Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
0answers
46 views

Security certificates for software [closed]

Could anyone help me understand security certificates for software? Let's suppose we're talking about a complex application that has a desktop version and a cloud version as well. The final goal is to ...
0
votes
0answers
31 views

Why is /cacerts request necessary in RFC 7030 Enrollment Over Secure Transport?

In RFC 7030 Enrollment Over Secure Transport (EST) https://tools.ietf.org/html/rfc7030, the /cacerts request (Section 4.1 of RFC 7030) is used by the client to request the current CA certificates. The ...
21
votes
3answers
3k views

Why don't folks seem to use ECC for TLS root certificate signature?

I looked around, and all I see is websites using RSA2048 for Root signature, and a few using ECC for encryption. Are there any reasons folks don't seem to use ECC for TLS root signature? Are there ...
0
votes
0answers
51 views

TLS handshake failure (40) solved by removing intermediate certificate from server?

I'd like to better understand my workaround, and confirm that it's secure. Problem I have a crt file containing a root and intermediate certificate installed on my server (I have limited access to ...
-1
votes
2answers
64 views

extract public key from Certificate Signing Request

Hi is there a way where we can extract public key from certificate signing request ? if so can this be done using python3 ? here is the sample csr from https://www.digicert.com/order/sample-csr.php as ...
0
votes
1answer
57 views

StrongSwan, IPsec remote certs and cert_policy

I'm looking for a way to limit the certs that my IPsec can accept. I'm using StrongSwan (swanctl version 5.7), I want to accept only certs coming from a remote with a name of yoji.*.example.com I ...
0
votes
0answers
28 views

Which combinations of certificate keyUsage bits have security implications?

When generating a certificate, there is a set of KeyUsage bits that can be set, as defined in RFC 5280 (section 4.2.1.3). These include bits such as nonRepudiation and digitalSignature. The RFC ...
3
votes
0answers
88 views

How does Cloudflare negotiate its server certificate?

When I access https://example.com on my company's laptop that has a X509 client certificate installed, using my home internet connection, without using a VPN, the requested page is signed using the ...
1
vote
1answer
70 views

Can I pre-register an SSL certificate with validity in the near future?

Can I register an SSL certificate that will only start to be valid in the near future and not right away?
0
votes
1answer
53 views

Does HSTS prevents MITM using a valid certificate?

Let’s consider this scenario: An attacker got a valid certificate for a HSTS protected domain https://example.com. Can he still perform a man-in-the middle attack even if the website is already ...
1
vote
1answer
99 views

What is dynamic SSL certificate?

I'm confused with the term "Dynamic SSL certificate", how it works and what the difference is with a usual SSL certificate for web communication between client and the server. For example, I'm using ...
0
votes
1answer
45 views

Missing DEK-Info header when converting from P12 to PEM using OpenSSL 2.8.3

I'm using openssl to convert an exported *.p12 file into a *.pem file that has a certificate and an encrypted private key. The P12 file was exported with a password, this is the command that I'm ...
1
vote
0answers
38 views

Enforce weak RSA in TLS [migrated]

I'm going to give a small talk on the mathematical background of RSA. My audience will consist mostly of software engineers and to make the mathematical stuff tangible, I wanted to demonstrate how to ...
0
votes
0answers
15 views

Is my understanding how of a secure connection is made using PKI correct? [duplicate]

My understanding as as follows: Client requests a secure connection with a Website's Server Server provides a certificate with the address of the server and public key of the server encrypted with a ...
24
votes
6answers
7k views

Is HTTPS required for local network server to server communication

I am building web applications for my customer's company. At the server side, there will be 2 kinds of server to server network communication. Separated REST API servers making requests among each ...
4
votes
2answers
82 views

Generate digital certificates for employees using the organization's certificate

I live in Peru and we have a small problem in the organization where I work. Dozens of documents are physically signed daily but this is a waste of time since there are documents that must be signed ...
0
votes
0answers
38 views

How to determine whether the certificate is a root certificate [migrated]

My understanding is that if Issuer and Subject fields for same, the certificate is self-signed and must be a root certificate. I'm trying to do this comparison in code but facing issues. ...
2
votes
1answer
82 views

Do Sha-1 certs work with TLS 1.2?

I have been looking at potentially disabling the use of all SSL versions, TLS 1.0 and 1.1 across all servers in my environment. However, I have an internal CA that issues SHA-1 based digitally signed ...
7
votes
2answers
222 views

What is the difference between a certificate and a private key?

What is the difference between a certificate and a private key? In answering another question on this site, I wanted to point to a canonical answer to this question, but to my surprise I don't see ...
0
votes
0answers
57 views

Certificate checking with OCSP and root CA not trusted

I have a root certificate authority, an sub CA and an server. The root ca delivers a certificate for the sub CA. The sub CA delivers a certificate for the server. I want to check all the ...
0
votes
1answer
46 views

Is really TLS backward compatible independent of the version?

I was reading two answers here on the site about the TLS versions compatibility: The first one says: Basically, for the handshake to succeed, there must be a protocol version that both client ...
-1
votes
2answers
135 views

Trying to extract SSL client certificate from android app

I'm trying to find out a specific request from an android application to its API server. Using Burp Suite, I get a handshake failure alert. Using fiddler it asks me to provide a custom certificate. ...
0
votes
0answers
27 views

How does a web browser obtain the public key of a certificate author? [duplicate]

As far as I know, when a web browser verifies the signature in a SSL certificate, it uses the public key of the certificate author (CA) which has signed the certificate. Does the web browser contacts ...
0
votes
2answers
66 views

certificate used in SSL and keys used in SSH

To do SSH to any server we should create private key pair through which we encrypt the connection. Now in SSH we are just doing encryption and here we don't need to verify the server, that's why we ...
0
votes
0answers
12 views

Certificate check works with root but fails with Intermediate CA [duplicate]

I have 3 certificates, server.crt issued by Intermediate CA which is issued by Root. The server.crt is configured on apache2 (version 2.4.29-1) on Ubuntu 18.04. However when I am trying to connect to ...
0
votes
1answer
97 views

How can I create and use self signed server certificate?

In development of a web service, I can use self signed server certificate for testing under HTTPS. How can we make a client (possibly run in the same host, but maybe a different host) work with the ...
0
votes
1answer
58 views

How does a web client check the signing authority of a server certificate? [duplicate]

In HTTP The Definitive Guide When you establish a secure web transaction through HTTPS, modern browsers automatically fetch the digital certificate for the server being connected to. If the ...
0
votes
1answer
108 views

Are the following two ways to obtain server certificates for web servers to host web applications?

https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-gunicorn-and-nginx-on-ubuntu-18-04#step-6-%E2%80%94-securing-the-application says for running a flask web ...
0
votes
0answers
75 views

Packet Capturing with 2 or more SSL Certificate

To capturing the packet from android application, I configurated proxy likes below. Physical :::: [Mobile Device] -------------------- [PC] ------------------- [Server] Installed :::: [Packet ...
1
vote
1answer
100 views

Why does productsign use SHA1 instead of SHA256 to sign the pkg?

I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also ...
0
votes
0answers
57 views

Is this a valid equation for determining certificate lifetimes in a PKI infrastructure?

I have an intuitive sense of how certificate lifetimes should work in a PKI infrastructure, but I don't consider myself an expert in this field so I would like someone to validate or critique my ...
0
votes
0answers
21 views

Can CN=localhost be used on a server that should run on any machine [duplicate]

Got a query about self-signed certificates that after doing several searches I don't feel I've got a concrete answer for. Say I have generated a self-signed server certificate with CN=localhost. Does ...
0
votes
1answer
80 views

Comodo dragon gives me warning about certificates installed on my system

today I was surfing the web with Comodo dragon browser and it gave me this warning: it don't tell me which certificate! is there any tool that I can use to scan my installed certificates? and also ...
0
votes
2answers
67 views

Do CAs issue intermediate Certificate for each new certificate request?

Do CAs issue intermediate Certificate for each new certificate? I am new to certificates and asking this to understand if the CAs have a ready set of intermediate certificates they use to issue leaf ...
-1
votes
2answers
54 views

Binding self signed certificate to a signed application/exe

This is a follow up to this question I asked before. While I am happy to custom verify the certificate from the client side using the thumbprint approach, there is one additional scenario I wish to ...
1
vote
1answer
56 views

Custom certificate verification using thumbprint

I'm trying to confirm if the approach I'm thinking of taking towards verifying a self signed certificate is sound, or if I'm going about it the wrong way. I'm no security expert, so bear with me ...
0
votes
1answer
68 views

Which certificate on my computer is used to make a SSL/TLS handshake

When connecting to a specific website(www.test.yyy.com) inside of an organisation SSL/TLS handshake is performed. From my understanding, I would say that one of my personal certificates on computer is ...
1
vote
1answer
64 views

Which has to handle certificate, a website, a web server or a web application?

In web, what is a certificate issued to, a website, a web server or a web application? Which has to handle certificate, a website, a web server or a web application? For example, when I run a web ...
0
votes
1answer
43 views

How does a digital certificate prevent impersonation by holding other's certificate? [duplicate]

As far as I know, a digital certificate contains information about a user or firm that has been vouched for by a trusted organization. https://www.geeksforgeeks.org/digital-signatures-certificates/ ...
1
vote
0answers
42 views

Confirming the validity/ownership of a Android Signing Certificate

I have a certificate that says the application was signed by Google, but on multiple searches I have reason to believe that it's not actually a google signing certificate. Is there a way to query ...
2
votes
0answers
111 views

Firefox SSL_ERROR_BAD_CERT_DOMAIN but the names are correct

Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was ...
0
votes
2answers
67 views

Using the same password to encrypt and to authenticate other actions

Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN. I would also like to use this same PIN as a secondary protection for some ...
0
votes
0answers
59 views

CA Root Certificate with same subject

Let's assume I have issued two root certificates for my domain - a RSA and a ECDSA one. Both have the same subject. As far as I know, the subject does not have to be unique. Do crypto libraries such ...
1
vote
1answer
90 views

openssl: does -keyform engine enables accessing TPM persistent handles with any key arguments ? Even with third party plugin like CMP?

If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ? Will it work with extensions, like CMP for OpenSSL, for ...
1
vote
1answer
55 views

Explanation required on Relationship between “Certificate Type” and “Key Exchange Algorithms” in TLS 1.2

A certificate, in itself, (RFC 5280) does not seem to have any indicator of what algorithm was used (for example the argument to openssl req -newkey) to create the public and private keys ("...
5
votes
1answer
101 views

Can someone explain the “Section 4.2.1.3. Key Usage” extension in RFC 5280 as it relates to TLS 1.2 RFC 5246

There are references in TLS 1.2 RFC 5246 about use of certificates (server and client). I am unclear about the "key usage" extension of a certificate as it relates to TLS 1.2 and that too for data ...
0
votes
2answers
68 views

Who/what maintains the CRL for a web server's client certs?

In the instance of a web server that requires client certificates to log in, what exactly is creating and updating the CRL? From all of the examples I see, it is a manual process. Is it really a ...
0
votes
1answer
106 views

Differences in certificate verification between ssl libraries

I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
1
vote
1answer
72 views

Is this a PEM certificate?

I'm doing research on certificates and I've managed to find a dataset. It is a single large text file where each line appears to be a PEM encoded certificate but I am unable to load them using pythons ...
1
vote
2answers
163 views

Does the “Key Encipherment” key usage make sense when using ECDH P384?

I configured a Windows CA and created a certificate template to issue certificates with ECDH_P384 keys: Then I noticed that it's not possible to set the "Key Encipherment" key usage in the "...

1
2 3 4 5
48