Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
1answer
21 views

Can lower level intermediate cert declare SAN that broader than higher level cert?

Suppose 1st level intermediate cert specifies DNS=www.dev.com Can 2nd level intermediate cert which is signed by the 1st level specify DNS=*.dev.com or maybe DNS=*.dev2.com? Does certificate level ...
2
votes
2answers
124 views

Certificates(CA certificate and EE/Local certiificate)

There is a small confusion related to CA certificate and Local certificate. I had asked a similar question before. This time, its a little specific. For authentication using PKI, below are the steps. -...
0
votes
1answer
24 views

Separate certificates on a local machine for each service

I'd like to know if it's possible to have a separate certificate on a local machine, one for a heavy client and the another one for the web browser to be sure the correct client communicate with the ...
2
votes
0answers
32 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
19
votes
6answers
4k views

Is there a protocol that provides data integrity, but not encryption for HTTP?

HTTP I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed. HTTPS On the other hand, HTTPS sends encrypted text over the network that can ...
0
votes
0answers
34 views

Burpsuite pro ca certificate [closed]

Cannot download burpsuite pro CA certificate as it says unknown host I had configured the proxy settings but its response as unknown host
0
votes
0answers
67 views

Is there a way to generate certificates without using the command line? [closed]

I need to authenticate users for a key exchange process since in my case they will be considered the untrusted party. In my research I could not find many ways to authenticate the client that is not ...
1
vote
1answer
57 views

Any disadvantages to long-lived self-signed certificates for personal use?

I run my own IMAP server on my own machine, and am the only user of it. The server uses a self-signed certificate that I generated with OpenSSL. I don't use the certificate for any other purpose. I ...
6
votes
2answers
2k views

How to block requests in web app when certificate is insecure?

I am developing a web app and wanted it to be secure from attacks from the application layer. Currently, my website is allowing interception from Burpsuite like certificate proxy software. Is there a ...
2
votes
1answer
280 views

What is the correct terminology for a private key corresponding to a public key certificate?

I have learned that the certificate is something that contain information about a public key. An article on wikipedia says Public Key Certificate as well. If we are talking about private key, it's not ...
0
votes
1answer
42 views

CA cert with many Subject Alternative Name (SAN) entries, versus individual certs in public production?

I'm looking into creating a CA certificate strategy where i work. And i was wondering if anyone had any points of interest to raise around the difference of a model where our .com and key subdomains ...
0
votes
2answers
67 views

How does encryption, certificates in an end to end SSO flow?

So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
0
votes
0answers
41 views

How to pin public keys in current browsers

Public key pinning is deprecated. Is there still some way to pin keys on browsers like chrome, edge, firefox? For chrome I can add sites to a hsts or expect-ct list. But there is no way to pin keys or ...
0
votes
1answer
42 views

MFA using PKI certificates [closed]

I'm trying to set up a multi factor authentication using PKIs certificates. A PKI infrastructure is ready to use and i'm planning to put these certificates on smart cards. I was looking for a smart ...
0
votes
0answers
54 views

Certificates between services in a single machine

I'd like to know if it's possible to protect communications between a heavy client on a machine and a remote server accessible by a web interface on this machine using certificates. Or the only way is ...
0
votes
1answer
60 views

Why sometimes intermediate certificates don't include a “CA Issuers” part?

I'm learning about certificates, and would like to understand: How is it possible for intermediate certificates to not include a CA Issuers part? Is it not a must so that clients can figure it the ...
0
votes
0answers
30 views

Aruba ClearPass WiFi DV/OV/EV Certificate

Our ClearPass RADIUS server currently has a Sectigo DV certificate and I need to replace it (for issues unrelated to this question) and I am wondering if the level of verification of the certificate ...
0
votes
0answers
25 views

Switching CSC certificate issuer and SmartScreen

We have most of our SSL certificates hosted at GoDaddy but have Standard Code signing certificate from GlobalSign, we would like to switch to GoDaddy CSC since our CSC from GlobalSign is expiring in 3 ...
0
votes
0answers
10 views

OV certificate: How many downloads you need in order to get rid of the smart screen? [migrated]

If I sign my application with an OV certificate, how many downloads I need until reputation builds up and the smart screen goes away? Of course there are few possible ramifications here: The OV ...
0
votes
1answer
36 views

How to implement TLS in a product with complex distributed architecture?

We have a distributed product where one server acts as a 'Scheduler' of jobs and there are hundreds if not thousands of 'Agents' which receive commands from the 'Scheduler' and execute the jobs. The ...
0
votes
0answers
71 views

How to verify public key?

If you live in a jurisdiction where the public key server cannot be trusted (some countries in the world), the only way to authenticate the public is to compare the public key you received with the ...
0
votes
1answer
50 views

Certificate Authority generates private key for Extended Validation code signing certificate?

My company upgraded to an Extended Validation code signing security certificate, which was delivered via mail on a physical USB key, called a "token." The token contains a private key and ...
0
votes
0answers
5 views

Declare certificate purposes in Android <23 [migrated]

In android api 22 I can use only this function to create keys and certificate: Calendar notBefore = Calendar.getInstance(); Calendar notAfter = Calendar.getInstance(); ...
6
votes
1answer
141 views

Why not signing a certificate with more than one Certification Authority [duplicate]

A student asked me a good question today when I was explaining the concept of certificates chain. As I said "if a CA is compromised by an attacker he can emit false certificates for the entities ...
0
votes
2answers
82 views

Create CSR for S/MIME certificate from existing OpenPGP key pair

While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone). I believe the ...
0
votes
2answers
84 views

openssl verify error: unable to get local issuer certificate

I have a test certificate chain that I generated and it fails the openssl verify command: openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem The output I get from the ...
0
votes
1answer
64 views

who should create a CSR, the developer or system management? [closed]

I am developing an internal web application. I think it would be a good idea to secure the local web server with an https certificate. I read several postings recommending certificates on local ...
0
votes
2answers
58 views

How CAs verify they are issuing the certificate to the correct party?

Say youtube.com wants to generate their new certificate. How certification authority verify that the request came from youtube.com, not from a party pretending to be youtube.com?
0
votes
0answers
47 views

SAN is getting replaced into CSR with CA's SAN

I am using the following command to create a certificate sign request file. openssl.exe req -new -key clinetkey.pem -out client.csr" -config client_cacert.cnf where client_cacert.cnf has the ...
4
votes
1answer
102 views

Why does openSUSE sporadically prompt during boot to trust its built-in certificate?

The conundrum My wife’s laptop has been running openSUSE Leap 15.0 for several years, and she has once or twice been flummoxed by this prompt at the very beginning of the boot sequence, most recently ...
0
votes
1answer
64 views

How to use password certificate in code securely

I have a piece of code that is using a certificate for authentication with a cloud service. The certificate is stored locally, and is protected by a password - thus what the developers did is to ...
1
vote
2answers
82 views

If certificate authority generates key pair for us, do they maintain/have access to our private key?

If they do keep our private key and by chance if anyone within the CA organization listen to our conversation. Isn't it a confidentiality breakage?
2
votes
1answer
210 views

Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?

I have developed my DRF back-end API locally, deployed it on an AWS Lightsail instance (with a public static IP) and I now want to secure it with HTTPS. I understand that in order to use Let's Encrypt ...
1
vote
2answers
82 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
0
votes
1answer
101 views

“unsupported certificate purpose” for nginx client auth

Please concern the following setup: A client certificate is issued like this: Root CA → Intermediate CA → Client Cert Let's assume everything is fine up to here, the intermediate CA cert is properly ...
0
votes
0answers
42 views

Private key vs encryption session keys: For what is the private key used when there are session keys for encryption? [duplicate]

I have read that the private key that the certificate owner/web server has (which is the corresponding private key of the public key presented on the certificate) is used to decrypt the data that the ...
2
votes
2answers
123 views

MITM attack with HSTS implemented websites

I want to perform a Man-in-the-Middle attack against my own network for educational purposes. I want the following scenario: Perform a MITM attack with Bettercap, navigate to a website and accept the ...
1
vote
1answer
112 views

Is certificate signature encoded to ASN.1 format?

I'm working on a diagram to describe the process of issuing digital certificates, with the help of answers on my question here and some other research: I just read in the IETF that: The ...
0
votes
2answers
108 views

How to securely get a key from a key server?

In the installation procedure of Gentoo, there is a step to check signature of the downloaded iso file. To do so, we first need to download the set of keys from a key server: $ gpg --keyserver hkps://...
0
votes
1answer
48 views

Certificate Signed Using Weak Hashing Algorithm impact on a workstation

I did a vulnerability scan on some of our company workstations. These are workstations used by employees (dev, HR, accounting, etc.) to do their job. One of the common result I found is SSL/TLS ...
0
votes
0answers
59 views

What prevents me from using a some server's public key and impersonate another server [duplicate]

I read alot regarding RSA encryption/DH key exchange/digital signatures and the whole TLS protocol. There's something i am missing regarding the public key signatue validation. Let say some website ...
2
votes
1answer
289 views

How is public key included in the CSR?

I've read a lot of articles on the PKI and digital certificate topics because it's very rare to find one article covers all the aspects; also the topic is confusing at the beginning, (this beautiful ...
0
votes
1answer
45 views

how end certificate refers to intermediate certificate

As far as i know certificate chain is accomplished based on the issuer's CA name. It is possible that the algorithm to create certificate chain first reads end-certificate's issuer area and get the ...
0
votes
2answers
56 views

Does end entity SSL Certificates need to be re-keyed periodically to improve security?

Is it necessary to periodically re-key end entity SSL certificates apart from typical scenarios like Key lost/key compromise? What benefits does it provides in terms of security and others? Is there ...
2
votes
1answer
56 views

What are the security implications of adding an Intermediate Certificate into the Trusted Root Store in Windows?

I have 2 certificates (one root and one intermediate). In Windows OS, the Root certificate is in the trusted root store (for current user). The other intermediate certificate (signed by the root CA), ...
3
votes
2answers
185 views

Why would a certificate authority have multiple root certificates?

When I look at the trusted certificates in my browser, I see that many certificate authorities have multiple root certificates associated with them. For example, org-Amazon has Amazon Root CA 1, ...
1
vote
1answer
77 views

What is LS0… encoding of a PKI certificate?

I am looking through a set of PKI certificates and key strings that are specified in a kubernetes yaml file. They are used for testing. Some of the strings are keyed (as in yaml key-value) as crt.pem. ...
0
votes
0answers
24 views

Trust the same intermediate CA in client/server programmatically with C language [duplicate]

I would like service A (Client) to communicate with service B (server) without the need to send the whole chain of trust in the code ( CA racine and CA1 intermediate).I want to verify just with CA1 ...
1
vote
1answer
41 views

How to protect certificates and keys in peer to peer application

I'm making a peer-to-peer cross-platform application (in Java & Kotlin), and I want to encrypt conversations between tens of users, concurrently. However, due to lack of knowledge in security good ...
2
votes
1answer
110 views

How to authenticate an Add-In on interprocess communication?

We are considering to build a Windows application that is split in 2 parts: one Windows service some Add-Ins for Microsoft Office, Microsoft Management Console (MMC) and PowerShell. Additional info: ...

1
2 3 4 5
50