Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
1answer
54 views

Where are field names of decoded human readable X.509 certificates specified?

The ASN.1 module for X.509 certificates as specified in RFC 5912 - Section 14 is as follows: TBSCertificate ::= SEQUENCE { version [0] Version DEFAULT v1, serialNumber ...
8
votes
3answers
4k views

Adding custom data in X.509 certificate

I am using SSL with client authentication. I need to send some extra data while sending the client certificate? Can I send it in the certificate? Can I use the extension fields in certificate for that ...
3
votes
1answer
460 views

OCSP recording with JMeter

How can I record an application which is using OCSP security with the help of JMeter? I am not able to record the application i.e. a native app with the help of JMeter as it is using OCSP protocol ...
1
vote
1answer
56 views

Independent C library or function (on Linux) to programmatically generate a self-signed certificate [closed]

Is there a simple C library or function to programmatically generate a self-signed certificate in C on Ubuntu? Of course, one can execute a simple system("....") call to execute a CLI. I am ...
61
votes
4answers
10k views

Is there a way to make sure my government does not swap out SSL certificates?

I was recently wondering whether there exists a way to make sure my government is not swapping out SSL certificates in order to intercept the traffic. I know almost all browsers are complaining in ...
1
vote
2answers
98 views

Is it possible to craft a certificate signing chain that thwarts MITM corporate VPNs?

Some companies install software on corporate VPNs which also come with a root certificate installed on all employees' machines. This allows for encrypted traffic to be decrypted by technology ...
1
vote
2answers
85 views

When/why should the “mark this key as exportable” option be selected when importing a certificate?

When a certificate is being imported on Windows, at some point the following option is available: [] mark this key as exportable I understand that this is used in case the certificate needs to be ...
-1
votes
1answer
40 views

Digital signature from hashing encrypted webpage

I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...
12
votes
2answers
2k views

Are X.509 nameConstraints on certificates supported on OS X?

I have the following "chain" of certificates on a test machine right now: A self-signed CA cert, in my Keychain and trusted & trusted by Firefox. A CA cert with with the following, X509v3 Name ...
42
votes
2answers
9k views

Can I restrict a Certification Authority to signing certain domains only?

Is it possible to create a CA certificate (even unsigned), which is only allowed to sign certificates for specific limited domain(s), so that it can't be misused for other domains?
0
votes
1answer
83 views

Who am I really trusting?

My trusted root certificates are below. As an exercise, I want to be sure that a MITM is not changing the list. So, can I somehow get this list signed? In my opinion, the list could be signed by my ...
1
vote
1answer
141 views

.Net WebClient - self signed certificate

I have two applications (.net) on two web-servers. The first application will need to do a request (via WebClient) to the second and get results. I need to ensure Encryption, data integrity, and ...
5
votes
3answers
6k views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
0
votes
0answers
38 views

Bettercap TCP proxy upstream server

I am using bettercap command line to perform a Man in the Middle attack on my LAN network with an EDUCATIONAL purpose (of course!). I want to intercept the TCP traffic, with the intention to view on ...
9
votes
3answers
5k views

Should antivirus HTTPS scanning be left on? Is it secure?

Some antivirus software MitMs, or through other methods, HTTPS connections in order to scan for malware, for example, Avast, and maybe other vendors too. Is the method they (let's say Avast as an ...
2
votes
2answers
975 views

How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?

This document describes how there are 3 ways to constrain a SmartCard certificate The Enhanced Key Usage field defines one or more purposes for which the public key may be used. RFC 5280 states “...
6
votes
3answers
5k views

Why does generating a self-signed X509 certificate not require my public key?

Let's say I have an RSA (2048) keypair that I generated private.key public.key For testing purposes I'd like to generate a self-signed X509 certificate. My understanding of a certificate is that it ...
2
votes
1answer
122 views

Could a certificate authority and a ISP preform a MITM attack on HTTPS traffic?

I'm just wondering if it is technically possible for your ISP to work with a certificate authority (either compelled by a government agency or otherwise) to create a MITM attack to see into your https ...
2
votes
2answers
754 views

How to programatically verify a file signature?

I have a dll file signed with my private key, here is the signature info in Windows Explorer: Now, using the public key found in the certificate, how can I verify the integrity of the file? I am ...
2
votes
1answer
61 views

How to fully view cross-signed certificate signatures

Long story short: Security scan raised a flag about a cert, found that it was an expired root on a cross-signed cert. Yadda yadda, updated intermediates, fixed issue. However, I noticed that openssl ...
12
votes
2answers
34k views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey rsa:...
3
votes
1answer
90 views

Is macOS installing known bad Certificate Authorities by default?

Today I was checking out macOS security and privacy guide, and when I looked at my keychain, I was surprised to find Startcom CA and Symantec CA trusted by default. Isn't this supposed to be ...
2
votes
2answers
84 views

Can public keys in digital certificates be used to verify name of certificate holder?

I recently had a conversation with a teacher who argued that in a digital certificate (x509), the public key is used to verify the name of the certificate holder. From my understanding, there are ...
0
votes
0answers
46 views

Is it safe to install a trusted CA certificate from another source?

As you may know, a CA certificate issued by Sectigo expired recently. This is affecting certain mobile apps and possibly websites, rendering them unable to connect to required network resources. In ...
1
vote
1answer
62 views

Forge certificate for man in the middle attack

I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server that would ...
1
vote
1answer
146 views

Self-signed certificates in embedded IoT device

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC). These IoT nodes would be deployed and, during ...
0
votes
0answers
84 views

Using OpenVPN on Windows instead of VPN apps: missing certificate

Sorry this might be a noob question, but I subscribed to a VPN provider which ships its own app on Windows. Now I thought I'd prefer to use the OpenVPN client app instead. I create a profile by ...
3
votes
1answer
300 views

Why do some email software products block SSL certificates attached to a message?

Whenever I have to share our public SSL certificate with our trading partners through email, I have to change the filename extension of the attached file (i.e. from “.cer” to “.txt”) to ensure it is ...
0
votes
1answer
42 views

TLS/SSL Offloading to PA220 without requiring clients to load additional CA

If I'm understanding this correctly, the Palo Alto PA-220 allows for SSL/TLS traffic decryption using its proxy feature. By generating a Certificate Signing Request and loading it into the firewall, ...
0
votes
3answers
121 views

Why do we need to sign the self-signed certificate?

When we add a self-signed certificate to a device's list of trusted root certificates, we're already trusting it. So, why should it be signed with the server's private key? Signatures only ensure ...
1
vote
2answers
96 views

HTTP Public Key Pinning vs Certificate Transparency, which is better and why?

We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well. The ...
0
votes
3answers
60 views

While importing certificates in keystore, do we treat these like CA root certificates?

When we need to call an internal domain via HTTPS, Java doesn't allow it because it doesn't recognize the certificate that those domain web servers are sending (probably because those certificates are ...
1
vote
1answer
49 views

getting no subject alternative name present exception when the csr shows that the SANs are present [duplicate]

I am trying to setup ssl for grpc but no matter what I try I get a no subject alternative name present. I've verified the SANs are in the certificate signing request. The common name and also a SAN ...
0
votes
1answer
43 views

Process and order of verification of a X.509 certificate chain

While going through the rfc5280 Certificate Path Validation to understand how the X.509 certificate chain is validated, I found out that the X.509 path processing Algorithm processes the chain in an ...
1
vote
2answers
64 views

What is the benefit of public Certificate Authority when using SSL mutual authentication?

I was working the other day and I had a question come up, that I want to ask here to make sure my assumptions are correct. In terms of SSL Mutual Authentication a self signed CA and a public CA ...
1
vote
1answer
1k views

How to identify which certificate I'm missing to produce HTTPS calls?

I posted a question similar to this one on Stack Overflow, but that has not produced any answers so far, so I'm hoping someone here will be able to help me out. Somewhat simplified, I'm trying to do ...
15
votes
5answers
5k views

HTTPS connection to specific sites fail with cURL on macOS

On my Mac, HTTPS connnections to certain sites fail using the built-in curl binary of macOS 10.14. They work fine with different browsers, as well as other builds of cURL on the same system. One of ...
0
votes
0answers
62 views

Clear Browser Cache of Certificates Used for Authentication

We are using cert based authentication where the client sends a cert to the server, which is validated for authentication for a web application. This all works well. The problem happens when the user ...
3
votes
1answer
594 views

VPN provider asks to install RootCertificate. How is it safe?

I want to use VPN provider (ProtonVPN), and don't want to use an app. They ask user to install their Root Ca. How safe is it? What type of info could they get from my laptop? If I have their ...
0
votes
0answers
58 views

Adding Expect-CT header to HTTP response

In the security test report, I have a recommendation to add Expect-CT header to the HTTP response from web application, additionally developers set this to: Expect-CT: max-age=0, report-uri= I am ...
1
vote
0answers
69 views

openSSL shows a revoked certificate as secure

I downloaded a revoked certificate from the website https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/. Specifically, the revoked certificate of the site https://revoked-rsa-ev....
-2
votes
2answers
84 views

Free EV on localhost

I am doing some pen test on my localhost I was wondering if I could find an EV certificate for localhost only. If you have an EV this is free just for localhost It will be find. I know EV is expensive ...
1
vote
0answers
34 views

Certificate for SSTP VPN server

I'm trying to set up an SSTP VPN on Windows Server 2019 Essentials (I was originally going to use L2TP/IPSec, but the company which manages our network infrastructure doesn't support it). I'm new to ...
1
vote
1answer
74 views

Algorithm and key size to choose for SSL certificates (security and CPU wise) in 2020 (using nginx)

I posted this question already on SO, but as it is not really a programmin question I thought it might be a better place to ask here: I want to setup a new SSL certificate store for generating SSL ...
6
votes
2answers
2k views

Why/how does Firefox bypass my employer's SSL decryption?

My employer has set up what they're calling "SSL decryption" for Internet access from within the company. I believe this is provided by an f5 device. They have installed a trusted root certificate on ...
27
votes
3answers
39k views

Generate CSR from existing certificate

Can we generate the CSR (certificate signing request) used for certificate signing from the signed certificate? It should work with the original private key when signed again with different authority.
11
votes
2answers
2k views

Is an identity certificate the same as a public key?

I'm new to public key infrastructure but I think I understand how public key encryption works, conceptually. So a public key is, by definition, public and not a secret. Recently when I came across ...
0
votes
0answers
34 views

Exporting SSL Certificate to 3rd Parties

One of our 3rd party service provider wants us to create a certificate PFX file in order to host an application outside our network from xxx.companyname.com What are the security risks about this? ...
0
votes
1answer
38 views

Credential encryption scenarios using certificates

Situation: We have several service accounts (AD) that need to use a limited set of credentials. These service accounts run scripts (PowerShell & Python), etc on different servers, requiring these ...
1
vote
1answer
69 views

Firefox does not trust Burp Suite's certificates in case of accessing sharepoint online

I want to investigate requests/responses between firefox and some private mysite.sharepoint.com site which I could access using my microsoft's email and password. For this I've configured Burp Suite'...

1
2
3 4 5
50