Skip to main content

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
1288 votes
3 answers

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
Polynomial's user avatar
  • 135k
94 votes
4 answers

SSL Certificate framework 101: How does the browser verify the validity of a given server certificate?

(I have a basic understanding of public/private key, hashing, digital signatures... I have been searching online & stack forums last couple days but cannot seem to find a satisfactory answer.) ...
SecurityNoob's user avatar
  • 1,051
371 votes
6 answers

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
Son of the Wai-Pan's user avatar
217 votes
7 answers

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
jojo's user avatar
  • 2,281
90 votes
12 answers

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
makerofthings7's user avatar
38 votes
3 answers

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
Novice User's user avatar
  • 2,108
53 votes
2 answers

Digital Certificate deployment: using two certs for each user?

At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs: One for signing documents, emails, etc. that is ...
George's user avatar
  • 2,833
6 votes
2 answers

Could a stolen certificate show as trusted?

I have recently started learning about PKI and have the following question/s. As far as I know a signed certificate contains the domain name of the server that the certificate will be placed upon. ...
RJSmith92's user avatar
  • 311
301 votes
18 answers

Provide subjectAltName to openssl directly on the command line

Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line? I know it's possible via a openssl.cnf file, but that's not really elegant for batch-...
Michael Seiwald's user avatar
144 votes
14 answers

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
Luke Sheppard's user avatar
33 votes
6 answers

Missing X509 extensions with an openssl-generated certificate

My goal is to create a certificate with opensslsimilar to this one generated with cfssl Certificate: Data: Version: 3 (0x2) Serial Number: 60:44:dc:0d:80:f4:54:55:e8:...
user avatar
262 votes
7 answers

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
lynks's user avatar
  • 10.7k
97 votes
10 answers

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
sharptooth's user avatar
  • 2,241
87 votes
5 answers

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
Kyle Rosendo's user avatar
  • 4,025
69 votes
4 answers

How does the digital signature verification process work?

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
n92's user avatar
  • 881
48 votes
5 answers

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
IMB's user avatar
  • 2,968
30 votes
4 answers

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
makerofthings7's user avatar
9 votes
3 answers

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude lower&...
cnst's user avatar
  • 1,964
109 votes
8 answers

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
Stefany's user avatar
  • 1,287
62 votes
2 answers

Can I restrict a Certification Authority to signing certain domains only?

Is it possible to create a CA certificate (even unsigned), which is only allowed to sign certificates for specific limited domain(s), so that it can't be misused for other domains?
Smit Johnth's user avatar
  • 1,791
56 votes
2 answers

What are the risks of self signing a certificate for SSL

Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
Timo Willemsen's user avatar
42 votes
3 answers

What is an SSL certificate intended to prove, and how does it do it?

If I get an SSL certificate from a well-known provider, what does that prove about my site and how? Here's what I know: Assume Alice and Bob both have public and private keys If Alice encrypts ...
Nathan Long's user avatar
  • 2,734
31 votes
6 answers

What ciphers should I use in my web server after I configure my SSL certificate?

There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list. ...
makerofthings7's user avatar
19 votes
1 answer

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=* (Serial ...
Simon Fromme's user avatar
14 votes
5 answers

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
AnonSmith's user avatar
  • 141
7 votes
3 answers

Digital Signature and Verification?

AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it. So public key is used to decrypt ...
Royi Namir's user avatar
1 vote
1 answer

What could cause classic "ERR_CERT_DATE_INVALID" when I can confirm no error from numerous other clients?

The ERR_CERT_DATE_INVALID error, I'm sure we're all familiar with, is below Visiting the same site from numerous other locations, web clients, etc shows a valid certificate. It's issued by let's ...
TCooper's user avatar
  • 366
112 votes
10 answers

Should I change the private key when renewing a certificate?

My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
Commander Keen's user avatar
101 votes
4 answers

What is the difference between an X.509 "client certificate" and a normal SSL certificate?

I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
Brandon Yarbrough's user avatar
22 votes
3 answers

What are the risks of a Certificate Authority hack for 'the average user'?

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
beetstra's user avatar
  • 415
22 votes
2 answers

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
unor's user avatar
  • 1,779
18 votes
5 answers

Multiple CAs signing a single Cert/CSR?

Just saw this suggested on Slashdot So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea to ...
scuzzy-delta's user avatar
  • 9,343
16 votes
2 answers

Does SSL certification have anything to do with the website legitimacy?

Does SSL certification have anything to do with the website's legitimacy? Are those websites which has it are under some kinda monitoring? Generally speaking, can a company say they follow the law ...
omidh's user avatar
  • 279
8 votes
2 answers

Why is it fine for certificates above the end-entity certificate to be SHA-1 based?

I have heard about the phasing out of SHA-1 based certificates for end entity use, and the steps that are outlined for Google Chrome to display progressively more aggressive warnings for SHA-1 ...
Breakhty's user avatar
  • 367
5 votes
2 answers

Are there other roots of trust on my computer aside from these 46 root certificates?

I've heard many people imply that modern browsers and OSes trust a myriad of root certificates. The implication is that it is impossible to ensure the private keys of all of the root certificates ...
alx9r's user avatar
  • 569
48 votes
12 answers

Is anybody using client browser certificates?

Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
StasM's user avatar
  • 1,911
41 votes
5 answers

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
user53029's user avatar
  • 2,737
38 votes
3 answers

Why is 'avast! Web/Mail Shield Root' listed as CA for

I just noticed something weird in my browser: the certificate for has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
Pieter's user avatar
  • 1,329
33 votes
1 answer

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
Ben Jencks's user avatar
33 votes
4 answers

How does an end user differentiate between OV and DV certificates?

This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
Shurmajee's user avatar
  • 7,457
23 votes
3 answers

How to reset Windows trusted certificates store to its default [closed]

Over time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, other times for reasons of development and testing. Is ...
Jaime Hablutzel's user avatar
19 votes
2 answers

Encryption and the "security time decay" of prior encrypted data

This question is on the assumption that any data once encrypted, may (eventually) be decrypted through Brute force (compute power/time) Exploits in the cryptography used Theft of private keys Most ...
makerofthings7's user avatar
18 votes
5 answers

How to validate a client certificate

My understanding is that when using a client certificate for security one issues a private and public key cert (for example X509) of some sort and sends that of to the consumer of the service that one ...
Riri's user avatar
  • 425
15 votes
1 answer

Kaspersky Antivirus "secure connection scan" as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
mrclschstr's user avatar
15 votes
5 answers

Why is this certificate valid for so many domains?

If you look at the (invalid) certificate for it says only valid for the following names: The certificate is only valid for the following names and then a list of about 100 names. ...
jdoe's user avatar
  • 337
12 votes
3 answers

Use openssl to individually verify components of a certificate chain

This is related to another question, How to verify a signature of one entity by another using OpenSSL CLI? I used openssl s_client -showcerts -connect to collect three certificates ...
Fixee's user avatar
  • 1,575
10 votes
1 answer

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
makerofthings7's user avatar
8 votes
4 answers

How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)

I'd like to have my server APIs only accept requests from my own app, to prevent other "rogue" clients of my service. As i understand it, the way to do this would be with a "client certificate" that ...
Daniel Magliola's user avatar
159 votes
4 answers

What exactly does it mean when Chrome reports 'no certificate transparency information was supplied by the server?'

When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I receive a message 'no certificate transparency information was supplied by the server' (...
Andrew's user avatar
  • 1,806
90 votes
2 answers

What is the difference between serial number and thumbprint?

I have problems to understand what is the difference between the serial number of a certificate and its SHA1 hash. The MSDN says: Serial number A number that uniquely identifies the ...
reox's user avatar
  • 1,052

2 3 4 5