Skip to main content

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

Making a safe certifcates system for an actions API [duplicate]

I have been working on a certificate system for use (as a means of authentication) with my accounts system APIs. I am still thinking out the details, I have only watched a few videos on asymmetric ...
0xENDER's user avatar
0 votes
0 answers
22 views

Types of certificate? [duplicate]

What types of certificates are there? I was checking online and I found several different types, some at the level of the format of the certificate (x509, PEM, DER), and one at the application level (...
anonymous's user avatar
0 votes
1 answer
57 views

How to verify hostname of certificate? and Is it mandatory if client knows the certificate?

I have a reported finding saying that hostname verification is disabled. This can be deduced from this line of code: final HttpClientBuilder httpClientBuilder = HttpClientBuilder.create(); ...
anonymous's user avatar
0 votes
0 answers
39 views

What is the security impact of disabling certificate check [duplicate]

I have this line of code in a client server project: sslContext.init(null, new TrustManager[]{new TrustAnyManager()}, null); A security guy pointed out that this is skipping the validation of the ...
anonymous's user avatar
0 votes
0 answers
25 views

Given the wide trust of Domain Validated certificates by browsers, is there any reason to get higher validation for Internet/public-facing websites? [duplicate]

Let's Encrypt has made Domain Validated certificate ubiquitous and trusted by mainstream browsers. Against this backdrop, is there any reason for an Internet and general public-facing https website to ...
xuhdev's user avatar
  • 101
0 votes
1 answer
72 views

How can Amazon add its own headers when I make HTTPS requests to a web application?

I was playing with httpbin.org to test a client and discovered that some sites will get an header I did not set (X-Amzn-Trace-Id). If I do a curl https://httpbin.org/headers (which will respond with ...
simondvt's user avatar
  • 101
0 votes
0 answers
82 views

AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment

Let's say we produce IoT devices and want them to access AWS IoT Core. The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
Francesco B.'s user avatar
2 votes
1 answer
152 views

Openpubkey SSH workflow details

Currently looking into OpenPubKey and more specifically into OpenPubkey SSH: https://github.com/openpubkey/openpubkey https://docs.bastionzero.com/openpubkey-ssh Terminology: OPK => OpenPubkey ...
ieggel's user avatar
  • 225
0 votes
2 answers
149 views

What is the impact of disabled TLS hostname verification?

If I have a java client that connects to a server, but in the java client code where the connection is built, it skips hostname verification disabled. When a client tries to connect to serverA.com, ...
anonymous's user avatar
0 votes
0 answers
67 views

Checking Against the CN Of Every Certificate In The Certificate Chain

Is it possible to check against the CN (Common Name) or SAN (Subject Alternative Names) of each and every certificate in the certificate chain for a match ? I have 2 docker containers hosted on my VM, ...
Dhiwakar Ravikumar's user avatar
0 votes
2 answers
118 views

Automatically check if a certificate matches specific ciphers

My nginx backend server supports the following ciphers: ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:...
Shahar G's user avatar
0 votes
0 answers
64 views

Connecting Logstash To Elasticsearch via SSL (Docker Container)

My environment consists of 2 docker containers, one running Logstash and another running Elasticsearch on the SAME host & SAME docker network. I am trying to setup SSL between the 2 of them (this ...
Dhiwakar Ravikumar's user avatar
1 vote
0 answers
70 views

Is it common practice that vendors put own root certificates on customer devices? [closed]

At work, we are deploying a new VoIP solution, and as part of that, we are supposed to install a custom root certificate on our computers and mobile devices. The manufacturer of that VoIP solution ...
Torsten Bronger's user avatar
0 votes
0 answers
54 views

Will this certificate Pinning plan work as expected?

I have a mobile app deployed to millions of user in both Android and iOS. My Security dpto rotates our certs once a year. Our certs are issued by GlobalSign. I would like to pin the certificate ...
Leonardo's user avatar
  • 119
1 vote
0 answers
75 views

Certify using Yubikey

I just started using a Yubikey 5. I've set up GPG according to this excellent guide, and now I have 3 working ECC key pairs on my Yubikey: Sign/S :: ed25519, Encrypt/E :: cv25519, Authentication/A :: ...
telephone's user avatar
  • 111
1 vote
0 answers
60 views

Other benefits of creating my certificate authority aside from the firefox issue and centralized management of certificates?

I've been trying to read more about self-signed SSL certificates versus creating my own certificate authority to sign SSL certificates. I am still not completely clear on this. I'll start by ...
learningtech's user avatar
0 votes
1 answer
85 views

Does EAP TLS benefit from “Verify the server’s identity by validating the certificate” setting

For PEAP it's important to enable the "Verify the server’s identity by validating the certificate" setting in a Windows WiFi profile. Is there any benefit enabling this for EAP TLS? If I ...
JPX's user avatar
  • 101
3 votes
1 answer
2k views

How does the SSL/TLS protocol determine if a certificate is expired or not?

I already tried googling but no luck. All search results always tell you how to check cert expiration manually, but that is not my question. Yes I can use OpenSSL for example, but what I am asking is ...
Noob_Guy's user avatar
  • 139
0 votes
1 answer
156 views

Why openssl verify does not work for the certificate chain of a correctly configured site?

I download its certificates. To do that, I used the openssl debug output of the command openssl s_client -connect security.stackexchange.com:443 -servername security.stackexchange.com -showcerts -...
peterh's user avatar
  • 3,023
0 votes
1 answer
94 views

What file extensions are specific to qualified and advanced seals?

A definition of qualified and advanced seals can be found on this page https://europa.eu/europass/en/how-issue-european-digital-credentials at the section "Advanced or Qualified eSeal" A ...
the common starling's user avatar
0 votes
0 answers
68 views

Help identify the tool generating certificate displays on the EU eIDAS Dashboard

The EU eIDAS Dashboard serves as a repository for trusted "trust providers" in accordance with the eIDAS regulation. The provider's certificates are listed within the dashboard. You can find ...
ARF's user avatar
  • 101
1 vote
0 answers
223 views

SSL Certificates signed by our CA show as invalid in browser

We're experiencing an issue, where SSL server-certificates issued by our own internal PKI will show as invalid in the browser, when accessing the site. The error is NET::ERR_CERT_INVALID (Tested in ...
AssistantTOtheCA's user avatar
2 votes
0 answers
54 views

Requesting an user-specific certificate in a tiered domain

Environment: A multi-tiered Active Directory (AD) where tier-specific admin accounts are restricted to log on to only their tier servers. Microsoft's Certificate Services (CS). Let's say the CA tier ...
Ramil's user avatar
  • 21
1 vote
0 answers
73 views

Support for domain-specific root CAs in X.509 certificate format, OS and browsers

Chance is one gets an invalid certificate warning when one follows this link https://www.cnss.gov. As explained there (same warning) this is on purpose, and the solution is supposed to be to install1 ...
fgrieu's user avatar
  • 1,231
2 votes
1 answer
109 views

How to feasibly digital sign high volume documents with CA issued digital certificate?

My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
BambiBundle's user avatar
0 votes
2 answers
195 views

Is there a tool for auditing my root certificates?

Is there any tool out there that will monitor my system's use of root CAs? So far I have not found anything, and so I am hoping that this community will know if such a tool exists. For background, I ...
Cogitative's user avatar
-1 votes
2 answers
216 views

What happens to the key pair once the CSR has been enrolled?

I have a key pair which I used to generate a CSR. Once I enrolled that CSR PKCS10, I get from the PKI (or CA) a certificate signed with the PKI private key. From here, I would like to know if my ...
MoBe's user avatar
  • 21
1 vote
0 answers
72 views

Is it fine if I share a .pfx self signed certificate generated inside my machine with other users to test and use PnPCore SDK

We want to develop some Azure functions which use PnPCore SDK. For testing purposes, I registered an Azure app which uses self-signed certificate for authentication. Now I configured the Azure app ...
microsoftdeveloperdesigner's user avatar
0 votes
1 answer
125 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145
0 votes
0 answers
158 views

openssl: Not able to verify 3rd in the chain with self-signed certificate [duplicate]

(Disclaimer: Checked all the openssl related topics, no success). OpenSSL version: OpenSSL 1.1.1s 1 Nov 2022 I'm trying to generate the chain of certificates, root -> intermediate -> user1,...
unalignedmemoryaccess's user avatar
0 votes
0 answers
84 views

Godaddy automatic renewals (Powershell & alternatives)

how are you? My orgazation is transitioning to using GoDaddy certificates, and I'm exploring if there's an established automated process to download and apply renewed certificates from GoDaddy to our ...
JustToKnow's user avatar
1 vote
0 answers
156 views

Do code signing certificates build reputation only for Microsoft, and is reputation maintained across releases?

I have a Windows executable file that has been code signed with a certificate from a Certificate Authority. The CA is listed in the official Microsoft Trusted Root Program list of participants. The ...
Ron's user avatar
  • 111
1 vote
2 answers
162 views

Is it possible to get an SSL certificate with a Subject Alternate Name of a different website?

If this is possible, what is stopping a malicious file from adding an entry to \etc\hosts that points example.com to a phishing clone of a website? Usually, the browser warns you that the common name ...
Sam Wilson's user avatar
0 votes
1 answer
277 views

Is it possible to extend the validity of a pem certificate

Please help me understand and solve this problem. Assumptions Let's start with an IoT design. When it is working correctly, a remote device has a pem certificate which is used to validate traffic to ...
monkey's user avatar
  • 103
0 votes
1 answer
507 views

How can one use HTTPS without a domain name, or on a local network?

I was looking at the LXI Device Specification 2022 Version 1.6. For those not familiar with LXI, it is a standard for lab instruments like oscilloscopes, function generators, LCR meters and many more ...
Jack B's user avatar
  • 103
3 votes
0 answers
110 views

Does a signature service provider level digital certificate for electronic signature comply with eIDAS requirement for Advanced Electronic Signatures?

I have some basic questions regarding eIDAS and 'Advanced Electronic Signatures'. Say, if I create a product under my company Acme Inc that offers a simple electronic signature where I sign every ...
BambiBundle's user avatar
0 votes
0 answers
412 views

How to get Certificate's Subject Public Key from CSR

I am currently using this code to have the public key pinning OkHttpClientFactory okHttpClientFactory = () -> { CertificatePinner certificatePinner = new CertificatePinner.Builder() ...
Archie.bpgc's user avatar
0 votes
1 answer
570 views

openssl: genrsa vs req -newkey private keys. What's the difference?

I'm trying to understand the difference between generating a private key using openssl genrsa and adding -newkey to req. I found a 2014 answer saying the underlying code is the same, one from 2015 ...
pollirrata's user avatar
0 votes
1 answer
105 views

How to resolve an issue with potential mismatch between device certificate and CA certificate?

I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
monkey's user avatar
  • 103
0 votes
2 answers
171 views

Website returns different certificate on my home network to mobile hotspot

This is a "should I be worried" question. I access a website on my laptop via my home network/router. My Edge browser gives me a "Your connection isn't private" warning page and ...
Kepboy's user avatar
  • 101
0 votes
1 answer
388 views

crt.sh shows certificates for domains I don't recognize

Today I learned of the existence of crt.sh. I typed one of my domain names into the search box to find out what it returns. I found a lot of certificate entries for domains that I don't recognize, and ...
Scott Severance's user avatar
1 vote
1 answer
313 views

How to set/modify "positive trust attributes" in a certificate for openssl

I'm trying to set positive trust attributes to a certificate, however, in openssl's documenation there is no information about how to set them: From the OpenSSL perspective, a trust anchor is a ...
Cris's user avatar
  • 83
0 votes
0 answers
131 views

CNAME redirection and certificate

As an experiment, I attempted to setup a CNAME for mail.mydomain.com pointing to mail.myisp.com, and using mail.mydomain.com instead of mail.myisp.com in setting up email clients connecting to that ...
fgrieu's user avatar
  • 1,231
1 vote
3 answers
876 views

is mTLS authentication alone considered secure for authentication

We have recently engaged an external party to undertake a pen test on a recently implemented API. The API is considered internal although it itself is on AWS and is consumed from on-prem resources, ...
Kinexus's user avatar
  • 113
0 votes
0 answers
83 views

Is a Certificate Signing Request a concatenation of public key and metadata?

From this question, it is said that when creating a CSR, we attach the public key and fill in other data. When creating a CSR, you attach your public key to it and fill in other needed data; you then ...
JLC's user avatar
  • 101
1 vote
3 answers
252 views

self signed certificate

I read a lot of articles about self signed certificates and I'm not exactly sure if I'm getting near to what I want to actually achieve. I'm trying to implement a self signed certificate so that the ...
Reefo Relaxo's user avatar
0 votes
1 answer
595 views

What is default_crl_days in OpenSSL and recommended days?

I'm new and I'm trying to understand default_crl_days. The default is 30 days thus does it mean after 30 days, the CRL list can no longer be trusted? If so, do we need to generate a new list before 30 ...
ratib90486's user avatar
0 votes
0 answers
85 views

Are sections in openssl config file case sensitive?

I'm reading this and it has the below (excerpt). # Certificate Authority Section [ ca ] default_ca = CA_default # The default CA section # Default CA configuration to ...
ratib90486's user avatar
0 votes
1 answer
693 views

NordVPN Couldn't Estabish a Secure Connection - ISRG Root X2

I'm using NordVPN and it's popped up with this about how it couldn't validate a TLS certificate: I've tried looking up what ISRG is but I don't get much of an explanation on it anywhere. It appears ...
aspanda's user avatar
0 votes
0 answers
1k views

How does automatic SSL certificate renewal work without having access to the private key?

From GoDaddy's Renewing my SSL Certificate docs (emphasis mine): If you’re using a Domain Validation (DV) certificate with the primary domain for your account, and you’ve set the certificate to auto-...
toraritte's user avatar
  • 129

1
2 3 4 5
58