Skip to main content

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
2 votes
1 answer
196 views

How do I ship my SSL keys with my application?

I have an executable, and I have the SSL certificates and keys necessary to establish the secure connection. The application performs self-updating by downloading and replacing itself with an updated ...
Chris's user avatar
  • 121
3 votes
1 answer
260 views

Name Constraints, empty sets in permitted subtree (RFC 3280 vs RFC 5280)

I'm trying to understand the effect of empty sets in permittedSubtrees in both, RFC 5280 and RFC 3280. There is something that doesn't compile in my head. Scenario: We have a CA certificate with the ...
Crypt32's user avatar
  • 6,381
0 votes
0 answers
94 views

Database TLS and certificates clarification

Is this behaviour of MongoDB secure? Database TLS is turned on and the client's cert .pem is loaded on the machine. When the client-side app is launched and communicating with the database, the cert ...
Tester two DS's user avatar
1 vote
2 answers
389 views

Any security concerns when importing self-signed certificate to Trusted Root certification Authorities store?

I have an ESXi server that is using a self-signed certificate, and the browser gives a warning that SSL certificate cannot be trusted. I want to put that cert into the Trusted Root Certification ...
Mike's user avatar
  • 13
0 votes
0 answers
155 views

SSL certificates their public keys and thumbprints

I want to use mTLS, so for testing I created simple API. I wanted to check if I will receive the public key of the certificate after the client sends the certificate to me (the server) as I want to ...
Szyszka947's user avatar
0 votes
1 answer
266 views

mTLS with OpenID Connect and validating self-signed certificates

OIDC says mTLS can be used to authenticate the client. But I haven't read anywhere whether the OIDC Provider is supposed to accept self-signed SSL certificates. Are there any dangers to accepting self-...
Szyszka947's user avatar
1 vote
1 answer
445 views

Is the certificate of this Windows EXE really invalid?

The file can be downloaded from: https://www.vpay.co.kr/eISP/install/VPWSSetup_C.exe This is some stupid "security" ActiveX control that Korean government mandates for web commerce. On ...
Damn Vegetables's user avatar
0 votes
0 answers
28 views

Is there a way to find out which certificates came preinstalled with Windows and which ones installed afterwards? [duplicate]

I'm looking for a way to find out which certificates, whether machine level or user level, came preinstalled with Windows (when using official Microsoft ISO file to clean install the OS) and which ...
user avatar
0 votes
1 answer
265 views

Strange Root CA certificate in Windows Trusted Root CA Store

While reviewing Root CA certificates in Windows Trusted Root CA Store I came across a stange Root CA certificate with Issuer Desktop-XXXXXXX and Subject Desktop-XXXXXXX, enhanced key usage for server ...
1000's user avatar
  • 1
0 votes
1 answer
2k views

What is this certificate I found on my computer and can I delete it?

I noticed an error in my event viewer logs about certificate with specific thumbprint unable to be renewed. After I dug some more, I found that the certificate in question was accompanied by two other ...
Asd_467's user avatar
0 votes
0 answers
83 views

Retrieve list of trusted server public keys during an application run

I'm trying to implement a mechanism that allows me to maintain a list of SSL server certificate public keys that have been verified as trusted during an application run time. For example: Application ...
Kakalokia's user avatar
  • 111
0 votes
0 answers
110 views

Use a remote certificate (on other computer) for mTLS transaction

I have an USB Token (brand 3SKey) containing a certificate "C" with its private key stuck on a machine "A". The certificate's private key is obviously not exportable and I'm not ...
Perfect28's user avatar
  • 101
1 vote
2 answers
793 views

What is CA response after giving them the CSR?

I'm trying to understand the logical flow of SSL certificate. Suppose I have a website running on a machine. I generate a CSR file that contains information (e.g. common name, organization, country, .....
Mostafa's user avatar
  • 113
1 vote
1 answer
137 views

Comparing ACME client logs against Certificate Transparency logs

Inspired by this comment from Can DDNS provider perform a MITM attack?, I was wondering if there is an automated way to check the Certificate Transparency logs for malicious/unexpected certificates. ...
oliver's user avatar
  • 581
1 vote
1 answer
1k views

Identification of weak and anonymous ciphers with openssl

I'm doing two tests using the openssl s_client command to identify anonymous. I did two tests: One first test: I'm using the following command to anonymous ciphers: openssl s_client -cipher aNULL -...
Jhon Laurence's user avatar
2 votes
2 answers
3k views

OAuth2 - What is the advantage of using certificate over client secret credentials? (Azure)

When using OAuth2 in Azure, why Certificates are more secure than using Secrets? The Secrets have expiration and are strong, and generated automatically. The application needs to send a JWT containing ...
danilo's user avatar
  • 121
0 votes
1 answer
404 views

Make certificate and private key available only to a single app

I want to make a smart card reader app, that sends read data to a server. In order to be certain in the integrity of the data, I want to use a client certificate to communicate with the server and I ...
Savo Pejović's user avatar
1 vote
1 answer
266 views

Best practice for "stateOrProvinceName" in certificate

In RFC-4519 stateOrProvinceName is abbreviated to ST. Should we assume that it is best practice to put ST=<name-of-state> in the certificate if the state or province is indicated? After all X-...
Maarten Bodewes's user avatar
1 vote
2 answers
3k views

Is it a risk to allow security or privacy apps to install a certificate and filter HTTPS?

I recently installed the AdGuard app on Windows and Android. It wants to enable HTTPS filtering and install a certificate. I've seen antivirus do similar things. How exactly does this work and what ...
FizzBop's user avatar
  • 13
0 votes
0 answers
255 views

How to trust CA chain with sub-CA intermediate

I have a development web server that I need to add trust certificates on my local machine. Http connections to server https://machine-name.a.b.local/ show an SSL issue. This is the cert chain: ABCD-...
W. Young's user avatar
0 votes
1 answer
336 views

Is it possible to trust a certificate authority ONLY when a specific domain is accessed?

I would like to know if there is a way to only trust a CA only when a specific domain is being accessed, eg. wikipedia.org. I'm using Chrome, and I'm not really tech savvy so the simpler the solution ...
keiowo's user avatar
  • 3
2 votes
2 answers
928 views

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Here is the scenario, just wanted confirmation that I am understanding it correctly. I have a TLS certificate that will expire soon; Upon renewal, I paid the CA, and they reissued me with a new public ...
joedotnot's user avatar
  • 337
1 vote
1 answer
215 views

Export ECDSA certificate from Windows Store

I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
Amal Jesudas's user avatar
0 votes
0 answers
139 views

Client Identification using Self Signed Certificates

Taking the concept from the Gemini protocol that allows clients to identify themselves using their own self-signed certificate - is this a valid concept that could be used in other protocols and what ...
LittleBobTable's user avatar
1 vote
1 answer
176 views

Certificate warnings on websites with client certificate authentication

I have been operating websites that use client certificates to authenticate the users. To my understanding, you need to make your own CA. First of all, that way an attacker will have huge troubles to ...
Michael's user avatar
  • 305
2 votes
1 answer
128 views

Adobe uses CA signature type as identifier on signatures created with user certificates

I am testing several PKCS12 keystores with ECC type keys, generated by a CA with RSA key, to sign PDF documents. I have also tested with my own certificates from a demo CA certificate. I use Adobe ...
RobertGG's user avatar
0 votes
1 answer
207 views

Are self-signed certificates better for local usage?

When generating a certificate what would more secure - generating a self-signed certificate using PGP or using a public CA like Let's Encrypt? We are using it for signing and encrypting. What are the ...
Munchkin's user avatar
  • 264
0 votes
0 answers
164 views

I was asked to install an SSL .cert in my server, should I do this?

I am trying to connect to a company's internal API (I am working on a project for them). This company has an API that has an SSL certificate from Sectigo. From what I have gathered is a pretty well ...
S. Dre's user avatar
  • 101
0 votes
1 answer
1k views

How to perform MitM against SSL/TLS when certificate owned?

Performing a local network man-in-the-middle (MitM) attack is fairly straightforward, especially when the traffic is unencrypted HTTP. There are other approaches to encrypted SSL/TLS HTTPS connections,...
questioner's user avatar
0 votes
1 answer
2k views

Check public key certificate [closed]

I have created public, private keys and a self signed certificate with the following commands: openssl genrsa -out private-key.pem 3072 openssl rsa -in private-key.pem -pubout -out public-key.pem ...
vico's user avatar
  • 279
0 votes
1 answer
88 views

Certificate not valid for common name?

I have a certificate with a common name of "myApi.mycompany.com" and 3 SANs: "myApi-dev.mycompany.com", "myApi-uat.mycompany.com" and "myApi-stg.mycompany.com". ...
Leonardo's user avatar
  • 119
0 votes
2 answers
3k views

Local Machine certificate (certlm.msc) Import - Enable strong private key protection

We were trying key export from Windows Certificate Store as part of a certificate module development. The code is in C++ and mostly WinCrypt and openssl APIs are used. I installed a certificate that ...
Amal Jesudas's user avatar
2 votes
2 answers
411 views

How to add extension to existing TLS certficate?

We have our own root certificate authority which is used to sign the certificates for the agents connected to our server. We have generated the root certificate authority using keytool command as ...
Ravindra12jan's user avatar
0 votes
0 answers
114 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
Alexandre's user avatar
  • 101
0 votes
0 answers
8k views

security certificate does not specify Subject Alternative Names

We have a Windows Server 2016 that we use as a web server hosted on premise and we host numerous web applications under the Default Web Site in IIS. All applications are reached by using the server ...
tnk479's user avatar
  • 101
0 votes
1 answer
370 views

Multi Domain SAN or single SSL certificate

I want to use a multi-domain SAN certificate for 5 of my public-facing domains. All of these domains point to the same ingress server (SSL is terminated at the load balancer), but the backend ...
ab-ha-y's user avatar
  • 11
6 votes
1 answer
3k views

How can a .exe be modified and still keep a valid digital signature?

When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true. ...
tree1234's user avatar
1 vote
3 answers
113 views

Auto-certification of internal services, does it make sense?

I work for a big insurance company, they have created a certification authority to generate certificates for their internal webservices. These webservices are accessible from their intranet only and ...
peveuve's user avatar
  • 113
1 vote
1 answer
686 views

How insecure are self-signed certificates? Why does Tor still use them?

How insecure are self-signed certificates? Why does Tor still use them?
Gaai Chia's user avatar
0 votes
0 answers
84 views

What prevents an SSL certificate holder to issue new 'valid' certificates [duplicate]

I am new to SSL certificates and trying to wrap my head around this concept. As per my understanding when a valid certificate is signed (by one of the many official CAs) it can also sign a certificate ...
dimitar.d's user avatar
  • 101
2 votes
1 answer
2k views

Is it OK to have both, the hostname and the FQDN of a server, in an SSL certificate?

On a company intranet, it is often more comfortable to access an internal webserver just by its hostname (e. g. webserver) instead of providing the FQDN (e. g. webserver.company.com). As long as the ...
stackprotector's user avatar
1 vote
1 answer
598 views

Why include the root certficiate in the chain, if it is already in receiving parts' truststore?

If I have a self-signed CA certificate in my truststore, and I am sent a chain of certificates where the root CA is missing, is this a problem and if so why? Say that the last certificate in the chain ...
A_Weierstrass's user avatar
0 votes
1 answer
471 views

Why digital certificate doesn't ask for password in Linux?

I have imported a personal digital certificate into a Linux Mint computer (OS is up to date, certificate is imported in Firefox and Chrome). I used a password in the process of importing, but after ...
JanezKranjski's user avatar
1 vote
1 answer
320 views

Why do the X.509 certificates need the public key?

I am currently reading about X.509 certificates from RFC 5280 and there is a thing in section 3.1 that I cannot understand. It says: Users of a public key require confidence that the associated ...
retne's user avatar
  • 11
59 votes
7 answers
11k views

Can a CA decrypt HTTPS traffic?

My state has made a statement that in case my country will be disconnected from the world's CAs, it is necessary to install its own state certificates. In many forums, information has flashed that in ...
RoyalGoose's user avatar
  • 1,035
0 votes
2 answers
333 views

Can any field in a CSR be overwritten in the issued cert?

Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
Liam Kelly's user avatar
1 vote
0 answers
387 views

iOS (iPhone) S/MIME certificate with multiple addresses

On an iPhone I have a mail account in the native Mail app with two distinct e-mail addresses, and a certificate that lists both of those e-mail addresses in the SAN field. When I try to send mail with ...
Chris Owens's user avatar
0 votes
0 answers
313 views

Is it inappropriate at all for someone in my client organization to email their PEM file to me?

I have a SAML offering for my clients to access my cloud based application. Should I have a portal for them to upload their certificates or should I go the easy route and just have them e-mail them to ...
williamohara's user avatar
0 votes
1 answer
95 views

When application is in HTTPS mode, is SSL certificate validation implicitly expected?

I have a application, that can communicate with some other devices on local network and it has a possibility to turn on only HTTPS communication in its GUI. However since the application is specially ...
user10099's user avatar
  • 145
0 votes
0 answers
88 views

Is it possible for a company to buy a signing certificate so that everything it signs (Software,SSL, Documents) states its from that company?

If I work for a company that wants to sign its own certificates for its website, documents and software it writes, is it possible? I have read a couple of post on here from around 10/8 years ago but ...
Definity's user avatar
  • 109

1 2 3
4
5
58