Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
5
votes
4answers
18k views

Missing X509 extensions with an openssl-generated certificate

My goal is to create a certificate with opensslsimilar to this one generated with cfssl Certificate: Data: Version: 3 (0x2) Serial Number: 60:44:dc:0d:80:f4:54:55:e8:...
3
votes
1answer
233 views

Good practices for protecting a machine certificate against extraction

Consider the following scenario: You are providing VPN access for a number of machines running Windows 10. The machines are configured and hardened according to company standards. You rely on machine ...
2
votes
1answer
82 views

If I accept a root Cert what am I opening myself up to?

If I connect to a WIFI AP and it wants to install a root cert. They read my HTTPS traffic, Right? Does using OpenSSH on my cell phone to my home router help protect me? Or can this traffic be ...
0
votes
0answers
5 views

OpenSSL encrypts public key after conversion to pfx [migrated]

I'm exporting a certificate and private key into .pfx file with: openssl pkcs12 -export -out export.pfx -in public.crt -inkey private.key -nodes However despite encrypting private key with provided ...
8
votes
3answers
8k views

Is it required to have the same Domain Name and Common Name for SSL Certificate?

I have an SSL cert in which CN is "abc.xyz.com". But the url shared to 3rd party organization to access a web app on our server is: "def.stu.com/what-ever". When this arrangement is working for ...
0
votes
0answers
47 views

Examples of SSL certificates from major vendors [closed]

Is there some place I can find example of SSL (TLS) certificates issued by the major vendors, so I can examine them for myself to see things such as what exactly the issuer field says, what signature ...
7
votes
0answers
300 views

Transferring Microsoft SmartScreen reputation to renewed certificate

I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning: Windows Defender SmartScreen prevented an unrecognized app from starting The ...
14
votes
3answers
34k views

Reset Windows trusted certificates store to its default [closed]

Over the time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, some other times for development and testing. Is there ...
298
votes
6answers
233k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
0
votes
0answers
8 views

Does Juniper have an equivalent of 'show security pki local-certificate' for remote certificates? [migrated]

On a Juniper Firewall, the command show security pki local-certificate will give all sorts of detail for a local certificate. (The sort of certificate you would use to stand up an IKE connection) My ...
8
votes
3answers
4k views

Should antivirus HTTPS scanning be left on? Is it secure?

Some antivirus software MitMs, or through other methods, HTTPS connections in order to scan for malware, for example, Avast, and maybe other vendors too. Is the method they (let's say Avast as an ...
1
vote
1answer
52 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
1
vote
0answers
37 views

How attackers bypass windows smart screen

I'm curious to how attackers gain access to valid EV certificates that bypass windows smart screen (for malware delivery/execution) or how they sign these malicious software(s) without access to EV ...
1
vote
0answers
232 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
0
votes
2answers
867 views

Is it possible to catch public key certificate in network and hack the public key so you could pretend that you were someone else?

I am very confused about the way of sending the CA's certificate to another party. What if some hacker is monitoring the network in the moment you send a certificate to other party and hacks the ...
0
votes
1answer
85 views

Access protected (from export) private key in windows certificate store

I have created a CSR with the option to disallow the export of the private key. Can I still access it? If not, how is it protected?
3
votes
2answers
5k views

CSR with only public key with openssl

So I have been doing my research and haven't found anything specific enough to my problem. As the question title states, I want to make a CSR with only the public key. What I have been able to do is ...
24
votes
1answer
19k views

Which properties of a X.509 certificate should be critical and which not?

RFC5280's section 4.2 states Each extension in a certificate is designated as either critical or non-critical. A certificate-using system MUST reject the certificate if it encounters ...
1
vote
0answers
11 views

AD CS Configuration Using Install-AdcsCertificationAuthority Cmdlet [migrated]

I am trying to configure a subordinate CA using a .PFX file with PowerShell. I am using the below parameters: $params = @{ CAType = "EnterpriseSubordinateCA" Credential = $credential ...
2
votes
1answer
53 views

Certificate warning when I enable DNSSEC

I registered mydomain.net (with Google domain registration server). In the DNS settings on the google control panel, I say that mail.mydomain.net should go to the email cloud app (business.zoho.com in ...
7
votes
4answers
3k views

How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)

I'd like to have my server APIs only accept requests from my own app, to prevent other "rogue" clients of my service. As i understand it, the way to do this would be with a "client certificate" that ...
2
votes
1answer
29 views

Is there a risk associated with to many entries in your SAN list? [duplicate]

Is there any risk associated with having lots of websites in your SAN list? For instance: Or is this common among website hosts, and possibly safe?
4
votes
3answers
647 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
4
votes
2answers
62 views

Is pinning global root CA almost same as not having any certificate pinning at all?

I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all? ...
-1
votes
2answers
167 views

Can I have a TLS signed certificate without a CA

And how can I do that if the answer is Yes?
2
votes
1answer
68 views

Questions on TLS 1.2 RFC - Clarification or references needed

I have been reading RFC 5246 on TLS 1.2 and have a few questions on algorithms chosen. Before I start, let me clarify that I am reading on 1.2 and not 1.3 because my ultimate interest is in DTLS 1.2. ...
2
votes
2answers
2k views

eset smart security root certificate injection

I dont know a lot about this subject but - I am trying out ESET Smart Security version 9 which includes the nod32 product (antimalware/virus) and I received an error regarding the addition of a new ...
0
votes
0answers
10 views

Microsoft Word Security Warning for Signed VBA Project [migrated]

I am attempting to setup signed VBA Projects so that I can find the right balance between security and useability. Currently my end users are instructed to just hit "Enable Content" on Microsoft ...
2
votes
2answers
72 views

Understanding how clients handle incomplete certificate chains

How do clients (browser for example) handle a missing intermediate certificate? In the following answer it is explained that they download certificates or use cached certificates: https://security....
1
vote
1answer
37 views

Node certificate vs admin certificate [closed]

I tried to understand what is the difference between node and admin certificate. Admin certificate is like root and the node certificate is just for communication with others nodes?
0
votes
0answers
37 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
-3
votes
1answer
53 views

Digital Certificates, exhaustive set of their uses and references [closed]

I am a newbie of sorts as far as particulars of security is concerned.can somebody list all the possible uses of a digital certificate? it is used in SSL, signing and what else? Also is there a good ...
0
votes
1answer
50 views

Are there security risks in exposing a certificate?

If an attacker would have access to a certificate, could he build an attack out of that? or rephrasing it: How could an attacker profit from a device certificate, that he gets his hands on? For ...
1
vote
0answers
26 views

Certificate generation using Advanced Electronic Signature (AdES)

For a mobile application I would like to be so compliant as possible with the AdES standard. The mobile application will perform operations on behalf of the user, signing them first. A backend ...
0
votes
2answers
75 views

Can you make a device certificate expire after the root certificate?

I have created a CA root certificate and a device certificate to go on my device signed by the CA certificate. My question is as follows: Can you make the device certificate last for 30 years, and ...
3
votes
1answer
378 views

OCSP recording with JMeter

How can I record an application which is using OCSP security with the help of JMeter? I am not able to record the application i.e. a native app with the help of JMeter as it is using OCSP protocol ...
2
votes
2answers
66 views

Does Windows require the full certificate chain in order to trust a certificate?

I'm putting together a Root CA to sign multiple intermediate CAs which will then be used to sign VPN server and VPN user certificates. When I provide a user with their certificate, ideally I only ...
48
votes
2answers
39k views

Why would I choose SHA-256 over SHA-512 for a SSL/TLS certificate?

I'm looking to renew an SSL (okay, TLS) wildcard certificate with a well-known service. I need to provide a CSR, which I have created using a 2048-bit key. I also need to choose a signature hash. The ...
9
votes
3answers
3k views

What websites can be protected by a particular SSL certificate?

What websites (URLs) can be protected by one SSL certificate? For example, www.security.hsbc.co.uk has a SSL certificate. Can this certificate be used to protect other websites (URLs)? Something that ...
0
votes
1answer
69 views

Is using trusted CA to issue certificate for a VPN server insecure?

I’d like to have an AlgoVPN server that uses a trusted CA to issue a certificate for the VPN server. I am currently using an AlgoVPN server, which is completely setup via Ansible scripts and ...
81
votes
1answer
23k views

Is Starbucks spoofing me?

When I connected to Starbucks's Wi-Fi, I got a security alert from MS Outlook that looks like this: I looked up secure.datavalet.io, but there's no mention of this thing anywhere. This does not ...
0
votes
1answer
20 views

gpg importing public key

I'm trying to follow this: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Step_by_Step_Guide/s1-gnupg-import.html to import a key.asc using gpg --import key.asc, so that ...
1
vote
1answer
76 views

Does it serve any purpose to have a CRL with the next update scheduled for 25 years in the future?

What purpose does it serve to have a CRL with nextUpdate set to +25 years? A CRL issued by the root of an operating Certificate Authority Certificate Revocation List (CRL): Version 2 (0x1) ...
1
vote
0answers
15 views

High Availability Boot processes and only using code-signing certificates

High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as: "HAB authentication is based on public key cryptography using the RSA algorithm in ...
0
votes
0answers
19 views

How to get decrypted content from a pfx certificate

I am developing ERP software. One of the features that I am implementing is the issuance of invoices, which is something related to the federal revenue of my country. In the documentation says that ...
0
votes
1answer
56 views

Why is subject verification an effective means to detect MitM attacks in TLS? [duplicate]

Say, an attacker fakes an original server certificate by a trusted CA using a another certificate from the same CA in a Man-in-the-middle attack. Why can this be detected using subject verification on ...
1
vote
1answer
52 views

MitM to intercept SSL/TLS based on network traffic alone?

Say, an attacker wants to perform a MitM but all he has available is the network traffic between a client and a server. He has no further information about the data or certificates than what's being ...
0
votes
1answer
31 views

Need for additional verification in mutual TLS authentication with own CA

Say, the goal is to facilitate secure communication between two parties. The definition of secure is that both parties can be sure that they are actually talking to a trusted party, not somebody else ...
1
vote
1answer
80 views

.Net WebClient - self signed certificate

I have two applications (.net) on two web-servers. The first application will need to do a request (via WebClient) to the second and get results. I need to ensure Encryption, data integrity, and ...
1
vote
1answer
53 views

User Credentials Android. Who can read the web traffic?

Are User Credentials on Android such as "user key", "user certificate", and "CA certificate" only used to connect to a single specific network? In other words, will the network admins be able to see ...