root CA and other PKI stuff to our own PKI infrastructure once I'm ready to manage it ourselves?
ratib90486's user avatar
0 votes
0 answers
68 views

Can you sign a TLS root certificate that already exists? [duplicate]

Alice and Bob have TLS certificate authorities. My device trusts Alice's CA, and connects to servers that present a certificate rooted at Alice's CA. It does not explicitly trust Bob's CA, or the ...
Danya02's user avatar
  • 373
0 votes
1 answer
163 views

Evading authenticated diffie hellman with MITM

I understand that in a non-authenticated Diffie-Hellman setup, a man-in-the-middle attack can occur. Now i'm curious about the feasibility of the following scenario: Let's assume a situation where www....
SempriGno's user avatar

1
2 3 4 5
58