Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

docker-compose gives SSL verification [migrated]

TLS based docker daemon is running on EC2 host. docker client local to the docker daemon works fine, but docker-compose gives below error: $ export DOCKER_HOST=tcp://172.31.3.2:2376 ...
-2
votes
0answers
36 views

How can a signed ssl certificate not have access to the thumbprint? [on hold]

I recently read an email requiring that a signed ssl certificate have access to the thumbprint, so what causes it to not have access to the thumbprint?
0
votes
1answer
51 views

How can I authenticate the certifcate of a Private CA while I'm not on that network i.e. offline

I want my application to verify that it is being run on a computer with a certificate issued by my Private CA. How can I do this when the computer is not on the network?
-1
votes
2answers
45 views

technical difference between TLS and a certificate [duplicate]

I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
2
votes
3answers
141 views

Sharing an expired certificate?

Today one of our certificates expired and I needed to order a new one. When collecting all the data needed to create a new one, I got the idea that all needed information is already contained in the ...
2
votes
1answer
53 views

How to copy Subject Alternative Names in csr while signing a cert?

I already know how to add Subject Alternative Names (SANs) to a Certificate Signing Request and I know it's possible to manually add once again to a certificate which is similar to add SAN to csr ...
1
vote
2answers
60 views

ECDHE_RSA_WITH_AES_128_GCM_SHA256 - How to determine ECDHE Key Length?

Server: SSL Certificate, 2048-bit RSA Public Key, Signature Algorithm is sha256RSA What am I missing here? ! I've scoured the RFC's, and I have yet to find anything on how to determine the ECDHE key ...
0
votes
1answer
30 views

Accept a https connection with invalid certificate and validate the certificate before. Is it possible?

I will integrate with a new application on the next weeks. But something that was told to me by the partner team was very strange. The partner ask us to pass one .CSR file with our company ...
3
votes
1answer
57 views

what is the usage of extendedkeyusage in a CA certificate?

we have a CA certificate template to verify, which contains an extendedkeyusage extension with the following values "clientAuthentication" "emailProtection" and "id-kp-OCSPSigning" Is this a ...
-1
votes
0answers
15 views

DOD PKI CA access outside of of those specific certs? [duplicate]

I work for the government and mostly everyone installs the DOD PKI Certs on their private computers to be able to check email, admin stuff, etc. I’m getting into networking, security, white hat ...
1
vote
1answer
66 views

Access client certificate stored on another computer

We are developing an application, that is using client certificate needed for client authentication (HTTPS connection) when using a specific web service. When a customer company has hundreds of ...
0
votes
1answer
68 views

Where precisely are client X509 certificates stored?

Apologies for what might seem like a naive question, but there is a detail to PKI architecture between clients and servers, the answer to which I have so far not been able to come across no matter ...
0
votes
0answers
29 views

How do I get a Linux box to use RADIUS authentication with a certificate? [migrated]

Googling anything involving RADIUS configuration has been hell, as many of the terms get mixed together, making search results useless, so... I have a RADIUS server offering EAP-TTLS based ...
1
vote
1answer
63 views

How does client authentication work when using a TLS Proxy?

We're using a load balancer, which implements TLS interception for a server, which in turn uses TLS Client authentication. Since TLS interception implies that the client will make the connection to ...
1
vote
1answer
47 views

TLS key exchange and certificate subject public key clarification

This question is similar to this one, so let me elaborate what I'm struggling with. I want to get the length/strength of the key used by the server during the key exchange and authentication, i.e. ...
0
votes
2answers
100 views

I work with a company and another developer posted this and wanted us all to run it. i'm noob with things like this [closed]

I don't really trust the guy and i'm trying to take my time to learn everything about it, but what do you guys think? generate_ssl.sh #!/bin/bash name=ourwebdomain.local openssl req \ -new \ -...
0
votes
1answer
47 views

Why does the CSR state/province name need to be the same as the CA certificate?

This is more a conceptual question than it is about a bug/error I'm encountering. I am learning about PKI (public key infrastructure), and attempting to sign my own certifications by walking through ...
0
votes
1answer
33 views

Openssl not showing complete certificate chain

Tried following openssl command to show the certificate chain,but the ROOT certificate 'depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign' is not shown in the output...Why? ...
0
votes
0answers
54 views

OpenSsl and self-signed certificates - verifying a chain [migrated]

I have a chain.pem -----BEGIN CERTIFICATE----- // My server cert signed by intemediate CA -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- // My intermediate cert signed by root CA -----END ...
0
votes
1answer
72 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
0
votes
2answers
80 views

Can MitM spoof a signed certificate by imitating the Certificate Authority?

I understand that a signed certificate is a server public key signed by the private key of a certificate authority. As a result, a client allegedly rest assured that the signed public key is for the ...
0
votes
0answers
24 views

Seeking a reliable way of creating trusted certificate files for OCSP

In my deployments I use OCSP must-staple flags on certificates, and ensure that my server is set to do verification and OCSP stapling. That's all good, but I'm forever having problems creating the ...
0
votes
0answers
20 views

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication? [duplicate]

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication?
0
votes
0answers
25 views

Verifying Public Key Using The Digital Signature on Mac

I have just started with encryption and stuff, so please bear with me. Just playing around. I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
0
votes
1answer
67 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
10
votes
2answers
1k views

Trying to understand how Digital Certificates and CA are indeed secure

I understand that Digital Certificates and Certificate Authorities (trusted 3rd parties) help prevent man in the middle attacks during HTTPS connections. However, I am confused on a few details. Let'...
1
vote
1answer
145 views

Is it safe to use personal wiki over http?

I hosting my site on infinityfree.net for free and dokuwiki is installed there. Couple of my colleagues, including me, are going to use wiki for writing documentation for our project. Wiki is private,...
2
votes
1answer
117 views

Encrypting a blob with a password

Is there anything to say against to have an amount of public keys, which encrypt a common password for a blob encrypted? So Users 1,2,3 have all certificates for themselves and can use them to get ...
19
votes
3answers
4k views

Are certificates without DNS fundamentally flawed?

I am new to security work and I am implementing someone else's design. The design calls for a TCP server with TLS in an environment where there is no DNS - only IPs. I am working with a typical ...
0
votes
1answer
51 views

SSL certificate distribution of API

We have an API which has SSL certificate signed from authorized CA. The access to the API is limited. API is accessed from webapp and only from those client who have valid public key for SSL. Now, how ...
2
votes
4answers
98 views

How to secure VPN credentials on end-user devices?

I have a VPN and PKI in place with MFA. My question is: What's the best method/solution for protecting the integrity and identity of end-user certs? I want to make sure that users only able to use VPN ...
0
votes
3answers
99 views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
2
votes
1answer
55 views

Wildcard certificate generated for local CA do not work for the subdomains

I have created Makefile to simplify generation certificates for local development: DOMAIN ?= localhost NAME ?= ${DOMAIN} CAKEY ?= CAkey.key CACERT ?= CAcert.pem SIGN_REQ ?= ${NAME}.csr ...
1
vote
2answers
160 views

Is the installed certificate used for school wifi able to track me at home?

I've read similar questions being answered on the safety and privacy of school wifi certificates but my question on whether they can still track me at home stands. I'm using my own computer (not ...
2
votes
1answer
139 views

Is it dangerous to add a custom cert authority to a browser?

For example if my friend develops a webapp with a custom cert and I add them as CA to my browser, can they do any damage? I mean for example somehow faking certs and stealing my banking password, etc.?...
1
vote
2answers
83 views

Can I get an SSL certificate even if external DNS does not resolve

I have an intranet website that requires an SSL Certificate. From what I've seen it seems like this is difficult to accomplish or cumbersome. Would I be able to buy an SSL certificate if there is an ...
72
votes
1answer
15k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
0
votes
2answers
154 views

Why does localbattle.net point to localhost?

I found a random link on a forum linking to localbattle.net, at the same time I was running a local server on localhost. When I went to localbattle.net, my local server page appeared! The certificate ...
1
vote
0answers
49 views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
0
votes
0answers
26 views

How can TLS/HTTPS remain secure if the entire transmission is monitored? [duplicate]

Okay, so I'm pretty sure this question comes from a fundamental misunderstanding of how HTTPS works, but here goes: Say that someone has hooked into the "internet line" coming from your home so that ...
0
votes
0answers
33 views

Automating certificate management across a large number of printers?

Is there a way to manage certificates on a large group of printers that will install and renew them? It doesn't look like any of the fleet management programs will do this. How are these managed in an ...
20
votes
7answers
5k views

Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?

Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
0
votes
1answer
81 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
1
vote
1answer
156 views

Is Certified | Ethical Hacker (C|EH) a scam or legitimate? [closed]

I've been doing a lot of research on Certified | Ethical Hacker (C|EH) to see if it's a credible certification. But I've stumbled across a Wikipedia article on it and discovered that the sources are ...
6
votes
2answers
545 views

Did google chrome kill public key pinning?

I've read many articles talking about google chrome killing public key pinning in Chrome 67 (May 2018). See here, here, and here. However, I haven't found any information about whether or not they ...
2
votes
1answer
161 views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
1
vote
1answer
41 views

Is a SSL client required to try multiple certificate chains?

Yesteday, 10 July 2019 I failed to access dict.tu-chemnitz.de with Epiphany (WebKit2, which is using GNUTLS) and mailed the administrator which fixed it quickly. Here is the access via GNUTLS: $ ...
0
votes
1answer
76 views

Cross sign two self signed root CA

I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster. However, one of the ...
0
votes
0answers
21 views

Certificate Pinning with SockJS

What is the SockJS way of pinning SSL Certificates in the client side when contacting wss:// to avoid CA trust? FYI, when using modules like HTTPS or WS, we can listen to the socket event and then on ...
2
votes
1answer
96 views

Does SSL inspection break applications utilizing certificate pinning?

A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...