Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
4
votes
1answer
2k views

exponent value in certificates

I have seen that in gmail, there are 3 certificates in hierarchy. I noticed that all the certificates have the same exponent(65537 with 24bits). Why is the exponent value same for all certificates and ...
0
votes
2answers
2k views

Issuing browser certificates to Chrome and Firefox with Microsoft CA

Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval. Since many browsers either block or don't support ActiveX controls, how can I enroll them using a ...
3
votes
1answer
2k views

How to generate self-signed certificate for S/MIME with usage 'signing' only, like DOD uses

I'm testing a feature to support S/MIME mail signing and encryption. As far as I know US DOD has quite strict standard on these certificates. So that DoD uses separate authentication, signing, and ...
7
votes
2answers
3k views

Is DIGEST-MD5 secure if done over HTTPS?

If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?: Digest access authentication is intended as a security ...
7
votes
1answer
2k views

How secure is TOTP key on phones?

Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
1
vote
1answer
126 views

valid intermediate certs not in browser

Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
1
vote
2answers
203 views

SSL/TLS Certificate Authority supply policy

I would like to ask for recommendations regarding the following issue: As a company with a number of customers worldwide we supply our product to many different sites. We need to shape our policy ...
9
votes
3answers
9k views

Any good free SSL proxy on windows? [closed]

I'm looking for SSL proxy capable of dumping requests. I want to test custom browser against SSL-MITM attacks. I'm able to re-route all traffic ongoing from browser to machine with proxy. ...
3
votes
2answers
3k views

Secure communication between C# client and Java server, using certificates

I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on: server send RSA public key to ...
19
votes
2answers
2k views

Encryption and the “security time decay” of prior encrypted data

This question is on the assumption that any data once encrypted, may (eventually) be decrypted through Brute force (compute power/time) Exploits in the cryptography used Theft of private keys Most ...
2
votes
1answer
442 views

Does iOS use built-in certificates to authenticate peers when using ipsec VPNs?

Suppose I am setting up an IPsec VPN for Apple iOS clients with the requirement that the iOS clients need to know that the server is legitimate and vice-versa. I create a root CA and issue a ...
0
votes
1answer
393 views

id-ce-cRLDistributionPoints ASN.1 / DER encoding question

I have a file - test.pem - with the following contents: -----BEGIN CERTIFICATE----- MBIwEKAOoAwwCqMIMAZhBEFCQ0Q= -----END CERTIFICATE----- openssl asn1parse -inform PEM -in test.pem -i returns the ...
2
votes
1answer
662 views

Does client certificate authentication demand more server-side entropy?

We have a secure web service running Apache that requires client certificates for access. This service has a problem with running out of entropy. We have several other sites that use TLS that get ...
19
votes
1answer
14k views

Getting a Root CA accepted in systems and browsers

I would like to ask about the procedures for a given CA to get one of its root CAs (SSL issuance CA) to get accepted and installed as a trusted root CA in operating systems and browsers.
2
votes
1answer
154 views

CSR generation origin?

Platform: Windows 7 x64 Development: .NET 4 Web Server: HttpListener (IIS not installed, will not be installed :) ) Can Machine A generate a Certificate Signing Request for Machine B and have the ...
3
votes
3answers
254 views

What is the worse that could happen if a government wanted to interfere with a CA?

In our time of SOPA, PIPA and ACTA, I was wondering what could happen if a government wanted to remove the certificate of a website ? CA are companies, so they would have to obey to instructions from ...
8
votes
3answers
343 views

Would using distinct IP addresses help support browsers with older SSL implementations?

We have a site with two wildcard certificates: *.foo.com and *.bar.foo.com. All of our subdomains resolve to the same IP address. Newer browsers work fine with this, but IE7, for example, does not. ...
4
votes
1answer
1k views

X.509 algorithm identifier parameters vs. extension values

From the X.509 specs: AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } ...
3
votes
1answer
2k views

Why doesn't asn1parse parse all DER encoding strings?

I have a file - crl.txt - that contains the following: MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw= It's from one of the extensions in a particular X.509 cert. Why ...
8
votes
1answer
5k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
3
votes
1answer
3k views

parsing the id-ce-keyUsage extension in X.509 certs

I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows: ...
7
votes
4answers
714 views

What fields in a suspicious certificate should I look at?

Looking at a certificate for a web-site (in Windows/Google Chrome) I see it lists the following fields Version Serial number Signature algorithm Issuer Valid from Valid to Subject Public Key Basic ...
6
votes
3answers
15k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
8
votes
1answer
331 views

Why are website certificates secure?

I understand how HTTPS connections work, and I also understand they they require a certificate to know that the secure connection you have is with the right server (and not someone pretending to be ...
4
votes
1answer
3k views

Purpose of certificates signed and trusted by CA

Another newbie question but I just don't get the purpose of certificates signed and trusted by CA. We already have public/private keys, hash functions to sign/encrypt messages so why do we need ...
12
votes
3answers
617 views

Incorrect use of HTTPS?

When I open https://java.com my browser says “untrusted connection” but when I open https://www.java.com my browser says it’s ok. But it's the same site. So my question is: Is this a security bug? It'...
3
votes
2answers
2k views

How to make a certificate encrypted flash drive?

I was wondering if it possible to encrypt a flash drive (or any other external medium) using certificates instead of a password. The idea is to have a number of encrypted pendrives that can be used on ...
15
votes
4answers
2k views

Is my Company Tracking Me?

Every time I try to connect to a site through HTTPS from my office computer, there is a Certificate Error thrown 2-3 times before showing the login screen. Till now I use to ignore this and click ...
6
votes
3answers
479 views

Are SSL certificates from a CA necessary for secure communication?

Am I right in thinking that SSL certificates from a CA are purely for identification purposes and serve no purpose in the actual encryption of data? In other words if I were to create a self signed ...
6
votes
3answers
467 views

Why are CA's signing keys available on the internet

I am not very knowledgeable about CA certificates, but I thought these things mainly said "The public key for bank X is Y, and this is verified by CA Z". Once you've bought this certificate, there is ...
3
votes
1answer
1k views

What kind of certificate do I need to be able to make and sign my own digital signing certicates?

At build time for a program, I would like to generate a new key pair, and create a certificate that will be embedded (securely) into the program. The purpose of the key pair is to digitally sign an ...
1
vote
3answers
1k views

Benefits to using EV certificates with a privately hosted Certificate Authority

For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate? Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the ...
1
vote
2answers
193 views

How can I force certain the webclient to honor or remember certain parameters from the webserver?

HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...
6
votes
2answers
985 views

How practical is a certificate's “basic constraint” property in protecting my HTTPS / SSL session?

Suppose a leaf node creates a certificate for a different domain, acting as a CA. Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be ...
5
votes
1answer
601 views

How secure is a https website? [duplicate]

Possible Duplicate: Does an established ssl connection mean a line is really secure When I visit a website -- say, https://ebanking.pick-your-bank.com -- my browser (fully patched version of ...
19
votes
3answers
4k views

What are the risks of a Certificate Authority hack for 'the average user'?

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
4
votes
2answers
176 views

Need an overview of web service / web site security world, where do I start? [duplicate]

Possible Duplicate: Resources to learn about security I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and services ...
3
votes
1answer
3k views

Securing WCF service with X.509 cert [duplicate]

Possible Duplicate: What is the difference between an x.509 “client certificate” and a normal SSL certificate? I'm getting really confused with WCF and certs. I have a WCF service ...
1
vote
1answer
163 views

Challenge Response across several hops

This is a follow-up question to "When should I use Message layer encryption vs transport layer encryption". I need to send a certificate from the mobile phone to the server. Regardless of all the ...
3
votes
3answers
183 views

Warn about specific CA in Firefox

Consider a setup where all HTTP/HTTPS traffic goes through a proxy. The certificate of this proxy must be trusted by all browsers (in this case, Firefox). This certificate replaces the original ...
9
votes
3answers
592 views

Are there any smartcard/hardware-tokens for certificate-based authentication which are easily destroyed?

It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can ...
7
votes
2answers
4k views

Getting self-signed SSL certificates for all https connections made from some premises

Context: I'm currently working as an expat for my company in a country where the Internet is notably untrustworthy. It made the headlines a few months ago for stealing facebook, twitter and gmail ...
7
votes
1answer
3k views

How do I learn Cryptographic/Mathematical notation

I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation. How do I learn this notation and how to convey my approach? How can I annotate this ...
8
votes
1answer
550 views

distributing files to VPN partners

suppose i've created VPN certificates for a certain VPN-RoadWarrior-Client, expressed in the files VPN-RoadWarrior-Client.key and VPN-RoadWarrior-Client.crt*, however VPN-RoadWarrior-Client is ...
16
votes
1answer
4k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
6
votes
3answers
2k views

Certificate chain

For my computer to verify the identity of a certain certificate should it have all the certificates up to the root certificate?
6
votes
3answers
743 views

Personal digital certificate how to verify

A server certificate would have its domain name at its subject field. A personal certificate would have your name as the subject field. How can you be sure that there are no two certificates with the ...
5
votes
2answers
5k views

Dealing with expired or revoked signing certificates with Infopath documents

Suppose I have an Infopath form that is digitally signed today by a valid, and active user. When that user leaves the company, we disable the account and revoke the certificate. This causes a problem ...