Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
-1
votes
1answer
45 views

Is it ok to use the same SSL certificate (pfx) used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis?

Is it secure enough to use the SSL certificate used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis? Or must I use a separate certificate just for this ...
1
vote
1answer
93 views

How does a Certificate get associated to the private key pair? [duplicate]

I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
1
vote
2answers
41 views

openssl certificate chain - windows

I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities. ...
0
votes
0answers
36 views

How does https block the man in the middle from just forwarding the certificate chain? [duplicate]

Suppose I have a client : Alice and a server: Bob A ---- B There is a Charles in between. A ----- C ----- B When Alice asks for bob's public key and certificate. Charles can intercept this and form a ...
1
vote
3answers
122 views

Self-Signed Certificates with SSL

Today I was playing around with an SslStream implementation in C#, and was able to create a client/server connection over TCP. Also to verify it, I used wireshark to ensure that the data was in fact ...
0
votes
2answers
66 views

On a server to server SSL connection is there any trustable information identifying the calling server?

Imagine server A calling server B over SSL and that both servers have SSL certificates installed. Later server A again calls server B. Is there a way for server B to know that server A is the same ...
2
votes
3answers
863 views

Application to detect SSL certificate fingerprint differences

My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
0
votes
2answers
44 views

Any difference between these certificates from a security perspective?

I understand some might buy a particular brand because, I guess, it's like buying a Rolex instead of a Swatch? But marketing considerations aside, is there any real security difference between the ...
1
vote
1answer
56 views

Are long-lived SSL/TLS certificates acceptable for non-public resources?

Our organization maintains a private certificate authority to issue SSL/TLS certificates to non-public backend services running on our cloud infrastructure. For example, Postgres and Elasticsearch ...
0
votes
1answer
37 views

Exporting a JKS entry to X509 certificate - why public key differs?

There is a JKS file containing an entry named "mycert": https://filebin.net/l93faa9qa3rkt32h Password is test123 Based on the following screenshot, mycert has a public key (RSA 2048 bits) ...
0
votes
0answers
13 views

Enterprise/Universities WIFI CA Certificate for android [duplicate]

I have read an article discussing the issues with enterprise WIFI not validating CA certificates which seemed to be a security flaw. android-11-break-enterprise-wifi-connection I've some similar ...
1
vote
0answers
66 views

Hosting the certificates from CSP in Windows Store to be visible for other applications

I am developing a CSP that performs electronic signature in the cloud and I want to use it from applications like Adobe Reader and Microsoft Word. For this, the certificates from CSP (from the cloud) ...
0
votes
0answers
33 views

Extract Issuer and Subject from certificate [migrated]

I have a fairly basic question, but I haven't found the answer for that. There is a certificate (called "authToken") which I have not too much information about. I know: it's in X509 format ...
0
votes
1answer
34 views

SSL Cert SAN field

I'm not really sure exactly how to ask this, but I'll try my best. I have two SSL certs, and I'm tyring to figure out if I accidentally invalidated one of them. Cert 1 was just renewed, and issued to ...
0
votes
1answer
51 views

When do I need to install root certificate on the client trust store?

I have a https server with following the certificate chain : Root CA -> Intermediate CA -> server certificate I noticed that for the client (eg. browser) trusts the server I need to install in ...
0
votes
1answer
88 views

Replace hashed password by public key generated from password

I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
-1
votes
1answer
56 views

Preventing MITM Attack with Squid

There are two options, what is the best approach? I want to either Create a squid proxy server that detects MITM attacks or Create a python UI application to detect differences between local ...
2
votes
1answer
72 views

ssh-keygen: How to guarantee the uniqueness of serial numbers?

(FYI: I'm using Ubuntu 18.04 Desktop although I don't think my question is platform-dependent.) I read the article Scalable and secure access with SSH and it says: ... if you want to use revocation ...
0
votes
3answers
104 views

Authenticating root certificate

I'm building a web service and have questions regarding authentication. I have a strict requirement that this application only run on company machines. We have a root certificate this is installed on ...
1
vote
1answer
64 views

SSL certificate for desktop app?

I built an app, which authenticates users via oauth2. I have a simple server that can accept requests. After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and ...
11
votes
4answers
2k views

Is it possible to update the contact info (FN/LN, OU, Organization,..) of a certificate?

When creating a self-signed certificate you are asked to enter some information (First Name, Last Name, Organization Unit, Organization, City, State,...). Is it possible to update any of those fields ...
0
votes
2answers
79 views

How to authenicate personal computers and phones?

I feel like this information should be readily available but looks like it's not: When I buy a new laptop or phone, it seems like there's a whole set of initial connections that might require my (...
1
vote
1answer
48 views

Embed Private Key Inside Agent [closed]

We are owing a domain with wildcard certificate (*.mycompany.com). Now we have an application running as an agent on the customer machine. The browser is communicating with the agent by sending ...
3
votes
0answers
57 views

Using TPM to generate certificates associated with different users on the same device

I plan to use the TPM to generate CSR's backed by a private key stored on the TPM. The CSR's will then be signed by an external HSM. Since a certificate is tied to a particular private key, how do you ...
0
votes
1answer
62 views

SSL Certificates Management and Tracking

I'm not aware of any frameworks/tools to achieve what we're trying to do, but posting here to hear experts opinions and comments on how this is done at large organizations and recommended automation ...
1
vote
0answers
22 views

How does the client get the certificate chain when verifying a TLS connection? [duplicate]

When a client creates a TLS connection, he is given a certificate. To make sure this certificate is authentic the client must look at the certificate chain. My question is: How does the client get ...
3
votes
0answers
73 views

What are the risks of trusting a certificate that is not logged in CT logs?

A website that I do banking on has a login page on a different subdomain than their main website, and this login page is secured with an Amazon-issued domain-validation certificate (their main website ...
2
votes
1answer
63 views

Trying to create cert for RSA and Not ECDH

I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key....
23
votes
2answers
4k views

Are we gossiping in Certificate Transparency?

Ben Laurie's original paper on Certificate Transparency proposed that clients (browsers) should "gossip". In particular, it proposed that when a browser connects to a web server, it should ...
1
vote
4answers
100 views

Certificate SHA1 Thumbprint reported as a vulnerability [closed]

So a few weeks ago I came across a security report that stated that the SHA1 thumbprint of the certificate was a vulnerability. The vulnerability was raised due to fact that the thumbprint used the ...
1
vote
0answers
35 views

Certificate Checking for MITM w/ Squid

I have already set up a squid cache proxy server on a Raspberry Pi 4. I need to create some sort of GUI to turn on and off certificate checking for man in the middle attacks. First, how do I get squid ...
1
vote
0answers
46 views

What is the relation between cipher suite and certificate? [duplicate]

I generated my self signed certificate using openssl and I chose ECC keys (prime 256v1) for root certificate but while authenticating with the server i.e. IBM cloud and my device the negotiated cipher ...
1
vote
1answer
51 views

Encryption for intranet site?

I am developing a web application which will be downloaded, installed and used by my customers on their intranet. The data in the application is confidential, so all requests and responses need to be ...
1
vote
1answer
74 views

Is it safe to distribute the server's certificate file with the client?

I've been working on making an SSL server/client on C++ using Boost. To load the certificates, I use the following code for each side: server.cpp boost::asio::ssl::context ssl_context(boost::asio::ssl:...
1
vote
1answer
93 views

Use the public key of a certificate as the key for HMAC SHA

Consider the following scenario. A company has several computers for each users on the same domain. They purchase an RSA certificate from a recognized authority which will be deployed with private / ...
0
votes
1answer
47 views

Why do I need to check the issuer/subject of a certificate rather than just the thumbprint?

I'm following Microsoft's example here - https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth#aspnet-sample When validating the certificate, they check that the ...
1
vote
0answers
38 views

verifying certificates

In my test setup I have a root CA only. I also have a node cert (joe0.lab.local.pem). I did the following: openssl verify -CAfile ca.pem joe0.lab.local.pem joe0.lab.local.pem: CN = joe0.lab.local ...
1
vote
1answer
66 views

Website certificates in different browsers

I looked at a certificate of (e.g. stackoverflow) a website and the fingerprint in chrome was different then microsoft edge, so I was wondering how it that possible? chrome: ...
2
votes
2answers
60 views

ssh into a server with knowledge of ca bundle

Let's say I had a ca bundle with many certificates in it on my server. I accidentally gave this to a team of programmers I have hired. Could they theoretically use this to somehow ssh into my server ...
0
votes
1answer
85 views

How to remove a ca certificate in debian?

I have added a root ca in my debian machine by using the following commands: mkdir /usr/local/share/ca-certificates/custom/ mv myserver.crt /usr/local/share/ca-certificates/custom/ update-ca-...
17
votes
4answers
4k views

Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?

I'm learning about X509 certs used in client-cert authentication to https endpoints. If I have an OCSP checker (Python script that creates, submits, decodes OCSP responses), do I need to check the not-...
0
votes
2answers
64 views

Approach to authorizing users and X.509 certificates

I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
0
votes
1answer
33 views

CT logs for non browser applications

Most what I read on CT logs is about browsers checking the logs for websites. But what about normal applications or updates for operating systems (like apt-get over https, windows/osx updates ...) Is ...
2
votes
1answer
89 views

Securing HTTPS between two local applications on same system

I would like to know how to securely setup HTTPS between two applications running on the same workstation in a production environment please: A local server application (C#) A web frontend which ...
7
votes
1answer
186 views

Are EV certificates still useful?

Years ago (~2010-2019) the Extended Validation (EV) Certificates made a lot of sense. The user in their browser would see a clear difference between a "grey" (http/not secured) website a &...
2
votes
2answers
55 views

Is it possible to create a certificate for a key pair which I do not possess?

Perhaps the answer is no, and perhaps this is a dumb question. However I am trying to understand the underlying principles better. My understanding of certificate signing process. I generate a key ...
4
votes
3answers
189 views

How can you bind a public key to a certificate if the public key depends on the choice of algorithms?

Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
0
votes
0answers
47 views

Using fields in X.509 cert for authorization [duplicate]

I understand that X.509 certificates are used for authentication. How can I use the information provided in an X.509 certificate for authorization? For example, are there any fields in the certificate ...
2
votes
1answer
62 views

Is there a standard order for the X.509 extensions of a certificate?

Is there a standard order for the X.509 extensions of a certificate? For example: [ myca_extensions ] basicConstraints = critical,CA:FALSE keyUsage = digitalSignature,keyEncipherment ...
0
votes
1answer
27 views

Should root certificates have OCSP or CRL for it? [duplicate]

Should root certificates have OCSP or CRL for its own revocation status? So here is what I mean: Intermediate Cert -> http://example.com/root.crl SAN Cert -> https://example.com/intermediate.crl ...

1
2 3 4 5
52