Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
2
votes
1answer
106 views

What is the benefit of signing an executable that is not a driver on windows?

What is the security benefit of signing an executable that is not a driver? How is the signature verified by the windows?
1
vote
1answer
260 views

Extract issuer public key from certificate pem file

I know that a certificate that's been signed by a CA contains identifiers for both the subject and the issuer's public keys: $ openssl x509 -in cert.pem -text X509v3 Subject Key Identifier: ...
110
votes
5answers
339k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
0
votes
2answers
78 views

Is the root certificate issued from one Certificate Authority is same for all the requesting organisation?

Let me please explain the question a bit more through an example: There are lots of companies who have their certificates signed by Verisign (or any CA). I understand that Verisign signs these certs ...
3
votes
1answer
52k views

Is using “SHA-256 with RSA-2048 Encryption” a secure certificate hashing algorithm?

Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm? I don't think it is. Two examples: nsa.gov [careers site] give.wfp.org
0
votes
0answers
43 views

Renewing self signed SSL cert without updating client

I have a server and a single client. I have full control of both, the client is not a distributed application used by the public. For various reasons, I'm having the client use HTTPS to communicate ...
0
votes
0answers
186 views

In what important ways can a digital signature be invalid?

I am trying to write some code to verify that a digitally signed file came from my company. I was horrified to stumble across this deeply buried answer on Stack Overflow, an out-of-left-field ...
0
votes
2answers
1k views

Creating root CA to issue certificates programmatically

I have to generate a self signed root CA and use it to issue to certificates programmatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
2
votes
1answer
73 views

DNS entry defined only in HOSTS file - will browsers mark the SSL cert as valid?

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server. We have a few contractors accessing this site from outside the ...
0
votes
2answers
128 views

How to check Google SSL certificate?

I encountered this error on Google Chrome on my Windows 10. I solved it by installing the certificate and now it is working fine. I wonder, how do I know the certificate I have is legit? That is, ...
0
votes
0answers
102 views

Proxying an Android application with Burp Suite

I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
2
votes
1answer
69 views

Sub-domains TLS certificates and wildcard certificate [duplicate]

1) Is it a good security practice to have a separate TLS certificate for each sub-domain? 2) Is wildcard certificate (i.e. one certificate for many/every sub-domains) a bad practice?
0
votes
1answer
508 views

can MiTM read server certificate in TLS1.2?

We have a client and server that works via TLS 1.2 connection. Client connects to server, client checks server's certificate, connection established. Question - can anyone who read all data packets (...
6
votes
1answer
2k views

How to generate a unique and uncopyable VPN certificate/key for a specific client hardware device?

The problem is : Nothing prevents the user to copy the certficate/key on a different hardware device and use it from a different hardware device... Is it possible to generate a really unique ...
1
vote
0answers
19 views

Using build time generated, self-signed certs for inter application authentication

I need to be able to authenticate requests between different applications I am responsible for. My company does have CA signed certs, but there are two problem with using it for this purpose. ...
3
votes
1answer
2k views

When can I commit an OpenSSL Certificate (.pem) to source control?

That is to say, in what cases does it make sense to commit .cer files, or a stack of .cer files in a .pem, to internal source control like SVN or Git? If it's just a list of signed public keys, I ...
1
vote
2answers
71 views

Does Digital Certificate affect privacy of the user?

As I know the user use the digital certificate to identify himself for the others. Can a Digital Certificate to be use as unique identifier for the user to trace and profile user activities?
16
votes
2answers
43k views

OpenSSL generate different types of self signed certificate

Does anyone know how to use OpenSSL to generate certificates for the following public key types: DSA - For DHE_DSS key exchange. Diffie-Hellman - For DH_DSS and DH_RSA key exchange. ECDH - For ...
1
vote
1answer
46 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...
64
votes
7answers
16k views

Why would a school need to install certificates on student laptops?

This question indicates parents are to buy laptops for a school to install software and certificates. I am seeking to understand reasons for site certificates installation: Why would site ...
3
votes
1answer
94 views

Can cURL block a rogue CA?

I know which Certificate Authority (CA) my server uses for its TLS certs. My client system also knows who the CA is. When I use cURL, I can specify --cacert to specify a custom CA file to use, but ...
1
vote
1answer
30 views

What are the security differences between a service-signed client certificate and an out-of-band shared secret?

TLS allows for client certificate validation. Client certificates can be signed by the client, the service provider, or a trusted third-party CA. I'm talking about the middle option. At a glance, it ...
7
votes
1answer
750 views

How do certificates work in terms of encryption, hashing, and signing?

I think I might understand this stuff, but I want to be sure I've got the details correct. There is a lot of information out there on the high-level implementation of certificates, as well as the ...
0
votes
0answers
20 views

How to read Security Technical Details for Connection Encrypted [duplicate]

I'm doing some research on encryptions websites and could use some help. How do you read/interpret this connection detail: Connection Encrypted (TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256_256 BIT ...
0
votes
2answers
908 views

How to eavesdrop and decrypt the HTTPs communication of an IoT device?

I am trying to setup a MitM scenario between an IoT device and WAN. It is possible and quite easy to achieve same thing for the application run on a mobile device by setting my proxy server(Fiddler)'s ...
2
votes
1answer
291 views

Multiple Intermediate Certificates on openssl

I need to create multiple intermediate certificates so the chain would be like this root >> int 1 >> int 2 >> user cert. Till yet, I have created a root and an intermediate certificate (signed by ...
0
votes
0answers
83 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...
44
votes
5answers
20k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
0
votes
2answers
48 views

Can certificate signing requests be stored at the server to prolong existing certificates?

I want to build a PKI (public key infrastructure) to host certificates for users. My use case is, that I want to use the certificates for e2e encryption between the users. Users must be able to ...
8
votes
2answers
1k views

Why is it fine for certificates above the end-entity certificate to be SHA-1 based?

I have heard about the phasing out of SHA-1 based certificates for end entity use, and the steps that are outlined for Google Chrome to display progressively more aggressive warnings for SHA-1 ...
1
vote
1answer
982 views

OpenSSL - how to renew certificates in production?

Have a number of private network services deployed on different nodes outside of optionally encrypted mesh systems, like Docker or Consul. The services have high value and should communicate via TLS ...
2
votes
2answers
112 views

Is it okay to have your SSL cert showing when server is reached by IP?

I've been doing some research into SSL for a paper for school, so please forgive my ignorance and lack of experience in this subject. While doing my research I have noticed that some websites when you ...
1
vote
2answers
206 views

What is being verified in OpenSSL's SSL_get_verify_result

In OpenSSL the following function is used to verify certs. SSL_get_verify_result I looked at the manual here. But it does not detail what is being verified. Can you clarify to me what does this ...
1
vote
1answer
120 views

OCSP, CRLs, crlset - Revocation Delivery and Attacks

OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the ...
0
votes
1answer
41 views

Tls certificate correspondence

I am not really good in tls details, just know some basics. So there are couple of questions about it: Is there a way to decipher tls in wireshark if the cipher method is diffie hellman? I know that ...
7
votes
2answers
2k views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
7
votes
3answers
10k views

How to generate self-signed EV SSL Certificate?

I configured XAMPP / Windows on my laptop so that this URL: https://www.supersite.com/ points to XAMPP / localhost rather look elsewhere. I basically generated a self-signing certificate, imported ...
67
votes
3answers
11k views

Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?

After installing Firefox 54.0.1 on my work laptop, the first page I see warns me that "Your connection is not secure" when opening https://www.mozilla.org/. "The owner of Firefox has configured their ...
2
votes
2answers
134 views

Use combination of digital certificates and symmetric key cryptography

Assuming that: - A have CertA and secret key KsA - B have CertB and secret key KsB A need to transfer data M to B with the requirement of confidentiality and authenticity, BUT Data encryption must ...
0
votes
1answer
55 views

Is this CA store related to Ubuntu or OpenSSL

I am checking TLS certificates chain validity against CA sore in this path: etc/ssl/certs/ca-certificates.crt I use Ubuntu 18.04 and OpenSSL 1.1.0g. I need to know whether this CAs store is from ...
0
votes
2answers
58 views

xmlns.jcp.org domain SSL cert weirdly invalid?

I was looking for some information about Java EE Schemas and found page https://www.oracle.com/webfolder/technetwork/jsc/xml/ns/javaee/index.html. From there I clicked at http://xmlns.jcp.org/xml/ns/...
4
votes
3answers
3k views

Self-signed cert - how it works

I am new to SSL / digital certificates / signatures. What I know is that a digital signature must be verified/decrypted using the public key. So a cert that is signed by a CA must be verified/...
1
vote
1answer
96 views

Chain of causality in Equifax breach (expired certificates disabling IPS capabilities)

I am researching the Equifax breach described here: https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf Apparently the attack went undetected for a long period of time and the ...
4
votes
3answers
597 views

What is the best way to reissue user certificates after configuration change in a template?

I have setup my MS-ADCS environment in my company and configured auto-enrollment. i have everything working great, but found out that I want my "Subject Name Format" to have a different value. We are ...
25
votes
5answers
8k views

What does “signing” a file really mean?

I'm a bit new to security and trying to get the concepts properly. I'm wondering what exactly "signing" a file (a certificate, an apk file, or something else) means? Do we sign the whole file so ...
4
votes
3answers
218 views

What if somebody sends me genuine certificate that they do not own? [closed]

I just started learning about the digital certificates, its architecture and how it works internally. What will happen if someone sends me a genuine certificate for authentication which does not ...
4
votes
1answer
356 views

How will Certificate Transparency be enforced?

The Chrome team has announced that "[they]’ll be moving forward with [their] plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018." It's ...
1
vote
1answer
174 views

Certificate serial and thumbprint number spacing

We have a Microsoft PKI setup at our organization. As per just about all certificates I've ever seen, new certificates issued by our issuing CAs will put the serial number and thumbprint in a HEX ...
0
votes
1answer
96 views

How does TLS verify a certificate belongs to a domain? [duplicate]

Say I own a domain called Bob.com, and I've sent an API request to Google.com. But instead of supplying a certificate for Bob.com, I send a certificate for Alice.com (which I got from a previous API ...
57
votes
1answer
4k views

Does a client certificate identify the owner to unrelated websites?

If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it? I once visited an ssl diagnostic site that immediately ...