Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
38
votes
3answers
21k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
3
votes
2answers
156 views

Server certificate proving client identity

When we look at StackExchange's server certificate (by clicking on the Lock icon), it says: This certificate is intended for the following purposes: Ensures the identity of a remote computer. ...
10
votes
2answers
2k views

How can a domain be impersonated with a fraudulent SSL certificate?

I was reading this article about the fraudulent certificates from Comodo back in 2011. It talks about domain impersonation. I understand that a fake website could be secured with the fraudulent ...
0
votes
1answer
41 views

Usage of SSL_CTX_use_certificate

While building a context through openssl, if I do not provide a certificate by using the function SSL_CTX_use_certificate, would all the connections from that context default to anonymous diffie-...
2
votes
1answer
76 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
0
votes
0answers
29 views

Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?

I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
0
votes
0answers
28 views

Proving that a certain site had given page at certain time [duplicate]

Lets someone opens https://foo.com and saves the page using "save page as". Is there any way to prove later that the locally saved files have not been altered assuming that we trust the server public ...
0
votes
1answer
166 views

Windows Server: Import HSM-backed certificate into second server

Scenario: Using Amazon CloudHSM with CloudHSM Windows Client installed and configured. Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider. Submitted ...
0
votes
1answer
51 views

Explanation of the authentication procedure when using signed certificates [duplicate]

I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT. On my device side, I have a device certificate ( deviceCert.crt ) and the device ...
49
votes
4answers
84k views

How does the digital signature verification process work?

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
2
votes
3answers
144 views

SSL authentication unexpectedly failing - could this be caused by SSL Inspection/Fortinet?

I'm dealing with an SSL issue that's been plaguing me for several days. I know relatively little about security, so if anyone here could lend a helping hand I would be extremely grateful. Ultimately ...
1
vote
0answers
59 views

Why is digital signature enforcement on webservers not common practice?

Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
0
votes
1answer
44 views

truststore and intermediate certificates

We have a situation where our on premise product talks to a third party external API over SSL. This API has a certificate which is issued by an intermediate. We use the default java cacerts truststore,...
10
votes
1answer
2k views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
1
vote
2answers
723 views

List of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards, PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
1
vote
0answers
179 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
1
vote
0answers
127 views

Replying to a digitally signed email using thunderbird

So Basically I sent a digitally signed email using a certificate issued by Sectigo RSA Client Authentication and Secure Email CA. Now the recipient of the email replied to me with a certificate ...
6
votes
2answers
9k views

Why OpenVPN is using both certificates and DH?

I am reading about OPENVPN and I am a little bit confused. In the OPENVPN howto website, there is a step by step setup guide for generating certificates and diffie-hellman (DH) params. However, I cant ...
2
votes
2answers
362 views

Why is OpenSSL verify output depending on source of cert files?

As a test of my TLS/SSL knowledge, I'm trying to verify wikipedia.org's TLS cert. I have downloaded the server-distributed certificate to a file called cert.pem and the root cert (from Globalsign's ...
0
votes
0answers
37 views

How can I create a self-signed certificate with a custom field? [duplicate]

For experiment, I want to add a custom field in a TLS certificate then validate it. Because it is experiment, it will be a self-signed certificate. I use OpenSSL 1.1.0g and Ubunut 18.04. Any hint will ...
2
votes
2answers
873 views

WPA2 with 802.1x - how is the server certificate validated?

I want to replace my current WPA2/PSK Setup with WPA2+802.1x with RADIUS authentication. There are various algorithms which can be used for that which can be roughly divided in two groups: a) the ...
12
votes
5answers
6k views

Which encryption algorithm is used in password protected *.pfx/PKCS 12 certificates?

As the title says, I can't find any resources on which encryption algorithm is used in *.pfx/PKCS 12 certificates that are password protected.
0
votes
0answers
51 views

How to check if installed Trusted CAs are not dangerous? [duplicate]

I've checked my Windows 7 installed Trusted Certificate Authorities using MMC tool as below: Questions are: How can I be sure that they are genuine and are installed by Microsoft and not by a third-...
1
vote
1answer
105 views

How do I validate a certificate by hand?

I have a website, which has a signed certificate file (website.crt) from a certificate authority (CA). How do I make sure exactly, that this certificate is valid? I know, that browsers do it ...
1
vote
0answers
538 views

Use self-signed certificate inside of Docker Container for localhost

I've created a self-signed certificate for localhost to use https. I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
1
vote
0answers
35 views

Is distributing software with KeyStores as resource secure?

I'm working on a client / server application. I want to encrypt the communication between the two. This GitHub project served as a starting point for me. It uses SSLEngine to establish a secure ...
30
votes
6answers
38k views

What ciphers should I use in my web server after I configure my SSL certificate?

There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list. ...
0
votes
1answer
107 views

What are MITM proxies used for in enterprises?

My company (like many others I assume), uses a "man in the middle" proxy with a personal root CA. Disclaimer : I'm not a security expert so perhaps I do not correctly understand what this network ...
35
votes
3answers
42k views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
0
votes
0answers
209 views

What is a reasonable default_crl_days value for OpenVPN CLR? Why?

I am having trouble finding a definitive answer (with a rationale) on what a reasonable default value for default_crl_days (in openssl.cnf) for use with OpenVPN. The current default is 30 days. But ...
0
votes
0answers
55 views

How to obtain a private client certificate

We have a fairly weird integration scenario where we need to connect the following two systems: 1) Partner's API Portal - the server, which uses MASSL authentication with a requirement that the ...
-3
votes
1answer
81 views

what is the maximum life-time for Let's Encrypt certificates

Let's Encrypt is one of the most popular TLS Certificate Authorities. I have conflicting information about its certificates life-time. In this link it says 90-days. In one research paper I read 1 ...
2
votes
2answers
1k views

Four ECDSA P256 CSPs are available in Windows. Which one should I use?

According to Azure support case #116120515025419, the public datacenter only supports the following TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256 ...
2
votes
2answers
162 views

Maximum number of certificates generated by a CA

What is the maximum number of certificates that can be generated from a CA? The use case is a VPN using certificate authentication and I would like to know what is the theoretical number of unique ...
10
votes
2answers
424 views

What are the risks of installing a root certificate from Facebook on your phone?

I read a TechCrunch article today describing a program Facebook has been running since 2016 where they pay users $20 in exchange for installing a root certificate run by Facebook. This immediately ...
0
votes
1answer
114 views

More clarity on Certificate, public key, hash

I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below. I've used below command to see what this certificate ...
41
votes
2answers
34k views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
1
vote
1answer
67 views

Certificate not trusted in Root CA Store - does it still enable secure connection? [duplicate]

I'm a bit new with certificates and have been unable to find an answer on this. We need to place controls around an application that is accessed via URL, we have moved the URL to citrix, but the ...
0
votes
0answers
20 views

Using client certificate from a file and a key pair from a hardware token

The question is about TLS client authentication using a browser. I have been using a smart card to authenticate to certain web sites. However, the card is a bit old and for whatever reason importing ...
0
votes
1answer
64 views

Is it possible to mitigate risks of using a wifi connection that uses a self-signed security certificate?

I don't really know anything about security certificates, and I tried reading about this, but couldn't find the answer. Edit: The hotel I'm staying in uses a login page for the wifi connection that ...
0
votes
2answers
165 views

How to approach 2 tier PKI RSA Root CA with subordinates that should support ECDSA

I have a situation for which I am not sure how to approach it. Basicialy I need to find out if it is possible how to issue ECDSA Certificates with a RSA Root Certificate. Is this possible? and how ...
2
votes
1answer
106 views

What is the benefit of signing an executable that is not a driver on windows?

What is the security benefit of signing an executable that is not a driver? How is the signature verified by the windows?
1
vote
1answer
239 views

Extract issuer public key from certificate pem file

I know that a certificate that's been signed by a CA contains identifiers for both the subject and the issuer's public keys: $ openssl x509 -in cert.pem -text X509v3 Subject Key Identifier: ...
109
votes
5answers
338k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
0
votes
2answers
77 views

Is the root certificate issued from one Certificate Authority is same for all the requesting organisation?

Let me please explain the question a bit more through an example: There are lots of companies who have their certificates signed by Verisign (or any CA). I understand that Verisign signs these certs ...
3
votes
1answer
51k views

Is using “SHA-256 with RSA-2048 Encryption” a secure certificate hashing algorithm?

Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm? I don't think it is. Two examples: nsa.gov [careers site] give.wfp.org
0
votes
0answers
41 views

Renewing self signed SSL cert without updating client

I have a server and a single client. I have full control of both, the client is not a distributed application used by the public. For various reasons, I'm having the client use HTTPS to communicate ...
0
votes
0answers
179 views

In what important ways can a digital signature be invalid?

I am trying to write some code to verify that a digitally signed file came from my company. I was horrified to stumble across this deeply buried answer on Stack Overflow, an out-of-left-field ...
0
votes
2answers
1k views

Creating root CA to issue certificates programmatically

I have to generate a self signed root CA and use it to issue to certificates programmatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
2
votes
1answer
73 views

DNS entry defined only in HOSTS file - will browsers mark the SSL cert as valid?

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server. We have a few contractors accessing this site from outside the ...