Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

191 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
0answers
784 views

Where to put a code signing server with EV code signing certificate and plugged-in HSM

Microsoft recently started enforcing apps to be signed by EV code-signing certificates instead of just regular certificates. These usually come on an external device such as USB smart card or a HSM, ...
6
votes
1answer
392 views

TLS connection to untrusted server - client reaction for dropping connection standardized?

I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
5
votes
0answers
2k views

iOS & Android Certificate Pinning with Lets Encrypt

We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for. We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
4
votes
1answer
334 views

Using NameConstrains in a CA certificate

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart. I have a CA certificate with Name Constrains (RFC): Permitted [1]Subtrees (0..0): ...
4
votes
0answers
129 views

.net website using certificate with .com

I found a website where all browsers navigate to just fine and do not complain about the certificates. When i inspect the certificate i noticed something i hadn't thought i would see. the website foo....
4
votes
0answers
2k views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
4
votes
0answers
384 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect securely ...
4
votes
0answers
137 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
4
votes
0answers
1k views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
3
votes
0answers
107 views

How does Cloudflare negotiate its server certificate?

When I access https://example.com on my company's laptop that has a X509 client certificate installed, using my home internet connection, without using a VPN, the requested page is signed using the ...
3
votes
0answers
76 views

What is the maximum amount of certificates that can be pinned with HPKP?

We are currently looking into enabling HTTP Public Key Pinning on our website. The problem we are currently facing is that our certificates last only 90 days, but we have devised the following steps ...
3
votes
0answers
274 views

Why does the TLS Client have to send the digital signature over all previous handshake messages in CertificateVerify?

TLS (non-anonymous) Handshake requires the Server to sign the ServerKeyExchange message so that the Client can authenticate the Server using the public key present in the Server Certificate. However, ...
3
votes
1answer
455 views

OCSP recording with JMeter

How can I record an application which is using OCSP security with the help of JMeter? I am not able to record the application i.e. a native app with the help of JMeter as it is using OCSP protocol ...
3
votes
0answers
445 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
3
votes
0answers
719 views

How to generate “CRL numbers” for X.509 CRL

(Context: I'm working a process to publish a CRL periodically -- eg once every day.) With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to ...
3
votes
0answers
604 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: 0_.].[0Y0W0U..image/gif0!0.0...+......
2
votes
1answer
56 views

How do clients extract the public key from a self-signed certificate?

I have gone over: Why do we need to sign the self-signed certificate? Basic self-signed certificate questions Is a self-signed SSL certificate much better than nothing? I am new to cryptography and ...
2
votes
0answers
40 views

Public key stored in server is different from what is shown in OpenSSL

I obtained an SSL certificate from LetsEncrypt for my web application using Apache web server. LetsEncrypt generated these 4 files: cert.pem chain.pem fullchain.pem privkey.pem As I understand, ...
2
votes
0answers
187 views

Firefox SSL_ERROR_BAD_CERT_DOMAIN but the names are correct

Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was ...
2
votes
0answers
144 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
2
votes
0answers
277 views

Can I sign with two Code Signing certs to build reputation on the newer one?

I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon. Obviously, the new certificate has no ...
2
votes
2answers
111 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
2
votes
0answers
880 views

Use self-signed certificate inside of Docker Container for localhost

I've created a self-signed certificate for localhost to use https. I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
2
votes
0answers
144 views

Delegating SSL certificate requests to a third party

I'm wondering what best practices are regarding delegating the authority to approve SSL certificate issuance. One of our vendors (www.vendordomain.com) will soon host a Web application for us (www....
2
votes
2answers
216 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
2
votes
0answers
415 views

Storing Wireless auth certs in a TPM

Within my organisation we're being asked to provide a secure but seamless wireless experience e.g. user logs on to Windows device and are connected automatically to corporate network via wireless. ...
2
votes
0answers
91 views

Custom keystore/certificate to hold asymmetric (RSA) keys

My app will require maintaining an RSA keypair locally on the user's machine. I was a bit disappointed to discover that PKCS#12 and JKS don't offer higher than 3DES (correct me if I have this wrong). ...
2
votes
0answers
69 views

How can I create a verifiable signature for a digital transaction?

I am currently working on creating a digital signature pad that customers can sign instead of a traditional paper receipt for credit card transactions. Currently I have the ability for them to sign a ...
2
votes
0answers
209 views

Resolving dupe CA certs in keystore

Consider a keystore in which are loaded two duplicate CA Root certificates. They have the same Issuer/Subject DN and the same key. The major difference is that one expires in 2019 and one expires ...
2
votes
0answers
390 views

Which entriey does a Card Verifiable Certificate contain?

Which entries e.g. public key, valid until, etc. does a CVC has and where can I find a good explanation of this elements? - also with the size, which an entry and related to that, which size the ...
2
votes
0answers
135 views

Does any SSL certificate vendor allow custom expiration date while creating the SSL Certificate?

The public SSL certificate vendors (Comodo, Thawte, etc.) allow you to create certs that expire after a certain fixed period (1 yr, 2yr, 3yr, etc.) from the date of creation. However, I would like ...
2
votes
0answers
51 views

Windows NPS: Policy should check Issuing CA

I have some trouble in configuring a Windows NPS, maybe anybody of you have an idea. Is it possible for NPS to check whether a client certificate was signed by a specific issuing CA? I have two ...
2
votes
0answers
202 views

Security Concerns of importing SharePoint Root Authority to Trusted Root Certification Authorities store

We are experiencing slowness because of SharePoint's STS certificate CRL checking. This is a known issue and there is a Microsoft Workaround for it: https://support.microsoft.com/en-us/kb/2625048 The ...
2
votes
0answers
6k views

SSL self signed certificate CER exception added to Keychain but fails in Chrome

Operating System: Mac OSX El Capitan 10.11.5 When browsing to the page I have a Privacy error, although an exception was added. I have the correct CER file so I added it to my Keychain TRUST THE CERT ...
2
votes
0answers
120 views

Finding the EMSA-PKCS1-v1_5 DigestAlgorithm field in the x509 certificate

From the RFC - https://www.ietf.org/rfc/rfc3447.txt A.2.4 RSASSA-PKCS1-v1_5 For each OID, the parameters field associated with this OID in a value of type AlgorithmIdentifier shall have a value ...
2
votes
0answers
163 views

Problem using custom CryptoNG KSP on IE 11

We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for ...
2
votes
0answers
77 views

Windows IIS Event/Security Log ID of Private Key deletion of corresponding TLS certificate?

I'm in the middle of writing an MS Active Directory Certificate Services Key Management Lifecycle document for my organization. The primary purpose certificates will serve for this organization is to ...
2
votes
0answers
134 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
2
votes
0answers
353 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
2
votes
1answer
792 views

Chrome Internal Certificate Authority List for SSL + EV

Chrome specifies that it maintains a internal "hard-coded" list of root certificates that are "EV-Qualified". https://www.chromium.org/Home/chromium-security/root-ca-policy#TOC-Extended-Validation-...
2
votes
2answers
2k views

Getting Certificate KeyContainerName to initialize CspParameters

How can I get the name of a Key Container that's in a smart card required for initialization of CspParameters? CspParameters^ cspa = gcnew CspParameters(ProviderType, ProviderName, keyContainerName, ...
1
vote
0answers
32 views

Why don't CAs advertize public keys of verified entities on a central location instead of giving out signed certificates?

If CAs (Certification Authorities) start advertizing public keys of verified websites via some API, browsers can simply query them for each domain instead of asking websites to give them certificates ...
1
vote
0answers
28 views

A solution for the absence of Certifying Subkeys in OpenPGP Certs

As discussed in this answer, gpg does not offer the capacity for subkeys to certify (eg. "sign") other keys, though there may be good reason why it should, and they do sign at least one key. ...
1
vote
1answer
38 views

How do you verify the key given by remmina (libfreerdp2)

This morning I took an update to remmina and started getting a "fingerprint changed" warning. When using xfreerdp (from freerdp-x11) I get they old key. The old key being 20 bytes and the new key ...
1
vote
0answers
66 views

openSSL shows a revoked certificate as secure

I downloaded a revoked certificate from the website https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/. Specifically, the revoked certificate of the site https://revoked-rsa-ev....
1
vote
0answers
33 views

Certificate for SSTP VPN server

I'm trying to set up an SSTP VPN on Windows Server 2019 Essentials (I was originally going to use L2TP/IPSec, but the company which manages our network infrastructure doesn't support it). I'm new to ...
1
vote
1answer
113 views

Self-signed certificates in embedded IoT device

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC). These IoT nodes would be deployed and, during ...
1
vote
0answers
49 views

I need to make a PKI infrastructure, but i don't now how to segment my CA

I'm currently working on a project where we have to rethink a PKI architecture, but we don't know how to segment the different CA_SUBs, do you have any recommendations?
1
vote
0answers
64 views

Confirming the validity/ownership of a Android Signing Certificate

I have a certificate that says the application was signed by Google, but on multiple searches I have reason to believe that it's not actually a google signing certificate. Is there a way to query ...
1
vote
1answer
920 views

How to identify which certificate I'm missing to produce HTTPS calls?

I posted a question similar to this one on Stack Overflow, but that has not produced any answers so far, so I'm hoping someone here will be able to help me out. Somewhat simplified, I'm trying to do ...