Skip to main content

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
1 vote
0 answers
25 views

How to limit the Wireless CA can only use in wireless connection on Windows?

My school require me to install a CA to do connect to the school Wi-Fi network. In android, I can install it into Wireless CA list, and based on my understanding, that won't give the CA owner ...
Funnyone's user avatar
1 vote
0 answers
52 views

TLS Server Certificate Validations 1.2 [duplicate]

I have just started to study the TLS 1.2 protocol and would like to know what checks are performed on the client side by the browser when checking the server certificate. I would be glad if you could ...
Данил Зигрей's user avatar
5 votes
2 answers
1k views

How did I obtain a wildcard SSL certificate without port 80 opened for a challenge?

I wanted to secure my apps running in a private subnet with SSL. Albeit not necessary, it is very nice to have. Because of my constant changes, I opted for a wildcard ssl certificate through my DNS ...
OutwardThinking's user avatar
0 votes
1 answer
49 views

Using mTLS for API access control and authentication

my question is about using mTLS for API access control and authentication. I understand in mTLS, both the server and client (making the API request) will verify each other's identity. This allows the ...
huthut28's user avatar
1 vote
0 answers
52 views

Can a certificate have multiple unrelated roots?

I need to install certificates on a server for a particular company. This company has two CA vendors. When renewing a certificate, it could be signed be either one. When I apply the certs to my server,...
Wyko ter Haar's user avatar
2 votes
0 answers
83 views

EIDAS compliant advanced digital signature in company name

The company I work for is developing a digital signature application very similar to DocuSign, but we aim to make our signatures EIDAS compliant. For the first version we aim to do the same thing ...
Michael Munta's user avatar
0 votes
1 answer
75 views

export burp certificate to wireshark for inspection

I am trying to figure out if i can take the burpsuite certificate and export it to wireshark to be able to inspect the traffic going through it. My main goal here is to test a website i own to see ...
Don Schulz's user avatar
1 vote
0 answers
62 views

ECDSA certificates not impacted by Let’s Encrypt certificate chain change?

We received an email from Cloudflare about the upcoming Let’s Encrypt certificate chain change. At some point, it states that "Additionally, this change only impacts RSA certificates. It does not ...
Vic Seedoubleyew's user avatar
3 votes
1 answer
436 views

Multiple certificate chains on a single server for TLS

Is it possible for a single server to use two different certificate chains for TLS? For instance, rootCA1, intermediateCert1, serverCert1, rootCA2, intermediateCert2, serverCert2. If this is possible, ...
Devz's user avatar
  • 33
0 votes
1 answer
69 views

Using an application specific entity id in X.509 certificates

I'm generating self-signed X.509 certificates so I can use TLS in peer-to-peer applications. My problem is that the identifier of each peer is an arbitrary string of bytes derived from the public key, ...
Felipe Rossi's user avatar
0 votes
0 answers
74 views

Is this X509 Subject field, with no space between 'jurisdiction' and an RDN, correctly formatted?

I recently purchased a new EV certificate (having previously used an OV certificate) and have successfully used it to sign my files. However I'm getting a lot of warnings from Microsoft Defender about ...
Dan Gravell's user avatar
0 votes
0 answers
24 views

Making a safe certifcates system for an actions API [duplicate]

I have been working on a certificate system for use (as a means of authentication) with my accounts system APIs. I am still thinking out the details, I have only watched a few videos on asymmetric ...
0xENDER's user avatar
0 votes
0 answers
40 views

Types of certificate? [duplicate]

What types of certificates are there? I was checking online and I found several different types, some at the level of the format of the certificate (x509, PEM, DER), and one at the application level (...
anonymous's user avatar
0 votes
1 answer
159 views

How to verify hostname of certificate? and Is it mandatory if client knows the certificate?

I have a reported finding saying that hostname verification is disabled. This can be deduced from this line of code: final HttpClientBuilder httpClientBuilder = HttpClientBuilder.create(); ...
anonymous's user avatar
0 votes
0 answers
55 views

What is the security impact of disabling certificate check [duplicate]

I have this line of code in a client server project: sslContext.init(null, new TrustManager[]{new TrustAnyManager()}, null); A security guy pointed out that this is skipping the validation of the ...
anonymous's user avatar
0 votes
0 answers
26 views

Given the wide trust of Domain Validated certificates by browsers, is there any reason to get higher validation for Internet/public-facing websites? [duplicate]

Let's Encrypt has made Domain Validated certificate ubiquitous and trusted by mainstream browsers. Against this backdrop, is there any reason for an Internet and general public-facing https website to ...
xuhdev's user avatar
  • 123
0 votes
1 answer
96 views

How can Amazon add its own headers when I make HTTPS requests to a web application?

I was playing with httpbin.org to test a client and discovered that some sites will get an header I did not set (X-Amzn-Trace-Id). If I do a curl https://httpbin.org/headers (which will respond with ...
simondvt's user avatar
  • 101
0 votes
0 answers
96 views

AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment

Let's say we produce IoT devices and want them to access AWS IoT Core. The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
Francesco B.'s user avatar
2 votes
1 answer
205 views

Openpubkey SSH workflow details

Currently looking into OpenPubKey and more specifically into OpenPubkey SSH: https://github.com/openpubkey/openpubkey https://docs.bastionzero.com/openpubkey-ssh Terminology: OPK => OpenPubkey ...
ieggel's user avatar
  • 225
0 votes
2 answers
259 views

What is the impact of disabled TLS hostname verification?

If I have a java client that connects to a server, but in the java client code where the connection is built, it skips hostname verification disabled. When a client tries to connect to serverA.com, ...
anonymous's user avatar
0 votes
0 answers
82 views

Checking Against the CN Of Every Certificate In The Certificate Chain

Is it possible to check against the CN (Common Name) or SAN (Subject Alternative Names) of each and every certificate in the certificate chain for a match ? I have 2 docker containers hosted on my VM, ...
Dhiwakar Ravikumar's user avatar
0 votes
2 answers
143 views

Automatically check if a certificate matches specific ciphers

My nginx backend server supports the following ciphers: ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:...
Shahar G's user avatar
0 votes
0 answers
100 views

Connecting Logstash To Elasticsearch via SSL (Docker Container)

My environment consists of 2 docker containers, one running Logstash and another running Elasticsearch on the SAME host & SAME docker network. I am trying to setup SSL between the 2 of them (this ...
Dhiwakar Ravikumar's user avatar
1 vote
0 answers
85 views

Is it common practice that vendors put own root certificates on customer devices? [closed]

At work, we are deploying a new VoIP solution, and as part of that, we are supposed to install a custom root certificate on our computers and mobile devices. The manufacturer of that VoIP solution ...
Torsten Bronger's user avatar
0 votes
0 answers
64 views

Will this certificate Pinning plan work as expected?

I have a mobile app deployed to millions of user in both Android and iOS. My Security dpto rotates our certs once a year. Our certs are issued by GlobalSign. I would like to pin the certificate ...
Leonardo's user avatar
  • 119
1 vote
0 answers
70 views

Other benefits of creating my certificate authority aside from the firefox issue and centralized management of certificates?

I've been trying to read more about self-signed SSL certificates versus creating my own certificate authority to sign SSL certificates. I am still not completely clear on this. I'll start by ...
learningtech's user avatar
0 votes
1 answer
116 views

Does EAP TLS benefit from “Verify the server’s identity by validating the certificate” setting

For PEAP it's important to enable the "Verify the server’s identity by validating the certificate" setting in a Windows WiFi profile. Is there any benefit enabling this for EAP TLS? If I ...
JPX's user avatar
  • 101
3 votes
1 answer
2k views

How does the SSL/TLS protocol determine if a certificate is expired or not?

I already tried googling but no luck. All search results always tell you how to check cert expiration manually, but that is not my question. Yes I can use OpenSSL for example, but what I am asking is ...
Noob_Guy's user avatar
  • 139
0 votes
1 answer
266 views

Why openssl verify does not work for the certificate chain of a correctly configured site?

I download its certificates. To do that, I used the openssl debug output of the command openssl s_client -connect security.stackexchange.com:443 -servername security.stackexchange.com -showcerts -...
peterh's user avatar
  • 3,030
0 votes
1 answer
109 views

What file extensions are specific to qualified and advanced seals?

A definition of qualified and advanced seals can be found on this page https://europa.eu/europass/en/how-issue-european-digital-credentials at the section "Advanced or Qualified eSeal" A ...
the common starling's user avatar
0 votes
0 answers
86 views

Help identify the tool generating certificate displays on the EU eIDAS Dashboard

The EU eIDAS Dashboard serves as a repository for trusted "trust providers" in accordance with the eIDAS regulation. The provider's certificates are listed within the dashboard. You can find ...
ARF's user avatar
  • 101
1 vote
0 answers
304 views

SSL Certificates signed by our CA show as invalid in browser

We're experiencing an issue, where SSL server-certificates issued by our own internal PKI will show as invalid in the browser, when accessing the site. The error is NET::ERR_CERT_INVALID (Tested in ...
AssistantTOtheCA's user avatar
2 votes
0 answers
64 views

Requesting an user-specific certificate in a tiered domain

Environment: A multi-tiered Active Directory (AD) where tier-specific admin accounts are restricted to log on to only their tier servers. Microsoft's Certificate Services (CS). Let's say the CA tier ...
Ramil's user avatar
  • 21
1 vote
0 answers
83 views

Support for domain-specific root CAs in X.509 certificate format, OS and browsers

Chance is one gets an invalid certificate warning when one follows this link https://www.cnss.gov. As explained there (same warning) this is on purpose, and the solution is supposed to be to install1 ...
fgrieu's user avatar
  • 1,273
2 votes
1 answer
117 views

How to feasibly digital sign high volume documents with CA issued digital certificate?

My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
BambiBundle's user avatar
0 votes
2 answers
224 views

Is there a tool for auditing my root certificates?

Is there any tool out there that will monitor my system's use of root CAs? So far I have not found anything, and so I am hoping that this community will know if such a tool exists. For background, I ...
Cogitative's user avatar
-1 votes
2 answers
282 views

What happens to the key pair once the CSR has been enrolled?

I have a key pair which I used to generate a CSR. Once I enrolled that CSR PKCS10, I get from the PKI (or CA) a certificate signed with the PKI private key. From here, I would like to know if my ...
MoBe's user avatar
  • 21
1 vote
0 answers
85 views

Is it fine if I share a .pfx self signed certificate generated inside my machine with other users to test and use PnPCore SDK

We want to develop some Azure functions which use PnPCore SDK. For testing purposes, I registered an Azure app which uses self-signed certificate for authentication. Now I configured the Azure app ...
microsoftdeveloperdesigner's user avatar
0 votes
1 answer
143 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145
0 votes
0 answers
228 views

openssl: Not able to verify 3rd in the chain with self-signed certificate [duplicate]

(Disclaimer: Checked all the openssl related topics, no success). OpenSSL version: OpenSSL 1.1.1s 1 Nov 2022 I'm trying to generate the chain of certificates, root -> intermediate -> user1,...
unalignedmemoryaccess's user avatar
0 votes
0 answers
96 views

Godaddy automatic renewals (Powershell & alternatives)

how are you? My orgazation is transitioning to using GoDaddy certificates, and I'm exploring if there's an established automated process to download and apply renewed certificates from GoDaddy to our ...
JustToKnow's user avatar
1 vote
0 answers
187 views

Do code signing certificates build reputation only for Microsoft, and is reputation maintained across releases?

I have a Windows executable file that has been code signed with a certificate from a Certificate Authority. The CA is listed in the official Microsoft Trusted Root Program list of participants. The ...
Ron's user avatar
  • 111
1 vote
2 answers
182 views

Is it possible to get an SSL certificate with a Subject Alternate Name of a different website?

If this is possible, what is stopping a malicious file from adding an entry to \etc\hosts that points example.com to a phishing clone of a website? Usually, the browser warns you that the common name ...
Sam Wilson's user avatar
0 votes
1 answer
469 views

Is it possible to extend the validity of a pem certificate

Please help me understand and solve this problem. Assumptions Let's start with an IoT design. When it is working correctly, a remote device has a pem certificate which is used to validate traffic to ...
monkey's user avatar
  • 103
0 votes
1 answer
731 views

How can one use HTTPS without a domain name, or on a local network?

I was looking at the LXI Device Specification 2022 Version 1.6. For those not familiar with LXI, it is a standard for lab instruments like oscilloscopes, function generators, LCR meters and many more ...
Jack B's user avatar
  • 103
3 votes
0 answers
120 views

Does a signature service provider level digital certificate for electronic signature comply with eIDAS requirement for Advanced Electronic Signatures?

I have some basic questions regarding eIDAS and 'Advanced Electronic Signatures'. Say, if I create a product under my company Acme Inc that offers a simple electronic signature where I sign every ...
BambiBundle's user avatar
0 votes
0 answers
591 views

How to get Certificate's Subject Public Key from CSR

I am currently using this code to have the public key pinning OkHttpClientFactory okHttpClientFactory = () -> { CertificatePinner certificatePinner = new CertificatePinner.Builder() ...
Archie.bpgc's user avatar
0 votes
1 answer
864 views

openssl: genrsa vs req -newkey private keys. What's the difference?

I'm trying to understand the difference between generating a private key using openssl genrsa and adding -newkey to req. I found a 2014 answer saying the underlying code is the same, one from 2015 ...
pollirrata's user avatar
0 votes
1 answer
121 views

How to resolve an issue with potential mismatch between device certificate and CA certificate?

I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
monkey's user avatar
  • 103
0 votes
2 answers
230 views

Website returns different certificate on my home network to mobile hotspot

This is a "should I be worried" question. I access a website on my laptop via my home network/router. My Edge browser gives me a "Your connection isn't private" warning page and ...
Kepboy's user avatar
  • 101

1
2 3 4 5
58