Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509],...

1
vote
0answers
23 views

Provide email author origin integrity

If i receive an email, how does my computer verify the author origin integrity using the digital certificates? Does it use any specific protocol for this?
1
vote
0answers
30 views

How does my computer actually validate a certificate? [duplicate]

Let's say I receive an email from my friend, X. The email is attached with the digital certifciate of X. Suppose this digital certificate is issued by a company called DS, and my computer does not ...
0
votes
0answers
31 views

How trusted are digital certificates? [duplicate]

When a certificate is created that contain the public key of the website and the fingerprint of the certificate, digital information can be tricked all the time. Can we even trust a certificate ...
1
vote
1answer
69 views

Understanding Microsoft list of disallowed certificates

Microsoft publishes their untrusted certificates as disallowedcerts.stl Warning: direct download. It is ASN.1 encoded. After decoding it there is a list of sequences like so: SEQUENCE { ...
0
votes
0answers
22 views

Let's Encrypt SSL Certificate fails on Postman's SSL Certificate Verification [closed]

I have a problem calling my API secured with Let's Encrypt SSL Certificate from Postman. I have generated a certificate for my deployed services on the alibaba's servers and everything is working ...
1
vote
1answer
19 views

Multiple Intermediate Certificates on openssl

I need to create multiple intermediate certificates so the chain would be like this root >> int 1 >> int 2 >> user cert. Till yet, I have created a root and an intermediate certificate (signed by ...
1
vote
1answer
47 views

How can I verify the certificates when connecting to an FTP server with Filezilla?

Today most hosting providers start a TLS connection whenever you connect to their FTP server. But Filezilla doesn't store any root certificates, so whenever you connect to an FTP server and the TLS ...
0
votes
1answer
179 views

How to eavesdrop and decrypt the HTTPs communication of an IoT device?

I am trying to setup a MitM scenario between an IoT device and WAN. It is possible and quite easy to achieve same thing for the application run on a mobile device by setting my proxy server(Fiddler)'s ...
0
votes
1answer
48 views

Do SSL proxies such as those from antivirus vendors hijack client processes?

In an attempt to understand the topic further, the following posts were reviewed. Why is 'avast! Web/Mail Shield Root' listed as CA for google.com? Are the certificates from “skype click to call” ...
1
vote
0answers
68 views

Why Diffie-Hellman instead of just share the secret [duplicate]

I read that D-H is used to make a shared secret between parties that then they use to encrypt the messages. This is used in TLS, for example, after the server has authenticated itself with a ...
0
votes
0answers
11 views

SSLError: (“bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])”))) [migrated]

I want to scrape results from my company portal. It seems that my company intranet portal uses ping SSO to login. So when I try to login, it is not asking for my username and password. When I go to ...
0
votes
2answers
47 views

How to detect if X.509 certificate belongs to CA or regular end user (host)

If I understand correctly in SSL/TLS authenticity validation there are 2 (maybe more) types of certificates according to the following: the ones that belong to CA (these contain the public key that ...
2
votes
2answers
233 views

Can Certificate be validated locally [duplicate]

When I establish TLS/SSL with some server he sends me the certificate in the process. The certificate is signed by a certificate authority. In my PC/browser I have a list of trusted certificate ...
-2
votes
0answers
49 views

Are commercial certs more secure than free ones? [duplicate]

Commercial certificate signing services have existed for a long time, where companies charge a fee for signing a certificate so that it's trusted by root programs. But recently Let's Encrypt claims it ...
0
votes
0answers
42 views

What encoding and how to decode CRT which have: “backslash”, “slash” and “+” sign?

I have 3 CRTs and cant figure out how to decode them. Checked mostly all tools online and base64 says: Malformed input. Other CRT decoders say invalid input. This are the 3 CRTs I want to decode: "...
0
votes
1answer
51 views

Root cert lacks CN

A company's internal CA has issued a root signer cert (there's no intermediate cert acting as signer) in which the DN contains only the C=US and O=company_name and no other DN fields. The cert signed ...
2
votes
1answer
36 views

Server secured with a Certificate from a Custom CA Root: OK on Firefox but KO on Chrome? [duplicate]

The Setup In order to protect the very small intranet of the ACME company, which contains two private servers, foo-server and bar-server, I've created with OpenSSL: The Root CA Certificate The ...
2
votes
1answer
128 views

Can my network admin examine files I upload on a HTTPS site? [duplicate]

I have been working in a big company for the past 4 months. I have two machines that i work on, my personal laptop and my desktop workstation (company property). Occasionally, as all my colleagues do, ...
0
votes
0answers
4 views

How do I install the OWASP ZAP certificate as a trusted system CA on Bluestacks? [migrated]

I have a rooted bluestacks android. I would like to use ZAP to monitor its SSL traffic. I exported ZAP's SSL certificate as a .cer file ("----- BEGIN CERTIFICATE .... ------ END CERTIFICATE -------")....
1
vote
1answer
58 views

Are all SSL domain validation basically the same technically speaking? [duplicate]

I've googled this and haven't really been able to find a straight answer and this question which I have read is a bit different and is a bit outdated considering the landscape has changed a lot ...
1
vote
2answers
75 views

Does a File's Checksum Change after it is Digitally Signed?

From my understanding, when you digitally sign a file, it changes that file's checksum because they are bundled together. Example of what I mean: file1.txt only contains the letter 'd' and the ...
1
vote
2answers
74 views

Why digital signatures needs different algorithm

Why digital signatures uses algorithms such as DSA, ECDSA or RSA-PSS, and not just the RSA algorithm to encrypt the message hash with the private key? Is the choice more security or performance ...
-1
votes
1answer
75 views

Certificate weird behaviour

I tried to understand a certificate issue and capturing using Wireshark to inspect the different sequences. The case that is not working (wifi connection through my cable provider), I see: client ...
1
vote
1answer
44 views

How to authenticate a specific client program? [duplicate]

I have a server application which provides functions to a client program. The client is also programmed by me. Now I want to authenticate the client program itself (not any user) before using my ...
0
votes
0answers
56 views

Browser resolving wrong certificate

When I visited google.com using Chrome, the browser said: "Your connection is not private" I checked the certificate, it's a certificate for *.atlassolutions.com which belongs to Facebook. The same ...
4
votes
1answer
69 views

How to check if Certificate from Certificate Log is revoked?

I have a DB with certs from CTL. (using 'certstream' utility). Here's an example of one set of certificate data: { "all_domains" : [ "benesseresalus.com", "benesseresalus.it", "...
2
votes
1answer
82 views

How to programatically verify a file signature?

I have a dll file signed with my private key, here is the signature info in Windows Explorer: Now, using the public key found in the certificate, how can I verify the integrity of the file? I am ...
-1
votes
1answer
52 views

SSL Certificate Subject Alternative Name Information Disclosure

I'd appreciate if someone could shed some lights on the subject findings. Is this a security problem having bank.com appearing on the SAN? Hostname was discovered in the Subject Alternative Name (...
8
votes
3answers
2k views

Can my school see exactly what I’m doing? [duplicate]

My school requires us to install digicert global root CA and digicert sha2 secure server to access to the secure and guest WiFi onto our personal devices. Does this mean that the school can see the ...
0
votes
0answers
34 views

iPhone hardware certificate / MIC?

Do iOS devices have some sort of unique hardware certificates signed by Apple? I mean built-in in every device, pre-installed by manufacturer (Apple). Is it possible with iOS SDK to sign the data ...
1
vote
1answer
49 views

Must the CN of a certificate (self-signed or otherwise) be DNS resolvable?

I'm trying to get Bareos working with TLS encryption using a self-signed certificate. I have used the name of the server for the self-signed certificate CN. The server does NOT have a domain set. ...
0
votes
2answers
80 views

How to convert my cert chain to PFX without a password

I am trying to enable an Azure Front Door instance on the front of my website using my EV cert (Extended Validation Certificate). However, from Azure Front Door Cert Instructions, Azure Front Door ...
0
votes
1answer
22 views

Giving a PFX cert to a 3rd party email service for DKIM?

My organization is working with a vendor that needs to send emails on our behalf. They want us to import a PFX certificate into a DKIM key. We want to understand the implications first. What ...
3
votes
2answers
110 views

Are Let’s Encrypt wrapper services secure?

There are a number of web based portals that purport to make installation of free SSL certificates user friendly for non-technical users (ZeroSsl, SSLforFree). For lack of a better term I am calling ...
0
votes
1answer
74 views

Authenticating Certificate for School Wifi [duplicate]

My school wifi, which requires me to login using ny username and password, is requiring that I accept a certificate in order to connect. I don’t know if this is a trusted root certification but what ...
1
vote
1answer
44 views

Deutsche Bank PhotoTan app signed with self-signed certificate?

Deutsche Bank recently started forcing its customers to switch their transaction authentication from iTAN to PhotoTAN. Now I wanted to verify the authenticity of the Android app like this: # ...
-2
votes
1answer
57 views

Wget cannot securely connect to web.archive: self-signed certificate encountered [closed]

I wanted to get a few files from https://web.archive.org with wget, but it's throwing a self-signed certificate encountered error. I'm connecting through my phone directly to the mobile network so I ...
0
votes
1answer
44 views

re-reading decoded openssl pubkey

I was playing with openssl just to see how reading of the public key from a certificate works; Gave a "letsencrypt.pem" certificate I have, I gave these commands. See the entire certificate text: ...
1
vote
2answers
51 views

openssl certificate chain output

I was reading the "Security with HTTPS and SSL" guide for android developers and reading this paragraph. The paragraph discusses the fact that servers do not always return the entire certificate ...
2
votes
2answers
76 views

Is it okay to have your SSL cert showing when server is reached by IP?

I've been doing some research into SSL for a paper for school, so please forgive my ignorance and lack of experience in this subject. While doing my research I have noticed that some websites when you ...
2
votes
0answers
47 views

Delegating SSL certificate requests to a third party

I'm wondering what best practices are regarding delegating the authority to approve SSL certificate issuance. One of our vendors (www.vendordomain.com) will soon host a Web application for us (www....
0
votes
1answer
48 views

OCSP, CRLs, crlset - Revocation Delivery and Attacks

OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the ...
0
votes
4answers
79 views

Why are CRLs used instead of “valid certificates lists” and inner workings of CRLs

I don't really understand why the approach towards checking the validity of certificates is "valid until proven otherwise" (aka revocation lists). In my opinion this is kind of weird. A CA has to ...
2
votes
2answers
154 views

Root CA with Extended Key Usage fields

I recently started using AWS's Certificate Manager to get free TLS certificates for my load balancer. When I was inspecting the certificate chain I noticed that the Root CA, Starfield Class 2 ...
4
votes
2answers
136 views

How do short lived certificates increase security?

After reading a blog post about the new Roughtime protocol, I am not convinced of the original premise that shorter certificate lifetimes increase security. The claim is that a shorter time somehow ...
1
vote
0answers
36 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
1
vote
0answers
17 views

Best way to back up locally stored Certificates

What is the best way to back-up all the locally stored certificates on Windows 7? An adware Trojan has installed fraudulent certificates as part of its payload. Before I alter anything, I want to ...
3
votes
2answers
100 views

OpenSSL Certificate Renewal with same keys and NO CSR

I have a Linux-based vendor-supplied virtual appliance that uses OpenSSL to manage certificates. The current server certificate is from Symantec so has to be replaced with a DigiCert. DigiCert is ...
0
votes
2answers
31 views

How to deliver an application to several clients with a single trusted SSL certificate? [duplicate]

I am working for a software editor and we deliver to our clients a turnkey solution that the client has just to install on his server to use it. This solution is a web service who uses HTTPS to ...
0
votes
1answer
257 views

Your connection will not be private - Wi-Fi CA certificate warning message on Android

I try to connect to a Wi-Fi network, Eduroam, using my new Android device. It asks me to provide the CA certificate and warns that otherwise my connection would not be private. No certificate ...