Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
1
vote
1answer
27 views

Is there a security benefit to giving an SSH key a passphrase when using certificates?

https://goteleport.com/blog/how-to-ssh-properly/ I'm following this guide on setting up SSH certificates, and it says to NOT put a passphrase on keys, or that it's "my choice" whether to do ...
2
votes
2answers
71 views

Is it ok to skip validation of TLS validation if the request's host is targeting localhost?

I'm writing a canary for monitoring which will be deployed to the same host as the monitored application. The underlying application validates certificates for incoming requests and validates that the ...
1
vote
1answer
44 views

Is providing a "Acceptable client certificate CA names" list a security vulnerability for a server?

The certificate list I am referring to can be found using the openssl command, and is displayed under the "Acceptable client certificate CA names" heading. I am wondering if by exposing this ...
0
votes
0answers
20 views

Hot to validate X.509 Certificate [duplicate]

A client wants to show a stream of his Motobix Webcam on his website. Its easy to show a jpg stream. But the problem is: The stream source is not protected with a valid ssl certificate. On the camera ...
0
votes
1answer
43 views

Is it possible for the public key of the issuer to be stored in a subject's certificate?

For example, assume stackoverflow.com used a certificate issued by Google who is trusted. In the stackoverflow.com certificate, its own public key would be stored. However, is it also possible for ...
1
vote
1answer
84 views

What does it mean to create a Let's Encrypt certificate "automatically" rather than manually?

I am getting the error below in trying to renew my certificate from the command line (and thus too from cron). From searching similar error reports, I understand that it means that I initially ...
1
vote
0answers
21 views

Does Java cache intermediate certificates fetched via AIA?

Java supports AIA chasing via the system property com.sun.security.enableAIAcaIssuers (which is disabled per default). There is some documentation available but it is pretty slim regarding details. I ...
2
votes
3answers
104 views

Can a SHA2 x509 cert thumbprint be spoofed/specified?

Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control. Supposing someone was able to view the thumbprint of a cert ...
1
vote
2answers
95 views

What happens if one certificate path is valid while the other one is not?

I have recently figured out that Lets Encrypt provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it ...
0
votes
0answers
54 views

Can we double encrypt VPN traffic with a custom certificate?

I want to forward VPN traffic to an Internal Proxy that uses client certificates to authenticate users. Can we add this second encryption at the VPN Configuration file for example? Or what is the best ...
2
votes
1answer
82 views

What is the security advantage of requiring the CN to be in the SAN list?

For quite a while, it has been common that the CN of a web server certificate also needs to be present in the SAN list, and new versions of browsers enforce this. So, if my CN is www.example.com, and ...
1
vote
1answer
97 views

Firewall is blocking OCSP (Online Certificate Status Protocol) check

I have a certificate issued by lets encrypt and one of the certificate in the path has this information: [1]CRL Distribution Point Distribution Point Name: Full Name: URL=...
0
votes
0answers
60 views

Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?

We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate. With help of old article oscp-must-staple I managed to create CRA with ...
0
votes
1answer
52 views

Why does length of Signatures in two certificates using same Signature Algorithm sha256WithRSAEncryption is different?

I have this recent Wikipedia certificate issued by intermediate CA Let's encrypt: Certificate: Data: Version: 3 (0x2) Serial Number: 03:95:2f:46:69:de:e4:d2:19:35:7f:f0:...
1
vote
1answer
62 views

How should I securely rsync to a host with a self-signed certificate on a private network?

I have a backup server that has a self-signed certificate (x509) and another server on the same network. I would like to rsync data to the backup server from the other server. However, I prefer not to ...
1
vote
3answers
88 views

Stolen server key on TLS intercepting proxy

TLS intercepting proxies create fake server public and private keys on the fly and sign them with a root CA. Depending on the software the keys might be cached or regenerated on each new connection. ...
0
votes
1answer
61 views

Risk Assessment of Windows Cert Store

We all know that SmartCards protect private keys much better than any software-based solution. However, when it comes to the Windows Cert Store to be compared to SmartCards: how difficult is it for ...
0
votes
1answer
85 views

Could having intermediate CA not installed to trust store be a vulnerability?

I've read through several articles and posts here and on other resources and I'm still confused. Say I have a key pair, and I got a server certificate for my public key from some trusted CA. Now I'm ...
0
votes
2answers
133 views

How does a site use the wrong certificate?

I click a link with good content (this doesn't guarantee the site isn't compromised) and Firefox gives me this error: Websites prove their identity via certificates. Firefox does not trust this site ...
1
vote
1answer
73 views

Is a OCSP request verified via TLS?

I was wondering if the connection towards the ocsp responder/server is TLS encrytped itself. Meaning that the client requesting a validity check for a certificate verifies the OCSPs server certificate?...
1
vote
1answer
75 views

problems to verify ecdsa certificate

I'm working on an application which uses ECDSA certificates. After the cert generation, they should be verified but currently the following error is received: C = CA, ST = BC, L = City, O = Corp, OU = ...
1
vote
1answer
113 views

Ramifications of including "localhost" in the subject alternative field of a x509 certificate?

Are we inviting any problems if we add localhost and 127.0.0.1 to the subject alternative name field of an x509 certificate? We are still trusting the appropriate root CA, but relaxing the rules of ...
1
vote
1answer
68 views

Wifi: Added Security Certificate After the Fact?

I'm a freshman in university, and I recently moved into residence. Pretty quickly, I logged into campus wifi so I can actually do classes and things. My laptop and primary phone logged in with minimal ...
0
votes
1answer
68 views

How can I find the list of certificates present in a set of CA stores

Someone is running an automated scan on our SSL setup and they insist that our root certificate be included in all the following CA stores: "Mozilla NSS - 01/2014" "Apple - OS X 10.9.2&...
0
votes
0answers
59 views

Using SMIME with Azure Information Protection and OME

As far as I know, SMIME encryption is more user-friendly than AIP, but there is the need to know the recipients public key (well, and even the need for them to have a public key). I would like to ...
0
votes
0answers
66 views

eIDAS qualified timestamp on email

Every document that needs to be eIDAS compliant needs to have a qualified timestamp. If we take an email as a document, then the email, based on eIDAS regulations, needs to have an qualified timestamp ...
1
vote
0answers
53 views

What's the best practice for server certificate issuance protocols in mixed environments?

In mixed Windows/Linux environments what's the best practice for issuing server certificates? If you use Windows MSCA PKI, you're kind of stuck with using previous certificates to authenticate the ...
3
votes
1answer
92 views

What can I do if I spot an EV certificate being misused?

While helping my family with their computer problems, I found a malicious executable signed by a valid EV certificate. The executable is flagged as malicious by a majority of engines on VirusTotal, ...
0
votes
1answer
114 views

Is there a reason to renew host SSH certificates?

tl;dr: In certificate based SSH authorization, is there any benefit to keeping host certificates lifespan short? Do you gain anything by renewing them periodically? Full Story Recently I have been ...
0
votes
1answer
87 views

Are problems expected when a subdomain CNAME target has no CAA record?

Consider the following DNS setup of example.com: A 89.41.169.49 # this is for redirect.pizza CAA 0 issue "letsencrypt.org" www CNAME ghs....
0
votes
1answer
205 views

Why are there no modern web browsers that allow extension access to SSL information about the site you are browsing?

In all my Googling, I found one version of FireFox that allowed it temporarily a long time ago, it has been discussed on the Chromium development forums for years, but yet, as of today, there is still ...
2
votes
2answers
175 views

Can certificates be blocked temporarily by CAs?

I am an Open Banking enthusiast and I'm studying the Berlin Group's XS2A framework these days. There, it has an error code called CERTIFICATE_BLOCKED. As the description of it, it states, "...
0
votes
1answer
108 views

I installed internet certificates on my android to connect to uni wifi, can they see what I'm doing at home?

I wouldn't have thought that certificates could be used to track my history, I thought they were essentially login credentials, but I installed some to use my Uni wifi and now my google pixel 3 has a ...
8
votes
2answers
1k views

Is SNI always used in TLS connections?

I know that even with DoT or DoH the target of the connection is leaked due to the use of SNI in the client hello (and that ESNI/ECH are proposed solutions), but what I can't figure out is does SNI ...
0
votes
0answers
43 views

Query on CMP POPO, encrypted cert and certhash

I am reading RFC4210 and trying to understand the CMP protocol. I will use the sample capture cmp_IR_sequence_OpenSSL-Cryptlib.pcap from https://wiki.wireshark.org/SampleCaptures to put forth my ...
0
votes
1answer
51 views

Relative security of using on https connection over http when the site does not have a cert implemented [duplicate]

I have a site that I would like to remotely monitor purely for the uptime status of my home network. I don't want to expose my router sign-on page to the internet, so instead, I point to the login ...
0
votes
0answers
72 views

As of August 2021, does the Expect-CT header provide any security benefit?

The MDN article on the Expect-CT header states that it is "likely to become obsolete" by June 2021 (two months ago): Note: The Expect-CT will likely become obsolete in June 2021. Since May ...
5
votes
1answer
245 views

Impact of having more X509v3 Key Usage fields than required?

I was wondering if having an "oversubscription" of "Key usage fields" inside a X509v3 certificate can negatively impact the performance and/or the security of a server. For example ...
0
votes
1answer
89 views

Do I need root access to install a certificate?

I need to have security certificates renewed soon on several RedHat servers. Will I need root access to install them?
1
vote
1answer
89 views

What are the benefits of using different certificates to identify the same service to different audiences?

Recently I was having a discussion with a team which uses a separate certificate for each different backend service that it interacts with. The backend services do client auth as well so that is what ...
0
votes
2answers
78 views

PCI DSS Compliance and Firewalling Dynamic Hosts with MITM Certificates

Question Would using a firewall MITM capability to inspect all HTTPS web requests be against PCI compliance/rules? Further Info We have an issue where we need to allow access to some HTTPS sites on ...
0
votes
0answers
47 views

How Does it Work - User Authentication using Yubico Smart Card (Yubico PIV) on Mac

Background: I have setup my macOS Catalina so that I can authenticate my user account using my Yubico (set up as a Smart Card) and its PIN After setting this up I can see that there are now 2 ...
1
vote
1answer
106 views

OpenSSH AuthorizedPrincipalsFile Allows Any User

I am bewildered as to the below config and subsequent behaviour. /etc/ssh/sshd_config: AuthorizedPrincipalsFile /etc/ssh/principals /etc/ssh/principals: all host.example.com dev This allows me to ...
0
votes
0answers
63 views

Using DPAPI in order to extract a certificate private key and create a pfx file

What is the reason to use DPAPI in order to decrypt the certificate private key and create a pfx file like explained here howto-~-decrypt-EFS-files over using the Crypt functions like Mimikatz uses (...
0
votes
2answers
87 views

How can I install a self-signed star cert with a self-generated root CA that openssl will verify against?

I'm trying to test some services and they need to talk to each other over https ( and they can't talk over http). I want to: create a Root CA that I can install in my Ubuntu-based docker images sign ...
1
vote
0answers
318 views

"Failed connecting to the YubiKey. Make sure the application has the required permissions." [closed]

I have a Yubikey version 5.2.7 and I can't generate any new certificates on yubikey manager app, which is weird since I have already generated two certs (on 9d slot) and they worked fine. Now the ...
1
vote
1answer
60 views

Software signing : multiple certificates

I'm quite new to the cryptography field, and I'm trying to understand a few things: I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below: I'm ...
0
votes
1answer
87 views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
0
votes
2answers
143 views

What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?

While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command: openssl req -new -addext &...
0
votes
0answers
52 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...

1
2 3 4 5
54