Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
1answer
50 views

OpenSsl and self-signed certificates - verifying a chain

I have a chain.pem -----BEGIN CERTIFICATE----- // My server cert signed by intemediate CA -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- // My intermediate cert signed by root CA -----END ...
0
votes
1answer
59 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
0
votes
2answers
64 views

Can MitM spoof a signed certificate by imitating the Certificate Authority?

I understand that a signed certificate is a server public key signed by the private key of a certificate authority. As a result, a client allegedly rest assured that the signed public key is for the ...
0
votes
0answers
20 views

Seeking a reliable way of creating trusted certificate files for OCSP

In my deployments I use OCSP must-staple flags on certificates, and ensure that my server is set to do verification and OCSP stapling. That's all good, but I'm forever having problems creating the ...
0
votes
0answers
7 views

Kernel Mode Driver Signing using Self Signed Certificates [migrated]

Can anyone help me in signing the .sys files for windows 7 64 bits? I have created the self signed certificates using Openssl and I want to sign the the .sys files with that certificates using ...
0
votes
0answers
15 views

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication? [duplicate]

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication?
0
votes
0answers
22 views

Verifying Public Key Using The Digital Signature on Mac

I have just started with encryption and stuff, so please bear with me. Just playing around. I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
0
votes
0answers
40 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
9
votes
2answers
990 views

Trying to understand how Digital Certificates and CA are indeed secure

I understand that Digital Certificates and Certificate Authorities (trusted 3rd parties) help prevent man in the middle attacks during HTTPS connections. However, I am confused on a few details. Let'...
1
vote
1answer
142 views

Is it safe to use personal wiki over http?

I hosting my site on infinityfree.net for free and dokuwiki is installed there. Couple of my colleagues, including me, are going to use wiki for writing documentation for our project. Wiki is private,...
2
votes
1answer
111 views

Encrypting a blob with a password

Is there anything to say against to have an amount of public keys, which encrypt a common password for a blob encrypted? So Users 1,2,3 have all certificates for themselves and can use them to get ...
19
votes
3answers
4k views

Are certificates without DNS fundamentally flawed?

I am new to security work and I am implementing someone else's design. The design calls for a TCP server with TLS in an environment where there is no DNS - only IPs. I am working with a typical ...
0
votes
1answer
49 views

SSL certificate distribution of API

We have an API which has SSL certificate signed from authorized CA. The access to the API is limited. API is accessed from webapp and only from those client who have valid public key for SSL. Now, how ...
2
votes
4answers
93 views

How to secure VPN credentials on end-user devices?

I have a VPN and PKI in place with MFA. My question is: What's the best method/solution for protecting the integrity and identity of end-user certs? I want to make sure that users only able to use VPN ...
0
votes
3answers
96 views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
2
votes
1answer
50 views

Wildcard certificate generated for local CA do not work for the subdomains

I have created Makefile to simplify generation certificates for local development: DOMAIN ?= localhost NAME ?= ${DOMAIN} CAKEY ?= CAkey.key CACERT ?= CAcert.pem SIGN_REQ ?= ${NAME}.csr ...
1
vote
2answers
143 views

Is the installed certificate used for school wifi able to track me at home?

I've read similar questions being answered on the safety and privacy of school wifi certificates but my question on whether they can still track me at home stands. I'm using my own computer (not ...
2
votes
1answer
137 views

Is it dangerous to add a custom cert authority to a browser?

For example if my friend develops a webapp with a custom cert and I add them as CA to my browser, can they do any damage? I mean for example somehow faking certs and stealing my banking password, etc.?...
-3
votes
0answers
38 views

How to be sure that my app is my app? [duplicate]

I want to protect my server against someone who would have replicate my iOS application and used the internal http calls, by decompiling or just by some way obtained my source code. I guess It would ...
-2
votes
0answers
34 views

How can I determine which algorithm a certificate implements for data encryption? [duplicate]

I'm attempting to discover which encryption algorithm(s) are available on a particular Certificate. Is this possible? I have examined some certs in CertMgr and I see things like: Signature ...
1
vote
2answers
81 views

Can I get an SSL certificate even if external DNS does not resolve

I have an intranet website that requires an SSL Certificate. From what I've seen it seems like this is difficult to accomplish or cumbersome. Would I be able to buy an SSL certificate if there is an ...
72
votes
1answer
15k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
0
votes
2answers
153 views

Why does localbattle.net point to localhost?

I found a random link on a forum linking to localbattle.net, at the same time I was running a local server on localhost. When I went to localbattle.net, my local server page appeared! The certificate ...
0
votes
0answers
37 views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
0
votes
0answers
25 views

How can TLS/HTTPS remain secure if the entire transmission is monitored? [duplicate]

Okay, so I'm pretty sure this question comes from a fundamental misunderstanding of how HTTPS works, but here goes: Say that someone has hooked into the "internet line" coming from your home so that ...
0
votes
0answers
32 views

Automating certificate management across a large number of printers?

Is there a way to manage certificates on a large group of printers that will install and renew them? It doesn't look like any of the fleet management programs will do this. How are these managed in an ...
20
votes
7answers
5k views

Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?

Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
0
votes
1answer
65 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
1
vote
1answer
150 views

Is Certified | Ethical Hacker (C|EH) a scam or legitimate? [closed]

I've been doing a lot of research on Certified | Ethical Hacker (C|EH) to see if it's a credible certification. But I've stumbled across a Wikipedia article on it and discovered that the sources are ...
6
votes
2answers
483 views

Did google chrome kill public key pinning?

I've read many articles talking about google chrome killing public key pinning in Chrome 67 (May 2018). See here, here, and here. However, I haven't found any information about whether or not they ...
2
votes
1answer
123 views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
1
vote
1answer
41 views

Is a SSL client required to try multiple certificate chains?

Yesteday, 10 July 2019 I failed to access dict.tu-chemnitz.de with Epiphany (WebKit2, which is using GNUTLS) and mailed the administrator which fixed it quickly. Here is the access via GNUTLS: $ ...
0
votes
1answer
74 views

Cross sign two self signed root CA

I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster. However, one of the ...
0
votes
0answers
17 views

Certificate Pinning with SockJS

What is the SockJS way of pinning SSL Certificates in the client side when contacting wss:// to avoid CA trust? FYI, when using modules like HTTPS or WS, we can listen to the socket event and then on ...
2
votes
1answer
81 views

Does SSL inspection break applications utilizing certificate pinning?

A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
0
votes
2answers
173 views

Why does pinning a CA root certificate not present a security risk?

AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
-1
votes
2answers
81 views

SSL/TLS Extended Validation implemented in fraudulent domains

People trust green bars, because it is proven to not to be of malicious origin. This seems to be the questions of hundreds and many are concerned about it, picture that; a team of fraudsters(or at ...
0
votes
0answers
74 views

Why is my gf seeing a localhost self signed certificate when going to netflix?

Recently my gf told me she was receiving errors when trying to go to netflix. I took a look and the certificate is super wierd saying it is self signed. Why could this be happening? She only uses the ...
0
votes
1answer
49 views

How to create a self-signed client-certificate without a CA?

I tried A lot of articles online generating certificates using openssl, but unfortunately none of them worked for me :( There is a website that everytime I visit throws me this error: Sorry, but ...
0
votes
1answer
78 views

Websocket connection hostname check

I am testing an application that uses both regular http rest requests and websockets. Burp cert is installed on the device I am using for the tests. I can intercept the encrypted traffic using Burp. ...
0
votes
0answers
39 views

CSP/KSP module for MacOS

My company developed a custom Key Storage Provider for Microsoft CAPI so that CNG-using Windows apps can perform signatures using a remote signature service. I would like to know if there is support ...
1
vote
1answer
55 views

Feedback for self-signed certificates setup for custom product auth?

HW (linux) <---Eth---> Official PC (win,mac,linux) | | ----> Man-in-the-middle eavesdrop I'm looking to prevent an unauthorized party inside the ...
0
votes
1answer
65 views

Can we keep our customer's X509 Certificate as BLOB on our server?

I have a scenario in which I need to use the customer's X509 certificate and passphrase for executing their web services. Now, I need to know what will it be a security breach if I store customers' ...
1
vote
0answers
53 views

Can my company see my network traffic if their certificate doesn't appear in the web browser? [duplicate]

I have a work-issued Mac, when I go to keychain access right now these are the following certificates: AddTrust External CA Root (Root certificate authority) COMODO RSA Certification Authority (Root ...
29
votes
2answers
4k views

Can you sign using a digital certificate itself?

Googling I saw several lectures saying that it is possible to sign using digital certificates. I am confused about that, because according to my knowledge it is possible to sign only using the private ...
0
votes
0answers
43 views

Unable to get information from a PKCS certificate

I sniffed the communication between the client and the server using Wireshark, and I found out that during the handshake session, the client sends its certificate to the server. I've managed to get ...
1
vote
0answers
16 views

What would happen to the connection when certificate expires? [duplicate]

We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure) The expiry date of the certificate is 3 years from now. Once the ...
0
votes
1answer
86 views

Why am I receiving this error message when browsing nvidia.com?

I'm receiving this randomly when I try to visit nvidia.com. I can either not reach the site at all with a 504 error, or I get this screen. What does it mean, and what is the cause?
0
votes
0answers
41 views

What are the security protections in using a TPM generated VSC to create a CSR

I am extremely new to the field of information security but was given a project to create a secure TLS certificate signed by our CA for a new security process. I found this thread (How to generate a ...
1
vote
1answer
77 views

Where do TLS clients fetch intermediate CA certificates from? [duplicate]

When I use my browser (a TLS client) to navigate to a secure web page (e.g. https://example.com), during the TLS handshake, the browser will receive an end-entity certificate from the web server of ...