Questions tagged [certificates]
A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.
527
questions
38
votes
3
answers
23k
views
What does it mean for a digital certificate to be "signed"?
When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
- 951
33
votes
3
answers
61k
views
Is it technically possible to configure two different SSL certificates for the same domain?
Say I have these URLs:
https://example.org/
https://example.org/criticalpath
I want the first one to be served with a domain validated commercial SSL certificate and the second one with an extended ...
- 2,858
31
votes
4
answers
22k
views
What elliptic curves are supported by browsers?
I Wireshark'ed a Firefox 3 request, because I couldn't find the curve names documented:
Elliptic curve: secp256r1 (0x0017)
Elliptic curve: secp384r1 (0x0018)
Elliptic curve: secp521r1 (0x0019)
What ...
- 1,781
31
votes
4
answers
92k
views
What is the purpose/role of the "alias" attribute in Java keystore files?
I've heard conflicting information about the purpose of the alias attribute in Java keystore files. Can someone please clarify on what exactly this attribute is, and what it should be set to when ...
- 3,458
28
votes
3
answers
3k
views
Does any technology prevent a CA unilaterally revoking a certificate?
As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP).
In an increasingly TLS world, what current technology stops a CA shutting ...
- 1,122
27
votes
5
answers
21k
views
Is it safe to send a CSR via email?
I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?
- 587
25
votes
3
answers
13k
views
Is SHA1 weak for SSL?
I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
- 2,737
25
votes
3
answers
10k
views
What happens when an Intermediate CA is revoked?
Currently I’m working on a certificate manager that allows our product to securely connect to remote web services (over TLS/SSL). For security, we use Certificate Revocation List checking (or CRL-...
- 353
24
votes
6
answers
32k
views
Possibility to sniff HTTPS traffic on devices without installing a certificate
My goal is to sniff the HTTPS traffic of some digital devices (AppleTV, game consoles, etc.), and decrypt the HTTPS packets in my local network.
I cannot figure out a way by using some HTTPS ...
- 359
23
votes
4
answers
13k
views
Can an intermediate CA be trusted like a self-signed root CA?
Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
- 4,243
22
votes
3
answers
4k
views
Which signing key should I use for certifying other peoples public keys: master or subkey?
I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA).
I sign documents with the signing subkey: GnuPG selects this key ...
- 410
22
votes
2
answers
31k
views
Recommended key usage for a client certificate
My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicates with the server to a path that requires a ...
- 369
21
votes
2
answers
31k
views
How is an X509 certificate signer verified?
Lets say I create a self-signed X509 certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question ...
- 467
20
votes
5
answers
19k
views
Which encryption algorithm is used in password protected *.pfx/PKCS 12 certificates?
As the title says, I can't find any resources on which encryption algorithm is used in *.pfx/PKCS 12 certificates that are password protected.
- 996
20
votes
4
answers
3k
views
Dealing with SSL Certificates on Products
We are developing a product (device / system) that will be installed on customer sites. Many of our customers will (should) be concerned about security, and should be thinking about it seriously.
Our ...
- 303
20
votes
7
answers
5k
views
Is there a protocol that provides data integrity, but not encryption for HTTP?
HTTP
I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed.
HTTPS
On the other hand, HTTPS sends encrypted text over the network that can ...
- 2,361
19
votes
2
answers
4k
views
SSL fingerprint inconsistency: what does it mean?
I apologize if this is not the best place to ask my question on the Stack Exchange network, I couldn't figure out where to get enough attention and be relevant.
Facebook provides a SSL host, it can ...
- 762
19
votes
1
answer
7k
views
Why does GoDaddy have four different certificate chain, G2, G3, G4?
I see from Godaddy they have multiple certificate chains https://certs.godaddy.com/repository
GoDaddy Certificate Chain
GoDaddy Certificate Chain - G2
GoDaddy Certificate Chain - G3
GoDaddy ...
- 293
18
votes
4
answers
8k
views
Why is it a good idea that X.509 digital certificates have an expiry date?
What is the benefit of having certificates expire at some fixed date?
Waz
17
votes
5
answers
7k
views
Does HTTPS Everywhere defend me against sslsniff-like attacks?
http://www.thoughtcrime.org/software/sslsniff/
If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
- 6,279
16
votes
1
answer
4k
views
Is it safe to let apt-get applications install root certificates?
I've recently installed Pinta, a program for drawing and image editing, and as part of the installation it installed 173 root certificates (see below).
Is it normal practice to do so? Why does it ...
- 761
16
votes
1
answer
21k
views
Are certificate sans case sensitive
Creating a certificate request for my exchange server I am wondering if sans and CNs are case sensitive?
- 499
15
votes
3
answers
15k
views
Why is my Positive SSL certificate deemed insecure by Google Chrome? [duplicate]
We run a website over HTTPS with a wildcard certificate from Positive SSL.
Today, when I opened Google Chrome (v. 42.0.2311.90 m) and navigated to the site, I noticed a red cross through the https ...
- 253
14
votes
4
answers
2k
views
Why isn't OCSP required by default in browsers?
According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers.
Can someone please explain why this isn't ...
- 6,279
14
votes
2
answers
8k
views
Benefits of a wildcard vs per-subdomain certificates
As you might know, Let's Encrypt doesn't offer wildcard certificates and it won't in a short-term because you can just order as many certificates as you want for the sub-domains.
This make me wonder.....
user15194
13
votes
2
answers
31k
views
OpenSSL, x509: what's the significance of CN (Common Name)?
With regard to these three items
Certificate Authorities (CA)
Gateway certificates
End-point Certificates (client-cert)
What is the significance of the Common Name CN with regard to the a VPN? Does ...
- 2,811
13
votes
1
answer
16k
views
Encrypting local HTTP traffic using a self-signed certificate
For the past couple of hours I've been trying to create a self-signed certificate which I'd like to use to encrypt HTTP traffic between computers and a server on my home network (because I'm paranoid ...
- 233
11
votes
2
answers
27k
views
Obsolete cryptography (SHA1) warning although certificate uses SHA256
I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message:
Your connection is encrypted with obsolete cryptography.
The connection is encrypted using AES_256_CBC,...
- 223
11
votes
3
answers
12k
views
Is it OK to create a new SSL certificate before the old one expires?
Over the past year I have created multiple SSL certificates that are all valid for a year. In a week or so, the first will expire. I thought it would be practical if all my certificates would have the ...
user21287
11
votes
3
answers
12k
views
How does an SSL server prove its identity?
This document says that a challenge response authentication proves the servers identity. But is a man in the middle attack still possible if the client does not verify domain name ? Please help me ...
- 1,787
11
votes
4
answers
25k
views
Do I need a new CSR for a certificate renewal?
I want to renew my expired certificate I'm using in Tomcat for SSL. Other posts indicate that to renew my certificate I need to create a new CSR and obtain a new certificate and import into my ...
- 323
11
votes
3
answers
8k
views
Best practices to implement HTTPS in embedded devices
Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...
- 211
10
votes
4
answers
4k
views
Why does Windows have a place to store intermediate SSL certificates?
As I understand the process of verifying a remote computer's SSL certificate, the remote system sends its 'leaf' certificate and any intermediate certificates, but not the root certificate. Executing ...
- 521
10
votes
1
answer
470
views
How can I protect myself against software installing insecure root certificates?
With the recent news that Dell installed a root certificate with a publicly accessible private key on their notebooks, I'm wondering how I can protect myself against this kind of incompetence. Of ...
- 891
10
votes
1
answer
645
views
Is the ACME HTTP-01 challenge secure against MITMs?
Many certificate authorities these days use the ACME protocol to automate the process of certificate issuance. This includes verifying that the applicant is the owner of the domain. And the most ...
- 203
10
votes
3
answers
6k
views
Adding custom data in X.509 certificate
I am using SSL with client authentication. I need to send some extra data while sending the client certificate? Can I send it in the certificate? Can I use the extension fields in certificate for that ...
- 473
10
votes
2
answers
29k
views
What role do hashes play in TLS/SSL certificate validation?
After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
- 4,763
9
votes
2
answers
5k
views
How to create an Apple Installer Package Signing Certificate
How can we create a certificate with the following Extended Key Usage extension using OpenSSL?
Extended Key Usage extension, critical, with a purpose containing Developer ID Installer Package Code ...
- 213
9
votes
3
answers
11k
views
How would you know a certificate/private key if you extracted it from RAM? Or would you?
Related to, of course, the heartbleed vulnerability, I've been reading the news about the worst case scenario for this attack being the extraction of the SSL private key, because, of course, this ...
- 3,407
9
votes
3
answers
9k
views
Does checking the fingerprint of a self signed certificate improve security?
I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
- 341
9
votes
2
answers
16k
views
Create certificate without private key with OpenSSL
I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely fine,...
- 171
9
votes
2
answers
6k
views
Did google chrome kill public key pinning?
I've read many articles talking about google chrome killing public key pinning in Chrome 67 (May 2018). See here, here, and here.
However, I haven't found any information about whether or not they ...
- 31.2k
8
votes
2
answers
2k
views
Signing my certificate by using my smart card and eID card?
In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication.
I ...
8
votes
6
answers
3k
views
I see two different sets of certificates for Google websites when I am at work and when I am at home
I see two different sets of certificates for Google websites when I am at work and when I am at home.
I mean if I save the certificates (in firefox, click on the "Google.com" block on the left of ...
- 733
8
votes
1
answer
9k
views
Can a certificate have multiple chains and multiple self-signed roots?
The following MSFT document has this paragraph:
All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed
certificate,...
- 50.9k
8
votes
4
answers
8k
views
Does http support encryption without https (like STARTTLS)?
Does http support encryption without https, akin to STARTTLS in smtp?
This may sound like a stupid question, but just think about it.
Banks require strong encryption, and cannot do business without ...
- 1,964
8
votes
3
answers
12k
views
Root CA with Extended Key Usage fields
I recently started using AWS's Certificate Manager to get free TLS certificates for my load balancer. When I was inspecting the certificate chain I noticed that the Root CA, Starfield Class 2 ...
- 255
8
votes
1
answer
2k
views
A workplace installs custom certificates on personal devices, can this be used to decrypt HTTPS traffic? [duplicate]
So another engineer buddy of mine and I were having a drink the other night. He mentioned that you're allowed to use personal devices on the office wifi, but that they install a custom certificate so ...
- 231
8
votes
1
answer
30k
views
Windows Certificates - where is private key located?
In Windows 10:
When I load a certficate into the "Current User" store, it puts a private key file here:
C:\Users\[userID-A]\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-xxx\...
- 197
8
votes
6
answers
10k
views
How can I know that the CA certificates in my computer have not been spoofed?
As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...
- 183