Skip to main content

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
1 vote
2 answers
697 views

Keys vs Certificate & x509 vs GPG

I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG. Where I get lost is how the certificate comes into play and what ...
Arthae's user avatar
  • 13
0 votes
1 answer
262 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
Vlad A.'s user avatar
1 vote
2 answers
566 views

How do I create a Client Authentication Certificate without a domain signed by a commercial CA?

For sending soap messages to a webservice we need to include a client authentication certificate with these messages. Normally we simply created a self signed client auth. certificate (with as a ...
user2713516's user avatar
0 votes
1 answer
316 views

What mechanisms exist to detect compromised default certificate private signing keys?

This is partially a follow-up to the these questions: Is visiting HTTPS websites on a public hotspot secure? Can free Wi-Fi hotspot providers snoop on HTTPS communications? I understand of course ...
Tronman's user avatar
  • 101
0 votes
0 answers
251 views

client side certificate installed on ios 16 are not being sent by browsers on that device when a server requests for a identity cert

I have a client side certificate from cloudflare (non-root) that i install on our devices in order to gain access to our sites that ask for a client side certificate from browsers. This works ...
Muhammad Ebrahym's user avatar
0 votes
0 answers
103 views

What security risks would arise from someone else using my certificate without my knowledge? [duplicate]

Apologies if this has already been asked but i couldn't find a clear cut answer. Please keep in my mind i'm not very technical but am learning. So let's take scenario where i have a subdomain "...
Yasmeen Ali's user avatar
5 votes
1 answer
923 views

Can Namecheap get certificates issued for my domain without my knowledge?

I bought a domain on Namecheap a few weeks back and now that I want to set it up, I visited my domain on the web and discovered that it had a valid cert issued and was pointing to an unknown site. The ...
Ermir's user avatar
  • 153
2 votes
2 answers
898 views

Can a client script (running within a webpage) provide to the browser a certificate to accept in a wss:// connection?

Can a client script provide to the browser a certificate to accept in a wss:// connection? The WebSocket constructor does not seem to have many options. (I am designing an IoT server that lets the ...
personal_cloud's user avatar
0 votes
1 answer
109 views

Man in the middle attack on response from server [duplicate]

Let's assume that I am logging into my Gmail account from my browser using my username and password. I know that my input will be encrypted using Google's private key and the only one who can decrypt ...
yusuf tezel's user avatar
2 votes
1 answer
235 views

Determine if the client certificate comes from a smarcard in mTLS [closed]

I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
Luna's user avatar
  • 31
0 votes
1 answer
184 views

Privacy related to company VPN

Last week my employer sent me a root cert to access the company’s VPN on my personal iMac. When I am connected to the VPN, I’m aware the VPN server can encrypt/decrypt the traffic, but I have some ...
Peter's user avatar
  • 9
1 vote
0 answers
210 views

Any vulnerability of OCSP for proof of concept

I have an assignment in which I have to implement OCSP and do a proof of concept of a vulnerability. My idea was to implement OCSP without using a nonce (this is done) and then perform a replay attack....
Pedro's user avatar
  • 11
11 votes
3 answers
4k views

Why create a CSR on my own server to have it signed by a 3rd party?

I am looking into our current website certificate-management process and am looking for steps that may be unnecessary and can be simplified. The current process was created by our sysadmin who now ...
user2713516's user avatar
-3 votes
1 answer
130 views

Hiding a certificate [duplicate]

Is it possible to embed a TLS certificate into an application or hide it somehow so that it’s not so easy for a user to just export it from cert manager on Windows? Or does all certificates have to be ...
Q-bertsuit's user avatar
12 votes
3 answers
6k views

How do we know that our SSL certificates are to be trusted?

On Linux, the /etc/ssl/certs folder includes all the necessary public keys for Certificate Authorities. If I have not misunderstood something, this makes it possible to verify public keys received ...
lonew0lf's user avatar
  • 173
1 vote
1 answer
220 views

Is there a way to enforce a user password challenge for a certificate every single time in Windows Security Policy?

In Local Security Policy configuration, I have set System cryptography: Force strong key protection for user keys stored on the computer to value User must enter a password each time they use a key. ...
Juan Cortines's user avatar
0 votes
1 answer
610 views

Can VPN protect me against MITM attacks if my device is already compromised by having a malicious root certificate installed?

Let's say my device is already compromised without my knowledge by my ISP, it has a malicious root certificate installed which allows my ISP to view all of my HTTPS traffic as plain text. now if I use ...
user avatar
0 votes
1 answer
2k views

Connecting to company VPN issues a failed certificate verification

As one can see on the screenshot below, connecting to the company VPN via FortiClient issues a X509 verify certificate failed. I have informed the CIO who is the security person as well but it is not ...
David's user avatar
  • 101
3 votes
2 answers
2k views

Is NordVPN changing my security cerificates? Could this be a MiTM attack?

I noticed that when it comes to some websites (e.g. Twitter), the security certificate is changed when I log in and out of NordVPN - the SHA-1 digest is visibly different. Keep in mind that not only I ...
lonew0lf's user avatar
  • 173
1 vote
1 answer
106 views

Confusion Regarding TLS Handshake and Key Exchanges

I know much has been written on this topic, but I am still stuck on some on the details of TLS handshake and I would like to have a better understanding of what happens. I've been using several ...
DoubtingThomas3005's user avatar
1 vote
5 answers
548 views

How does a digital certificate prove authenticity?

Imagine the following scenario: We have Bob that wants to send a message to Alice. Both have a public/private key. Bob uses his private key to sign the digest (hash of the message) with it's private ...
muyat's user avatar
  • 13
2 votes
1 answer
1k views

What's the use of HMAC or hashing in TLS or SSL inspection

In the Server hello, I got the below Cipher suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 Now, I know that we are using DHE for the key exchange, we are using RSA for the authentication, and AES for the ...
Shashank Kumar's user avatar
0 votes
2 answers
933 views

Is it bad idea to upload SSL Certificate as base64 encoded string?

I have to create an API for uploading a certificate file. Unfortunately, the library that I'm using (graphQL) does not support file upload. It only supports primitive types like string, int, float etc....
YesImStupidxD's user avatar
0 votes
0 answers
594 views

Self-signed certificate chain verified by OpenSSL but Windows says leaf is invalid

Let's say I have rootCA.crt, intermediateCA.crt and leaf.crt. I used openssl to veriy leaf.crt: cat rootCA.crt intermediate.crt > chain.crt openssl verify -CAfile chain.crt leaf.crt and it said ...
Jędrzej Dudkiewicz's user avatar
1 vote
1 answer
175 views

How safe is a certificate on a smart card in terms of microscopy?

I wonder if it is possible for an attacker to dump the certificate of a smart card using microscopy. For example an electron microscope. Please do not blame me if there is nothing to see because the ...
zomega's user avatar
  • 145
0 votes
0 answers
21 views

How does client data encryption work in HTTPS? [duplicate]

When you connect to a HTTPS server the server encrypts its data using the private key of its private certificate. The client decrypts it using the server's public key of the server's public ...
zomega's user avatar
  • 145
6 votes
1 answer
1k views

Same domain, same local network, different certificate chain

I was doing some security checks in some devices in my local network and I noticed that I obtain two different certificate chains for the same domain (www.google.com) from two different devices (...
JoD's user avatar
  • 63
2 votes
1 answer
268 views

In this Facebook article, how do they prevent the engineers from copying SSH certificates from bastion hosts to personal laptops?

These days I'm reading this Facebook engineering article Scalable and secure access with SSH. Most of the article makes sense to me but I am not experienced enough to understand the paragraph about ...
yaobin's user avatar
  • 161
1 vote
0 answers
27 views

PKI Structure with multiple intermediates [duplicate]

is there a possibility to create a 2-Tier PKI with multiple CA's for redundancy? The scenario would if, if CA1 becomes unavailable, CA2 could be used to verify certificates and/or the complete ...
Rage's user avatar
  • 11
1 vote
2 answers
174 views

Why would a company choose to use different SSL providers for different subdomains

Recently, I happened to notice that a site I was looking at had different certificate providers for different subdomains. Whilst looking around, I found that seems to be somewhat common (or at least ...
Hotblack Desiato's user avatar
3 votes
3 answers
817 views

Is it OK to use client TLS certificate for site login instead of username/password?

Is it OK to just use a client's TLS certificate as a way of logging in to a website? What are the drawbacks? Is there any real system doing it? Normally, there is mutual client/server TLS ...
user3108468's user avatar
1 vote
1 answer
1k views

Host header is preferred by OpenSSL over SNI

As I understand a webserver shall serve SNI first and ignore HOST header from HTTP 1.1 as TLS handshakes occurs before HTTPS, to test I came up with this example: two domain names under the same IP ...
Ghost Rider's user avatar
18 votes
2 answers
4k views

Why doesn't a TLS certificate with a domain name mask that doesn't match the site name trigger a warning in the browser?

I visited stackoverflow.com and found in Chrome that its certificate is valid and has Common Name (CN) *.stackexchange.com. After that I checked a fingerprint for stackexchange.com and it matched ...
Ghost Rider's user avatar
0 votes
0 answers
40 views

How does Certificate Transparency protect from hacked CA server [duplicate]

I was able to grasp how CT works by reading this explanation, but one thing remains unclear for me - how CT may protect ecosystem from hacked CA server. For example, someone hacked Digicert, and now ...
Ghost Rider's user avatar
0 votes
0 answers
571 views

Verify self signed certificate

My plan is to create rootCA.crt and sign newly created server.crt. Later server.crt should sign newly created child.crt. As result I will get small chain. Now I would like to test if child certificate ...
vico's user avatar
  • 279
0 votes
2 answers
5k views

How does the option to “use system certificates” for a wifi login vary from choosing a specific certificate?

This is concerning an android device (not sure if that information helps, since Apple works differently). When logging into a wifi network, there will be sections that ask for different information. ...
Dan's user avatar
  • 27
0 votes
1 answer
2k views

What are the implications of the “do not validate” message for wifi network certificate?

I know a year ago when signing into school wifi there were a few options. First time I had to sign into a school wifi, so I did not understand the difference. Ended up choosing a wireless option. One ...
user avatar
0 votes
1 answer
905 views

CA-signed certificate for localhost / production app

I have developed an application that consists of various parts, each part communicating either via http and / or gRPC to one another. All communication has been switched over to TLS using a self-...
Chris B's user avatar
0 votes
0 answers
65 views

System audit of hardened device regarding certificate handling

I am tasked with auditing the default configuration (system configuration, default applications...) that is set for some computers before they are given to users. Though I have never seen it anywhere, ...
mido's user avatar
  • 1
0 votes
2 answers
309 views

Could certificate pinning work if one checks the intermediate certificate when the leaf certificate already expired?

I have the following scenario: When the leaf certificate expires, the intermediate certificate is checked and if the intermediate is not expired, the application will keep running and will not be ...
osas's user avatar
  • 1
0 votes
1 answer
2k views

Client Authentication in SSL Handshake

I am trying to understand how client certificate authentication works in an SSL handshake. Can someone help to clarify the following bullet points below: Do we need to have a Client Leaf certificate ...
rizwan's user avatar
  • 3
1 vote
3 answers
754 views

Encryption certs protected from decryption by thumbprint

Is it true that you can only decrypt data that was encrypted by a certificate using the same exact thumbprint? My thought was that you can decrypt the data using an updated version of the same ...
q933a's user avatar
  • 11
2 votes
1 answer
884 views

How to create and embed Signed Certificate Timestamp (SCT) in certificate

I have deployed a Certificate Transparency (CT) log server that uses Google's CTFE (named "certificate-transparency-go" on Github) and Trillian Projects. And I have issued a pre-certificate, ...
Levi Marvin's user avatar
0 votes
2 answers
188 views

DomainFronting - re-routing and SSL certificats

I'm looking for a specific answer regarding the TLS handshake in a scenario of domain-fronting. Following hensonsecurity and zscaler blogs I have noticed that a detailed description regarding the re-...
user281868's user avatar
0 votes
2 answers
453 views

What can happen if lifetime info is not included into an X.509 certificate?

When a certification authority generates a signature, but if the message to be signed does not include the lifetime information (period of validity), what can happen in terms of security being ...
jillatik's user avatar
0 votes
0 answers
297 views

How to determine validation process of a certificate used by a website using HTTPS?

When visiting a website that uses HTTPS, we can see its certificate in the browser. But how can we know for sure which validation process the company or domain behind the website has gone through? ...
user avatar
0 votes
1 answer
106 views

IdP Personal/Signer Certificates

We are implementing SAML/OIDC-based SSO across our enterprise and wanted to get a feel for best practices when it comes to using Personal/Signer Certificates within our IdP. Historically we've ...
user1913559's user avatar
0 votes
1 answer
142 views

Why my certificate is still not recognized by some hosts?

My website certificate is not recognized by all hosts. I already scanned here https://www.ssllabs.com/ssltest/analyze.html?d=eleicoesjustas.org. Is that because of Java trust store? Unfortunately some ...
Maf's user avatar
  • 213
1 vote
0 answers
557 views

How to renew intermediate Sub CA certificate? [closed]

The intermediate sub-CA certificate is expiring mid 2023 and the root CA certificate is expiring in 2028. How to renew the intermediate Sub CA? Or is it auto-renewed? If Yes then how and where do I ...
Hashmat Khawaja's user avatar
0 votes
1 answer
103 views

Real time domain verification through DV cert or DNS check?

I want to add an extra layer of security/validation into our app/network. I plan to do some mTLS in which we will provide customers with a certificate to use in the TLS handshake. However, I want the ...
Decrypter's user avatar
  • 101

1 2
3
4 5
58