Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0 votes
1 answer
1k views

Implications of using a self-signed certificate to sign JWT tokens in OAuth

I'm looking to setup an integration between GitHub and Service Now and I can use OAuth2 using JWT Tokens, the steps to take can be found here. There is a specific step that states: Create a CA signed ...
0 votes
1 answer
144 views

Forging SSL certificate to the browser

A man in the middle attacker can intercept and send a different certificate (a self-signed one, maybe) to the browser. In this case, browser will show warning to the user and doesn't display's the ...
0 votes
1 answer
316 views

What are the risks when using proxy such as Fiddler

I would like to understand a point. When I use fiddler it creates a local proxy to analyze the traffic, so far everything is fine. However when Fiddler is launched and I browse an HTTPS site the ...
0 votes
1 answer
104 views

Verifying public key visually

Verifying a string of long numbers is hard (think of cert public key). I remember there is a tool to visualize this randomness into a "randomness graph" but I cannot recall what is the graph ...
  • 103
0 votes
0 answers
24 views

Why does Firefox claim a site has a "Potential Security Risk"? [duplicate]

When trying to go to https://www.pfizerpapconnect.com, the Firefox web browser claims there is a "Potential Security Risk" and pops up a page recommending to not proceed. Is there a real ...
  • 1
3 votes
2 answers
785 views

What is the point of signing a JWT with a JWK if you need to communicate with the token issuer?

If I understand correctly, a JSON Web Token (JWT) can be asymmetrically signed with a special private key (JWK). At least in some common configurations, the public part of the signing key can't be ...
0 votes
2 answers
223 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
  • 103
0 votes
1 answer
498 views

Adding a self-signed client certificate to HAProxy for mutual-tls?

I added the client cert into ca.pem as in bind 0.0.0.0:443 ssl crt /etc/ssl/private/asdf.hdavid.io.pem verify optional ca-file /etc/ssl/certs/ca.pem http-request set-header X-SSL-Client-Verify %...
0 votes
0 answers
2k views

Unable to add Zscaler certificates to Ubuntu trusted store

I have a set of three certificates to form a trusted chain from Zscaler but I cannot install them in the Ubuntu trusted store. The three corresponding certificates are there for reference: Zscaler ...
2 votes
1 answer
407 views

Can possession of device certificate be considered a factor in MFA? [duplicate]

We have had a discussion in our organization about whether possession of a server-issued device certificate can be considered a factor in MFA. The certificate asserts that only enrolled devices can ...
0 votes
1 answer
163 views

How to use DH certificate to configure nginx server

My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer). I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
1 vote
2 answers
444 views

Storing SSL certificates for developers

I work as a .NET developer on a small development team. Our organization has several websites, that all have certificates for serving them via HTTPS. The websites are deployed to On-premise Windows ...
13 votes
3 answers
3k views

How to change a website to no longer needing an SSL certificate

I have recently had an active website that was protected by an SSL certificate. The site is no longer active and the certificate has expired. I have tried to put up a simple HTML holding page but ...
0 votes
1 answer
146 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
1 vote
1 answer
1k views

How to update certificates/CRL on Windows 7 systems that are without support contracts?

A quality answer to this question mentions: "System is regularly updated with latest patch specifically certificate/CRL from trusted source such as Microsoft." How does one update ...
0 votes
1 answer
305 views

What is the workflow from client to server for SSL enabled sites?

I have a basic question on workflow of SSL enabled sites from client browser to server. My understanding is when the browser has to access some https enabled site, the browser contacts some CAs. I am ...
0 votes
0 answers
461 views

Unable to decrypt password protected certificates with Freeradius or from GUI

I am trying to use Freeradius 3.0 for authentication with certificates. To generate the CA, Server and Client certificate, make is available, reading a specific configuration file for each ...
  • 173
1 vote
2 answers
217 views

How to distiguish if SSL certificate is for both domain and subdomains or for domain only?

Provider suggests me two types of SSL certificates: for domain only or for domain and subdomains. First one is cheaper. Currently I already have certificate for previous year. How to know, if it was ...
  • 125
0 votes
2 answers
225 views

What prevents an attacker from registering a TLS certificate for an existing site?

This would be used in a phishing attack for example - coffee shop attack where google.com becomes a website controlled by the attacker completed with the magic lock next to the URL. Can I use ...
  • 472
0 votes
2 answers
194 views

For organizations running modern, functioning PKI, can mTLS be used as SSO mechanism?

I am trying to determine best practices for implementing a webapp running in an extremely tight PKI environment. Assume: Yubikey like devices that have Certs with reasonable expiration dates The ...
0 votes
1 answer
97 views

Why would device manufacturer refuse to publish root CA that signs devices but provides the CA via support ticket attachment

Background: We got a few new model SIP phones. Each phone has built-in unique certificate issued by the manufacturer. Previous models had certs issued by a different CA and that CA cert was published, ...
  • 103
3 votes
3 answers
363 views

Does EFS protect against data theft by ransomware?

Recent ransomware events often include data theft in addition to just encrypting data. The Encrypting File System on Windows Pro/Enterprise editions encrypts individual files using a private key ...
0 votes
0 answers
105 views

How to implement internal certification mechanism for my web applications?

Our company develops web applications and uses them on the internal network. We need to set up a mechanism to control and monitor internal network traffic so that only approved applications on the ...
7 votes
1 answer
857 views

Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP

Given the scenario that: Victim rents VM1 from a cloud provider, and points his/her DNS record to that VM1's IP address Victim deletes VM1 and switches to a different cloud provider, and creates VM2 ...
4 votes
3 answers
2k views

What differentiates a CA cert from a server cert? [duplicate]

From what I can gather, as long as a client trusts a particular CA root, and a server produces a valid chain that leads up to it, the client will trust the server's cert. This only makes sense if the ...
  • 143
0 votes
0 answers
103 views

Self-Signed Certificates on Management Interfaces - Cyber Security Standards

We have dozens of internal management interfaces on our appliances that use self-signed certificates - ILO, DRAC, switch management, etc. These certificates display a warning in the browser, but their ...
  • 71
0 votes
1 answer
154 views

WPA2 Enterprise Authentication Certificate Security

While reading up about WPA2-Enterprise, it states that it is more preferred over WPA2-Personal as it allows authentication via digital certificates which prevents over-the-air attacks. However, I am ...
0 votes
1 answer
429 views

On TLS 1.2 with Diffie-Hellman Key Exchange, how does the client make sure the server has the certificate's private key?

When RSA is used for Key Exchange, the pre-master key is encoded with the server certificate public key, so the server would not be able to decode it if it didn't possess the private key. However, ...
1 vote
4 answers
124 views

Ingress client certificate authenticate requires CA certificate to be stored in secret?

I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...
  • 113
0 votes
0 answers
33 views

Validate that CA really signed certificate [duplicate]

What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust? What is the part of the certificate (The one I try to validate) is the one cant be faked? ...
-1 votes
1 answer
170 views

Certificates Do Nothing [duplicate]

Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...
0 votes
0 answers
74 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
0 votes
1 answer
206 views

Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)

I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time. I understand that both methods require to prove that the certificate (...
7 votes
3 answers
2k views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
2 votes
1 answer
127 views

Validation of server identity via SSL certificate in during SSL connection handshake

My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
0 votes
1 answer
163 views

Generating a DER-encoded DSA public key of a particular file size

I am reverse engineering a binary that contains a raw, DER-encoded X.509 certificate containing a DSA public key. I want to replace this certificate with one that I have generated so that I have ...
  • 1
1 vote
1 answer
127 views

If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?

I have some questions about certificate pinning. Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
  • 11
0 votes
1 answer
141 views

What are requirements of Key Usage extension of parent and child certificates?

This question is about validating certificates. Imagine some machine gets a leaf certificate (i.e. a certificate signed by the certificate of some CA) with specific Key Usage attributes. Example #1: ...
  • 234
-1 votes
1 answer
105 views

Is it ok to use the same SSL certificate (pfx) used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis?

Is it secure enough to use the SSL certificate used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis? Or must I use a separate certificate just for this ...
  • 99
2 votes
1 answer
349 views

How does a Certificate get associated to the private key pair? [duplicate]

I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
  • 131
1 vote
2 answers
342 views

openssl certificate chain - windows

I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities. ...
  • 113
1 vote
3 answers
628 views

Self-Signed Certificates with SSL

Today I was playing around with an SslStream implementation in C#, and was able to create a client/server connection over TCP. Also to verify it, I used wireshark to ensure that the data was in fact ...
  • 111
0 votes
2 answers
126 views

On a server to server SSL connection is there any trustable information identifying the calling server?

Imagine server A calling server B over SSL and that both servers have SSL certificates installed. Later server A again calls server B. Is there a way for server B to know that server A is the same ...
2 votes
3 answers
1k views

Application to detect SSL certificate fingerprint differences

My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
  • 442
0 votes
2 answers
83 views

Any difference between these certificates from a security perspective?

I understand some might buy a particular brand because, I guess, it's like buying a Rolex instead of a Swatch? But marketing considerations aside, is there any real security difference between the ...
  • 181
1 vote
1 answer
115 views

Are long-lived SSL/TLS certificates acceptable for non-public resources?

Our organization maintains a private certificate authority to issue SSL/TLS certificates to non-public backend services running on our cloud infrastructure. For example, Postgres and Elasticsearch ...
0 votes
1 answer
2k views

Exporting a JKS entry to X509 certificate - why public key differs?

There is a JKS file containing an entry named "mycert": https://filebin.net/l93faa9qa3rkt32h Password is test123 Based on the following screenshot, mycert has a public key (RSA 2048 bits) ...
  • 103
1 vote
1 answer
140 views

Hosting the certificates from CSP in Windows Store to be visible for other applications

I am developing a CSP that performs electronic signature in the cloud and I want to use it from applications like Adobe Reader and Microsoft Word. For this, the certificates from CSP (from the cloud) ...
0 votes
1 answer
89 views

SSL Cert SAN field

I'm not really sure exactly how to ask this, but I'll try my best. I have two SSL certs, and I'm tyring to figure out if I accidentally invalidated one of them. Cert 1 was just renewed, and issued to ...
  • 111
0 votes
1 answer
145 views

When do I need to install root certificate on the client trust store?

I have a https server with following the certificate chain : Root CA -> Intermediate CA -> server certificate I noticed that for the client (eg. browser) trusts the server I need to install in ...

1 2 3
4
5
56