Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509],...

1
vote
0answers
28 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
1
vote
0answers
16 views

Best way to back up locally stored Certificates

What is the best way to back-up all the locally stored certificates on Windows 7? An adware Trojan has installed fraudulent certificates as part of its payload. Before I alter anything, I want to ...
3
votes
2answers
42 views

OpenSSL Certificate Renewal with same keys and NO CSR

I have a Linux-based vendor-supplied virtual appliance that uses OpenSSL to manage certificates. The current server certificate is from Symantec so has to be replaced with a DigiCert. DigiCert is ...
0
votes
2answers
30 views

How to deliver an application to several clients with a single trusted SSL certificate? [duplicate]

I am working for a software editor and we deliver to our clients a turnkey solution that the client has just to install on his server to use it. This solution is a web service who uses HTTPS to ...
0
votes
1answer
60 views

Your connection will not be private - Wi-Fi CA certificate warning message on Android

I try to connect to a Wi-Fi network, Eduroam, using my new Android device. It asks me to provide the CA certificate and warns that otherwise my connection would not be private. No certificate ...
1
vote
3answers
79 views

Can a rogue wifi network install a CA certificate?

Could an attacker create a false wifi network, then force (either via the user exploitation or other means) CA certificate install to the browser, allowing them to use something such as Burp Suite to ...
2
votes
1answer
33 views

Can you point out the flaws in the stated approach of adding a new device to an existing ssl certificates secured system?

I'm trying to add new devices into a secure system. A secure system where a webserver is identified by custom CA and all clients individually are too. That is, every client connecting to the server ...
0
votes
0answers
16 views

Limit OpenVPN client certificate to specific VPN with shared CA chain

I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of ...
0
votes
1answer
47 views

Client certificate common name? Subject alternative name?

For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) ...
1
vote
1answer
67 views

Should we use x509 V1 certificate for a new root CA?

I read a couple of articles that kind of gives the impression that the norm is to use a V1 x509 pkc for a root CA. This is one of them. However the rfc5280 makes no such suggestion. My question is, ...
3
votes
1answer
89 views

I'm moving my website to a new server, what implications does this have for my SSL certificate?

I run a website which I serve over https and https only (add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";) The ssl certificate I bought came from namecheap.com, ...
0
votes
0answers
29 views

Transport header security header (HSTS) is not working with Internet Explorer 11 [migrated]

We are using a self-signed certificate in our application & want to use HSTS header for added security. We access our application using ip or hostname. I found that for HSTS to work, - no ...
3
votes
2answers
67 views

Best practices for design of mutual-auth TLS certificate chains?

I am looking for best-practice advice for building a mutually-authenticated system using certificates. I would like to create a system with multiple IoT devices reporting data to a web server, in ...
0
votes
1answer
28 views

How to add a custom CA to androids trusted root system folder

As of Android 7.0 no custom certificate will be used by android apps. App developers need to specifically write codes and change app settings to follow a custom CA. But this is difficult while ...
0
votes
1answer
50 views

Root CA or Intermediate CA in firewall trust store

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and ...
1
vote
1answer
40 views

RelativeDistinguishedName allowed SET items

According to RFC5280, a subject/issuer Name is a sequence of RelativeDistinguishedName, which in turn in a set of AttributeTypeAndValue (see https://tools.ietf.org/html/rfc5280#section-4.1.2.4). ...
0
votes
1answer
16 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
0
votes
1answer
116 views

understanding MITM attack [duplicate]

hi Everyone please correct me if im wrong for my understanding for the man in the middle attack used in a variant of diffie hellman key exchange . am i right to say that a protocol is susceptible to ...
0
votes
1answer
108 views

TLS certificate requirements [closed]

Can any certificate be used for TLS? What requirements should the certificate meet for TLS? SHA1/Sha2 {key specs} etc.
2
votes
1answer
135 views

Certs stop hackers from pretending to be a server. What stops them from pretending to be you?

Reading this answer on stackoverflow, I understand that certificates help identify that a public key and encrypted data are indeed sent by the one we're talking to. However, the data I send back to ...
2
votes
1answer
64 views

Why am I allowed to add exception for some sites but not others when using a proxy with a self signed cert?

I have a proxy server that runs on my local system. It's designed to capture traffic that passes through it for testing. It generates a self signed certificate that it uses to sign traffic. Here's ...
1
vote
1answer
160 views

OWASP ZAP: How to use TLS client certificate authentication?

Is there a way to get OWASP ZAP to send a client certificate? I have an HTTPS website that receives client certificates for authentication. I have the certificates installed in the browser. ...
2
votes
1answer
87 views

When to rotate a client TLS certificate?

What is the recommended rotation period of a TLS/client certificate? I have seen organizations rotating at half life and some that rotate only 30-50 days before expiry. For example, for a certificate ...
0
votes
2answers
64 views

Certificate verification fails for self-signed certificate

I'm trying to use a service that uses a self-signed cert. Download the cert: # printf QUIT | openssl s_client -connect my-server.net:443 -showcerts 2>/dev/null > my-server.net.crt Check that ...
0
votes
0answers
45 views

How is the crytography system used in Windows XP and does it need to be enabled?

The root certificates on my Windows XP machine have expired. As far as I understand it, Windows XP only uses crytography for doing "intranet" data transfers, which in my case is irrelevant because I ...
1
vote
2answers
37 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
3
votes
1answer
82 views

Good practices for protecting a machine certificate against extraction

Consider the following scenario: You are providing VPN access for a number of machines running Windows 10. The machines are configured and hardened according to company standards. You rely on machine ...
3
votes
1answer
58 views

Certificate based authentication

Can certificate-based authentication systems be bypassed in a MITM attack over WiFi ? I was just looking at a service called REMME and was wondering how secure it actually is.
2
votes
1answer
61 views

How does selection between multiple available certificate chains work?

I am trying to understand the practical mechanisms of cross-signing (intermediate) certificates. As an example, I am looking at the Let's Encrypt Chain of Trust. That page mentions: IdenTrust has ...
1
vote
1answer
53 views

HSTS doesn't work on browser when dealing with a self-signed certificate

We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to ...
3
votes
2answers
127 views

How can I Instruct a browser to reject proxy MITM certificate for my website

Is there any way for my website to tell a browser, such as Chrome, to disallow a substitute MITM certificate like those used by corporate proxy servers? e.g. see Question 61056: Is there any way for ...
2
votes
0answers
84 views

Why is hotmail mail server providing an invalid certificate?

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com. Both the mail server hostname and TLS ...
8
votes
1answer
1k views

Creating sub CA signed with Let's Encrypt certificate

I have a certificate issued from Let's Encrypt. Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the ...
1
vote
3answers
90 views

Who should issue the client certificate for client certificate authentication?

In case of client certificate authentication, who should issue the client certificate? The service provider which exposes the API or the client consumer which consumes the API? In my experience, I ...
3
votes
3answers
184 views

How significant is the invalid SSL cert at aoprals.state.gov?

For up to 4 weeks, the US Department of State's Office of Allowances web site has been using a security certificate whose chain of trust only goes to the State Dept's own CA, with no root CA. Browsers ...
0
votes
1answer
36 views

What is the difference between certificates held by intermediate CAs and those issued by them?

Given that one CA can issue another a certificate so that they can go on and do the same, what would stop someone from using the certificate for their website to issue certificates and become an ...
7
votes
3answers
647 views

Can a revoked certificate be re-instated?

If a certificate is revoked, can it be re-instated, or is the only option to generate a new one?
1
vote
2answers
79 views

Error in SSL handshake with a web service - chain violates basic constraints limit

I am writing a program where we invoke a third-party SOAP web-service over HTTPS. I am currently receiving an error at the SSL Handshake stage and it fails with the following error - chain violates ...
3
votes
1answer
86 views

How can a SSL certificate dermine the encryption strength

I've found a page from Digicert that made me very confusing. https://www.digicert.com/compare-and-buy-ssl-certificates/ In the "Technical Specifications" Section, it listed "Symmetric 256-bit ...
0
votes
1answer
46 views

Is it worth deleting certificate exceptions if they no longer need to be?

At my organization, I had some self-signed certificates for some internal applications. This was causing the browser to show the "This page is insecure" prompt and users would add an exception for ...
2
votes
1answer
40 views

Two certificates with HSTS on different ports?

Is it possible to set up Nginx in such way, that on the same domain it will serve on two different ports, two different valid certificates both with HSTS? Certificates are from different CA and for ...
1
vote
1answer
171 views

How will Certificate Transparency be enforced?

The Chrome team has announced that "[they]’ll be moving forward with our plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018." It's ...
11
votes
2answers
2k views

Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?

When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me. I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
2
votes
1answer
126 views

Can't understand how stuxnet was bogusly signed

Wikipedia says that Its device drivers have been digitally signed with the private keys of two certificates that were stolen from separate well-known companies, JMicron and Realtek, both ...
0
votes
1answer
86 views

Trustworthiness of Let’s Encrypt and ZeroSSL within browsers and OS [duplicate]

With regard to Are there technical disadvantages in using free ssl certificates? it has been highlighted by some that StartSSL is not a trustworthy CA, and I was wondering if Let’s Encrypt is the same....
2
votes
2answers
86 views

Where to get all the root CA certs?

Is there a common place where we can download all the root CA certs and get frequent updates for changes? This is one place where we can find the CAs, but we need to keep on checking for the updates. ...
3
votes
1answer
113 views

Why is TLS still commonly referred to as SSL? [duplicate]

I am developing in Visual Studio 2017 and I'm writing an asp.net core 2.0 web application. In the project properties there is a checkbox for Enable SSL. Any idea why this is called SSL instead of TLS? ...
3
votes
0answers
84 views

What happened with Kazakhstan's Root CA MITM policy?

In 2015 there were news that Kazakhstan was going to start intercepting all HTTPS traffic via "man-in-the-middle attack" starting Jan 1, 2016, by requiring kazakhstanis to install their root CA. ...
1
vote
0answers
86 views

How do I examine a fresh Windows 10 installation

I suspect an unauthorized modification has been applied to a fresh new installation of Win 10 x64 and/or a PC running it by a person who knows me personally with the purpose of tracking my activity ...
1
vote
1answer
55 views

Once a certificate has been validated, is it safe to string-match on the issuer field?

First, some background to the question: I have a Pulse Connect Secure VPN appliance in a multi-tenant environment, and I have been approached with the task of supporting certificate authentication (...