Skip to main content

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
2 votes
1 answer
4k views

Is there a tool that reports on PKI health (CRL dates, expiry, etc)?

I'm looking for a tool that will walk the AIA tree from a leaf node and check all corresponding CRL dates and times. Ideally it will also check versions and cross root trusts. Does such a tool exist?...
3 votes
1 answer
1k views

How to set up certificate architecture for on-premise server-client application

We are currently shipping a product to our customers that is server-client-based running on Windows server 2016 (server) and Windows 10 (clients). The server is installed on-premise in our customer's ...
0 votes
2 answers
776 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
0 votes
0 answers
24 views

Making a safe certifcates system for an actions API [duplicate]

I have been working on a certificate system for use (as a means of authentication) with my accounts system APIs. I am still thinking out the details, I have only watched a few videos on asymmetric ...
0 votes
0 answers
22 views

Types of certificate? [duplicate]

What types of certificates are there? I was checking online and I found several different types, some at the level of the format of the certificate (x509, PEM, DER), and one at the application level (...
0 votes
1 answer
57 views

How to verify hostname of certificate? and Is it mandatory if client knows the certificate?

I have a reported finding saying that hostname verification is disabled. This can be deduced from this line of code: final HttpClientBuilder httpClientBuilder = HttpClientBuilder.create(); ...
94 votes
4 answers
86k views

SSL Certificate framework 101: How does the browser verify the validity of a given server certificate?

(I have a basic understanding of public/private key, hashing, digital signatures... I have been searching online & stack forums last couple days but cannot seem to find a satisfactory answer.) ...
0 votes
0 answers
39 views

What is the security impact of disabling certificate check [duplicate]

I have this line of code in a client server project: sslContext.init(null, new TrustManager[]{new TrustAnyManager()}, null); A security guy pointed out that this is skipping the validation of the ...
3 votes
0 answers
110 views

Does a signature service provider level digital certificate for electronic signature comply with eIDAS requirement for Advanced Electronic Signatures?

I have some basic questions regarding eIDAS and 'Advanced Electronic Signatures'. Say, if I create a product under my company Acme Inc that offers a simple electronic signature where I sign every ...
4 votes
1 answer
1k views

Using NameConstrains in a CA certificate

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart. I have a CA certificate with Name Constrains (RFC): Permitted [1]Subtrees (0..0): ...
2 votes
1 answer
1k views

Is using both client side certificate and JWT for IoT device redundant?

Is there a case to be made for authorizing with both a client side certificate and JWT for an IoT device? Are JWTs good enough (assuming following of the specs)? And if client side certs are truly ...
0 votes
0 answers
82 views

AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment

Let's say we produce IoT devices and want them to access AWS IoT Core. The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
0 votes
2 answers
118 views

Automatically check if a certificate matches specific ciphers

My nginx backend server supports the following ciphers: ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:...
0 votes
0 answers
25 views

Given the wide trust of Domain Validated certificates by browsers, is there any reason to get higher validation for Internet/public-facing websites? [duplicate]

Let's Encrypt has made Domain Validated certificate ubiquitous and trusted by mainstream browsers. Against this backdrop, is there any reason for an Internet and general public-facing https website to ...
0 votes
1 answer
72 views

How can Amazon add its own headers when I make HTTPS requests to a web application?

I was playing with httpbin.org to test a client and discovered that some sites will get an header I did not set (X-Amzn-Trace-Id). If I do a curl https://httpbin.org/headers (which will respond with ...
2 votes
2 answers
1k views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
0 votes
1 answer
595 views

StrongSwan, IPsec remote certs and cert_policy

I'm looking for a way to limit the certs that my IPsec can accept. I'm using StrongSwan (swanctl version 5.7), I want to accept only certs coming from a remote with a name of yoji.*.example.com I ...
2 votes
1 answer
152 views

Openpubkey SSH workflow details

Currently looking into OpenPubKey and more specifically into OpenPubkey SSH: https://github.com/openpubkey/openpubkey https://docs.bastionzero.com/openpubkey-ssh Terminology: OPK => OpenPubkey ...
3 votes
2 answers
3k views

Getting Certificate KeyContainerName to initialize CspParameters

How can I get the name of a Key Container that's in a smart card required for initialization of CspParameters? CspParameters^ cspa = gcnew CspParameters(ProviderType, ProviderName, keyContainerName, ...
301 votes
18 answers
535k views

Provide subjectAltName to openssl directly on the command line

Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line? I know it's possible via a openssl.cnf file, but that's not really elegant for batch-...
2 votes
2 answers
389 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
2 votes
1 answer
388 views

Confirming the validity/ownership of a Android Signing Certificate

I have a certificate that says the application was signed by Google, but on multiple searches I have reason to believe that it's not actually a google signing certificate. Is there a way to query ...
0 votes
2 answers
149 views

What is the impact of disabled TLS hostname verification?

If I have a java client that connects to a server, but in the java client code where the connection is built, it skips hostname verification disabled. When a client tries to connect to serverA.com, ...
0 votes
2 answers
603 views

How can we verify an installer's validity by checking its signature?

I'm working on some software that can be self-hosted, and it includes a component that can be downloaded and installed on end user machines (Windows only). The download comes from the self-hosted ...
0 votes
2 answers
652 views

Does distributing an SSL certificate and private key pose a security risk?

I found some applications bundle an SSL certificate and associated private key signed by a public CA for a domain name pointing to 127.0.0.1, probably to bypass the certificate/mixed content warning ...
1 vote
1 answer
137 views

Comparing ACME client logs against Certificate Transparency logs

Inspired by this comment from Can DDNS provider perform a MITM attack?, I was wondering if there is an automated way to check the Certificate Transparency logs for malicious/unexpected certificates. ...
0 votes
1 answer
220 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
5 votes
1 answer
9k views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
2 votes
2 answers
421 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
1 vote
1 answer
362 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
5 votes
1 answer
5k views

Intermediate certificate not allowed to issue certificates?

I'm making a certificate chain: ..|root .....|intermediate ........|server When my certificates are installed, the intermediate certificate has an error: This certification authority is not ...
0 votes
0 answers
67 views

Checking Against the CN Of Every Certificate In The Certificate Chain

Is it possible to check against the CN (Common Name) or SAN (Subject Alternative Names) of each and every certificate in the certificate chain for a match ? I have 2 docker containers hosted on my VM, ...
0 votes
1 answer
655 views

OpenSSL: how to get matching subject_hash from a CMS SignerInfo?

So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate: https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash) now, if I ...
11 votes
1 answer
547 views

SolarWinds Orion SAML compromise mass cert update

SolarWinds Orion customers have suffered some network compromises according to news reports. One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
33 votes
1 answer
37k views

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
1 vote
1 answer
1k views

“Keyset does not exist” when using SignData function with RSA

"Keyset does not exist". I know that there are tons of question about this error, but mine is totally different. I'm not gona use the key from windows certificate store, but load the public key & ...
3 votes
2 answers
297 views

A solution for the absence of Certifying Subkeys in OpenPGP Certs

As discussed in this answer, gpg does not offer the capacity for subkeys to certify (eg. "sign") other keys, though there may be good reason why it should, and they do sign at least one key. ...
0 votes
0 answers
64 views

Connecting Logstash To Elasticsearch via SSL (Docker Container)

My environment consists of 2 docker containers, one running Logstash and another running Elasticsearch on the SAME host & SAME docker network. I am trying to setup SSL between the 2 of them (this ...
1 vote
2 answers
250 views

If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?

I have some questions about certificate pinning. Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
1 vote
0 answers
70 views

Is it common practice that vendors put own root certificates on customer devices? [closed]

At work, we are deploying a new VoIP solution, and as part of that, we are supposed to install a custom root certificate on our computers and mobile devices. The manufacturer of that VoIP solution ...
0 votes
1 answer
436 views

offline root CA workflow

I have reviewed several discussions here regarding offline root CA management. While useful, none quite capture my question. Firstly it presumably would not be generally assessed as an 'offline' root ...
2 votes
2 answers
9k views

Google Chrome and Certificate Problem

When I try to connect google.com and youtube.com with Chrome, I got the error below; 1. 2. Your connection is not private Attackers might be trying to steal your information from www.google.com.tr ...
0 votes
0 answers
54 views

Will this certificate Pinning plan work as expected?

I have a mobile app deployed to millions of user in both Android and iOS. My Security dpto rotates our certs once a year. Our certs are issued by GlobalSign. I would like to pin the certificate ...
1 vote
0 answers
75 views

Certify using Yubikey

I just started using a Yubikey 5. I've set up GPG according to this excellent guide, and now I have 3 working ECC key pairs on my Yubikey: Sign/S :: ed25519, Encrypt/E :: cv25519, Authentication/A :: ...
1 vote
0 answers
60 views

Other benefits of creating my certificate authority aside from the firefox issue and centralized management of certificates?

I've been trying to read more about self-signed SSL certificates versus creating my own certificate authority to sign SSL certificates. I am still not completely clear on this. I'll start by ...
0 votes
1 answer
85 views

Does EAP TLS benefit from “Verify the server’s identity by validating the certificate” setting

For PEAP it's important to enable the "Verify the server’s identity by validating the certificate" setting in a Windows WiFi profile. Is there any benefit enabling this for EAP TLS? If I ...
0 votes
1 answer
167 views

Evading authenticated diffie hellman with MITM

I understand that in a non-authenticated Diffie-Hellman setup, a man-in-the-middle attack can occur. Now i'm curious about the feasibility of the following scenario: Let's assume a situation where www....
3 votes
1 answer
2k views

How does the SSL/TLS protocol determine if a certificate is expired or not?

I already tried googling but no luck. All search results always tell you how to check cert expiration manually, but that is not my question. Yes I can use OpenSSL for example, but what I am asking is ...
0 votes
2 answers
188 views

DomainFronting - re-routing and SSL certificats

I'm looking for a specific answer regarding the TLS handshake in a scenario of domain-fronting. Following hensonsecurity and zscaler blogs I have noticed that a detailed description regarding the re-...
0 votes
2 answers
282 views

Will Users of Intermediate CA1 trust Users of intermediate CA2?

I have my own CA(CA) and 2 intermediate(ICA1 & ICA2) CA's(generated using the root CA). Using ICA1, generated a server cert(for server S1) and 2 user cert(for user U1 & U2). Now, user certs is ...

1
2 3 4 5
58