Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

2
votes
1answer
47 views

DNS entry defined only in HOSTS file - will browsers mark the SSL cert as valid?

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server. We have a few contractors accessing this site from outside the ...
0
votes
0answers
21 views

Proxying an Android application with Burp Suite

I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
0
votes
2answers
73 views

How to check Google SSL certificate?

I encountered this error on Google Chrome on my Windows 10. I solved it by installing the certificate and now it is working fine. I wonder, how do I know the certificate I have is legit? That is, ...
2
votes
1answer
22 views

Sub-domains TLS certificates and wildcard certificate [duplicate]

1) Is it a good security practice to have a separate TLS certificate for each sub-domain? 2) Is wildcard certificate (i.e. one certificate for many/every sub-domains) a bad practice?
1
vote
0answers
18 views

Using build time generated, self-signed certs for inter application authentication

I need to be able to authenticate requests between different applications I am responsible for. My company does have CA signed certs, but there are two problem with using it for this purpose. ...
1
vote
2answers
68 views

Does Digital Certificate affect privacy of the user?

As I know the user use the digital certificate to identify himself for the others. Can a Digital Certificate to be use as unique identifier for the user to trace and profile user activities?
0
votes
0answers
44 views

Certificate for Windows IoT Core Retail Image [on hold]

I am working on a Windows 10 IoT Core application and I need to build a custom retail image of Windows 10 IoT Core. I was following the docs of building retail image for Windows 10 IoT Core here(https:...
1
vote
1answer
32 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...
3
votes
1answer
58 views

Can cURL block a rogue CA?

I know which Certificate Authority (CA) my server uses for its TLS certs. My client system also knows who the CA is. When I use cURL, I can specify --cacert to specify a custom CA file to use, but ...
1
vote
1answer
22 views

What are the security differences between a service-signed client certificate and an out-of-band shared secret?

TLS allows for client certificate validation. Client certificates can be signed by the client, the service provider, or a trusted third-party CA. I'm talking about the middle option. At a glance, it ...
64
votes
7answers
16k views

Why would a school need to install certificates on student laptops?

This question indicates parents are to buy laptops for a school to install software and certificates. I am seeking to understand reasons for site certificates installation: Why would site ...
0
votes
0answers
20 views

How to read Security Technical Details for Connection Encrypted [duplicate]

I'm doing some research on encryptions websites and could use some help. How do you read/interpret this connection detail: Connection Encrypted (TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256_256 BIT ...
2
votes
1answer
83 views

Publishing a private key used for HTTPS certificates, is it ever OK?

I want to make it easy for users who have private servers to connect to those servers inside their LAN from Android devices. I want to avoid having these users perform configuration tasks like, ...
0
votes
0answers
33 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...
0
votes
2answers
39 views

Can certificate signing requests be stored at the server to prolong existing certificates?

I want to build a PKI (public key infrastructure) to host certificates for users. My use case is, that I want to use the certificates for e2e encryption between the users. Users must be able to ...
57
votes
4answers
9k views

Is there a way to make sure my government does not swap out SSL certificates?

I was recently wondering whether there exists a way to make sure my government is not swapping out SSL certificates in order to intercept the traffic. I know almost all browsers are complaining in ...
7
votes
1answer
88 views

The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates

I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My ...
1
vote
1answer
78 views

OpenSSL - how to renew certificates in production?

Have a number of private network services deployed on different nodes outside of optionally encrypted mesh systems, like Docker or Consul. The services have high value and should communicate via TLS ...
2
votes
2answers
51 views

Use combination of digital certificates and symmetric key cryptography

Assuming that: - A have CertA and secret key KsA - B have CertB and secret key KsB A need to transfer data M to B with the requirement of confidentiality and authenticity, BUT Data encryption must ...
0
votes
2answers
56 views

What is being verified in OpenSSL's SSL_get_verify_result

In OpenSSL the following function is used to verify certs. SSL_get_verify_result I looked at the manual here. But it does not detail what is being verified. Can you clarify to me what does this ...
0
votes
1answer
30 views

Is this CA store related to Ubuntu or OpenSSL

I am checking TLS certificates chain validity against CA sore in this path: etc/ssl/certs/ca-certificates.crt I use Ubuntu 18.04 and OpenSSL 1.1.0g. I need to know whether this CAs store is from ...
0
votes
2answers
45 views

xmlns.jcp.org domain SSL cert weirdly invalid?

I was looking for some information about Java EE Schemas and found page https://www.oracle.com/webfolder/technetwork/jsc/xml/ns/javaee/index.html. From there I clicked at http://xmlns.jcp.org/xml/ns/...
1
vote
1answer
62 views

Chain of causality in Equifax breach (expired certificates disabling IPS capabilities)

I am researching the Equifax breach described here: https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf Apparently the attack went undetected for a long period of time and the ...
4
votes
3answers
583 views

What is the best way to reissue user certificates after configuration change in a template?

I have setup my MS-ADCS environment in my company and configured auto-enrollment. i have everything working great, but found out that I want my "Subject Name Format" to have a different value. We are ...
4
votes
3answers
211 views

What if somebody sends me genuine certificate that they do not own? [closed]

I just started learning about the digital certificates, its architecture and how it works internally. What will happen if someone sends me a genuine certificate for authentication which does not ...
1
vote
1answer
141 views

Certificate serial and thumbprint number spacing

We have a Microsoft PKI setup at our organization. As per just about all certificates I've ever seen, new certificates issued by our issuing CAs will put the serial number and thumbprint in a HEX ...
0
votes
1answer
64 views

How does TLS verify a certificate belongs to a domain? [duplicate]

Say I own a domain called Bob.com, and I've sent an API request to Google.com. But instead of supplying a certificate for Bob.com, I send a certificate for Alice.com (which I got from a previous API ...
0
votes
1answer
55 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
57
votes
1answer
4k views

Does a client certificate identify the owner to unrelated websites?

If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it? I once visited an ssl diagnostic site that immediately ...
1
vote
0answers
26 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
2
votes
1answer
42 views

Do openssl CA certificates get updated with apt-get upgrade?

I use Ubunut 18.04. I need to know if OpenSSL CA certificates that are in this file: /etc/ssl/certs/ca-certificates.crt get updated when I upgrade my system using: apt-get upgrade? I have a ...
3
votes
1answer
73 views

How can I use X.509 cross signing to replace a CA?

I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate. I'...
1
vote
1answer
66 views

Risks of deploying a server authentication certificate along with a client application

What are the risks of deploying a client application with server authentication certificate (private + public key) so that a client application can host a webserver. Which is accessible via HOSTS ...
2
votes
1answer
75 views

Does the CA have to be same for mutual authentication?

I'm trying to establish mutual authentication between my Tomcat server and my customer's firewall. The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate). The ...
1
vote
0answers
27 views

Non-TLS-authoritative ZSKs?

Under DANE, the digital chain of trust goes (roughly): [Public visibility of the ceremony for the generation of the] ICANN Root Zone Key, which something something involving the TLD authorities and ...
1
vote
3answers
100 views

Why is client certificate authentication not more common

In my understanding client certificate authentication is not especially complex to implement and have several benefits compared to password authentication The secret (private key) does not have to ...
1
vote
1answer
59 views

Self-signed CA certificates - Can we throw away the private keys

I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion. I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
1
vote
0answers
34 views

How to sign a .jar file using XMSS (PQC) Signature Scheme with JarSigner

I am trying to use JarSigner to sign .jar files with XMSS Signatures. With the use of the JCA/JCE Post-Quantum Cryptography Provider from BouncyCastle it is possible to generate XMSS and XMSSMT ...
0
votes
1answer
44 views

Mutual Authentication using certifcates

How are digital certificates used to enable mutual authentication between two users? Suppose, at a bank, the employees are required to authenticate each other before transmitting sensitive data. How ...
23
votes
4answers
5k views

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as ...
0
votes
1answer
103 views

If I have a valid certificate for xxxxx.target.com, can't I read *.target.com's cookies?

Follow up: If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies? I was asked to ask this as a separate question. This isn't a duplicate question. Okay, so ...
2
votes
1answer
217 views

If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies?

Ref: How do I report a security vulnerability about a trusted certificate authority? This question involved a serious security vulnerability at WoSign. Here's the finder's blog: http://webcache....
25
votes
5answers
7k views

What does “signing” a file really mean?

I'm a bit new to security and trying to get the concepts properly. I'm wondering what exactly "signing" a file (a certificate, an apk file, or something else) means? Do we sign the whole file so ...
0
votes
1answer
39 views

Tls certificate correspondence

I am not really good in tls details, just know some basics. So there are couple of questions about it: Is there a way to decipher tls in wireshark if the cipher method is diffie hellman? I know that ...
0
votes
1answer
157 views

ssl handshake failure unable to get local issuer certificate

I have an issue with new integration that I am working on it. I should consume a web service provided by external company and this service is over https, so in order to integrate with them, they have ...
-1
votes
0answers
13 views

Extended key usage attributes for PKCS#7 signatures of backup files

We are considering creating timestamped PKCS#7 detached signatures for our backup files for audit purposes (timestamp would be created by an external trusted TSA). Which extended key usage (EKU) ...
1
vote
0answers
62 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
1
vote
2answers
59 views

Port bound TLS certificates? (1 Self-signed & 1 CA)

For my android game, I want to secure the connection between the server and its clients through TLS certificates on each side, because of the sensitive data that is beeing exchanged through a token ...
-1
votes
0answers
37 views

How do browsers check for an SSL Certificate Expiration Date

I was wondering if its possible to know how browsers, such Firefox or Chrome, decide about the expiration of SSL Certificates after looking at their Expiry Dates, curious about the fact if they allow ...
1
vote
3answers
83 views

Is looking at certificate expiration date a valid way of detecting malicious websites?

Whenever I buy something online or I receive bills on my mailbox with a link to pay via dotpay I always check if the page I am redirected to has a certificate valid for at least 1 year. Is it a good ...