A piece of data used in public key cryptography that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate.

learn more… | top users | synonyms

0
votes
1answer
26 views

Creating self-signed certificate for localhost and trusting fully

As an accompanyment to a web application we plan to have a node application running as a windows service running on the client computer. This will run a small web server which will listen on port XXXX ...
2
votes
0answers
21 views

How to enable self signed certificates in Windows 10?

I want to use a Yubikey 4 with Windows 10 Pro for Bitlocker and login with my TPM. Unfortunately, I found out I need to enable self signed certificates and all the guides on the Internet I found were ...
1
vote
0answers
15 views

How did I get a signed cert back with a wildcard common name when I submitted a csr with a specific common name? [duplicate]

Apologies if this is obvious but I'm hoping for some clarification here. I generated a CSR on an appliance of mine. This CSR had a specific common name (let's call it foo.domain.com). I then sent ...
-1
votes
1answer
40 views

Same certificate but different private keys on different servers. Does this work?

We have a SAN cert that is used on multiple servers. Is it possible to have the cert re-keyed and only use the new private key on a particular server while keeping all of our other servers using the ...
4
votes
2answers
51 views

Trusting the “subject” of an x509 certificate

A bit of background. Our organization is working on a document format that will be ingested by our software. We're using the CMS format to verify the integrity (by validating the signature). The CMS ...
3
votes
2answers
69 views

Best practices to implement HTTPS in embedded devices

Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...
0
votes
3answers
54 views

Same wildcard cert from two different 3rd party CA's

We have a wildcard cert that's due to expire in three months. The CA won't let us renew it until one month prior to its expiration. We're thinking about using a different CA since we've since ...
3
votes
1answer
44 views
+100

X509 CRL suspended certificates and openssl ca comand

In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it. ...
0
votes
1answer
20 views

How secure is it to bundle unencrypted private key and a CSR into PKCS12 certificate?

I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, ...
0
votes
1answer
39 views

Securing Internal Mobile REST API

I am planning to create an internal API for mobile devices for a company. They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
1
vote
5answers
83 views

Best Option for SSL Certificate for 2 Domains + All Subdomains

I am hosting multiple websites on my Mac Mini server (latest version). For some reason OS X server does not support multiple SSL certificates well for websites, and after hours on the phone with ...
1
vote
1answer
37 views

Securely opening an insecure webserver to a single phone

I have a webserver running inside my private network and not exposed to the internet. I'd like to securely talk to this webserver from my mobile phone over the internet. However, this webserver has ...
0
votes
0answers
16 views

Does the AppId matter when self signing a cert?

We are going to start using self-signed certificates on our dev server. I went through some step-by-step instructions on how to generate the cert and set up ssl with my service. To add the cert, I ran ...
3
votes
1answer
97 views

Benefits of a wildcard vs per-subdomain certificates

As you might know, Let's Encrypt doesn't offer wildcard certificates and it won't in a short-term because you can just order as many certificates as you want for the sub-domains. This make me ...
5
votes
1answer
64 views

Why are short-lived certificates so rare?

Let's encrypt recently left beta and limits the maximal life-time of certificates to 90 days and recommends 60 days. Now whenever I start talking about the issues of certificate revocation (e.g. OCSP ...
0
votes
1answer
49 views

Digitally signing a document with your public/private keypair without certificates?

I have generated a private/public key pair using gpg. Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead ...
1
vote
3answers
129 views

What SSL certificate do I need?

I have 2 domains, one where the website is hosted (lets call it www.a.com), and another (lets call it www.b.com) which has a CNAME record pointing to the first one (www.a.com). Which one should have a ...
3
votes
0answers
73 views

SSL certificate and price difference [closed]

After reading this discussion, Why are there very expensive and cheap SSL same type certificates? I surfed over the internet “Symantec Secure Site Pro with EV SSL Certificates”. I found something ...
2
votes
2answers
67 views

What advantage would someone gain by installing my root certificate?

The answer to this is probably simple, but it eludes me. Here's the scenario: At the moment, I have a server with a certificate issued to it using HTTPS that a customer POSTs responses to after ...
1
vote
2answers
25 views

Mandadory checks a client should make to verify a ssl/tls certificate [duplicate]

Let's say I have a client, not a browser, that wants to connect with https to a server. It could be a python program, an android app or a library etc. Suppose the client has a list of trusted CAs and ...
3
votes
1answer
39 views

What security impact is caused by a TLS server continuing the handshake when presented with an invalid SNI?

RFC 6066 defines Server Name Indication as an extension, whereby virtualised web servers may be given an SNI extension in order to know which certificate should be presented. It has the following to ...
31
votes
2answers
2k views

Can a SSL certificate have longer validity period than its parent in X.509 chain?

When a X.509 certificate chain is composed of X1, X2 ... Xn and Xn is root CA, Can a certificate in lower level have longer validity period than its parents? I think that lower level should be proper ...
1
vote
0answers
27 views

OCSP recording with JMeter

How can I record an application which is using OCSP security with the help of JMeter? I am not able to record the application i.e. a native app with the help of JMeter as it is using OCSP protocol ...
1
vote
1answer
44 views

How to determine effective trust chain for cert on MacOS X?

I'm seeing some curious issues with cert verification for an Issuer: Entrust - L1K cert that was issued and is in use (per inspection of the cert in Chrome and Firefox) for an internal site here. I ...
1
vote
0answers
27 views

How to provide our customers ability to self service client certificate creation?

We have an API for B2B customers to access our platform. We require each B2B customer to have a client certificate. This is not the URL SSL certificate (https). The CN of each customer's client ...
1
vote
0answers
30 views

What comes into calculation of certificate signature?

I have written my own code with openssl in order to create certificates. In order to verify this code, I tried to reconstruct an openssl commandline generated self-signed certificate ... openssl req ...
2
votes
0answers
29 views

Disadvantages of self signed and cross signed certificates? [closed]

Can anyone explain what are the disadvantages or loopholes in self signed and cross signed certificates?
1
vote
1answer
52 views

Can I move my private-key to a better token?

I recently purchased a personal signing certificate from GlobalSign - it wasn't cheap either. It arrived yesterday. GlobalSign gave me a "blank" USB security token device - a SafeNet eToken 5100. ...
1
vote
1answer
30 views

which the field represents digital signature value of CA in a certificate?

Normally CA signs the certificate with its private key and produces digital signature of it.The digital signature value will be displayed in certificate. My question is what is the field name that ...
4
votes
2answers
35 views

What is the difference between Digital certification revocation and retiring?

Certificate management tools use options called revocation and retiring digital certificates.Can someone explain what is the difference between both?
2
votes
1answer
43 views

Can I revoke a client certificate using only it's serial number (not it's crt/pem)?

I've signed and issued some client certificates with my CA. I can now revoke them like so: openssl ca -name ${CA_NAME} -revoke ${USERS_DIR}/${USERNAME}.crt -keyfile $SSL_PRIVATE_DIR/ca.key -cert ...
0
votes
1answer
41 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
7
votes
4answers
243 views

Bank website forwards to false site - formatted hard drive - still forwards

Summary: When I visit my bank's website, I get forwarded to a phishing mirror site. This has persisted through a re-format of my MacBook. Even on different browsers! Other computers on the same ...
3
votes
0answers
51 views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...
0
votes
0answers
30 views

Where are certificate private keys stored in Windows 7? [migrated]

Using the certmgr.msc utility, I can access the windows cert store, but I still can't figure out where Windows stores the private keys. For example for a given certificate, Windows tells me that ...
4
votes
2answers
84 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
4
votes
1answer
104 views

Prevent and/or detect installation of root certificates on Windows?

I noticed that some applications installed root certificates on my computer. Is it possible to prevent this? Or is there a firewall or such that notifies me?
0
votes
1answer
40 views

Can MITM redirect my HttpsURLConnection?

Scenario: Let's say a MITM was able to plant a faked, self-signed certificate on my client (Android app), instead of the self-signed certificate of my server. When now my app tries to connect to the ...
3
votes
1answer
65 views

How to simply check if a certificate has the OCSP must-staple attribute?

http://tools.ietf.org/html/rfc7633 https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/ How can I simple check if a certificate of a ...
1
vote
1answer
25 views

SSL certificates for a mixture of subdomains and top level domains [closed]

In order to provide https-enabled access to several (e.g. around 5) subdomains and several top level domains on different IPs. Which of the following approaches is technically feasible? a one-use ...
1
vote
2answers
54 views

understanding client certificate - pfx on the general

Today I am given a pfx and told to access a website. I have absolutely no idea what was given to me initially, so please kindly confirm my understanding on a general level 1) the pfx is a container ...
1
vote
2answers
41 views

Subdomains on a multidomain EV SSL [closed]

I have a domain https://joshmurray.eu/ which has a Standard SSL certificate. I also have two subdomains: http://one.joshmurray.eu/ and http://two.joshmurray.eu/. I wish to upgrade my SSL certificate ...
0
votes
2answers
39 views

Files related/required to a digital certificate

I am new to digital certification and I am trying to understand it as well as get my domain certified. I know this question may be broad, but can someone give me a general idea of the usage of the ...
1
vote
1answer
52 views

Subject Alt Name certs

Is it ok to specify subdomains in certificates that support SAN. For example base domain is example.com and I want a.example.com, b.example.com, and c.example.com to be included? What is the primary ...
5
votes
1answer
120 views

How To Bypass SSL pinning In SPDY protocol?

I have been trying for almost a month to intercept the traffic of an android app the uses SSL pinning. I used Android-SSL-TrustKiller and SSLUnpinning but it did not work.I also decompiled the app and ...
15
votes
5answers
3k views

How can trusting ONE certificate jeopardize everything I do online?

I am not sure I understand how TLS works correctly. To my understanding trusting a certain website's certificate is all about trusting that website or not, but the questions below suggest that ...
1
vote
2answers
58 views

What are the steps to take after adding an invalid certificat authority?

in order to pay my bills online internet , I have to go through the website for my internet provider , type the login and password then I redirect to a page your connection is not private i proceed to ...
1
vote
2answers
78 views

Certificate handling on a small network VPN

Background - I need to set up secure remote access for a small home office. I'm a bit of a noob and haven't needed to handle certificates before. I understand most of the setup but I want to ...
1
vote
0answers
27 views

Certificate transparency monitoring [closed]

Does exists monitoring for certificate transparency logs ? For example, a web service how send you an email each time a new certificate for a specific domain is seen in a CT log ?
0
votes
2answers
42 views

Local certification authority and certificate chain

I know that I can set up a local certification authority for a local network. I can issue certificates for all the devices in my network, and as long as they trust me, they can use such certificates ...