Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
2
votes
0answers
87 views

Why don't CAs advertize public keys of verified entities on a central location instead of giving out signed certificates?

If CAs (Certification Authorities) start advertizing public keys of verified websites via some API, browsers can simply query them for each domain instead of asking websites to give them certificates ...
2
votes
1answer
72 views

How do clients extract the public key from a self-signed certificate?

I have gone over: Why do we need to sign the self-signed certificate? Basic self-signed certificate questions Is a self-signed SSL certificate much better than nothing? I am new to cryptography and ...
0
votes
0answers
5 views

A lot of my windows drivers have expired dates for the certificate, and some are not even signed, is this normal? [migrated]

I just gathered all the drivers in my system32/drivers folder and checked their certificate (my windows is updated and its a windows 10 x64) But i found that so many of them have expired certificate! ...
1
vote
0answers
28 views

A solution for the absence of Certifying Subkeys in OpenPGP Certs

As discussed in this answer, gpg does not offer the capacity for subkeys to certify (eg. "sign") other keys, though there may be good reason why it should, and they do sign at least one key. ...
0
votes
1answer
50 views

Windows Certificates - where is private key located?

In Windows 10: When I load a certficate into the "Current User" store, it puts a private key file here: C:\Users\[userID-A]\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-xxx\...
-1
votes
0answers
42 views

Why letsencrypt certificate generation not done like domain verification done by GSuite? [closed]

I have used letsencrypt's certbot for creating certs for my domains. I have to download certbot and run in my machine and it gives a string to be placed in as dns record. I have to manually add the ...
1
vote
1answer
50 views

Help understanding CSR fields

I've made a CSR (Certificate Signing Request) in order to better understand how a PKI could be made and how it works. Using the following commands openssl req -new -newkey rsa:1024 -nodes -out ca.csr ...
3
votes
2answers
211 views

Does the CA create the public key or is it created by the requesting server and sent to the CA?

This link says that the requesting server creates the public-private key pair and sends the public key to the CA inside the CSR. However, DigiCert says: The CSR is submitted to a Certificate ...
0
votes
2answers
58 views

How can we verify an installer's validity by checking its signature?

I'm working on some software that can be self-hosted, and it includes a component that can be downloaded and installed on end user machines (Windows only). The download comes from the self-hosted ...
0
votes
1answer
78 views

X.509 - How Is Certificate Chain of Trust “Subject Name”-“Issuer Name” Match Comparison Made?

I keep reading that in an X.509 certificate chain of trust that the "Issuer Name" in a certificate that has been signed by the Issuer must "match" the "Subject Name" of ...
2
votes
0answers
40 views

Public key stored in server is different from what is shown in OpenSSL

I obtained an SSL certificate from LetsEncrypt for my web application using Apache web server. LetsEncrypt generated these 4 files: cert.pem chain.pem fullchain.pem privkey.pem As I understand, ...
0
votes
2answers
62 views

How is the digital certificate sent alongside digital signatures?

Most tutorials on the net only mention sending the digital signature attached to the document, but without the digital signature certificate, it'll be impossible for receivers to verify the signature. ...
0
votes
2answers
49 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
2
votes
1answer
48 views

Why is my RADIUS Certificate not automatically signed with the root CA Certificate on my iPhone

I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method. I have used this old tutorial for setting up my own CA and generating the certificates and ...
0
votes
0answers
5 views

Can I keep Windows 10 computer certificate on a different partition and prevent installation? [migrated]

I would like to reimage a machine while keeping the computer certificate on a different drive, causing the re-imaged computer use an existing certificate on a drive partition that wasn't overwritten, ...
4
votes
1answer
75 views

Smooth root certificate rotation

I am surprised that I couldn't find one concrete example of how to do root certificate rotation. For example: Root CA has 2 years validity period Intermediate CA has 9 months validity period leaf ...
0
votes
1answer
51 views

Where are field names of decoded human readable X.509 certificates specified?

The ASN.1 module for X.509 certificates as specified in RFC 5912 - Section 14 is as follows: TBSCertificate ::= SEQUENCE { version [0] Version DEFAULT v1, serialNumber ...
2
votes
1answer
66 views

Restrict CA to issue certficates for one domain or to be able to sign just one server certificate

I have a server and I want my iPhone to connect to it securely. However, I cannot just install the self-signed server certificate on my iPhone. When I install the profile (that's what they call the ...
-1
votes
2answers
45 views

Can SSL certificate (domain verification) process be eliminated?

Noob question alert. I understand SSL certificates help mitigate MITM attacks, but I see the process to be so badly designed. Basically the client needs to verify that it is talking to the particular ...
1
vote
1answer
55 views

Independent C library or function (on Linux) to programmatically generate a self-signed certificate [closed]

Is there a simple C library or function to programmatically generate a self-signed certificate in C on Ubuntu? Of course, one can execute a simple system("....") call to execute a CLI. I am ...
0
votes
0answers
3 views

Signed client certificate not accepted by websocket server [migrated]

Want to set up authentication in a python websocket server which builds up its ssl context like: ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) ctx.load_cert_chain('certificates/server_cert.pem', '...
-1
votes
1answer
40 views

Digital signature from hashing encrypted webpage

I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...
1
vote
2answers
59 views

When/why should the “mark this key as exportable” option be selected when importing a certificate?

When a certificate is being imported on Windows, at some point the following option is available: [] mark this key as exportable I understand that this is used in case the certificate needs to be ...
0
votes
1answer
77 views

Who am I really trusting?

My trusted root certificates are below. As an exercise, I want to be sure that a MITM is not changing the list. So, can I somehow get this list signed? In my opinion, the list could be signed by my ...
0
votes
1answer
21 views

Can PKCS#12 files contain multiple certificate chains?

I know that PKCS#12 files can contain multiple certificates and private keys. However, I could not find any resource where any limit was mentioned for the number of certificate chains or private keys ...
0
votes
0answers
35 views

Bettercap TCP proxy upstream server

I am using bettercap command line to perform a Man in the Middle attack on my LAN network with an EDUCATIONAL purpose (of course!). I want to intercept the TCP traffic, with the intention to view on ...
1
vote
2answers
97 views

Is it possible to craft a certificate signing chain that thwarts MITM corporate VPNs?

Some companies install software on corporate VPNs which also come with a root certificate installed on all employees' machines. This allows for encrypted traffic to be decrypted by technology ...
2
votes
1answer
56 views

How to fully view cross-signed certificate signatures

Long story short: Security scan raised a flag about a cert, found that it was an expired root on a cross-signed cert. Yadda yadda, updated intermediates, fixed issue. However, I noticed that openssl ...
1
vote
1answer
114 views

Could a certificate authority and a ISP preform a MITM attack on HTTPS traffic?

I'm just wondering if it is technically possible for your ISP to work with a certificate authority (either compelled by a government agency or otherwise) to create a MITM attack to see into your https ...
2
votes
2answers
80 views

Can public keys in digital certificates be used to verify name of certificate holder?

I recently had a conversation with a teacher who argued that in a digital certificate (x509), the public key is used to verify the name of the certificate holder. From my understanding, there are ...
0
votes
0answers
43 views

Is it safe to install a trusted CA certificate from another source?

As you may know, a CA certificate issued by Sectigo expired recently. This is affecting certain mobile apps and possibly websites, rendering them unable to connect to required network resources. In ...
1
vote
1answer
56 views

Forge certificate for man in the middle attack

I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server that would ...
0
votes
0answers
59 views

Using OpenVPN on Windows instead of VPN apps: missing certificate

Sorry this might be a noob question, but I subscribed to a VPN provider which ships its own app on Windows. Now I thought I'd prefer to use the OpenVPN client app instead. I create a profile by ...
3
votes
1answer
299 views

Why do some email software products block SSL certificates attached to a message?

Whenever I have to share our public SSL certificate with our trading partners through email, I have to change the filename extension of the attached file (i.e. from “.cer” to “.txt”) to ensure it is ...
1
vote
1answer
47 views

getting no subject alternative name present exception when the csr shows that the SANs are present [duplicate]

I am trying to setup ssl for grpc but no matter what I try I get a no subject alternative name present. I've verified the SANs are in the certificate signing request. The common name and also a SAN ...
0
votes
3answers
116 views

Why do we need to sign the self-signed certificate?

When we add a self-signed certificate to a device's list of trusted root certificates, we're already trusting it. So, why should it be signed with the server's private key? Signatures only ensure ...
1
vote
2answers
128 views

How can I work around the expired Sectigo certificate on my old mobile device?

As you may know, a CA certificate issued by Sectigo expired recently. This is affecting certain mobile apps and possibly websites, rendering them unable to connect to required network resources. This ...
0
votes
1answer
43 views

Process and order of verification of a X.509 certificate chain

While going through the rfc5280 Certificate Path Validation to understand how the X.509 certificate chain is validated, I found out that the X.509 path processing Algorithm processes the chain in an ...
0
votes
3answers
59 views

While importing certificates in keystore, do we treat these like CA root certificates?

When we need to call an internal domain via HTTPS, Java doesn't allow it because it doesn't recognize the certificate that those domain web servers are sending (probably because those certificates are ...
0
votes
1answer
66 views

why CA use private key to sign a digital certificate? What is the logic behind sign a digital certificate with CA private key?

In general(PKI), encryption happens with public key and decryption happens with private key. But, how Certificate Authority sign a digital certificate with private key? How this can be validated using ...
1
vote
1answer
38 views

How do you verify the key given by remmina (libfreerdp2)

This morning I took an update to remmina and started getting a "fingerprint changed" warning. When using xfreerdp (from freerdp-x11) I get they old key. The old key being 20 bytes and the new key ...
1
vote
2answers
62 views

What is the benefit of public Certificate Authority when using SSL mutual authentication?

I was working the other day and I had a question come up, that I want to ask here to make sure my assumptions are correct. In terms of SSL Mutual Authentication a self signed CA and a public CA ...
3
votes
1answer
86 views

Is macOS installing known bad Certificate Authorities by default?

Today I was checking out macOS security and privacy guide, and when I looked at my keychain, I was surprised to find Startcom CA and Symantec CA trusted by default. Isn't this supposed to be ...
0
votes
0answers
60 views

Clear Browser Cache of Certificates Used for Authentication

We are using cert based authentication where the client sends a cert to the server, which is validated for authentication for a web application. This all works well. The problem happens when the user ...
15
votes
5answers
5k views

HTTPS connection to specific sites fail with cURL on macOS

On my Mac, HTTPS connnections to certain sites fail using the built-in curl binary of macOS 10.14. They work fine with different browsers, as well as other builds of cURL on the same system. One of ...
3
votes
1answer
592 views

VPN provider asks to install RootCertificate. How is it safe?

I want to use VPN provider (ProtonVPN), and don't want to use an app. They ask user to install their Root Ca. How safe is it? What type of info could they get from my laptop? If I have their ...
0
votes
0answers
49 views

Adding Expect-CT header to HTTP response

In the security test report, I have a recommendation to add Expect-CT header to the HTTP response from web application, additionally developers set this to: Expect-CT: max-age=0, report-uri= I am ...
1
vote
0answers
67 views

openSSL shows a revoked certificate as secure

I downloaded a revoked certificate from the website https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/. Specifically, the revoked certificate of the site https://revoked-rsa-ev....
-2
votes
2answers
84 views

Free EV on localhost

I am doing some pen test on my localhost I was wondering if I could find an EV certificate for localhost only. If you have an EV this is free just for localhost It will be find. I know EV is expensive ...
-1
votes
2answers
102 views

Is possible to do bypass to VPN with Certificate?

I would like to know if there is a way to make a false certificate to bypass a Palo Alto VPN (specifically Global-Protect). The clients only connect by certificate and I don't know if some hacker can ...

1
2 3 4 5
49