Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0 votes
0 answers
93 views

Could a trusted CA pretend to be me and run a MITM? [duplicate]

Sorry for the basic question, I'm still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought ...
fruitless fruit juice's user avatar
0 votes
1 answer
220 views

Is Certificate Pinning safe and worthwhile for an API server that will only accept requests from an android application?

I have hosted an api on an AWS Windows server, imported ssl certificates from a known CA, and made https mandatory. Then built a client app that is an executable, then pinned the public key hash for ...
Subham Burnwal's user avatar
1 vote
0 answers
93 views

Best practice of x.509 client certificates accross multiple systems

I have several MongoDB's where I use x.509 Certificates to Authenticate Clients Let's say I create certificate and user for admin: subject: CN=admin issuer: CN=MongoDB Issuing CA -> db.createUser({...
Wernfried Domscheit's user avatar
0 votes
0 answers
62 views

How to Get Chrome to Prioritize Order of Errors Shown for Security Certificates

When you try to go to a website, chrome sometimes intercepts the connection and says there is a problem with the website's security certificate. This can be many things such as a common name error, ...
user17886134's user avatar
0 votes
0 answers
464 views

Tried 3 things to make Chrome accept remote self-signed SSL cert

I have a sandbox Windows 2016 server in the cloud that only I use for dev, testing, and experimentation. I can access the site remotely from Chrome, but no matter what I try, Chrome displays the ...
HerrimanCoder's user avatar
0 votes
1 answer
413 views

How do TLS clients validate intermediate CA certificates?

I have read many posts related to the intermediate CA certificates and I do hope my question is not a duplication. Where do TLS clients fetch intermediate CA certificates from? In SSL server handshake,...
Michael's user avatar
  • 1,469
0 votes
1 answer
107 views

Are certificates persistent outside of where it's created?

For example, consider https://www.cloudflare.com/ssl/ where I can get a free SSL cert. If I create a cloudflare account and get an cert but delete my cloudflare account, is the cert auto-revoked? What ...
bli00's user avatar
  • 115
0 votes
0 answers
148 views

How to handle KB5025823 X509 changes correctly?

According this change here, .NET Core will handle imports of X509 certificates differently. Using .NET 6, for the value of System.Security.Cryptography.Pkcs12UnspecifiedPasswordIterationLimit, we ...
Francis Ducharme's user avatar
0 votes
1 answer
91 views

what is the difference between the two openssl commands below

what is the difference between the commands below : command 1: openssl x509 -req -in certs/server_csr.pem -CA certs/intermediate_cert.pem -CAkey private/intermediate_key.pem -out server_cert.pem -...
ethicalhacker's user avatar
0 votes
0 answers
100 views

Error when validating certificate

I created a certificate signed by an intermediate CA that is signed by root CA following an online tutorial. Reference to tutorial that I followed: https://www.golinuxcloud.com/openssl-create-...
ethicalhacker's user avatar
1 vote
1 answer
1k views

How to identify certificate package type?

I am trying to identify a certificate CA distributed on https://acraiz.icpbrasil.gov.br/repositorio/Cadeia_FIREFOX.der (which is served signed by itself, while all pages leading to it are signed by a ...
gcb's user avatar
  • 233
0 votes
0 answers
69 views

Are X.509 certificates tied to a particular operation [duplicate]

I am looking to create a X.509 certificate to encrypt a payload (plaintext) (using Hybrid encryption) and send it across to a server. Can I create a SSL/TLS X.509 certificate and use that to do the ...
gRam's user avatar
  • 1
1 vote
0 answers
123 views

how to create truststore and keystore

I created a root CA and intermediate CA, and then created a server CA certificate signed by the intermediate CA. The purpose of whole that is for a TLS one way encryption between a java thin client ...
ethicalhacker's user avatar
24 votes
4 answers
6k views

What's the point of certificates in SSL/TLS?

A valid certificate cannot guarantee that I'm not being MITM'd right now, as either the private key or CA may have been compromised. For this reason, I have to contact a CA through CRL/OCSP to check ...
David Davidson's user avatar
0 votes
1 answer
644 views

what is the difference between the root CA certificate and the intermediate CSR certificate

I tried to search online for the difference between both CSR certificate and a certificate but I couldn't find a concrete asnwer. I am doing my own lab using this tutorial https://www.golinuxcloud.com/...
ethicalhacker's user avatar
8 votes
3 answers
3k views

.exe with Digital Signature, showing SHA1 but the Certificate is SHA384, is it secure?

For this file it shows SHA1: But going into details the certificate looks like this: I know SHA1 is an outdated algorithm but I'm not sure about this nested construction. Is this insecure? Which of ...
Strah Behry's user avatar
1 vote
1 answer
1k views

How to add additional information to Certificate Signing Request (CSR)?

I would like to generate a Certificate Signing Request (CSR) and add additional custom information in it. The standard CSR fields are common name, country, organization, organizational unit, etc. Is ...
Equinox's user avatar
  • 21
9 votes
2 answers
3k views

Do subdomains of a TLD with mandatory HTTPS require a wildcard certificate?

Many new TLDs have mandatory HTTPS requirements. Is there a way to disable that for subdomains? If not does that mean an expensive wildcard SSL certificate will need to be used with these domains? So ...
JamesWeir's user avatar
0 votes
1 answer
110 views

Suitable method of encryption for user-hosted chat platforms

I am considering how to make my chat application a bit more secure. It has a similar structure to IRC, multiple users can join each server, and servers can be hosted by anyone. I have been using TLS ...
Jachdich's user avatar
  • 103
4 votes
3 answers
200 views

Leaving SSH access to deployed on prem server -- why is this bad?

I've recently had a conversation with a colleague (in a new job for me) around access to client's servers which are deployed in their premises. They have said that allowing ssh access to those servers ...
David Boshton's user avatar
0 votes
1 answer
236 views

openssl ca -revoke causes `Can't open ./demoCA/cacert.pem`

I'm learning for the first time the concept of revoking certificates. I created a certificate with openssl then I tried to revoke it. But my revoke command causes an error. Here's what I did # ...
learningtech's user avatar
9 votes
1 answer
3k views

What is the current (April 2023) browser support for Ed25519 certificate signatures?

It seems that Firefox and Chrome both support x25519 keys, but they do not accept keys signed using Ed25519. Am I correct? If so, where can I find the official source of this information?
TonyStacker's user avatar
1 vote
0 answers
188 views

Microsoft Software Key Storage Provider for ECDH (Key Usage: keyAgreement) and for RSA encryption (Key Usage: keyEncipherment)

In the Windows Certificate Store, during a request creation, there are options given for the private key to be ECDH (Key Usage: keyAgreement) and for RSA for encryption only (Key Usage: ...
ARGYROU MINAS's user avatar
1 vote
0 answers
18 views

ECDSA_nistP384 vs ECDSA_secP384 vs ECDSA_P384 Microsoft Software Key Storage Provider (KSP) [duplicate]

The windows certificate store, during the creation of a request, gives the following options for the private key: ECDSA_nistP384,Microsoft Software Key Storage Provider (KSP) ECDSA_secP384,Microsoft ...
ARGYROU MINAS's user avatar
1 vote
1 answer
181 views

ECDSA_bainpoolP512 vs ECDSA Microsoft Software Key Storage Provider (KSP) / ECDSA_nistP384 vs ECDSA_secP384 vs ECDSA_P384

During the creation of a certificate request through the Windows Certificate Store, at the options for the private key, there are the following options for choosing a KSP: ECDSA_brainpoolP512,...
ARGYROU MINAS's user avatar
1 vote
0 answers
81 views

ssl\tls public key vs ethereum blockchain public key [closed]

In a ssl/tls, the public key for a domain is included in the ssl/tls certificate that your computer downloaded and stored locally. In the ethereum blockchain ecosystem, the public key is derived from ...
EmilyJ's user avatar
  • 113
0 votes
1 answer
1k views

Why cannot I see google's root certificate in certificate manager?

When I check Google's certificate (from browser), I notice the root certificate is GTS Root R1. However, I don't see this root certificate in certificate manager. Whereas for microsoft.com or oracle....
Mihir's user avatar
  • 1
0 votes
0 answers
79 views

What is the proper way to manage a company's SSL certificates?

Is there a way/software to manage and sign multiple SSL certificates? We have many intranet web applications that show the certificate error risk in the web browser. I have been googling a lot but SSL ...
SGP's user avatar
  • 101
3 votes
1 answer
810 views

Restrict VPN access to only authorised machines

Let's say the situation is this: I'm a big corporation with a whole bunch of GDPR compliance and other regulatory stuff which means I need to ensure that certain data doesn't leak (so basically most ...
Peter David Carter's user avatar
1 vote
1 answer
119 views

Ways to safeguard Internet users from fraudulent websites

Extended Validation SSL certificates have been effectively abandoned, as web browsers do not even show them as something special, so my question is: how would you go about safeguarding the user from ...
Artem S. Tashkinov's user avatar
0 votes
0 answers
215 views

SSL/x509 certificate/public key expiration [duplicate]

I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
Jeff's user avatar
  • 1
0 votes
2 answers
319 views

Does a certificate revocation list (CRL) keep it's entries at least as long as the certificate would have been valid?

This question is specifically about certificates that should have had a long lifetime, but were revoked quickly. Is every CRL issued by this CA guaranteed to include its revocation, as long as the ...
Towdo's user avatar
  • 3
1 vote
2 answers
975 views

Why is cert for localhost not trusted when using ssh tunnel?

I've created a developer cert with my companies CA for my development box. The CN is the FQDN of my development box mybox.example.com, but I've also added subjectAlternative names that include ...
PatS's user avatar
  • 121
0 votes
0 answers
91 views

Securing the keystore key?

My program, is installed on specific computers that use a shared, common login. The program decrypts variously sized (1KB-1GB) data assets which were encrypted elsewhere, and transferred over. Each ...
Reahreic's user avatar
  • 121
0 votes
1 answer
553 views

Certificate Propagation Service CertPropSvc immediately stops

Trying to use my smartcards, suddenly the certificates do not propagate. I try starting and restarting the Certificate Propagation Service, but it immediately stops. An event is created in the Event ...
ARGYROU MINAS's user avatar
1 vote
0 answers
282 views

Client certificate validation [duplicate]

In a mutual TLS connection, both the client and server authenticate each other using digital certificates. However, when the client presents a certificate, the server only sees the client's IP address ...
Mr.Eddart's user avatar
  • 1,003
1 vote
2 answers
865 views

How is one supposed to determine which IOD to use in a certificate?

I'm creating a self signed certificate for a practice dev system data encipherment keystore and am unable to determine which OID I'm supposed to use. Google result show the following as options: 1.3....
Reahreic's user avatar
  • 121
1 vote
0 answers
253 views

Self signing keystore certificates using smart card

Forgive my Naivety on the topic, I was only recently (this month) pushed into the application & data security rabbit hole and am still learning. I have a smart card issued by my organization, it ...
Reahreic's user avatar
  • 121
1 vote
1 answer
2k views

How to practice making self-signed certificates with intermediate CAs

I am trying to learn how ssl chain of trust works with practical examples. I thought maybe openssl would be a good education tool. But I'm running into a few problems while practicing, and I'm at a ...
learningtech's user avatar
0 votes
2 answers
643 views

Does distributing an SSL certificate and private key pose a security risk?

I found some applications bundle an SSL certificate and associated private key signed by a public CA for a domain name pointing to 127.0.0.1, probably to bypass the certificate/mixed content warning ...
ylem's user avatar
  • 101
0 votes
1 answer
326 views

Over what fields is the X509 hash computed over? [duplicate]

Is this how X509 certificates are verified to be valid? The receiver receives the certificate Look at the issuer of the cert, and find the public key of that CA (its hardcoded in the application or ...
user289431's user avatar
0 votes
0 answers
25 views

Which is more secure: Certificate or Secret inside our Azure Active Directory App, and why? [duplicate]

Inside our Azure Active Directory, we have 2 options to secure our calls to the Active Directory App: Secret Certificate Which option is more secure and why? Inside our applications which will be ...
test test's user avatar
0 votes
1 answer
437 views

HTTPS/TLS security with an invalid certificate

I'm trying to use a site that's https but has it's own certificate, and when I add an exception it still shows it as unsecure, with an exclamation on the padlock and when I click the padlock it says &...
vertigo's user avatar
  • 13
1 vote
1 answer
135 views

Does defining "a minimum path length" for certification validation have any security benefit?

As you may know, Common Criteria (AKA ISO/IEC15408: A standard for IT Security Evaluation) have provided some security base-line documents named "Protection Profile" for software developers ...
Ebrahim Ghasemi's user avatar
1 vote
1 answer
372 views

What problem does "max_path_length" attribute in certificates are going to solve?

I'm trying to understand the purpose of defining pathLenConstraint and max_path_length in RFC5280 (Internet X509 PKI Certificate and CRL Profile): For pathLenConstraint The above mentioned RFC states: ...
Ebrahim Ghasemi's user avatar
2 votes
1 answer
292 views

Can an Intermediate CA extend its "Certificate Key Usage" by issuing a new certificate for itself?

I'm trying to understand the purpose of defining self-issued certificate concept in RFC5280 (Internet X509 PKI Certificate and CRL Profile): Regarding this concept the RFC states: This specification ...
Ebrahim Ghasemi's user avatar
1 vote
2 answers
672 views

Keys vs Certificate & x509 vs GPG

I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG. Where I get lost is how the certificate comes into play and what ...
Arthae's user avatar
  • 13
0 votes
1 answer
257 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
Vlad A.'s user avatar
1 vote
2 answers
554 views

How do I create a Client Authentication Certificate without a domain signed by a commercial CA?

For sending soap messages to a webservice we need to include a client authentication certificate with these messages. Normally we simply created a self signed client auth. certificate (with as a ...
user2713516's user avatar
0 votes
1 answer
308 views

What mechanisms exist to detect compromised default certificate private signing keys?

This is partially a follow-up to the these questions: Is visiting HTTPS websites on a public hotspot secure? Can free Wi-Fi hotspot providers snoop on HTTPS communications? I understand of course ...
Tronman's user avatar
  • 101

1
2
3 4 5
58