Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
2
votes
0answers
29 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
2
votes
2answers
143 views

Why is openssl complaining that my certificate chain is self-signed?

I am trying to set up a certificate chain for a lab server. I have created my own root CA, an intermediate CA and a server certificate. I supplied these certificates along with the server key to the ...
1
vote
0answers
96 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
1
vote
2answers
133 views

How are UUIDs assigned in P2P protocols

I am learning about P2P in general (mainly blockchain). I know many P2P protocols uses a distributed hash table for node lookup (kademlia) that maps UUIDs of nodes to their addresses. I am curious ...
2
votes
0answers
104 views

Can I sign with two Code Signing certs to build reputation on the newer one?

I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon. Obviously, the new certificate has no ...
8
votes
1answer
3k views

The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates

I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My ...
0
votes
2answers
77 views

Changing the SSL certificate chain

When connecting to a resource with SSL, I know that the certificates can be validated by the client to make sure the connection is secure. I recently run into SSL problems at work, when connected to ...
3
votes
1answer
626 views

Certificate Transparency Android

For iOS-Apps, it is possible to use Certificate Transparency as stated here. We are developing native Apps for the different mobile platforms and are discussing to establish a more secure way of ...
4
votes
1answer
264 views

Why do VPN Providers ask for installation of Root CA?

I've seen a lot of VPN providers and they all seem to agree on one thing: ask user to install their own Root CA. I don't get why they do it. A legit server should have a certificate generated by ...
3
votes
1answer
5k views

Bitdefender Antivirus SSL Cert substitution

I am using Bitdefender AV 2013 ed and I have noticed that when the Scan SSL is enabled in the configuration BD will use a local certificate, as mentioned here. This modifies the cert chain with BD as ...
0
votes
0answers
34 views

Software build processes - Dependencies without admin privileges

we have the following problem and I would like to hear your opinions for this case: Currently several users are working with domain accounts which are in the local admin group (Yes, shame...) You ...
1
vote
0answers
108 views

My school is making everyone install SSL certificates and without it you cannot access the school network [duplicate]

This is the certificate they are making everyone install. Exactly what can they access using this and should I be concerned about my privacy?
5
votes
3answers
2k views

What are Implicit and Explicit Certificates in Public Key Cryptography?

A Public key is certified by a Trusted Certifying authority, to ensure the integrity of the key and authenticity of the entity who claims to have the corresponding private key. In this Public Key ...
72
votes
5answers
29k views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
2
votes
2answers
89 views

TLS: Clarification on trust in the certificate trust chain

Suppose I have the following trust chain in my trust store: ROOT_CERT | |---INTERMEDIATE_CERT_1 | |---INTERMEDIATE_CERT_2 I know that any certificate that is signed by INTERMEDIATE_CERT_2 ...
140
votes
11answers
171k views

Provide subjectAltName to OpenSSL directly on the command line

Is it possible to provide a subjectAltName-Extension to the OpenSSL req module directly on the command line? I know it's possible via a openssl.cnf file, but that's not really elegant for batch-...
0
votes
2answers
2k views

How to convert my cert chain to PFX without a password

I am trying to enable an Azure Front Door instance on the front of my website using my EV cert (Extended Validation Certificate). However, from Azure Front Door Cert Instructions, Azure Front Door ...
0
votes
2answers
94 views

Assuming that everyone always performs a revocation check, do we still need expiration time in each certificate? [duplicate]

I understand that each public key certificate includes an expiration time, and a CRL is issued periodically, listing all currently revoked certificates. However, in class we were told to think about ...
1
vote
1answer
48 views

How hard is it to retrieve IKEv2 Server Certificate from the server?

I got access to a VPN via IPsec and IKEv2. The provider gave me a username, a shared secret and a server certificate. Since the certificate was self-signed, the manual came with specific instructions ...
1
vote
0answers
65 views

What are the risks involved in blindly trusting all certificates for https requests over unknown proxy servers? [closed]

My use case is a Java application where no sensitive data being transmitted whatsoever, and the response being accurate (i.e. unmodified) is unimportant.
1
vote
0answers
134 views

open ssl: Verify return code: 2 (unable to get issuer certificate) [closed]

I have 3 certificates: root_ca.pem (self signed cert CA) issuing_ca.pem (Intermediate CA signed by root ca) user.pem (user cert signed by intermediate ca) If I try to validate the chain with openssl ...
4
votes
1answer
154 views

Certificate and Path validation for S/MIME

I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My ...
0
votes
2answers
121 views

Convert CSR to self-signed x509 Certificate

Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive ...
0
votes
1answer
100 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
0
votes
0answers
24 views

Certificate Validation with SDS enabled on Ingress Gateway and mode set to MUTUAL

I have been having some difficulty understanding the mechanism by which certificates are validated by either party in a mutual TLS handshake. I have SDS enabled on my ingress gateway(s) and the ...
0
votes
0answers
35 views

Addons still work with Firefox on one account

I'm using Firefox 66.0.3 on Ubuntu, and like everyone else I'm experiencing the certificate bug which causes addons to be disabled. However, in one of my user accounts, the addons still work like a ...
2
votes
1answer
89 views

How do partial wildcards in subjectAltName dNSName interact with IDNA domains?

For instance if I run IDNA encode bücher.tld you receive xn--bcher-kva.tld. Now imagine the certificate for https://bücher.tld has the following field within subjectAltName: (dNSName, xn--bcher*.tld). ...
3
votes
1answer
182 views

Using NameConstrains in a CA certificate

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart. I have a CA certificate with Name Constrains (RFC): Permitted [1]Subtrees (0..0): ...
1
vote
2answers
482 views

Is using both client side certificate and JWT for IoT device redundant?

Is there a case to be made for authorizing with both a client side certificate and JWT for an IoT device? Are JWTs good enough (assuming following of the specs)? And if client side certs are truly ...
0
votes
0answers
50 views

Usage of a self-signed certificate between Akamai and Azure

First of all, some background of what is proposed: The client's browser initialises request The request is resolved by public DNS (CNAME) to Akamai Edge The request is processed by Akamai accordingly ...
5
votes
1answer
596 views

What happened with Kazakhstan's Root CA MITM policy?

In 2015 there were news that Kazakhstan was going to start intercepting all HTTPS traffic via "man-in-the-middle attack" starting Jan 1, 2016, by requiring kazakhstanis to install their root CA. ...
21
votes
5answers
4k views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but that'...
1
vote
1answer
177 views

Prevent bypassing of SSL Pinning in android application

I am creating an android application which is able to ping the server for certain information and return them. There are a few methods by which a user can bypass the pinned SSL certificate of an ...
5
votes
2answers
796 views

OpenSSL Certificate Renewal with same keys and NO CSR

I have a Linux-based vendor-supplied virtual appliance that uses OpenSSL to manage certificates. The current server certificate is from Symantec so has to be replaced with a DigiCert. DigiCert is ...
20
votes
2answers
26k views

Generate CSR from existing certificate

Can we generate the CSR (certificate signing request) used for certificate signing from the signed certificate? It should work with the original private key when signed again with different authority.
5
votes
2answers
9k views

TLS-RSA vs TLS-ECDHE-RSA vs static DH

I understand there are a lot of articles explaining this subject and, before I post my question, this is my current understanding about it: ECDHE-RSA = The server randomly generates a DH-key pair ...
2
votes
2answers
116 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
0
votes
1answer
59 views

Employer Self Signed Root Certificate

I don't have knowledge into programming/cybersecurity so I stumbled upon this site and figured I'd ask a quick question. I worked for about 3 years at company and left as of last week. I don't know ...
0
votes
1answer
74 views

how do optional device certificates work?

i am trying to achieve this: i have a bunch of users who log in to my website. some of the user can opt to be allowed to log in using their selected devices. for this i am planning to use ssl based ...
48
votes
2answers
87k views

What's the difference between X.509 and PKCS#7 Certificate?

Am I correct calling file with .p7b file extension saved as 'Cryptographic Message Syntax Standard - PKCS#7 Certificates (.P7B)' in Windows - a 'PKCS#7 certificate'? Or is it better called 'X.509 ...
1133
votes
3answers
608k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
-1
votes
1answer
74 views

tls custom system trusted certificate on android6 not working [closed]

I encounter the same problem as the user has in this post: Why does Samsung Android browser say our site has a valid certificate, but the site identity has not been verified? The accepted answer is: ...
0
votes
1answer
65 views

Certificate Matching Fields

I have imported a CA into Chrome, and I am signing my own cert with the CA's private key. Obviously, I need the Common Name of the Issuer on my Cert to be the same as the Common Name of the subject of ...
2
votes
1answer
652 views

How to add a custom CA to androids trusted root system folder

As of Android 7.0 no custom certificate will be used by android apps. App developers need to specifically write codes and change app settings to follow a custom CA. But this is difficult while ...
6
votes
1answer
17k views

OpenSSL “unable to get local issuer certificate” even when passing in the Certificate Authority

I've attempted to setup a certificate authority, and issue a certificate from that authority (with no intermediate inbetween The authority covers *.node.consul, and the certificate is underneath that ...
0
votes
1answer
3k views

ssl handshake failure unable to get local issuer certificate

I have an issue with new integration that I am working on it. I should consume a web service provided by external company and this service is over https, so in order to integrate with them, they have ...
1
vote
2answers
128 views

Are SAN IP addresses / DNS names useless in self signed certificates by untrusted CAs?

I want to generate a self signed certificate for temporary local testing of a web service via HTTPS. I don't want to install the CA though, because the self signed certificate is generated on the fly ...
0
votes
0answers
31 views

SQRC use to verify e-delivered certificate

I have a need to provide a means of validating a certificate that is e-delivered. My thought is to use an SQRC to enable that verification by linking to a secure site that contains the original ...
1
vote
0answers
41 views

same CA, same CN [duplicate]

Can you order several certs from the same CA, in which only the DN differs, but the CN is the same? Will they accept a second request for the same CN or maybe then put the first cert on the ...
1
vote
1answer
192 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...