Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

1
vote
1answer
42 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
0
votes
0answers
17 views

what is the difference between PKCS#7 and CADES, PADES and XADES?

i am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me. thanks
4
votes
3answers
10k views

Missing X509 extensions with an openssl-generated certificate

My goal is to create a certificate with opensslsimilar to this one generated with cfssl Certificate: Data: Version: 3 (0x2) Serial Number: 60:44:dc:0d:80:f4:54:55:e8:...
4
votes
1answer
136 views

Certificate and Path validation for S/MIME

I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My ...
2
votes
1answer
53 views

Is it OK to set SSL fullchain to service

Imagine service with SSL-server authentication. There are 3 certificates in chain: Root CA certificate; Intermediate CA certificate; Host certificate. Is it ok to put all 3 certificates (fullchain) ...
5
votes
1answer
169 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
3
votes
1answer
86 views

Is it ok to use the same SSL certificate for both HTTPS and SOAP-level signing/encryption?

I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level ...
1
vote
0answers
36 views

Is Mobile ID secure? Certificates on SIM card (Mobile identity management)

In Switzerland Mobile ID is popular. It looks like it's international known as Mobile identity management. Mobile identity is a development of online authentication and digital signatures, where ...
0
votes
2answers
2k views

How does a client use the Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service?

According to a the technet articles: The Certificate Enrollment Web Service is an Active Directory Certificate Services (AD CS) role service that enables users and computers to perform ...
2
votes
2answers
135 views

Publishing a private key used for HTTPS certificates, is it ever OK?

I want to make it easy for users who have private servers to connect to those servers inside their LAN from Android devices. I want to avoid having these users perform configuration tasks like, ...
3
votes
1answer
215 views

Good practices for protecting a machine certificate against extraction

Consider the following scenario: You are providing VPN access for a number of machines running Windows 10. The machines are configured and hardened according to company standards. You rely on machine ...
0
votes
1answer
29 views

ADCS two tier PKI

Planning a two tier ADCS PKI infrastructure as follows: ORCA ____________|____________ | | | SCA1 SCA2 SCA3 one.int two.int three.int ...
2
votes
1answer
136 views

Why do VPN Providers ask for installation of Root CA?

I've seen a lot of VPN providers and they all seem to agree on one thing: ask user to install their own Root CA. I don't get why they do it. A legit server should have a certificate generated by ...
-1
votes
1answer
134 views

Why don't CAs sell certificates as files, instead of hardware or as a service?

I'm trying to purchase multiple certificates, some just signing, some just encrypting, and some a combination of the two. I wanted to purchase one signed by a CA, rather than using a self-signed one. ...
0
votes
1answer
68 views

Is there any standard that encrypts domain name of the certificate?

I guess widely used protocols today don't encrypt the domain names in TLS certificates. Does HTTP/3 and TLS 1.3 encrypt domain names of web sites?
0
votes
1answer
31 views

No certificate found alert in nodejs https server in mobile

I have created a website using nodejs . And using ssl certificate from sslforfree.com . It is working fine on desktop and i checked it in SSL Checker it is working fine . But in mobile it is showing ...
69
votes
2answers
84k views

What is the difference between serial number and thumbprint?

I have problems to understand what is the difference between the serial number of a certificate and its SHA1 hash. The MSDN says: Serial number A number that uniquely identifies the ...
2
votes
1answer
81 views

Duplicate subject names for intermediate and root certificates

I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates. They issue multiple root certificates and intermediate ...
0
votes
0answers
20 views

Securing a large application with multiple services and endpoints

Without getting too deep into the architecture, I would like to get suggestions / good reads on applying encryption to a large scale application with multiple endpoints. There are internal and ...
0
votes
0answers
26 views

authenticating SSL client certificates on server

current setup: i have a pki setup which issues client certificates to the users (so that only clients with the certificate can access the web application). was looking for ways to implement this and i ...
0
votes
1answer
32 views

How to make sure certifi python package is up to date

In python's requests module documentation, I find this important recommendation: For the sake of security we recommend upgrading certifi frequently! Q: How can I make sure that my system's certifi ...
93
votes
5answers
54k views

Let's Encrypt for intranet websites?

Many companies have intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate, which causes a bad habit for the users since they get used to just ...
1
vote
1answer
40 views

Finding the reason behind an RDP Certificate Change (man in the middle attack?)

I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions. Right after doing this, I ...
2
votes
2answers
124 views

Does client have to send the CA chain along with the client certificate after ServerHello?

During the MTLS handshake, after ServerHello is done client sends the client certificate back to the server, I need to know if the client should only send the client certificate or is it required to ...
4
votes
1answer
79 views

Should TLS clients put a limit on certificate chain depth?

Specifcally, when configuring nginx to validate proxy target SSL certificates (which it mystifyingly does not do by default), a maximum cert chain depth must be specified in the proxy_ssl_verify_depth ...
7
votes
3answers
11k views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
0
votes
1answer
33 views

What could cause Location not to transfer from CSR to final certificate?

I'm using the Win32 port of OpenSSL from Shining Light Productions to operate a small personal CA, and I'm running into a weird problem. These are the commands I use to generate a client key/...
0
votes
1answer
32 views

how do optional device certificates work?

i am trying to achieve this: i have a bunch of users who log in to my website. some of the user can opt to be allowed to log in using their selected devices. for this i am planning to use ssl based ...
3
votes
1answer
84 views

When accepting an SSL certificate, can I limit for which domains I accept it?

Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
0
votes
1answer
59 views

Access protected (from export) private key in windows certificate store

I have created a CSR with the option to disallow the export of the private key. Can I still access it? If not, how is it protected?
0
votes
1answer
56 views

PKI - CRL and OCSP

I've done quite a bit of reading about PKI in ADCS and CRL/OCSP, but I can't seem to find an answer to a small couple of questions I still have: It is clear to me that even with OCSP in place, you ...
0
votes
1answer
60 views

Certificate Matching Fields

I have imported a CA into Chrome, and I am signing my own cert with the CA's private key. Obviously, I need the Common Name of the Issuer on my Cert to be the same as the Common Name of the subject of ...
0
votes
0answers
26 views

Is Azure Key Vault more secure than the machine certificate store?

I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on ...
0
votes
1answer
62 views

Two message key agreement and mutual authentication protocol?

I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS. If we assume ...
7
votes
1answer
1k views

A workplace installs custom certificates on personal devices, can this be used to decrypt HTTPS traffic? [duplicate]

So another engineer buddy of mine and I were having a drink the other night. He mentioned that you're allowed to use personal devices on the office wifi, but that they install a custom certificate so ...
1
vote
0answers
12 views

Client authentication (certificate + private key) using WinInet [migrated]

I'm trying to communicate in https with a server using WinInet (from the Win32 API). Here is a very minimalist code : HINTERNET ses = InternetOpenA("test",INTERNET_OPEN_TYPE_DIRECT,NULL,NULL,0) ; ...
0
votes
1answer
101 views

Why does Amazon verify a TLS certificate?

Show site information, then Connection for https://support.mozilla.org indicates Verified by: Amazon Why is this? Is Amazon spying on me?
9
votes
3answers
3k views

Should antivirus HTTPS scanning be left on? Is it secure?

Some antivirus software MitMs, or through other methods, HTTPS connections in order to scan for malware, for example, Avast, and maybe other vendors too. Is the method they (let's say Avast as an ...
1
vote
1answer
72 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...
1
vote
1answer
60 views

Are self signed certs safe to a developer use in local debug?

The same computer I use for work in home, is the same for personal uses (gamimg, social medias) and of course, internet banking. I'm back-end developer and recently, I started to work with fiddler to ...
1
vote
1answer
18 views

How to use Windows User Certificate (S/MIME) to sign data

I am working on an internal ERP for my company. The portal is written in PHP and the current purchasing process is the following: Create a new order on the ERP portal Print the order (PDF) Ask for ...
0
votes
0answers
51 views

See data sent by application over https

Let's say I have an application (A) installed on my PC that communicates with some server over https. What would another application (B) on my machine need to do to be able to read the unencrypted ...
1
vote
2answers
73 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
2
votes
3answers
326 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
1
vote
1answer
38 views

What's the correct way to handle a failure with Client Certificate Authentication

I'm adding Client Certificate Authentication to my application - what is the correct way to handle an invalid certificate, untrusted certificate or an un-mapped user ID?
0
votes
1answer
54 views

What CA signed my certificate?

I'm trying to set up a Docker image that has our internal CA certificates installed so that users across the organization can make secure requests to intranet sites. We have a few different CAs that ...
0
votes
1answer
504 views

Break into WPA2-Enterprise RADIUS wifi network by stealing credentials

I need to ensure that no un-authorized DEVICE gains access to a wireless LAN network. Notice I said, "device". This means that I need to ensure that only authorized personnel can join the LAN and ...
0
votes
1answer
65 views

TLS certificate decoding

Anyone familiar with certificate decoding? I seem to have 3 more bytes at the end of a certificate than the length indicates. I have 3 certificates in the chain. The first one is 0x645 bytes, ...
1
vote
1answer
205 views

compare sha-256 fingerpirnt of certificate with google transparency report

Say that I want to check an https certificate. Suppose I know its SHA-256 fingerprint, how do I compare it to this service search tool, which apparently only gives me the serial number? edit1: can ...
1
vote
2answers
111 views

Is accessing by IP address without CA certificate secure?

If my server doesn't have a public domain name, and users access it via IP address, is using a self signed certificate (ignoring the warning) secure enough for https/ sftp? I am talking only from ...