Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

Trusted CA SSL certificates and embedded devices

There is an embedded device which should connect to the server over HTTPS and MQTTS. A server certificate is issued by a trusted CA (for example, Let's Encrypt). But there is a problem with server ...
0
votes
1answer
67 views

In Windows How to determine encryption algorithm used in certificate

How can one determine the encryption algorithm type (e.g. AES, DES, 3DES, etc.) that is used by a certificate in Windows (10, 2012-2019)? Is it obvious, and I'm just not seeing it in the certificate ...
0
votes
0answers
35 views

How to read Computer Certificates in Windows [closed]

I found on this post that I can find all Computer Certificate files under the directory: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys When I try to open them with Notepad++ there is just a blob ...
2
votes
1answer
95 views

If I accept a root Cert what am I opening myself up to?

If I connect to a WIFI AP and it wants to install a root cert. They read my HTTPS traffic, Right? Does using OpenSSH on my cell phone to my home router help protect me? Or can this traffic be ...
0
votes
0answers
5 views

OpenSSL encrypts public key after conversion to pfx [migrated]

I'm exporting a certificate and private key into .pfx file with: openssl pkcs12 -export -out export.pfx -in public.crt -inkey private.key -nodes However despite encrypting private key with provided ...
0
votes
0answers
47 views

Examples of SSL certificates from major vendors [closed]

Is there some place I can find example of SSL (TLS) certificates issued by the major vendors, so I can examine them for myself to see things such as what exactly the issuer field says, what signature ...
7
votes
0answers
311 views

Transferring Microsoft SmartScreen reputation to renewed certificate

I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning: Windows Defender SmartScreen prevented an unrecognized app from starting The ...
0
votes
0answers
8 views

Does Juniper have an equivalent of 'show security pki local-certificate' for remote certificates? [migrated]

On a Juniper Firewall, the command show security pki local-certificate will give all sorts of detail for a local certificate. (The sort of certificate you would use to stand up an IKE connection) My ...
1
vote
1answer
53 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
1
vote
0answers
37 views

How attackers bypass windows smart screen

I'm curious to how attackers gain access to valid EV certificates that bypass windows smart screen (for malware delivery/execution) or how they sign these malicious software(s) without access to EV ...
1
vote
0answers
11 views

AD CS Configuration Using Install-AdcsCertificationAuthority Cmdlet [migrated]

I am trying to configure a subordinate CA using a .PFX file with PowerShell. I am using the below parameters: $params = @{ CAType = "EnterpriseSubordinateCA" Credential = $credential ...
2
votes
1answer
53 views

Certificate warning when I enable DNSSEC

I registered mydomain.net (with Google domain registration server). In the DNS settings on the google control panel, I say that mail.mydomain.net should go to the email cloud app (business.zoho.com in ...
2
votes
1answer
29 views

Is there a risk associated with to many entries in your SAN list? [duplicate]

Is there any risk associated with having lots of websites in your SAN list? For instance: Or is this common among website hosts, and possibly safe?
4
votes
2answers
63 views

Is pinning global root CA almost same as not having any certificate pinning at all?

I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all? ...
2
votes
1answer
68 views

Questions on TLS 1.2 RFC - Clarification or references needed

I have been reading RFC 5246 on TLS 1.2 and have a few questions on algorithms chosen. Before I start, let me clarify that I am reading on 1.2 and not 1.3 because my ultimate interest is in DTLS 1.2. ...
0
votes
0answers
10 views

Microsoft Word Security Warning for Signed VBA Project [migrated]

I am attempting to setup signed VBA Projects so that I can find the right balance between security and useability. Currently my end users are instructed to just hit "Enable Content" on Microsoft ...
1
vote
1answer
37 views

Node certificate vs admin certificate [closed]

I tried to understand what is the difference between node and admin certificate. Admin certificate is like root and the node certificate is just for communication with others nodes?
0
votes
0answers
39 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
-3
votes
1answer
53 views

Digital Certificates, exhaustive set of their uses and references [closed]

I am a newbie of sorts as far as particulars of security is concerned.can somebody list all the possible uses of a digital certificate? it is used in SSL, signing and what else? Also is there a good ...
2
votes
2answers
73 views

Understanding how clients handle incomplete certificate chains

How do clients (browser for example) handle a missing intermediate certificate? In the following answer it is explained that they download certificates or use cached certificates: https://security....
0
votes
1answer
50 views

Are there security risks in exposing a certificate?

If an attacker would have access to a certificate, could he build an attack out of that? or rephrasing it: How could an attacker profit from a device certificate, that he gets his hands on? For ...
1
vote
0answers
26 views

Certificate generation using Advanced Electronic Signature (AdES)

For a mobile application I would like to be so compliant as possible with the AdES standard. The mobile application will perform operations on behalf of the user, signing them first. A backend ...
0
votes
2answers
75 views

Can you make a device certificate expire after the root certificate?

I have created a CA root certificate and a device certificate to go on my device signed by the CA certificate. My question is as follows: Can you make the device certificate last for 30 years, and ...
2
votes
2answers
66 views

Does Windows require the full certificate chain in order to trust a certificate?

I'm putting together a Root CA to sign multiple intermediate CAs which will then be used to sign VPN server and VPN user certificates. When I provide a user with their certificate, ideally I only ...
0
votes
1answer
20 views

gpg importing public key

I'm trying to follow this: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Step_by_Step_Guide/s1-gnupg-import.html to import a key.asc using gpg --import key.asc, so that ...
1
vote
1answer
76 views

Does it serve any purpose to have a CRL with the next update scheduled for 25 years in the future?

What purpose does it serve to have a CRL with nextUpdate set to +25 years? A CRL issued by the root of an operating Certificate Authority Certificate Revocation List (CRL): Version 2 (0x1) ...
9
votes
3answers
3k views

What websites can be protected by a particular SSL certificate?

What websites (URLs) can be protected by one SSL certificate? For example, www.security.hsbc.co.uk has a SSL certificate. Can this certificate be used to protect other websites (URLs)? Something that ...
0
votes
1answer
69 views

Is using trusted CA to issue certificate for a VPN server insecure?

I’d like to have an AlgoVPN server that uses a trusted CA to issue a certificate for the VPN server. I am currently using an AlgoVPN server, which is completely setup via Ansible scripts and ...
1
vote
0answers
15 views

High Availability Boot processes and only using code-signing certificates

High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as: "HAB authentication is based on public key cryptography using the RSA algorithm in ...
0
votes
0answers
19 views

How to get decrypted content from a pfx certificate

I am developing ERP software. One of the features that I am implementing is the issuance of invoices, which is something related to the federal revenue of my country. In the documentation says that ...
0
votes
1answer
56 views

Why is subject verification an effective means to detect MitM attacks in TLS? [duplicate]

Say, an attacker fakes an original server certificate by a trusted CA using a another certificate from the same CA in a Man-in-the-middle attack. Why can this be detected using subject verification on ...
1
vote
1answer
52 views

MitM to intercept SSL/TLS based on network traffic alone?

Say, an attacker wants to perform a MitM but all he has available is the network traffic between a client and a server. He has no further information about the data or certificates than what's being ...
0
votes
1answer
31 views

Need for additional verification in mutual TLS authentication with own CA

Say, the goal is to facilitate secure communication between two parties. The definition of secure is that both parties can be sure that they are actually talking to a trusted party, not somebody else ...
1
vote
1answer
53 views

User Credentials Android. Who can read the web traffic?

Are User Credentials on Android such as "user key", "user certificate", and "CA certificate" only used to connect to a single specific network? In other words, will the network admins be able to see ...
0
votes
1answer
42 views

Cross-signing certificates for Windows Driver Signing

For testing purposes I want to test cross-signing certificates for Windows driver signing. I understand the general concept: Two root CAs, one root CA cross-signs the other root CA's public key. ...
0
votes
0answers
36 views

Which certificate is recommended for releasing software in Healthcare domain?

Is there any third party company who assess software and provide a certificate saying the product is secured? I was reading about HITRUST alliance. I also read bit on EU cybersecurity certification ...
-1
votes
2answers
167 views

Can I have a TLS signed certificate without a CA

And how can I do that if the answer is Yes?
1
vote
0answers
25 views

How does PGP web of trust handle certificate expiration?

I have certificate that expires in two years. I'll probably try to participate in key signing party so I get to know what it actually looks like. What happens in two years? When my certificate ...
2
votes
1answer
101 views

Does a CAA record on a local hostname in a LAN offer additional security?

A CAA DNS record limits the certificate authorities that may issue a certificate for a domain and its subdomains. Do CAA records make sense in a LAN environment? Assume internal hostnames such as ldap....
5
votes
1answer
643 views

PFX file without import password?

Is it possible to create a pfx file without import password? Or is it possible to remove the import password from pfx file that I've already created?
5
votes
2answers
146 views

How can I verify my browser/OS's top level certificate?

I have a basic understanding of how the certificate authority ecosystem works. I know that when I'm connecting to a site, and they provide me with a certificate, my computer verifies the certificate's ...
0
votes
1answer
90 views

Is there any way to mitigate against a compromised CA as a client on Firefox?

If I, as a client, connect to a server and there is a malicious certificate authority, how can the client protect against this CA and still connect to the site? If this isn't possible, how can the ...
0
votes
1answer
34 views

How effective is Expect-CT against content inspection in an enterprise context?

HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection ...
0
votes
0answers
121 views

How to solve: Problem with converting pkcs12 file into a pem

I am trying to convert a client certificate from a pkcs12 type to a pem file using openssl, but this error is showed on my terminal. Does anyone have any idea why this is happening? I haven't edited ...
0
votes
1answer
167 views

Using LetsEncrypt certificates for WiFi network authentication

I am helping my school IT set up a RADIUS authentication system using PEAP/EAP-TTLS. We are able to achieve successful connection with the user devices, but the users need to accept a "Not trusted" ...
2
votes
2answers
179 views

Router tries to manipulate HTTPS connections?

At home I use a router (Huawei B528s-23a), the default device which my provider recommends. Over the last couple of days I often get a certificate error when opening a website which was obviously not ...
0
votes
1answer
55 views

How can I authenticate the certifcate of a Private CA while I'm not on that network i.e. offline

I want my application to verify that it is being run on a computer with a certificate issued by my Private CA. How can I do this when the computer is not on the network?
-1
votes
2answers
53 views

technical difference between TLS and a certificate [duplicate]

I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
3
votes
3answers
174 views

Sharing an expired certificate?

Today one of our certificates expired and I needed to order a new one. When collecting all the data needed to create a new one, I got the idea that all needed information is already contained in the ...
2
votes
1answer
104 views

How to copy Subject Alternative Names in csr while signing a cert?

I already know how to add Subject Alternative Names (SANs) to a Certificate Signing Request and I know it's possible to manually add once again to a certificate which is similar to add SAN to csr ...