Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0 votes
0 answers
11 views

Can't find private key file given CspKeyContainerInfo

I'm trying to use PowerShell to extra a private key from a certificate stored in the personal store. Most of the tools seem related to Local Machine certificates and are not working, and I hit on the ...
user avatar
  • 101
0 votes
0 answers
40 views

How to trust CA chain with sub-CA intermediate

I have a development web server that I need to add trust certificates on my local machine. Http connections to server https://machine-name.a.b.local/ show an SSL issue. This is the cert chain: ABCD-...
user avatar
0 votes
1 answer
38 views

Is it possible to trust a certificate authority ONLY when a specific domain is accessed?

I would like to know if there is a way to only trust a CA only when a specific domain is being accessed, eg. wikipedia.org. I'm using Chrome, and I'm not really tech savvy so the simpler the solution ...
user avatar
  • 3
1 vote
2 answers
45 views

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Here is the scenario, just wanted confirmation that I am understanding it correctly. I have a TLS certificate that will expire soon; Upon renewal, I paid the CA, and they reissued me with a new public ...
user avatar
  • 307
-1 votes
0 answers
36 views

Can a hacker resign an APK and keep the same certificate fingerprint

I'm a developer of a mobile Android app. In my app, I've implemented code that reports the SHA-1 certificate fingerprint (implemented in Java code, as described in this post), in this way we can tell ...
user avatar
1 vote
1 answer
26 views

Export ECDSA certificate from Windows Store

I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
user avatar
0 votes
0 answers
50 views

Client Identification using Self Signed Certificates

Taking the concept from the Gemini protocol that allows clients to identify themselves using their own self-signed certificate - is this a valid concept that could be used in other protocols and what ...
user avatar
1 vote
1 answer
52 views

Certificate warnings on websites with client certificate authentication

I have been operating websites that use client certificates to authenticate the users. To my understanding, you need to make your own CA. First of all, that way an attacker will have huge troubles to ...
user avatar
  • 30
1 vote
1 answer
38 views

Adobe uses CA signature type as identifier on signatures created with user certificates

I am testing several PKCS12 keystores with ECC type keys, generated by a CA with RSA key, to sign PDF documents. I have also tested with my own certificates from a demo CA certificate. I use Adobe ...
user avatar
0 votes
1 answer
67 views

Are self-signed certificates better for local usage?

When generating a certificate what would more secure - generating a self-signed certificate using PGP or using a public CA like Let's Encrypt? We are using it for signing and encrypting. What are the ...
user avatar
  • 200
0 votes
0 answers
91 views

I was asked to install an SSL .cert in my server, should I do this?

I am trying to connect to a company's internal API (I am working on a project for them). This company has an API that has an SSL certificate from Sectigo. From what I have gathered is a pretty well ...
user avatar
  • 101
0 votes
1 answer
73 views

How to perform MitM against SSL/TLS when certificate owned?

Performing a local network man-in-the-middle (MitM) attack is fairly straightforward, especially when the traffic is unencrypted HTTP. There are other approaches to encrypted SSL/TLS HTTPS connections,...
user avatar
0 votes
1 answer
52 views

Check public key certificate [closed]

I have created public, private keys and a self signed certificate with the following commands: openssl genrsa -out private-key.pem 3072 openssl rsa -in private-key.pem -pubout -out public-key.pem ...
user avatar
  • 249
0 votes
1 answer
32 views

Certificate not valid for common name?

I have a certificate with a common name of "myApi.mycompany.com" and 3 SANs: "myApi-dev.mycompany.com", "myApi-uat.mycompany.com" and "myApi-stg.mycompany.com". ...
user avatar
  • 121
0 votes
2 answers
73 views

Local Machine certificate (certlm.msc) Import - Enable strong private key protection

We were trying key export from Windows Certificate Store as part of a certificate module development. The code is in C++ and mostly WinCrypt and openssl APIs are used. I installed a certificate that ...
user avatar
2 votes
2 answers
64 views

How to add extension to existing TLS certficate?

We have our own root certificate authority which is used to sign the certificates for the agents connected to our server. We have generated the root certificate authority using keytool command as ...
user avatar
0 votes
0 answers
39 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
user avatar
  • 101
0 votes
0 answers
372 views

security certificate does not specify Subject Alternative Names

We have a Windows Server 2016 that we use as a web server hosted on premise and we host numerous web applications under the Default Web Site in IIS. All applications are reached by using the server ...
user avatar
  • 101
0 votes
1 answer
25 views

Multi Domain SAN or single SSL certificate

I want to use a multi-domain SAN certificate for 5 of my public-facing domains. All of these domains point to the same ingress server (SSL is terminated at the load balancer), but the backend ...
user avatar
0 votes
0 answers
31 views

Certificate encryption and hash algorithm [duplicate]

I was creating self-signed certificate with OpenSSL and had to choose encryption and hash algorithm. Are those algorithms used for encryption between client and a server? If not, then what are these ...
user avatar
  • 1
6 votes
1 answer
371 views

How can a .exe be modified and still keep a valid digital signature?

When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true. ...
user avatar
1 vote
3 answers
55 views

Auto-certification of internal services, does it make sense?

I work for a big insurance company, they have created a certification authority to generate certificates for their internal webservices. These webservices are accessible from their intranet only and ...
user avatar
  • 113
1 vote
1 answer
132 views

How insecure are self-signed certificates? Why does Tor still use them?

How insecure are self-signed certificates? Why does Tor still use them?
user avatar
0 votes
0 answers
40 views

What prevents an SSL certificate holder to issue new 'valid' certificates [duplicate]

I am new to SSL certificates and trying to wrap my head around this concept. As per my understanding when a valid certificate is signed (by one of the many official CAs) it can also sign a certificate ...
user avatar
  • 101
1 vote
0 answers
82 views

Is it OK to have both, the hostname and the FQDN of a server, in an SSL certificate?

On a company intranet, it is often more comfortable to access an internal webserver just by its hostname instead of providing the FQDN. As long as the hostname itself does not already equal a valid ...
user avatar
1 vote
1 answer
65 views

Why include the root certficiate in the chain, if it is already in receiving parts' truststore?

If I have a self-signed CA certificate in my truststore, and I am sent a chain of certificates where the root CA is missing, is this a problem and if so why? Say that the last certificate in the chain ...
user avatar
1 vote
1 answer
74 views

Why digital certificate doesn't ask for password in Linux?

I have imported a personal digital certificate into a Linux Mint computer (OS is up to date, certificate is imported in Firefox and Chrome). I used a password in the process of importing, but after ...
user avatar
1 vote
1 answer
84 views

Why do the X.509 certificates need the public key?

I am currently reading about X.509 certificates from RFC 5280 and there is a thing in section 3.1 that I cannot understand. It says: Users of a public key require confidence that the associated ...
user avatar
  • 11
57 votes
7 answers
7k views

Can a CA decrypt HTTPS traffic?

My state has made a statement that in case my country will be disconnected from the world's CAs, it is necessary to install its own state certificates. In many forums, information has flashed that in ...
user avatar
  • 1,015
0 votes
2 answers
43 views

Can any field in a CSR be overwritten in the issued cert?

Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
user avatar
1 vote
0 answers
56 views

iOS (iPhone) S/MIME certificate with multiple addresses

On an iPhone I have a mail account in the native Mail app with two distinct e-mail addresses, and a certificate that lists both of those e-mail addresses in the SAN field. When I try to send mail with ...
user avatar
0 votes
0 answers
51 views

Is it inappropriate at all for someone in my client organization to email their PEM file to me?

I have a SAML offering for my clients to access my cloud based application. Should I have a portal for them to upload their certificates or should I go the easy route and just have them e-mail them to ...
user avatar
0 votes
1 answer
44 views

When application is in HTTPS mode, is SSL certificate validation implicitly expected?

I have a application, that can communicate with some other devices on local network and it has a possibility to turn on only HTTPS communication in its GUI. However since the application is specially ...
user avatar
  • 103
0 votes
0 answers
52 views

Is it possible for a company to buy a signing certificate so that everything it signs (Software,SSL, Documents) states its from that company?

If I work for a company that wants to sign its own certificates for its website, documents and software it writes, is it possible? I have read a couple of post on here from around 10/8 years ago but ...
user avatar
  • 109
1 vote
1 answer
80 views

Risks of getting hostname for SSL cert verification via forward-confirmed reverse DNS lookup of user-supplied IP?

My understanding after reading other questions here is that an attacker would need control of the nameserver or the ability to forge responses from it to exploit this. Could it be abused in other ways?...
user avatar
0 votes
1 answer
121 views

Openssl and Let's Encrypt Cert Chain

I'm trying to understand openssl and some cert issues I was trying to track down. These certs were issued from Let's Encrypt. I will use their site as an example because I see the same behavior there. ...
user avatar
3 votes
1 answer
502 views

What signature and certificate signing is all about

I know that X.509 certificate signing process includes creating a CSR (certificate signing request) and then the following happens: Some data's from the certificate to be signed hash is computed ...
user avatar
  • 143
0 votes
1 answer
72 views

Client authentication using X509 certificates behind the scenes

In my application I've successfully implemented client authentication using X509 certificates Here's what I've done: Issued a self-signed CA root certificate with a private key Issued a web-server ...
user avatar
  • 143
0 votes
1 answer
307 views

SSL error when using curl with only trusted root certificate but server is already returning full certificate chain

My SSL server uses the following certificate setup: leaf -> intermediate -> root (trusted ca). I have verified using openssl that it's returning both leaf and intermediate certificate (at least ...
user avatar
3 votes
0 answers
106 views

Phishing? All websites show the same, wrong certificate

today I went to my Online-Banking by typing in the correct domain name in Firefox. I could login and even see my actual balance. Then within the site a warning appeared that I should do a test-...
user avatar
0 votes
1 answer
126 views

Does alias in a truststore matter?

I was trying to add a new certificate to our truststore. But I got the alias already exists error. I can't remove the old certificate yet, but I have to add the new certificate. Will it matter if I ...
user avatar
13 votes
1 answer
4k views

SSL Trust Seal of "https://www.ebay.co.uk"

when I visit "https://www.ebay.co.uk", I can see a trust seal at the bottom right of the page that says the certificate is issued by DigiCert. It is a clickable trust seal, so when I click ...
user avatar
  • 241
0 votes
2 answers
90 views

Authorising client (mTLS) based on distinguished name

I am working on a deployment where the customer is requesting to do things differently from our standard process for client authentication. Usually we generate a CA for a customer project, get them to ...
user avatar
  • 103
0 votes
1 answer
283 views

TLS 1.3 RSA key exchange

I have some confusion between the different public and private keys that are used in a TLS 1.3 connection. When a client makes a request to a server, I've always thought that a server's TLS x509 ...
user avatar
  • 103
7 votes
2 answers
3k views

How to prevent HTTPS man-in-the-middle with self-signed certificates?

I came across this issue when we implemented a new security solution. Said solution has its own root CA certificate and will create certificates for HTTPS web pages "on the fly". Each HTTPS ...
user avatar
  • 79
0 votes
0 answers
319 views

How some mobile apps prevent http traffic from being intercepted through a proxy like BurpSuite?

I noticed more and more times that some mobile apps are able to block requests, and they don't forward those requests to the server if they're going to be intercepted with a proxy like BurpSuite. This ...
user avatar
  • 54
19 votes
3 answers
3k views

Should I visit a website of a popular company if the browser warns of a potential security risk?

I have faced this situation several times. Some websites are presented as a potential security risk. Should I continue to browse such a webpage? I am attaching one example, just an example. Actually I ...
user avatar
  • 291
0 votes
1 answer
153 views

What could cause classic "ERR_CERT_DATE_INVALID" when I can confirm no error from numerous other clients?

The ERR_CERT_DATE_INVALID error, I'm sure we're all familiar with, is below Visiting the same site from numerous other locations, web clients, etc shows a valid certificate. It's issued by let's ...
user avatar
  • 302
0 votes
1 answer
87 views

What happens after SSL/TLS certificate expires? [closed]

This is what I understand about SSL/TLS protocol: Web server sends public key with cert. Client checks cert validity locally using trusted CA list. Client encrypts symmetric key using server's public ...
user avatar
  • 3
0 votes
1 answer
130 views

Invalid SSL cert using /etc/hosts

I have certificate for a.com that has two alternative domains: *.b.com and c.com. When I have the following in my /etc/hosts: <IP_OF_test.b.com> b.com If I then enter https://b.com in my ...
user avatar
  • 103

1
2 3 4 5
55