Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
18
votes
5answers
7k views

Does Google use extended validation certificates?

I just changed a password on a Google account while using the Chrome browser. After doing so, I noticed that the https connection to Google was not highlighted in green signifying that it was an "...
0
votes
0answers
60 views

Is this a valid equation for determining certificate lifetimes in a PKI infrastructure?

I have an intuitive sense of how certificate lifetimes should work in a PKI infrastructure, but I don't consider myself an expert in this field so I would like someone to validate or critique my ...
0
votes
0answers
27 views

Can CN=localhost be used on a server that should run on any machine [duplicate]

Got a query about self-signed certificates that after doing several searches I don't feel I've got a concrete answer for. Say I have generated a self-signed server certificate with CN=localhost. Does ...
0
votes
1answer
90 views

Comodo dragon gives me warning about certificates installed on my system

today I was surfing the web with Comodo dragon browser and it gave me this warning: it don't tell me which certificate! is there any tool that I can use to scan my installed certificates? and also ...
0
votes
2answers
72 views

Do CAs issue intermediate Certificate for each new certificate request?

Do CAs issue intermediate Certificate for each new certificate? I am new to certificates and asking this to understand if the CAs have a ready set of intermediate certificates they use to issue leaf ...
-1
votes
2answers
64 views

Binding self signed certificate to a signed application/exe

This is a follow up to this question I asked before. While I am happy to custom verify the certificate from the client side using the thumbprint approach, there is one additional scenario I wish to ...
1
vote
1answer
86 views

Custom certificate verification using thumbprint

I'm trying to confirm if the approach I'm thinking of taking towards verifying a self signed certificate is sound, or if I'm going about it the wrong way. I'm no security expert, so bear with me ...
1
vote
1answer
261 views

Generate certificate v3 instead of v1

Trying to get certificate v3, but getting v1. I'm using following commands: openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config san_server.cnf openssl ca -config san_server....
0
votes
1answer
72 views

Which certificate on my computer is used to make a SSL/TLS handshake

When connecting to a specific website(www.test.yyy.com) inside of an organisation SSL/TLS handshake is performed. From my understanding, I would say that one of my personal certificates on computer is ...
11
votes
3answers
1k views

Trying to understand how Digital Certificates and CA are indeed secure

I understand that Digital Certificates and Certificate Authorities (trusted 3rd parties) help prevent man in the middle attacks during HTTPS connections. However, I am confused on a few details. Let'...
1
vote
1answer
73 views

Which has to handle certificate, a website, a web server or a web application?

In web, what is a certificate issued to, a website, a web server or a web application? Which has to handle certificate, a website, a web server or a web application? For example, when I run a web ...
1
vote
1answer
54 views

How does a digital certificate prevent impersonation by holding other's certificate? [duplicate]

As far as I know, a digital certificate contains information about a user or firm that has been vouched for by a trusted organization. https://www.geeksforgeeks.org/digital-signatures-certificates/ ...
2
votes
0answers
172 views

Firefox SSL_ERROR_BAD_CERT_DOMAIN but the names are correct

Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was ...
58
votes
4answers
94k views

How does the digital signature verification process work?

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
1
vote
0answers
62 views

Confirming the validity/ownership of a Android Signing Certificate

I have a certificate that says the application was signed by Google, but on multiple searches I have reason to believe that it's not actually a google signing certificate. Is there a way to query ...
0
votes
2answers
74 views

Using the same password to encrypt and to authenticate other actions

Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN. I would also like to use this same PIN as a secondary protection for some ...
0
votes
0answers
63 views

CA Root Certificate with same subject

Let's assume I have issued two root certificates for my domain - a RSA and a ECDSA one. Both have the same subject. As far as I know, the subject does not have to be unique. Do crypto libraries such ...
1
vote
1answer
189 views

openssl: does -keyform engine enables accessing TPM persistent handles with any key arguments ? Even with third party plugin like CMP?

If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ? Will it work with extensions, like CMP for OpenSSL, for ...
3
votes
5answers
882 views

Is EV green extended validation slower than a regular SSL?

How does EV green extended validation SSL certificate affects the speed of my web site (if at all) comparing to a regular SSL? Also, my provider only allow the EV green certificates to be on the root ...
1
vote
1answer
69 views

Explanation required on Relationship between “Certificate Type” and “Key Exchange Algorithms” in TLS 1.2

A certificate, in itself, (RFC 5280) does not seem to have any indicator of what algorithm was used (for example the argument to openssl req -newkey) to create the public and private keys ("...
2
votes
1answer
1k views

Use Personal certificate without a key with Firefox

We have a website that authenticates the user using a certificate. The certificate is installed by the IT department and I can't export it with the private key. When I navigate the website with ...
0
votes
1answer
114 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me their S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not ...
5
votes
1answer
148 views

Can someone explain the “Section 4.2.1.3. Key Usage” extension in RFC 5280 as it relates to TLS 1.2 RFC 5246

There are references in TLS 1.2 RFC 5246 about use of certificates (server and client). I am unclear about the "key usage" extension of a certificate as it relates to TLS 1.2 and that too for data ...
3
votes
3answers
2k views

Employer wants me to install root certificate to work remotely - privacy concerns?

My new employer wants me to install a root certificate on my computer as trusted in order to work remotely. I believe it is to use Cisco AnyConnect vpn. I don't really have a clear understanding of ...
0
votes
2answers
72 views

Who/what maintains the CRL for a web server's client certs?

In the instance of a web server that requires client certificates to log in, what exactly is creating and updating the CRL? From all of the examples I see, it is a manual process. Is it really a ...
0
votes
1answer
182 views

Differences in certificate verification between ssl libraries

I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
2
votes
3answers
3k views

Restrict Microsoft Network Policy Server (NPS) to only trust client certificates from a given CA?

I'm working on an install of a Microsoft Network Policy Sever (NPS) / RADIUS server for controlling access to corporate Wi-Fi using 802.1x / WPA2-Enterprise - using client certificates for ...
1
vote
2answers
311 views

Does the “Key Encipherment” key usage make sense when using ECDH P384?

I configured a Windows CA and created a certificate template to issue certificates with ECDH_P384 keys: Then I noticed that it's not possible to set the "Key Encipherment" key usage in the "...
1
vote
1answer
79 views

Is this a PEM certificate?

I'm doing research on certificates and I've managed to find a dataset. It is a single large text file where each line appears to be a PEM encoded certificate but I am unable to load them using pythons ...
0
votes
1answer
117 views

Why generate dedicated issuer CA for TSU certificates?

I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME ...
0
votes
1answer
157 views

Default values for distinguished_name

Creating certificate: openssl req -new -newkey rsa:2048 -keyout private/cakey.pem -out careq.pem -config ./openssl.cnf I have value that tells openssl not prompt for req_distinguished_name fields: ...
4
votes
1answer
419 views

Certficate pinning: should I pin the leaf or intermediate?

I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp. As our app clients do not update their app regulary I don't want to take the risk ...
1
vote
1answer
55 views

What's the block cipher mode of my PEM certificate?

How can I find out the mode block cipher used in a PEM certificate I have? It's been generated with an intermediate CA that does sha256WithRSAEncryption but I need to find out if it's a GCM or CBC to ...
0
votes
2answers
493 views

Why is hotmail mail server providing an invalid certificate?

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com. Both the mail server hostname and TLS ...
4
votes
1answer
197 views

Certificate and Path validation for S/MIME

I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My ...
5
votes
2answers
233 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
3
votes
2answers
72 views

Client Certificates from Public Certificate Authorities

I'm looking into mutual TLS authentication for a B2B API. Is it possible to use mutual TLS authentication using X.509 certificates while relying on Public CAs? I see that some Public CAs (from CA/...
3
votes
1answer
249 views

Do mobile apps have their own certificate store?

When a mobile app is sending HTTPS requests, it verifies the server certificate against some kind of certificate store. My question is, would that certificate store be provided by the phone's OS, or ...
1
vote
3answers
177 views

Difference between certificate and digital signature [duplicate]

What is the difference between a digital certificate and a digital signature? Read on the internet that the digital signature is the result of encrypting with a private key, the 'hash' of the message ...
0
votes
1answer
166 views

Forced to install certificate on my laptop when using company WiFi. Risk? [duplicate]

My company has a 'bring your own device' policy. You connect your device to the WiFi, and then open a citrix environment through a web portal. Basically, everything inside the citrix env is company-...
1
vote
1answer
45 views

In client side certificate authentication why, if, do we need to share the certificate

Certificate authentication on https has always been one of my huge knowledge gaps ,and was trying to fill it today. I have made some progress on the client side certificate authentication but however ...
1
vote
0answers
39 views

Export IOS Certificates and Configuration Profiles

Is there anyway to export a configuration profile from an IOS device that you have root on? So I have a device with an MDM profile with login credentials for a wifi network, VPN, and email ...
1
vote
1answer
41 views

key usage attributes and enhanced key usage attributes overwritten with CA template properties

I have generated a csr with key usage attributes and enhanced key usage attribute but when we sign with the computer template in Microsoft CA, it overwrites the attributes in the CSR, how do i ...
95
votes
7answers
136k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
1
vote
0answers
121 views

Breakdown of signature verification in CertificateVerify (TLS 1.3) with RSA-PSS

I'm debugging a TLS v1.3 client program, which failed to verify the signature in server's CertificateVerify, so I'm learning the procedures for verifying the signature from server's CertificateVerify ...
8
votes
1answer
264 views

Is a self-signed certificate from my ISP-provided router a security threat?

I recently found out that in order to log on to the web-based administration tool on my ISP-provided router, I need to accept a self-signed certificate it offers. I did a bit of reading and it sounds ...
1
vote
1answer
1k views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
1
vote
0answers
60 views

Self-signed SSL certificates vs CA-signed certificates [duplicate]

While reading about certificates, I came across this article. It says: The point of a CA-signed certificate is to give slightly stronger verification that you are actually using the key that ...
2
votes
1answer
73 views

Is it possible to renew a certificate to allow end users to continue using the existing one, rather than having them implement the new one?

My organization has several certificates used for web services that are going to expire soon. We want to have these certificates renewed so that the service to our clients is uninterrupted and doesn't ...
1
vote
1answer
346 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...

1 2 3
4
5
49