Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
3
votes
5answers
893 views

Is EV green extended validation slower than a regular SSL?

How does EV green extended validation SSL certificate affects the speed of my web site (if at all) comparing to a regular SSL? Also, my provider only allow the EV green certificates to be on the root ...
1
vote
1answer
69 views

Explanation required on Relationship between “Certificate Type” and “Key Exchange Algorithms” in TLS 1.2

A certificate, in itself, (RFC 5280) does not seem to have any indicator of what algorithm was used (for example the argument to openssl req -newkey) to create the public and private keys ("...
2
votes
1answer
1k views

Use Personal certificate without a key with Firefox

We have a website that authenticates the user using a certificate. The certificate is installed by the IT department and I can't export it with the private key. When I navigate the website with ...
0
votes
1answer
120 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me their S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not ...
5
votes
1answer
165 views

Can someone explain the “Section 4.2.1.3. Key Usage” extension in RFC 5280 as it relates to TLS 1.2 RFC 5246

There are references in TLS 1.2 RFC 5246 about use of certificates (server and client). I am unclear about the "key usage" extension of a certificate as it relates to TLS 1.2 and that too for data ...
3
votes
3answers
2k views

Employer wants me to install root certificate to work remotely - privacy concerns?

My new employer wants me to install a root certificate on my computer as trusted in order to work remotely. I believe it is to use Cisco AnyConnect vpn. I don't really have a clear understanding of ...
0
votes
2answers
73 views

Who/what maintains the CRL for a web server's client certs?

In the instance of a web server that requires client certificates to log in, what exactly is creating and updating the CRL? From all of the examples I see, it is a manual process. Is it really a ...
0
votes
1answer
200 views

Differences in certificate verification between ssl libraries

I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
3
votes
3answers
3k views

Restrict Microsoft Network Policy Server (NPS) to only trust client certificates from a given CA?

I'm working on an install of a Microsoft Network Policy Sever (NPS) / RADIUS server for controlling access to corporate Wi-Fi using 802.1x / WPA2-Enterprise - using client certificates for ...
1
vote
2answers
374 views

Does the “Key Encipherment” key usage make sense when using ECDH P384?

I configured a Windows CA and created a certificate template to issue certificates with ECDH_P384 keys: Then I noticed that it's not possible to set the "Key Encipherment" key usage in the "...
1
vote
1answer
79 views

Is this a PEM certificate?

I'm doing research on certificates and I've managed to find a dataset. It is a single large text file where each line appears to be a PEM encoded certificate but I am unable to load them using pythons ...
0
votes
1answer
125 views

Why generate dedicated issuer CA for TSU certificates?

I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME ...
0
votes
1answer
200 views

Default values for distinguished_name

Creating certificate: openssl req -new -newkey rsa:2048 -keyout private/cakey.pem -out careq.pem -config ./openssl.cnf I have value that tells openssl not prompt for req_distinguished_name fields: ...
4
votes
1answer
506 views

Certficate pinning: should I pin the leaf or intermediate?

I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp. As our app clients do not update their app regulary I don't want to take the risk ...
1
vote
1answer
57 views

What's the block cipher mode of my PEM certificate?

How can I find out the mode block cipher used in a PEM certificate I have? It's been generated with an intermediate CA that does sha256WithRSAEncryption but I need to find out if it's a GCM or CBC to ...
0
votes
2answers
511 views

Why is hotmail mail server providing an invalid certificate?

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com. Both the mail server hostname and TLS ...
4
votes
1answer
199 views

Certificate and Path validation for S/MIME

I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My ...
5
votes
2answers
235 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
3
votes
2answers
74 views

Client Certificates from Public Certificate Authorities

I'm looking into mutual TLS authentication for a B2B API. Is it possible to use mutual TLS authentication using X.509 certificates while relying on Public CAs? I see that some Public CAs (from CA/...
3
votes
1answer
278 views

Do mobile apps have their own certificate store?

When a mobile app is sending HTTPS requests, it verifies the server certificate against some kind of certificate store. My question is, would that certificate store be provided by the phone's OS, or ...
1
vote
3answers
185 views

Difference between certificate and digital signature [duplicate]

What is the difference between a digital certificate and a digital signature? Read on the internet that the digital signature is the result of encrypting with a private key, the 'hash' of the message ...
0
votes
1answer
182 views

Forced to install certificate on my laptop when using company WiFi. Risk? [duplicate]

My company has a 'bring your own device' policy. You connect your device to the WiFi, and then open a citrix environment through a web portal. Basically, everything inside the citrix env is company-...
1
vote
1answer
45 views

In client side certificate authentication why, if, do we need to share the certificate

Certificate authentication on https has always been one of my huge knowledge gaps ,and was trying to fill it today. I have made some progress on the client side certificate authentication but however ...
1
vote
0answers
40 views

Export IOS Certificates and Configuration Profiles

Is there anyway to export a configuration profile from an IOS device that you have root on? So I have a device with an MDM profile with login credentials for a wifi network, VPN, and email ...
1
vote
1answer
44 views

key usage attributes and enhanced key usage attributes overwritten with CA template properties

I have generated a csr with key usage attributes and enhanced key usage attribute but when we sign with the computer template in Microsoft CA, it overwrites the attributes in the CSR, how do i ...
97
votes
7answers
136k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
1
vote
0answers
139 views

Breakdown of signature verification in CertificateVerify (TLS 1.3) with RSA-PSS

I'm debugging a TLS v1.3 client program, which failed to verify the signature in server's CertificateVerify, so I'm learning the procedures for verifying the signature from server's CertificateVerify ...
8
votes
1answer
277 views

Is a self-signed certificate from my ISP-provided router a security threat?

I recently found out that in order to log on to the web-based administration tool on my ISP-provided router, I need to accept a self-signed certificate it offers. I did a bit of reading and it sounds ...
1
vote
1answer
1k views

In AWS EKS, how should Kubernetes certificates be generated?

This article from 2018 states (emphasis mine): It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
1
vote
0answers
61 views

Self-signed SSL certificates vs CA-signed certificates [duplicate]

While reading about certificates, I came across this article. It says: The point of a CA-signed certificate is to give slightly stronger verification that you are actually using the key that ...
2
votes
1answer
73 views

Is it possible to renew a certificate to allow end users to continue using the existing one, rather than having them implement the new one?

My organization has several certificates used for web services that are going to expire soon. We want to have these certificates renewed so that the service to our clients is uninterrupted and doesn't ...
1
vote
1answer
353 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...
1
vote
1answer
67 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
0
votes
1answer
66 views

Is Certification path construction algorithm needed for SSL/TLS?

In the TLS Handshake a Certificate message is sent. This message contains the (chain of) certificates needed to validate the provided certificate of the communicating party. However, I have also ...
0
votes
0answers
146 views

A certificate contains an unknown extension that is marked “critical.”

I recently got my digital certificate to sign my software. Today I signed my first piece of software, it all went well until, I got the error, "A certificate contains an unknown extension that is ...
1
vote
1answer
70 views

How to import SSL certificates into OpenSSL

I have server certificates for making SSL connection. So, whenever I execute openssl s_client -engine gost -CApath /usr/local/share/ca-certificates/ -connect lk.egrz.ru:443 -servername lk.egrz.ru I ...
1
vote
1answer
170 views

Request certificate expiration date in CSR

I want to see how my application will behave in case if the SSL certificate expires. CSR are signed by CA, so they are not self-signed and the validity period is 2 years. For my test I want to set ...
0
votes
1answer
151 views

SSL certificate with IP

I have an embedded device and it is running a https server. This device will be accessed from a standard web browser using the IP address. I am generating a TLS certificate. I have added a commonName (...
0
votes
1answer
82 views

SSL server sends wrong certificate when accessed via Java

In my project I have to integrate with another system which uses quite specific SSL (and also specific cipher suite). Here's what I mean. Whenever I try to access the server with Java (send a request)...
0
votes
1answer
201 views

In Windows How to determine encryption algorithm used in certificate

How can one determine the encryption algorithm type (e.g. AES, DES, 3DES, etc.) that is used by a certificate in Windows (10, 2012-2019)? Is it obvious, and I'm just not seeing it in the certificate ...
12
votes
4answers
28k views

Missing X509 extensions with an openssl-generated certificate

My goal is to create a certificate with opensslsimilar to this one generated with cfssl Certificate: Data: Version: 3 (0x2) Serial Number: 60:44:dc:0d:80:f4:54:55:e8:...
3
votes
1answer
240 views

Good practices for protecting a machine certificate against extraction

Consider the following scenario: You are providing VPN access for a number of machines running Windows 10. The machines are configured and hardened according to company standards. You rely on machine ...
2
votes
1answer
107 views

If I accept a root Cert what am I opening myself up to?

If I connect to a WIFI AP and it wants to install a root cert. They read my HTTPS traffic, Right? Does using OpenSSH on my cell phone to my home router help protect me? Or can this traffic be ...
8
votes
3answers
10k views

Is it required to have the same Domain Name and Common Name for SSL Certificate?

I have an SSL cert in which CN is "abc.xyz.com". But the url shared to 3rd party organization to access a web app on our server is: "def.stu.com/what-ever". When this arrangement is working for ...
327
votes
6answers
272k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
1
vote
1answer
91 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
1
vote
0answers
44 views

How attackers bypass windows smart screen [closed]

I'm curious to how attackers gain access to valid EV certificates that bypass windows smart screen (for malware delivery/execution) or how they sign these malicious software(s) without access to EV ...
1
vote
0answers
354 views

Why is certificate rejected in firefox, but not IE and Chrome

Question: Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain). Is there a ...
0
votes
2answers
1k views

Is it possible to catch public key certificate in network and hack the public key so you could pretend that you were someone else?

I am very confused about the way of sending the CA's certificate to another party. What if some hacker is monitoring the network in the moment you send a certificate to other party and hacks the ...
4
votes
2answers
7k views

CSR with only public key with openssl

So I have been doing my research and haven't found anything specific enough to my problem. As the question title states, I want to make a CSR with only the public key. What I have been able to do is ...

1
3 4
5
6 7
50