Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
0answers
35 views

“Failed connecting to the YubiKey. Make sure the application has the required permissions.” [closed]

I have a Yubikey version 5.2.7 and I can't generate any new certificates on yubikey manager app, which is weird since I have already generated two certs (on 9d slot) and they worked fine. Now the ...
1
vote
1answer
41 views

Software signing : multiple certificates

I'm quite new to the cryptography field, and I'm trying to understand a few things: I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below: I'm ...
0
votes
1answer
26 views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
0
votes
2answers
61 views

What is the purpose of “certificatePolicies” in a CSR? How should an OID be used?

While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command: openssl req -new -addext &...
0
votes
0answers
35 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
1
vote
1answer
115 views

How may I check if an expired certificate was valid at the time?

I have an old let's encrypt (but disregard that, it could be any) certificate that is no longer active. How may I check if it was valid at the time?
18
votes
3answers
5k views

What is the problem of using a self signed-certificate for a game?

I am trying to understand the security problems when working with a game that needs an account for its players. What is the problem of using a self-signed certificate? If I understand the problem ...
0
votes
0answers
51 views

Can an SSL certificate be edited? [duplicate]

First of all I want to say that this question is not a duplicate. What I want to know(And possibly get reasons) is if it's able to edit SSL certificates. In more depth, let's say I have a server on my ...
0
votes
1answer
74 views

Implications of using a self-signed certificate to sign JWT tokens in OAuth

I'm looking to setup an integration between GitHub and Service Now and I can use OAuth2 using JWT Tokens, the steps to take can be found here. There is a specific step that states: Create a CA signed ...
0
votes
1answer
82 views

Forging SSL certificate to the browser

A man in the middle attacker can intercept and send a different certificate (a self-signed one, maybe) to the browser. In this case, browser will show warning to the user and doesn't display's the ...
0
votes
1answer
95 views

What are the risks when using proxy such as Fiddler

I would like to understand a point. When I use fiddler it creates a local proxy to analyze the traffic, so far everything is fine. However when Fiddler is launched and I browse an HTTPS site the ...
0
votes
1answer
64 views

Verifying public key visually

Verifying a string of long numbers is hard (think of cert public key). I remember there is a tool to visualize this randomness into a "randomness graph" but I cannot recall what is the graph ...
0
votes
0answers
39 views

Is it required to have the subject name also in the subject alternative name?

From the rfc5280 it's a bit unclear to me if the subject name needs to be repeated in the Subject Alternative Name (SAN). The RFC says "addition" or "in place". So it could be both?...
0
votes
0answers
15 views

SSL connection establishment where only client has a certificate [duplicate]

Consider a situation, where an end-point owns a certificate and wants to establish a connection to another end-point w.o a certificate. In ssl context, the end-point starting the connection is named ...
0
votes
0answers
22 views

Why does Firefox claim a site has a “Potential Security Risk”? [duplicate]

When trying to go to https://www.pfizerpapconnect.com, the Firefox web browser claims there is a "Potential Security Risk" and pops up a page recommending to not proceed. Is there a real ...
3
votes
2answers
128 views

What is the point of signing a JWT with a JWK if you need to communicate with the token issuer?

If I understand correctly, a JSON Web Token (JWT) can be asymmetrically signed with a special private key (JWK). At least in some common configurations, the public part of the signing key can't be ...
0
votes
2answers
82 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
0
votes
1answer
66 views

Adding a self-signed client certificate to HAProxy for mutual-tls?

I added the client cert into ca.pem as in bind 0.0.0.0:443 ssl crt /etc/ssl/private/asdf.hdavid.io.pem verify optional ca-file /etc/ssl/certs/ca.pem http-request set-header X-SSL-Client-Verify %...
0
votes
0answers
127 views

Unable to add Zscaler certificates to Ubuntu trusted store

I have a set of three certificates to form a trusted chain from Zscaler but I cannot install them in the Ubuntu trusted store. The three corresponding certificates are there for reference: Zscaler ...
2
votes
1answer
72 views

Can possession of device certificate be considered a factor in MFA? [duplicate]

We have had a discussion in our organization about whether possession of a server-issued device certificate can be considered a factor in MFA. The certificate asserts that only enrolled devices can ...
0
votes
1answer
41 views

How to use DH certificate to configure nginx server

My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer). I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
2
votes
2answers
223 views

Storing SSL certificates for developers

I work as a .NET developer on a small development team. Our organization has several websites, that all have certificates for serving them via HTTPS. The websites are deployed to On-premise Windows ...
13
votes
3answers
3k views

How to change a website to no longer needing an SSL certificate

I have recently had an active website that was protected by an SSL certificate. The site is no longer active and the certificate has expired. I have tried to put up a simple HTML holding page but ...
0
votes
1answer
75 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
0
votes
1answer
94 views

How to update certificates/CRL on Windows 7 systems that are without support contracts?

A quality answer to this question mentions: "System is regularly updated with latest patch specifically certificate/CRL from trusted source such as Microsoft." How does one update ...
0
votes
1answer
104 views

What is the workflow from client to server for SSL enabled sites?

I have a basic question on workflow of SSL enabled sites from client browser to server. My understanding is when the browser has to access some https enabled site, the browser contacts some CAs. I am ...
0
votes
0answers
61 views

Unable to decrypt password protected certificates with Freeradius or from GUI

I am trying to use Freeradius 3.0 for authentication with certificates. To generate the CA, Server and Client certificate, make is available, reading a specific configuration file for each ...
0
votes
0answers
31 views

Are there specific reasons why ADFS certificates are generated for 2 years?

Azure Active Directory generates certificates for federated SSO that have a lifespan of 3 years. in the case of an on premises AD, this is two years by default, and can be changed. Are there any ...
1
vote
2answers
52 views

How to distiguish if SSL certificate is for both domain and subdomains or for domain only?

Provider suggests me two types of SSL certificates: for domain only or for domain and subdomains. First one is cheaper. Currently I already have certificate for previous year. How to know, if it was ...
0
votes
2answers
153 views

What prevents an attacker from registering a TLS certificate for an existing site?

This would be used in a phishing attack for example - coffee shop attack where google.com becomes a website controlled by the attacker completed with the magic lock next to the URL. Can I use ...
0
votes
1answer
42 views

For organizations running modern, functioning PKI, can mTLS be used as SSO mechanism?

I am trying to determine best practices for implementing a webapp running in an extremely tight PKI environment. Assume: Yubikey like devices that have Certs with reasonable expiration dates The ...
0
votes
1answer
54 views

Why would device manufacturer refuse to publish root CA that signs devices but provides the CA via support ticket attachment

Background: We got a few new model SIP phones. Each phone has built-in unique certificate issued by the manufacturer. Previous models had certs issued by a different CA and that CA cert was published, ...
3
votes
3answers
129 views

Does EFS protect against data theft by ransomware?

Recent ransomware events often include data theft in addition to just encrypting data. The Encrypting File System on Windows Pro/Enterprise editions encrypts individual files using a private key ...
0
votes
0answers
65 views

How to implement internal certification mechanism for my web applications?

Our company develops web applications and uses them on the internal network. We need to set up a mechanism to control and monitor internal network traffic so that only approved applications on the ...
7
votes
1answer
778 views

Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP

Given the scenario that: Victim rents VM1 from a cloud provider, and points his/her DNS record to that VM1's IP address Victim deletes VM1 and switches to a different cloud provider, and creates VM2 ...
2
votes
3answers
340 views

What differentiates a CA cert from a server cert? [duplicate]

From what I can gather, as long as a client trusts a particular CA root, and a server produces a valid chain that leads up to it, the client will trust the server's cert. This only makes sense if the ...
0
votes
0answers
41 views

Self-Signed Certificates on Management Interfaces - Cyber Security Standards

We have dozens of internal management interfaces on our appliances that use self-signed certificates - ILO, DRAC, switch management, etc. These certificates display a warning in the browser, but their ...
0
votes
1answer
60 views

WPA2 Enterprise Authentication Certificate Security

While reading up about WPA2-Enterprise, it states that it is more preferred over WPA2-Personal as it allows authentication via digital certificates which prevents over-the-air attacks. However, I am ...
0
votes
1answer
92 views

On TLS 1.2 with Diffie-Hellman Key Exchange, how does the client make sure the server has the certificate's private key?

When RSA is used for Key Exchange, the pre-master key is encoded with the server certificate public key, so the server would not be able to decode it if it didn't possess the private key. However, ...
0
votes
4answers
62 views

Ingress client certificate authenticate requires CA certificate to be stored in secret?

I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...
0
votes
0answers
32 views

Validate that CA really signed certificate [duplicate]

What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust? What is the part of the certificate (The one I try to validate) is the one cant be faked? ...
-2
votes
1answer
116 views

Certificates Do Nothing [duplicate]

Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...
0
votes
0answers
32 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
0
votes
1answer
60 views

Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)

I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time. I understand that both methods require to prove that the certificate (...
6
votes
3answers
832 views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
2
votes
1answer
67 views

Validation of server identity via SSL certificate in during SSL connection handshake

My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
0
votes
1answer
40 views

Generating a DER-encoded DSA public key of a particular file size

I am reverse engineering a binary that contains a raw, DER-encoded X.509 certificate containing a DSA public key. I want to replace this certificate with one that I have generated so that I have ...
0
votes
1answer
49 views

If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?

I have some questions about certificate pinning. Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
0
votes
1answer
54 views

What are requirements of Key Usage extension of parent and child certificates?

This question is about validating certificates. Imagine some machine gets a leaf certificate (i.e. a certificate signed by the certificate of some CA) with specific Key Usage attributes. Example #1: ...
-1
votes
1answer
57 views

Is it ok to use the same SSL certificate (pfx) used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis?

Is it secure enough to use the SSL certificate used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis? Or must I use a separate certificate just for this ...

1
2 3 4 5
53