Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

232 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9 votes
0 answers
414 views

SolarWinds Orion SAML compromise mass cert update

SolarWinds Orion customers have suffered some network compromises according to news reports. One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
  • 359
7 votes
1 answer
2k views

iOS & Android Certificate Pinning with Lets Encrypt

We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for. We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
  • 2,809
7 votes
1 answer
520 views

TLS connection to untrusted server - client reaction for dropping connection standardized?

I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
  • 1,383
6 votes
0 answers
2k views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
5 votes
0 answers
174 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
  • 161
4 votes
0 answers
1k views

Use self-signed certificate inside of Docker Container for localhost

I've created a self-signed certificate for localhost to use https. I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
  • 43
4 votes
1 answer
747 views

Using NameConstrains in a CA certificate

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart. I have a CA certificate with Name Constrains (RFC): Permitted [1]Subtrees (0..0): ...
4 votes
0 answers
163 views

.net website using certificate with .com

I found a website where all browsers navigate to just fine and do not complain about the certificates. When i inspect the certificate i noticed something i hadn't thought i would see. the website foo....
  • 141
4 votes
0 answers
424 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect securely ...
  • 41
4 votes
0 answers
1k views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
3 votes
0 answers
144 views

Phishing? All websites show the same, wrong certificate

today I went to my Online-Banking by typing in the correct domain name in Firefox. I could login and even see my actual balance. Then within the site a warning appeared that I should do a test-...
3 votes
0 answers
131 views

Is this nginx config suitable to enforce proper authorization?

Scenario I have a website secret.example.com, which contains information which must not be disclosed to third parties. In order to protect the information, TLS client authentication was chosen. ...
's user avatar
3 votes
0 answers
213 views

How does Cloudflare negotiate its server certificate?

When I access https://example.com on my company's laptop that has a X509 client certificate installed, using my home internet connection, without using a VPN, the requested page is signed using the ...
  • 153
3 votes
0 answers
113 views

What is the maximum amount of certificates that can be pinned with HPKP?

We are currently looking into enabling HTTP Public Key Pinning on our website. The problem we are currently facing is that our certificates last only 90 days, but we have devised the following steps ...
  • 1,086
3 votes
0 answers
363 views

Why does the TLS Client have to send the digital signature over all previous handshake messages in CertificateVerify?

TLS (non-anonymous) Handshake requires the Server to sign the ServerKeyExchange message so that the Client can authenticate the Server using the public key present in the Server Certificate. However, ...
  • 193
3 votes
1 answer
619 views

OCSP recording with JMeter

How can I record an application which is using OCSP security with the help of JMeter? I am not able to record the application i.e. a native app with the help of JMeter as it is using OCSP protocol ...
  • 31
3 votes
0 answers
585 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
  • 31
3 votes
0 answers
856 views

How to generate "CRL numbers" for X.509 CRL

(Context: I'm working a process to publish a CRL periodically -- eg once every day.) With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to ...
  • 131
3 votes
0 answers
691 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: 0_.].[0Y0W0U..image/gif0!0.0...+......
  • 1,982
2 votes
1 answer
107 views

How do I ship my SSL keys with my application?

I have an executable, and I have the SSL certificates and keys necessary to establish the secure connection. The application performs self-updating by downloading and replacing itself with an updated ...
  • 121
2 votes
1 answer
125 views

How to set up certificate architecture for on-premise server-client application

We are currently shipping a product to our customers that is server-client-based running on Windows server 2016 (server) and Windows 10 (clients). The server is installed on-premise in our customer's ...
  • 21
2 votes
0 answers
144 views

Using TPM to generate certificates associated with different users on the same device

I plan to use the TPM to generate CSR's backed by a private key stored on the TPM. The CSR's will then be signed by an external HSM. Since a certificate is tied to a particular private key, how do you ...
2 votes
0 answers
150 views

What are the risks of trusting a certificate that is not logged in CT logs?

A website that I do banking on has a login page on a different subdomain than their main website, and this login page is secured with an Amazon-issued domain-validation certificate (their main website ...
  • 175
2 votes
0 answers
722 views

OpenSSL OCSP Responder "Cert Status: good" -> "Cert Status: unknown"

Summary: Certificates calling to OCSP Responder (OCSPr) have their "Cert Status" change from "good" to "unknown" with no known to changes to environment. Completely lost ...
  • 33
2 votes
0 answers
80 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
2 votes
0 answers
149 views

Why don't CAs advertize public keys of verified entities on a central location instead of giving out signed certificates?

If CAs (Certification Authorities) start advertizing public keys of verified websites via some API, browsers can simply query them for each domain instead of asking websites to give them certificates ...
  • 189
2 votes
1 answer
183 views

A solution for the absence of Certifying Subkeys in OpenPGP Certs

As discussed in this answer, gpg does not offer the capacity for subkeys to certify (eg. "sign") other keys, though there may be good reason why it should, and they do sign at least one key. ...
  • 233
2 votes
0 answers
130 views

Public key stored in server is different from what is shown in OpenSSL

I obtained an SSL certificate from LetsEncrypt for my web application using Apache web server. LetsEncrypt generated these 4 files: cert.pem chain.pem fullchain.pem privkey.pem As I understand, ...
  • 211
2 votes
0 answers
153 views

openSSL shows a revoked certificate as secure

I downloaded a revoked certificate from the website https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/. Specifically, the revoked certificate of the site https://revoked-rsa-ev....
2 votes
0 answers
375 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
2 votes
0 answers
385 views

Can I sign with two Code Signing certs to build reputation on the newer one?

I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon. Obviously, the new certificate has no ...
  • 21
2 votes
2 answers
228 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
2 votes
0 answers
315 views

Delegating SSL certificate requests to a third party

I'm wondering what best practices are regarding delegating the authority to approve SSL certificate issuance. One of our vendors (www.vendordomain.com) will soon host a Web application for us (www....
  • 1,009
2 votes
2 answers
609 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
  • 121
2 votes
0 answers
614 views

Storing Wireless auth certs in a TPM

Within my organisation we're being asked to provide a secure but seamless wireless experience e.g. user logs on to Windows device and are connected automatically to corporate network via wireless. ...
  • 41
2 votes
0 answers
792 views

ways to check a certificate fingerprint against known logs

Suppose I have a certificate sha-256 fingerprint, which I can obtain say visiting the relevant domain in firefox or from a shell script using openssl, and i want to verify this fingerprint. one option ...
  • 369
2 votes
0 answers
132 views

Custom keystore/certificate to hold asymmetric (RSA) keys

My app will require maintaining an RSA keypair locally on the user's machine. I was a bit disappointed to discover that PKCS#12 and JKS don't offer higher than 3DES (correct me if I have this wrong). ...
  • 43
2 votes
0 answers
106 views

How can I create a verifiable signature for a digital transaction?

I am currently working on creating a digital signature pad that customers can sign instead of a traditional paper receipt for credit card transactions. Currently I have the ability for them to sign a ...
2 votes
0 answers
567 views

Resolving dupe CA certs in keystore

Consider a keystore in which are loaded two duplicate CA Root certificates. They have the same Issuer/Subject DN and the same key. The major difference is that one expires in 2019 and one expires ...
  • 165
2 votes
0 answers
642 views

SSO - Client Certificate vs SAML

For me SSO is sign on where one need not type the password explicitly. I see one of the possible way to achieve it is by using Certificates loaded in browser. SAML/OAuth delegates the job of ...
  • 275
2 votes
0 answers
437 views

Which entriey does a Card Verifiable Certificate contain?

Which entries e.g. public key, valid until, etc. does a CVC has and where can I find a good explanation of this elements? - also with the size, which an entry and related to that, which size the ...
  • 229
2 votes
0 answers
280 views

How do 2 intermediate certificates work? (chaining)

I'm trying to learn a bit more about acting as my own CA. I've learned some of the basics so far. Create a root pair, keep your root key safe, private and use it to sign other things. I'm now trying ...
  • 21
2 votes
0 answers
534 views

Simple private AKKA encryption certs

There are several questions on stackoverflow regarding Akka, SSL and certificate management to enable secure (encrypted) peer to peer communication between Akka actors. The Akka documentation on ...
2 votes
0 answers
210 views

Does any SSL certificate vendor allow custom expiration date while creating the SSL Certificate?

The public SSL certificate vendors (Comodo, Thawte, etc.) allow you to create certs that expire after a certain fixed period (1 yr, 2yr, 3yr, etc.) from the date of creation. However, I would like ...
  • 43
2 votes
0 answers
88 views

Windows NPS: Policy should check Issuing CA

I have some trouble in configuring a Windows NPS, maybe anybody of you have an idea. Is it possible for NPS to check whether a client certificate was signed by a specific issuing CA? I have two ...
  • 81
2 votes
0 answers
272 views

Security Concerns of importing SharePoint Root Authority to Trusted Root Certification Authorities store

We are experiencing slowness because of SharePoint's STS certificate CRL checking. This is a known issue and there is a Microsoft Workaround for it: https://support.microsoft.com/en-us/kb/2625048 The ...
2 votes
0 answers
7k views

SSL self signed certificate CER exception added to Keychain but fails in Chrome

Operating System: Mac OSX El Capitan 10.11.5 When browsing to the page I have a Privacy error, although an exception was added. I have the correct CER file so I added it to my Keychain TRUST THE CERT ...
  • 161
2 votes
0 answers
225 views

Finding the EMSA-PKCS1-v1_5 DigestAlgorithm field in the x509 certificate

From the RFC - https://www.ietf.org/rfc/rfc3447.txt A.2.4 RSASSA-PKCS1-v1_5 For each OID, the parameters field associated with this OID in a value of type AlgorithmIdentifier shall have a value ...
  • 1,982
2 votes
0 answers
209 views

Problem using custom CryptoNG KSP on IE 11

We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for ...
  • 2,542
2 votes
0 answers
116 views

Windows IIS Event/Security Log ID of Private Key deletion of corresponding TLS certificate?

I'm in the middle of writing an MS Active Directory Certificate Services Key Management Lifecycle document for my organization. The primary purpose certificates will serve for this organization is to ...
  • 324

1
2 3 4 5