Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
9
votes
2answers
1k views

What happened with Kazakhstan's Root CA MITM policy?

In 2015 there were news that Kazakhstan was going to start intercepting all HTTPS traffic via "man-in-the-middle attack" starting Jan 1, 2016, by requiring kazakhstanis to install their root CA. ...
0
votes
1answer
51 views

OpenSsl and self-signed certificates - verifying a chain

I have a chain.pem -----BEGIN CERTIFICATE----- // My server cert signed by intemediate CA -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- // My intermediate cert signed by root CA -----END ...
0
votes
1answer
61 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
13
votes
2answers
33k views

Reset Windows trusted certificates store to its default

Over the time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, some other times for development and testing. Is there ...
0
votes
1answer
3k views

ssl handshake failure unable to get local issuer certificate

I have an issue with new integration that I am working on it. I should consume a web service provided by external company and this service is over https, so in order to integrate with them, they have ...
0
votes
2answers
721 views

RSA or ECDHE for key establishment?

Recently, i have been looking at PKI and certificates, and TLS 1.2 as part of my study of cryptography. I have the understanding that the public key included in the certificate of a website is the key ...
0
votes
2answers
64 views

Can MitM spoof a signed certificate by imitating the Certificate Authority?

I understand that a signed certificate is a server public key signed by the private key of a certificate authority. As a result, a client allegedly rest assured that the signed public key is for the ...
15
votes
5answers
19k views

A standard way to manually add a digital signature to a pdf file?

I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
0
votes
0answers
15 views

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication? [duplicate]

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication?
0
votes
0answers
20 views

Seeking a reliable way of creating trusted certificate files for OCSP

In my deployments I use OCSP must-staple flags on certificates, and ensure that my server is set to do verification and OCSP stapling. That's all good, but I'm forever having problems creating the ...
0
votes
0answers
7 views

Kernel Mode Driver Signing using Self Signed Certificates [migrated]

Can anyone help me in signing the .sys files for windows 7 64 bits? I have created the self signed certificates using Openssl and I want to sign the the .sys files with that certificates using ...
1
vote
1answer
228 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...
32
votes
10answers
14k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
1
vote
1answer
93 views

Are self signed certs safe to a developer use in local debug?

The same computer I use for work in home, is the same for personal uses (gamimg, social medias) and of course, internet banking. I'm back-end developer and recently, I started to work with fiddler to ...
1
vote
2answers
2k views

Getting Certificate KeyContainerName to initialize CspParameters

How can I get the name of a Key Container that's in a smart card required for initialization of CspParameters? CspParameters^ cspa = gcnew CspParameters(ProviderType, ProviderName, keyContainerName, ...
0
votes
0answers
22 views

Verifying Public Key Using The Digital Signature on Mac

I have just started with encryption and stuff, so please bear with me. Just playing around. I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
0
votes
0answers
45 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
0
votes
3answers
96 views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
1
vote
2answers
95 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
1
vote
1answer
47 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
9
votes
2answers
991 views

Trying to understand how Digital Certificates and CA are indeed secure

I understand that Digital Certificates and Certificate Authorities (trusted 3rd parties) help prevent man in the middle attacks during HTTPS connections. However, I am confused on a few details. Let'...
0
votes
1answer
66 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
29
votes
6answers
10k views

Why can SSL certificates not be free of charge?

I am a newbie in this field. I am confused with why SSL certificates cannot be free of charge. In my understanding the certificate is just a text file consisting of cryptic numbers installed on a ...
1
vote
1answer
142 views

Is it safe to use personal wiki over http?

I hosting my site on infinityfree.net for free and dokuwiki is installed there. Couple of my colleagues, including me, are going to use wiki for writing documentation for our project. Wiki is private,...
1
vote
1answer
131 views

How can you tell what certificate parameters were used with openssl?

So for example, Chrome browser (using F12 > security) will tell you what key-exchange, cipher, and protocol was used by a website's SSL certificate. e.g. protocol (TLS 1.2), a strong key exchange (...
5
votes
1answer
194 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
1
vote
1answer
558 views

Validate Code Signing Root Certificate Offline

I am developing a library distributed as a Windows DLL to be called by 3rd party executables. I expect the calling EXE to be digitally signed and need to verify that. I have no control over the ...
2
votes
1answer
111 views

Encrypting a blob with a password

Is there anything to say against to have an amount of public keys, which encrypt a common password for a blob encrypted? So Users 1,2,3 have all certificates for themselves and can use them to get ...
2
votes
4answers
93 views

How to secure VPN credentials on end-user devices?

I have a VPN and PKI in place with MFA. My question is: What's the best method/solution for protecting the integrity and identity of end-user certs? I want to make sure that users only able to use VPN ...
3
votes
1answer
223 views

Good practices for protecting a machine certificate against extraction

Consider the following scenario: You are providing VPN access for a number of machines running Windows 10. The machines are configured and hardened according to company standards. You rely on machine ...
19
votes
3answers
4k views

Are certificates without DNS fundamentally flawed?

I am new to security work and I am implementing someone else's design. The design calls for a TCP server with TLS in an environment where there is no DNS - only IPs. I am working with a typical ...
0
votes
1answer
50 views

SSL certificate distribution of API

We have an API which has SSL certificate signed from authorized CA. The access to the API is limited. API is accessed from webapp and only from those client who have valid public key for SSL. Now, how ...
97
votes
6answers
58k views

Let's Encrypt for intranet websites?

Many companies have intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate, which causes a bad habit for the users since they get used to just ...
4
votes
4answers
14k views

Missing X509 extensions with an openssl-generated certificate

My goal is to create a certificate with opensslsimilar to this one generated with cfssl Certificate: Data: Version: 3 (0x2) Serial Number: 60:44:dc:0d:80:f4:54:55:e8:...
2
votes
2answers
5k views

How do I revoke the certificate and generate a CRL?

I created a self-signed CA certificate, and then created a client certificate using this tutorial here. I am just trying to revoke the client certificate: openssl ca -keyfile rootCA.key -cert rootCA....
289
votes
6answers
224k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
2
votes
1answer
50 views

Wildcard certificate generated for local CA do not work for the subdomains

I have created Makefile to simplify generation certificates for local development: DOMAIN ?= localhost NAME ?= ${DOMAIN} CAKEY ?= CAkey.key CACERT ?= CAcert.pem SIGN_REQ ?= ${NAME}.csr ...
1
vote
2answers
145 views

Is the installed certificate used for school wifi able to track me at home?

I've read similar questions being answered on the safety and privacy of school wifi certificates but my question on whether they can still track me at home stands. I'm using my own computer (not ...
2
votes
1answer
137 views

Is it dangerous to add a custom cert authority to a browser?

For example if my friend develops a webapp with a custom cert and I add them as CA to my browser, can they do any damage? I mean for example somehow faking certs and stealing my banking password, etc.?...
2
votes
2answers
672 views

Can we restrict cipher suites using server certificate?

Can we restrict cipher suites (such as RC4) using server certificate?
-3
votes
0answers
38 views

How to be sure that my app is my app? [duplicate]

I want to protect my server against someone who would have replicate my iOS application and used the internal http calls, by decompiling or just by some way obtained my source code. I guess It would ...
0
votes
1answer
75 views

Access protected (from export) private key in windows certificate store

I have created a CSR with the option to disallow the export of the private key. Can I still access it? If not, how is it protected?
-2
votes
0answers
34 views

How can I determine which algorithm a certificate implements for data encryption? [duplicate]

I'm attempting to discover which encryption algorithm(s) are available on a particular Certificate. Is this possible? I have examined some certs in CertMgr and I see things like: Signature ...
72
votes
1answer
15k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
1
vote
2answers
81 views

Can I get an SSL certificate even if external DNS does not resolve

I have an intranet website that requires an SSL Certificate. From what I've seen it seems like this is difficult to accomplish or cumbersome. Would I be able to buy an SSL certificate if there is an ...
4
votes
3answers
7k views

In order to trust the digital certificate, does immediate CA cert also needs to be in trust store or root CA cert is enough?

In order to trust the digital certificate, does immediate CA certificate also needs to be in trust store or root CA certificate is enough?
0
votes
2answers
153 views

Why does localbattle.net point to localhost?

I found a random link on a forum linking to localbattle.net, at the same time I was running a local server on localhost. When I went to localbattle.net, my local server page appeared! The certificate ...
20
votes
7answers
5k views

Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?

Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
3
votes
1answer
4k views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
3
votes
3answers
556 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...