Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
3
votes
1answer
74 views

MITM on HTTPS traffic in Kazakhstan 2019

MITM on HTTPS traffic in Kazakhstan 2019 But for MITM to work, despite installing the certificate, there has to be someone proxying the request,right? That role will be played by the ISP's? Say I ...
0
votes
2answers
111 views

Why does localbattle.net point to localhost?

I found a random link on a forum linking to localbattle.net, at the same time I was running a local server on localhost. When I went to localbattle.net, my local server page appeared! The certificate ...
20
votes
7answers
4k views

Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?

Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
3
votes
1answer
4k views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
2
votes
3answers
516 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
0
votes
0answers
26 views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
0
votes
0answers
23 views

How can TLS/HTTPS remain secure if the entire transmission is monitored? [duplicate]

Okay, so I'm pretty sure this question comes from a fundamental misunderstanding of how HTTPS works, but here goes: Say that someone has hooked into the "internet line" coming from your home so that ...
0
votes
0answers
30 views

Automating certificate management across a large number of printers?

Is there a way to manage certificates on a large group of printers that will install and renew them? It doesn't look like any of the fleet management programs will do this. How are these managed in an ...
8
votes
2answers
949 views

What happened with Kazakhstan's Root CA MITM policy?

In 2015 there were news that Kazakhstan was going to start intercepting all HTTPS traffic via "man-in-the-middle attack" starting Jan 1, 2016, by requiring kazakhstanis to install their root CA. ...
0
votes
0answers
3 views

x509 certificate with excluded subtree violation issue [migrated]

I would like to use self-signed x509 certificates in our testing environment so I followed the process described in Ivan Ristic's "OpenSSL Cookbook". Great resource. I decided to go the private CA ...
0
votes
1answer
69 views

Cross sign two self signed root CA

I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster. However, one of the ...
6
votes
2answers
406 views

Did google chrome kill public key pinning?

I've read many articles talking about google chrome killing public key pinning in Chrome 67 (May 2018). See here, here, and here. However, I haven't found any information about whether or not they ...
0
votes
1answer
41 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
0
votes
0answers
11 views

How to generate trusted SSL certificate for secure MQTT? [migrated]

I am a beginner with information security and everything about SSL just goes over my head. Currently I'm trying to get an IoT device(ESP32) to connect to an MQTT broker, broker.losant.com:8883 in ...
1
vote
1answer
505 views

Use Personal certificate without a key with Firefox

We have a website that authenticates the user using a certificate. The certificate is installed by the IT department and I can't export it with the private key. When I navigate the website with ...
1
vote
1answer
137 views

Is Certified | Ethical Hacker (C|EH) a scam or legitimate? [closed]

I've been doing a lot of research on Certified | Ethical Hacker (C|EH) to see if it's a credible certification. But I've stumbled across a Wikipedia article on it and discovered that the sources are ...
0
votes
0answers
29 views

Error while loading Android Keystore [closed]

I am currently experiencing a problem with the use of Keystore on Android. My current situation is as follows: I want to store certificates in a custom format in the Keystore. For that, I created a ...
-1
votes
1answer
69 views

How to get a certificate valid for digitally sign a document? [closed]

I have to digitally sign a pdf. I created a little app using the DSS library (an EU project, based on Bouncy Castle, very simple to use) that sign the PDF with PADES using a p12 file. I know how to ...
2
votes
1answer
108 views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
0
votes
1answer
556 views

Break into WPA2-Enterprise RADIUS wifi network by stealing credentials

I need to ensure that no un-authorized DEVICE gains access to a wireless LAN network. Notice I said, "device". This means that I need to ensure that only authorized personnel can join the LAN and ...
0
votes
1answer
87 views

TLS certificate decoding [on hold]

Anyone familiar with certificate decoding? I seem to have 3 more bytes at the end of a certificate than the length indicates. I have 3 certificates in the chain. The first one is 0x645 bytes, ...
26
votes
5answers
43k views

How are Chrome and Firefox validating SSL Certificates?

How are Chrome and Firefox validating SSL Certificates? Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?
1
vote
1answer
38 views

Is a SSL client required to try multiple certificate chains?

Yesteday, 10 July 2019 I failed to access dict.tu-chemnitz.de with Epiphany (WebKit2, which is using GNUTLS) and mailed the administrator which fixed it quickly. Here is the access via GNUTLS: $ ...
0
votes
0answers
15 views

Certificate Pinning with SockJS

What is the SockJS way of pinning SSL Certificates in the client side when contacting wss:// to avoid CA trust? FYI, when using modules like HTTPS or WS, we can listen to the socket event and then on ...
0
votes
2answers
145 views

Why does pinning a CA root certificate not present a security risk?

AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
2
votes
1answer
57 views

Does SSL inspection break applications utilizing certificate pinning?

A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
-1
votes
2answers
79 views

SSL/TLS Extended Validation implemented in fraudulent domains

People trust green bars, because it is proven to not to be of malicious origin. This seems to be the questions of hundreds and many are concerned about it, picture that; a team of fraudsters(or at ...
0
votes
0answers
73 views

Why is my gf seeing a localhost self signed certificate when going to netflix?

Recently my gf told me she was receiving errors when trying to go to netflix. I took a look and the certificate is super wierd saying it is self signed. Why could this be happening? She only uses the ...
33
votes
4answers
76k views

how to import a private key in windows

Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys? Is the only way I can do that by converting both ...
0
votes
1answer
61 views

Websocket connection hostname check

I am testing an application that uses both regular http rest requests and websockets. Burp cert is installed on the device I am using for the tests. I can intercept the encrypted traffic using Burp. ...
0
votes
1answer
41 views

How to create a self-signed client-certificate without a CA?

I tried A lot of articles online generating certificates using openssl, but unfortunately none of them worked for me :( There is a website that everytime I visit throws me this error: Sorry, but ...
0
votes
0answers
34 views

CSP/KSP module for MacOS

My company developed a custom Key Storage Provider for Microsoft CAPI so that CNG-using Windows apps can perform signatures using a remote signature service. I would like to know if there is support ...
59
votes
4answers
9k views

Is there a way to make sure my government does not swap out SSL certificates?

I was recently wondering whether there exists a way to make sure my government is not swapping out SSL certificates in order to intercept the traffic. I know almost all browsers are complaining in ...
7
votes
1answer
812 views

How does the OpenSSL Alternative chains certificate forgery (CVE-2015-1793) attack work?

The security advisory for the issue can be found here: https://www.openssl.org/news/secadv_20150709.txt OpenSSL Security Advisory [9 Jul 2015] Alternative chains certificate forgery (CVE-2015-...
1
vote
1answer
51 views

Feedback for self-signed certificates setup for custom product auth?

HW (linux) <---Eth---> Official PC (win,mac,linux) | | ----> Man-in-the-middle eavesdrop I'm looking to prevent an unauthorized party inside the ...
0
votes
1answer
63 views

Can we keep our customer's X509 Certificate as BLOB on our server?

I have a scenario in which I need to use the customer's X509 certificate and passphrase for executing their web services. Now, I need to know what will it be a security breach if I store customers' ...
0
votes
1answer
3k views

Your connection will not be private - Wi-Fi CA certificate warning message on Android

I try to connect to a Wi-Fi network, Eduroam, using my new Android device. It asks me to provide the CA certificate and warns that otherwise my connection would not be private. No certificate ...
0
votes
0answers
63 views

Self signed ssl I created for localhost cannot be trusted even though I have already imported it to chrome [migrated]

I generated a certificate using ssl by running the script from the following link: https://gist.github.com/bjanderson/075fadfccdd12623ab935e57eff58eb4 The script ran just fine and I received all the ...
0
votes
1answer
195 views

Am I safe after importing Bitdefender's fake certificate?

I installed Bitdefender today and suddenly I couln't navigate to numerous websites that I used to visit (I use Mozilla Firefox). I got the error: SEC_ERROR_UNKNOWN_ISSUER. I searched a bit and found ...
1
vote
0answers
53 views

Can my company see my network traffic if their certificate doesn't appear in the web browser? [duplicate]

I have a work-issued Mac, when I go to keychain access right now these are the following certificates: AddTrust External CA Root (Root certificate authority) COMODO RSA Certification Authority (Root ...
2
votes
1answer
331 views

OCSP recording with JMeter

How can I record an application which is using OCSP security with the help of JMeter? I am not able to record the application i.e. a native app with the help of JMeter as it is using OCSP protocol ...
14
votes
3answers
7k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
1
vote
2answers
373 views

Why doesn't form based authentication use digest instead of plain text

In form based authentication the credentials are sent as such within the message, whereas in digest based authentication a digest of credentials, domain name and a random challenge is sent instead. ...
4
votes
3answers
9k views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...
29
votes
2answers
4k views

Can you sign using a digital certificate itself?

Googling I saw several lectures saying that it is possible to sign using digital certificates. I am confused about that, because according to my knowledge it is possible to sign only using the private ...
1
vote
1answer
52 views

.Net WebClient - self signed certificate

I have two applications (.net) on two web-servers. The first application will need to do a request (via WebClient) to the second and get results. I need to ensure Encryption, data integrity, and ...
0
votes
0answers
41 views

Unable to get information from a PKCS certificate

I sniffed the communication between the client and the server using Wireshark, and I found out that during the handshake session, the client sends its certificate to the server. I've managed to get ...
1
vote
0answers
16 views

What would happen to the connection when certificate expires? [duplicate]

We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure) The expiry date of the certificate is 3 years from now. Once the ...
0
votes
1answer
83 views

Why am I receiving this error message when browsing nvidia.com?

I'm receiving this randomly when I try to visit nvidia.com. I can either not reach the site at all with a 504 error, or I get this screen. What does it mean, and what is the cause?
1
vote
1answer
67 views

Where do TLS clients fetch intermediate CA certificates from? [duplicate]

When I use my browser (a TLS client) to navigate to a secure web page (e.g. https://example.com), during the TLS handshake, the browser will receive an end-entity certificate from the web server of ...