Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

0
votes
0answers
12 views

Two message key agreement and mutual authentication protocol?

I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS. If we assume ...
1
vote
1answer
22 views

What's the correct way to handle a failure with Client Certificate Authentication

I'm adding Client Certificate Authentication to my application - what is the correct way to handle an invalid certificate, untrusted certificate or an un-mapped user ID?
0
votes
1answer
41 views

What CA signed my certificate?

I'm trying to set up a Docker image that has our internal CA certificates installed so that users across the organization can make secure requests to intranet sites. We have a few different CAs that ...
0
votes
1answer
49 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
0
votes
0answers
14 views

Using adb to list certificates in Android devices [migrated]

I want to use adb to list all certificates installed by USER. How can I do that?
1
vote
2answers
101 views

Is accessing by IP address without CA certificate secure?

If my server doesn't have a public domain name, and users access it via IP address, is using a self signed certificate (ignoring the warning) secure enough for https/ sftp? I am talking only from ...
1
vote
1answer
86 views

Insufficient serial number entropy in GoDaddy certificate

I came across this article last night regarding SSL certificates and issues with the serial number not being long enough. Here is a status report from GoDaddy. According to their csv file, our sites ...
0
votes
1answer
53 views

Send a redirect after HTTPS certificate rejection

I would like to create a chain of HTTPS 302 redirects to a series of domains (for research purposes). I want also to make sure that I can do a redirect if one of the certificates in my chain has been ...
1
vote
1answer
32 views

Distinguish the end-entity cert in a PKCS#7 (P7B) cert chain

Is there a standard/definitive way to distinguish the end-entity cert in a PKCS#7 (P7B) cert chain? I believe the PKCS#7 standard doesn't not specify sequence when ordering the certs in the chain, ...
2
votes
1answer
48 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
0
votes
0answers
19 views

Best way to enable LDAPS / Self Signed Cert

Looking for best secure way to enable LDAPS support in ActiveDirectory / on DMZ servers, I did some leg work but I would like to run this by you guys. I don't have CA available, and domain is .local ...
0
votes
1answer
26 views

Usage of SSL_CTX_use_certificate

While building a context through openssl, if I do not provide a certificate by using the function SSL_CTX_use_certificate, would all the connections from that context default to anonymous diffie-...
0
votes
0answers
28 views

Openssl command: how to know if the certificate verification is ok [on hold]

I am using openssl tool to check a list of certificates validity. I am looking for the leaf certificate validity using openssl. In this example, I got this output. I see multiple verify results. I ...
2
votes
1answer
66 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
0
votes
0answers
23 views

Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?

I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
0
votes
0answers
27 views

Proving that a certain site had given page at certain time [duplicate]

Lets someone opens https://foo.com and saves the page using "save page as". Is there any way to prove later that the locally saved files have not been altered assuming that we trust the server public ...
0
votes
1answer
62 views

Windows Server: Import HSM-backed certificate into second server

Scenario: Using Amazon CloudHSM with CloudHSM Windows Client installed and configured. Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider. Submitted ...
0
votes
1answer
44 views

Explanation of the authentication procedure when using signed certificates [duplicate]

I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT. On my device side, I have a device certificate ( deviceCert.crt ) and the device ...
0
votes
0answers
52 views

Am I safe after importing Bitdefender's fake certificate?

I installed Bitdefender today and suddenly I couln't navigate to numerous websites that I used to visit (I use Mozilla Firefox). I got the error: SEC_ERROR_UNKNOWN_ISSUER. I searched a bit and found ...
2
votes
3answers
48 views

SSL authentication unexpectedly failing - could this be caused by SSL Inspection/Fortinet?

I'm dealing with an SSL issue that's been plaguing me for several days. I know relatively little about security, so if anyone here could lend a helping hand I would be extremely grateful. Ultimately ...
1
vote
0answers
56 views

Why is digital signature enforcement on webservers not common practice?

Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
0
votes
1answer
31 views

truststore and intermediate certificates

We have a situation where our on premise product talks to a third party external API over SSL. This API has a certificate which is issued by an intermediate. We use the default java cacerts truststore,...
1
vote
0answers
53 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
1
vote
0answers
44 views

Replying to a digitally signed email using thunderbird

So Basically I sent a digitally signed email using a certificate issued by Sectigo RSA Client Authentication and Secure Email CA. Now the recipient of the email replied to me with a certificate ...
2
votes
2answers
83 views

Server certificate proving client identity

When we look at StackExchange's server certificate (by clicking on the Lock icon), it says: This certificate is intended for the following purposes: Ensures the identity of a remote computer. ...
0
votes
1answer
64 views

TLS certificate decoding

Anyone familiar with certificate decoding? I seem to have 3 more bytes at the end of a certificate than the length indicates. I have 3 certificates in the chain. The first one is 0x645 bytes, ...
0
votes
0answers
36 views

How can I create a self-signed certificate with a custom field? [duplicate]

For experiment, I want to add a custom field in a TLS certificate then validate it. Because it is experiment, it will be a self-signed certificate. I use OpenSSL 1.1.0g and Ubunut 18.04. Any hint will ...
2
votes
2answers
98 views

Why is OpenSSL verify output depending on source of cert files?

As a test of my TLS/SSL knowledge, I'm trying to verify wikipedia.org's TLS cert. I have downloaded the server-distributed certificate to a file called cert.pem and the root cert (from Globalsign's ...
0
votes
0answers
38 views

How to check if installed Trusted CAs are not dangerous? [duplicate]

I've checked my Windows 7 installed Trusted Certificate Authorities using MMC tool as below: Questions are: How can I be sure that they are genuine and are installed by Microsoft and not by a third-...
1
vote
1answer
93 views

How do I validate a certificate by hand?

I have a website, which has a signed certificate file (website.crt) from a certificate authority (CA). How do I make sure exactly, that this certificate is valid? I know, that browsers do it ...
1
vote
0answers
126 views

Use self-signed certificate inside of Docker Container for localhost

I've created a self-signed certificate for localhost to use https. I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
1
vote
0answers
32 views

Is distributing software with KeyStores as resource secure?

I'm working on a client / server application. I want to encrypt the communication between the two. This GitHub project served as a starting point for me. It uses SSLEngine to establish a secure ...
0
votes
0answers
69 views

What is a reasonable default_crl_days value for OpenVPN CLR? Why?

I am having trouble finding a definitive answer (with a rationale) on what a reasonable default value for default_crl_days (in openssl.cnf) for use with OpenVPN. The current default is 30 days. But ...
0
votes
0answers
46 views

How to obtain a private client certificate

We have a fairly weird integration scenario where we need to connect the following two systems: 1) Partner's API Portal - the server, which uses MASSL authentication with a requirement that the ...
-3
votes
1answer
63 views

what is the maximum life-time for Let's Encrypt certificates

Let's Encrypt is one of the most popular TLS Certificate Authorities. I have conflicting information about its certificates life-time. In this link it says 90-days. In one research paper I read 1 ...
2
votes
2answers
128 views

Maximum number of certificates generated by a CA

What is the maximum number of certificates that can be generated from a CA? The use case is a VPN using certificate authentication and I would like to know what is the theoretical number of unique ...
0
votes
1answer
40 views

More clarity on Certificate, public key, hash

I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below. I've used below command to see what this certificate ...
0
votes
0answers
17 views

Using client certificate from a file and a key pair from a hardware token

The question is about TLS client authentication using a browser. I have been using a smart card to authenticate to certain web sites. However, the card is a bit old and for whatever reason importing ...
10
votes
2answers
354 views

What are the risks of installing a root certificate from Facebook on your phone?

I read a TechCrunch article today describing a program Facebook has been running since 2016 where they pay users $20 in exchange for installing a root certificate run by Facebook. This immediately ...
0
votes
2answers
38 views

How to approach 2 tier PKI RSA Root CA with subordinates that should support ECDSA

I have a situation for which I am not sure how to approach it. Basicialy I need to find out if it is possible how to issue ECDSA Certificates with a RSA Root Certificate. Is this possible? and how ...
0
votes
1answer
58 views

Is it possible to mitigate risks of using a wifi connection that uses a self-signed security certificate?

I don't really know anything about security certificates, and I tried reading about this, but couldn't find the answer. Edit: The hotel I'm staying in uses a login page for the wifi connection that ...
1
vote
1answer
62 views

Certificate not trusted in Root CA Store - does it still enable secure connection? [duplicate]

I'm a bit new with certificates and have been unable to find an answer on this. We need to place controls around an application that is accessed via URL, we have moved the URL to citrix, but the ...
1
vote
1answer
28 views

Extract issuer public key from certificate pem file

I know that a certificate that's been signed by a CA contains identifiers for both the subject and the issuer's public keys: $ openssl x509 -in cert.pem -text X509v3 Subject Key Identifier: ...
2
votes
1answer
97 views

What is the benefit of signing an executable that is not a driver on windows?

What is the security benefit of signing an executable that is not a driver? How is the signature verified by the windows?
0
votes
2answers
53 views

Is the root certificate issued from one Certificate Authority is same for all the requesting organisation?

Let me please explain the question a bit more through an example: There are lots of companies who have their certificates signed by Verisign (or any CA). I understand that Verisign signs these certs ...
0
votes
0answers
36 views

Renewing self signed SSL cert without updating client

I have a server and a single client. I have full control of both, the client is not a distributed application used by the public. For various reasons, I'm having the client use HTTPS to communicate ...
0
votes
0answers
74 views

In what important ways can a digital signature be invalid?

I am trying to write some code to verify that a digitally signed file came from my company. I was horrified to stumble across this deeply buried answer on Stack Overflow, an out-of-left-field ...
0
votes
2answers
100 views

What are MITM proxies used for in enterprises?

My company (like many others I assume), uses a "man in the middle" proxy with a personal root CA. Disclaimer : I'm not a security expert so perhaps I do not correctly understand what this network ...
2
votes
1answer
62 views

DNS entry defined only in HOSTS file - will browsers mark the SSL cert as valid?

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server. We have a few contractors accessing this site from outside the ...
0
votes
0answers
59 views

Proxying an Android application with Burp Suite

I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...