Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
0answers
52 views

How to verify public key?

If you live in a jurisdiction where the public key server cannot be trusted (some countries in the world), the only way to authenticate the public is to compare the public key you received with the ...
0
votes
2answers
71 views

openssl verify error: unable to get local issuer certificate

I have a test certificate chain that I generated and it fails the openssl verify command: openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem The output I get from the ...
0
votes
1answer
43 views

Certificate Authority generates private key for Extended Validation code signing certificate?

My company upgraded to an Extended Validation code signing security certificate, which was delivered via mail on a physical USB key, called a "token." The token contains a private key and ...
6
votes
1answer
126 views

Why not signing a certificate with more than one Certification Authority [duplicate]

A student asked me a good question today when I was explaining the concept of certificates chain. As I said "if a CA is compromised by an attacker he can emit false certificates for the entities ...
0
votes
2answers
49 views

Create CSR for S/MIME certificate from existing OpenPGP key pair

While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone). I believe the ...
1
vote
2answers
5k views

Google Chrome and Certificate Problem

When I try to connect google.com and youtube.com with Chrome, I got the error below; 1. 2. Your connection is not private Attackers might be trying to steal your information from www.google.com.tr ...
0
votes
0answers
5 views

Declare certificate purposes in Android <23 [migrated]

In android api 22 I can use only this function to create keys and certificate: Calendar notBefore = Calendar.getInstance(); Calendar notAfter = Calendar.getInstance(); ...
8
votes
4answers
14k views

System time and certificates

Recently I accidentally changed the system time to a different month, and then I surfed to a secure site. I got a warning from Google Chrome that mentioned my system time and said the certificate isn'...
0
votes
1answer
45 views

how end certificate refers to intermediate certificate

As far as i know certificate chain is accomplished based on the issuer's CA name. It is possible that the algorithm to create certificate chain first reads end-certificate's issuer area and get the ...
4
votes
1answer
95 views

Why does openSUSE sporadically prompt during boot to trust its built-in certificate?

The conundrum My wife’s laptop has been running openSUSE Leap 15.0 for several years, and she has once or twice been flummoxed by this prompt at the very beginning of the boot sequence, most recently ...
0
votes
1answer
60 views

who should create a CSR, the developer or system management?

I am developing an internal web application. I think it would be a good idea to secure the local web server with an https certificate. I read several postings recommending certificates on local ...
0
votes
2answers
56 views

How CAs verify they are issuing the certificate to the correct party?

Say youtube.com wants to generate their new certificate. How certification authority verify that the request came from youtube.com, not from a party pretending to be youtube.com?
0
votes
0answers
45 views

SAN is getting replaced into CSR with CA's SAN

I am using the following command to create a certificate sign request file. openssl.exe req -new -key clinetkey.pem -out client.csr" -config client_cacert.cnf where client_cacert.cnf has the ...
64
votes
4answers
181k views

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm What exactly is the difference here and why are two encryption bits ...
0
votes
1answer
60 views

How to use password certificate in code securely

I have a piece of code that is using a certificate for authentication with a cloud service. The certificate is stored locally, and is protected by a password - thus what the developers did is to ...
6
votes
3answers
4k views

Does client have to send the CA chain along with the client certificate after ServerHello?

During the MTLS handshake, after ServerHello is done client sends the client certificate back to the server, I need to know if the client should only send the client certificate or is it required to ...
1
vote
2answers
76 views

If certificate authority generates key pair for us, do they maintain/have access to our private key?

If they do keep our private key and by chance if anyone within the CA organization listen to our conversation. Isn't it a confidentiality breakage?
2
votes
1answer
107 views

How to authenticate an Add-In on interprocess communication?

We are considering to build a Windows application that is split in 2 parts: one Windows service some Add-Ins for Microsoft Office, Microsoft Management Console (MMC) and PowerShell. Additional info: ...
0
votes
0answers
9 views

What is the Character Encoding of x509 certificates? [migrated]

I'm implementing an SCEP server to distribute client certificates. According to the protocol, For the GetCACert request from device, the content-type of the response header should be application/x-...
3
votes
1answer
2k views

Use Personal certificate without a key with Firefox

We have a website that authenticates the user using a certificate. The certificate is installed by the IT department and I can't export it with the private key. When I navigate the website with ...
59
votes
4answers
96k views

How does the digital signature verification process work?

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
0
votes
0answers
34 views

Investigate private key corruption in certificate store [migrated]

I have more and more cases (let's say, 5-10 per day) in my organization (100k+ PCs) where people suddenly can't connect to VPN, and the reason is because the private key of their certificate no longer ...
0
votes
2answers
268 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
3
votes
2answers
8k views

Router tries to manipulate HTTPS connections?

At home I use a router (Huawei B528s-23a), the default device which my provider recommends. Over the last couple of days I often get a certificate error when opening a website which was obviously not ...
1195
votes
3answers
637k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
12
votes
3answers
2k views

Transferring Microsoft SmartScreen reputation to renewed certificate

I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning: Windows Defender SmartScreen prevented an unrecognized app from starting The ...
6
votes
1answer
857 views

Where to put a code signing server with EV code signing certificate and plugged-in HSM

Microsoft recently started enforcing apps to be signed by EV code-signing certificates instead of just regular certificates. These usually come on an external device such as USB smart card or a HSM, ...
1
vote
1answer
51 views

A solution for the absence of Certifying Subkeys in OpenPGP Certs

As discussed in this answer, gpg does not offer the capacity for subkeys to certify (eg. "sign") other keys, though there may be good reason why it should, and they do sign at least one key. ...
23
votes
3answers
4k views

Why don't folks seem to use ECC for TLS root certificate signature?

I looked around, and all I see is websites using RSA2048 for Root signature, and a few using ECC for encryption. Are there any reasons folks don't seem to use ECC for TLS root signature? Are there ...
0
votes
1answer
211 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
86
votes
5answers
38k views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
0
votes
1answer
62 views

“unsupported certificate purpose” for nginx client auth

Please concern the following setup: A client certificate is issued like this: Root CA → Intermediate CA → Client Cert Let's assume everything is fine up to here, the intermediate CA cert is properly ...
2
votes
1answer
202 views

Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?

I have developed my DRF back-end API locally, deployed it on an AWS Lightsail instance (with a public static IP) and I now want to secure it with HTTPS. I understand that in order to use Let's Encrypt ...
1
vote
1answer
60 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
1
vote
1answer
49 views

Expiration of superadmin.p12 certificate

I have a super admin certificate which is expired two days ago.When I try to click on Administration tab in my EJBCA instance to renew this certificate ,I am getting error like certificate has expired....
0
votes
1answer
48 views

Will Users of Intermediate CA1 trust Users of intermediate CA2?

I have my own CA(CA) and 2 intermediate(ICA1 & ICA2) CA's(generated using the root CA). Using ICA1, generated a server cert(for server S1) and 2 user cert(for user U1 & U2). Now, user certs is ...
4
votes
1answer
371 views

Using NameConstrains in a CA certificate

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart. I have a CA certificate with Name Constrains (RFC): Permitted [1]Subtrees (0..0): ...
1
vote
2answers
644 views

Is using both client side certificate and JWT for IoT device redundant?

Is there a case to be made for authorizing with both a client side certificate and JWT for an IoT device? Are JWTs good enough (assuming following of the specs)? And if client side certs are truly ...
67
votes
3answers
13k views

Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?

After installing Firefox 54.0.1 on my work laptop, the first page I see warns me that "Your connection is not secure" when opening https://www.mozilla.org/. "The owner of Firefox has configured their ...
0
votes
0answers
41 views

Private key vs encryption session keys: For what is the private key used when there are session keys for encryption? [duplicate]

I have read that the private key that the certificate owner/web server has (which is the corresponding private key of the public key presented on the certificate) is used to decrypt the data that the ...
2
votes
2answers
104 views

MITM attack with HSTS implemented websites

I want to perform a Man-in-the-Middle attack against my own network for educational purposes. I want the following scenario: Perform a MITM attack with Bettercap, navigate to a website and accept the ...
1
vote
1answer
91 views

Is certificate signature encoded to ASN.1 format?

I'm working on a diagram to describe the process of issuing digital certificates, with the help of answers on my question here and some other research: I just read in the IETF that: The ...
2
votes
1answer
274 views

How is public key included in the CSR?

I've read a lot of articles on the PKI and digital certificate topics because it's very rare to find one article covers all the aspects; also the topic is confusing at the beginning, (this beautiful ...
0
votes
2answers
99 views

How to securely get a key from a key server?

In the installation procedure of Gentoo, there is a step to check signature of the downloaded iso file. To do so, we first need to download the set of keys from a key server: $ gpg --keyserver hkps://...
0
votes
1answer
47 views

Certificate Signed Using Weak Hashing Algorithm impact on a workstation

I did a vulnerability scan on some of our company workstations. These are workstations used by employees (dev, HR, accounting, etc.) to do their job. One of the common result I found is SSL/TLS ...
0
votes
0answers
57 views

What prevents me from using a some server's public key and impersonate another server [duplicate]

I read alot regarding RSA encryption/DH key exchange/digital signatures and the whole TLS protocol. There's something i am missing regarding the public key signatue validation. Let say some website ...
34
votes
5answers
7k views

Eduroam requires installation of a CA Certificate - can they decrypt TLS traffic?

Eduroam is an organization that provides free WiFi to educational institutions and around some cities. I don't fully understand how the authentication works, but in order to connect you have to ...
2
votes
2answers
235 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
0
votes
1answer
113 views

StrongSwan, IPsec remote certs and cert_policy

I'm looking for a way to limit the certs that my IPsec can accept. I'm using StrongSwan (swanctl version 5.7), I want to accept only certs coming from a remote with a name of yoji.*.example.com I ...
0
votes
1answer
1k views

PDF Digital Signature [closed]

I got free certificate from Comodo and installed on my Windows. Now I'm trying to sign PDF document using this certificate, but get message: "signature validity is unknown": Why is this? How I can ...

1
2 3 4 5
50