Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
2
votes
1answer
93 views

How to authenticate an Add-In on interprocess communication?

We are considering to build a Windows application that is split in 2 parts: one Windows service some Add-Ins for Microsoft Office, Microsoft Management Console (MMC) and PowerShell. Additional info: ...
1
vote
1answer
46 views

A solution for the absence of Certifying Subkeys in OpenPGP Certs

As discussed in this answer, gpg does not offer the capacity for subkeys to certify (eg. "sign") other keys, though there may be good reason why it should, and they do sign at least one key. ...
3
votes
2answers
119 views

Why would a certificate authority have multiple root certificates?

When I look at the trusted certificates in my browser, I see that many certificate authorities have multiple root certificates associated with them. For example, org-Amazon has Amazon Root CA 1, ...
0
votes
2answers
262 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
0
votes
2answers
68 views

Can SSL certificate (domain verification) process be eliminated?

Noob question alert. I understand SSL certificates help mitigate MITM attacks, but I see the process to be so badly designed. Basically the client needs to verify that it is talking to the particular ...
1
vote
1answer
47 views

What is LS0… encoding of a PKI certificate?

I am looking through a set of PKI certificates and key strings that are specified in a kubernetes yaml file. They are used for testing. Some of the strings are keyed (as in yaml key-value) as crt.pem. ...
1
vote
1answer
30 views

How to protect certificates and keys in peer to peer application

I'm making a peer-to-peer cross-platform application (in Java & Kotlin), and I want to encrypt conversations between tens of users, concurrently. However, due to lack of knowledge in security good ...
0
votes
0answers
24 views

Trust the same intermediate CA in client/server programmatically with C language [duplicate]

I would like service A (Client) to communicate with service B (server) without the need to send the whole chain of trust in the code ( CA racine and CA1 intermediate).I want to verify just with CA1 ...
0
votes
2answers
70 views

How can we verify an installer's validity by checking its signature?

I'm working on some software that can be self-hosted, and it includes a component that can be downloaded and installed on end user machines (Windows only). The download comes from the self-hosted ...
0
votes
1answer
93 views

X.509 - How Is Certificate Chain of Trust “Subject Name”-“Issuer Name” Match Comparison Made?

I keep reading that in an X.509 certificate chain of trust that the "Issuer Name" in a certificate that has been signed by the Issuer must "match" the "Subject Name" of ...
6
votes
1answer
811 views

Where to put a code signing server with EV code signing certificate and plugged-in HSM

Microsoft recently started enforcing apps to be signed by EV code-signing certificates instead of just regular certificates. These usually come on an external device such as USB smart card or a HSM, ...
17
votes
2answers
3k views

Do browsers know domains that are supposed to be encrypted?

Do browsers have a list with sites that are supposed to be encrypted? Could a man in the middle attack be performed by presenting a user a http site instead of an https site? That way the server would ...
1
vote
1answer
37 views

Expiration of superadmin.p12 certificate

I have a super admin certificate which is expired two days ago.When I try to click on Administration tab in my EJBCA instance to renew this certificate ,I am getting error like certificate has expired....
0
votes
1answer
44 views

Will Users of Intermediate CA1 trust Users of intermediate CA2?

I have my own CA(CA) and 2 intermediate(ICA1 & ICA2) CA's(generated using the root CA). Using ICA1, generated a server cert(for server S1) and 2 user cert(for user U1 & U2). Now, user certs is ...
0
votes
2answers
137 views

certificate used in SSL and keys used in SSH

To do SSH to any server we should create private key pair through which we encrypt the connection. Now in SSH we are just doing encryption and here we don't need to verify the server, that's why we ...
1
vote
1answer
64 views

Can a client application volunteer to send a certificate?

When testing our c# application with a service from a new supplier our request was denied because the client certificate was not send. Network traffic with a service where our application is known to ...
0
votes
0answers
40 views

What is the difference between the certificate containers in Windows?

I’ve always wondered. When you import a PKI certificate on a Windows system, you have several choices of where to store it: Personal Trusted Root Certification Authorities Enterprise Trust ...
5
votes
3answers
1k views

Signtool validation fails when signing and validating are done in different machines

I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
8
votes
2answers
4k views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
0
votes
0answers
31 views

Different Subdomains and Certificates are given from the Same Site Button when I Use Different Internet Providers

I use shenghuo.ali... site for my transaction using my home WiFi internet connection. The Shenghuo Ali site's Confirm Button worked fine last week, it redirected me to Payment Page which is expected. ...
0
votes
1answer
98 views

Access protected (from export) private key in windows certificate store

I have created a CSR with the option to disallow the export of the private key. Can I still access it? If not, how is it protected?
3
votes
1answer
597 views

Which type of smart card supports certificates?

For an IT security demonstration I want to set up a small demo PKI including smart card authentication based on certificates generated by a Certificate Authority, using a class 3 pin pad reader. For ...
0
votes
1answer
33 views

Can PKCS#12 files contain multiple certificate chains?

I know that PKCS#12 files can contain multiple certificates and private keys. However, I could not find any resource where any limit was mentioned for the number of certificate chains or private keys ...
-1
votes
1answer
55 views

CDN end to end encryption?

I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did. Now I'm able to ...
0
votes
1answer
113 views

Will there be a grace period for the CA change to mandatory 1 year?

As I can see some sites were working yesterday and today they are not working so my guess is browsers have a grace period set in them. certificate lifespans limited to 1 year in browsers. Maybe this ...
1
vote
0answers
73 views

Regularly receiving suspicious certificate errors online

For the past few weeks, I have frequently been receiving error messages from websites stating that the certificate is invalid. This tends to happen for a while and then resolve itself. Other devices ...
3
votes
3answers
3k views

Encrypt a message or sign it with a X509 certificat

i have two similar questions about using certificates. I was reading about a Certificate Authority in a system and i've found that the CA uses PKI adhering to the X509 standard for public key ...
32
votes
4answers
15k views

How does an end user differentiate between OV and DV certificates?

This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
2
votes
0answers
107 views

Why don't CAs advertize public keys of verified entities on a central location instead of giving out signed certificates?

If CAs (Certification Authorities) start advertizing public keys of verified websites via some API, browsers can simply query them for each domain instead of asking websites to give them certificates ...
5
votes
3answers
904 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
2
votes
1answer
86 views

How do clients extract the public key from a self-signed certificate?

I have gone over: Why do we need to sign the self-signed certificate? Basic self-signed certificate questions Is a self-signed SSL certificate much better than nothing? I am new to cryptography and ...
0
votes
0answers
5 views

A lot of my windows drivers have expired dates for the certificate, and some are not even signed, is this normal? [migrated]

I just gathered all the drivers in my system32/drivers folder and checked their certificate (my windows is updated and its a windows 10 x64) But i found that so many of them have expired certificate! ...
0
votes
1answer
75 views

Windows Certificates - where is private key located?

In Windows 10: When I load a certficate into the "Current User" store, it puts a private key file here: C:\Users\[userID-A]\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-xxx\...
19
votes
3answers
2k views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
5
votes
2answers
2k views

Smart Card for RSA private key for SSL?

I have a YubiKey NEO which has a lot of amazing capabilities such as OTP, U2F, and PGP smart card for PGP/GPG and even SSH keys. One of the applications I've discovered recently for the device is a ...
1
vote
1answer
60 views

Help understanding CSR fields

I've made a CSR (Certificate Signing Request) in order to better understand how a PKI could be made and how it works. Using the following commands openssl req -new -newkey rsa:1024 -nodes -out ca.csr ...
182
votes
15answers
244k views

Provide subjectAltName to openssl directly on the command line

Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line? I know it's possible via a openssl.cnf file, but that's not really elegant for batch-...
1
vote
1answer
1k views

Why is CertificateVerify message necessary? (Why isn't client authentication done through the KeyExchange)

Why is client authentication not done through the KeyExchange like with the server, but through a CertificateVerify message? When using RSA key exchange the client encrypts the key material with the ...
3
votes
2answers
227 views

Does the CA create the public key or is it created by the requesting server and sent to the CA?

This link says that the requesting server creates the public-private key pair and sends the public key to the CA inside the CSR. However, DigiCert says: The CSR is submitted to a Certificate ...
1
vote
1answer
618 views

“Keyset does not exist” when using SignData function with RSA

"Keyset does not exist". I know that there are tons of question about this error, but mine is totally different. I'm not gona use the key from windows certificate store, but load the public key & ...
2
votes
0answers
43 views

Public key stored in server is different from what is shown in OpenSSL

I obtained an SSL certificate from LetsEncrypt for my web application using Apache web server. LetsEncrypt generated these 4 files: cert.pem chain.pem fullchain.pem privkey.pem As I understand, ...
0
votes
1answer
72 views

why CA use private key to sign a digital certificate? What is the logic behind sign a digital certificate with CA private key?

In general(PKI), encryption happens with public key and decryption happens with private key. But, how Certificate Authority sign a digital certificate with private key? How this can be validated using ...
0
votes
2answers
66 views

How is the digital certificate sent alongside digital signatures?

Most tutorials on the net only mention sending the digital signature attached to the document, but without the digital signature certificate, it'll be impossible for receivers to verify the signature. ...
1
vote
1answer
47 views

How do you verify the key given by remmina (libfreerdp2)

This morning I took an update to remmina and started getting a "fingerprint changed" warning. When using xfreerdp (from freerdp-x11) I get they old key. The old key being 20 bytes and the new key ...
0
votes
2answers
51 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
2
votes
1answer
51 views

Why is my RADIUS Certificate not automatically signed with the root CA Certificate on my iPhone

I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method. I have used this old tutorial for setting up my own CA and generating the certificates and ...
113
votes
7answers
77k views

Let's Encrypt for intranet websites?

Many companies have intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate, which causes a bad habit for the users since they get used to just ...
4
votes
1answer
83 views

Smooth root certificate rotation

I am surprised that I couldn't find one concrete example of how to do root certificate rotation. For example: Root CA has 2 years validity period Intermediate CA has 9 months validity period leaf ...
-1
votes
2answers
103 views

Is possible to do bypass to VPN with Certificate?

I would like to know if there is a way to make a false certificate to bypass a Palo Alto VPN (specifically Global-Protect). The clients only connect by certificate and I don't know if some hacker can ...
2
votes
1answer
67 views

Restrict CA to issue certficates for one domain or to be able to sign just one server certificate

I have a server and I want my iPhone to connect to it securely. However, I cannot just install the self-signed server certificate on my iPhone. When I install the profile (that's what they call the ...

1
2 3 4 5
50