Questions tagged [certificates]
A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.
2,803
questions
0
votes
0
answers
221
views
Can an SSL certificate be edited? [duplicate]
First of all I want to say that this question is not a duplicate.
What I want to know(And possibly get reasons) is if it's able to edit SSL certificates.
In more depth, let's say I have a server on my ...
- 1
0
votes
1
answer
1k
views
Implications of using a self-signed certificate to sign JWT tokens in OAuth
I'm looking to setup an integration between GitHub and Service Now and I can use OAuth2 using JWT Tokens, the steps to take can be found here.
There is a specific step that states:
Create a CA signed ...
- 159
0
votes
1
answer
146
views
Forging SSL certificate to the browser
A man in the middle attacker can intercept and send a different certificate (a self-signed one, maybe) to the browser. In this case, browser will show warning to the user and doesn't display's the ...
- 13
0
votes
1
answer
472
views
What are the risks when using proxy such as Fiddler
I would like to understand a point. When I use fiddler it creates a local proxy to analyze the traffic, so far everything is fine. However when Fiddler is launched and I browse an HTTPS site the ...
- 59
0
votes
1
answer
116
views
Verifying public key visually
Verifying a string of long numbers is hard (think of cert public key). I remember there is a tool to visualize this randomness into a "randomness graph" but I cannot recall what is the graph ...
- 103
0
votes
0
answers
24
views
Why does Firefox claim a site has a "Potential Security Risk"? [duplicate]
When trying to go to https://www.pfizerpapconnect.com, the Firefox web browser claims there is a "Potential Security Risk" and pops up a page recommending to not proceed.
Is there a real ...
- 1
3
votes
2
answers
1k
views
What is the point of signing a JWT with a JWK if you need to communicate with the token issuer?
If I understand correctly, a JSON Web Token (JWT) can be asymmetrically signed with a special private key (JWK). At least in some common configurations, the public part of the signing key can't be ...
- 190
1
vote
2
answers
293
views
Required certificate key usage for signing document
What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc...
I am going to create a self-signed certificate that is needed to sign those documents. I ...
- 113
0
votes
1
answer
754
views
Adding a self-signed client certificate to HAProxy for mutual-tls?
I added the client cert into ca.pem as in
bind 0.0.0.0:443 ssl crt /etc/ssl/private/asdf.hdavid.io.pem verify optional ca-file /etc/ssl/certs/ca.pem
http-request set-header X-SSL-Client-Verify %...
- 135
0
votes
0
answers
2k
views
Unable to add Zscaler certificates to Ubuntu trusted store
I have a set of three certificates to form a trusted chain from Zscaler but I cannot install them in the Ubuntu trusted store.
The three corresponding certificates are there for reference:
Zscaler ...
- 111
2
votes
1
answer
657
views
Can possession of device certificate be considered a factor in MFA? [duplicate]
We have had a discussion in our organization about whether possession of a server-issued device certificate can be considered a factor in MFA.
The certificate asserts that only enrolled devices can ...
- 21
0
votes
1
answer
261
views
How to use DH certificate to configure nginx server
My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer).
I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
1
vote
2
answers
617
views
Storing SSL certificates for developers
I work as a .NET developer on a small development team. Our organization has several websites, that all have certificates for serving them via HTTPS.
The websites are deployed to On-premise Windows ...
- 113
13
votes
3
answers
3k
views
How to change a website to no longer needing an SSL certificate
I have recently had an active website that was protected by an SSL certificate. The site is no longer active and the certificate has expired. I have tried to put up a simple HTML holding page but ...
- 233
0
votes
1
answer
157
views
Sensor device web interface certificate
I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
- 101
1
vote
1
answer
2k
views
How to update certificates/CRL on Windows 7 systems that are without support contracts?
A quality answer to this question mentions:
"System is regularly updated with latest patch specifically certificate/CRL from trusted source such as Microsoft."
How does one update ...
0
votes
1
answer
322
views
What is the workflow from client to server for SSL enabled sites?
I have a basic question on workflow of SSL enabled sites from client browser to server. My understanding is when the browser has to access some https enabled site, the browser contacts some CAs. I am ...
- 103
0
votes
0
answers
653
views
Unable to decrypt password protected certificates with Freeradius or from GUI
I am trying to use Freeradius 3.0 for authentication with certificates. To generate the CA, Server and Client certificate, make is available, reading a specific configuration file for each ...
- 173
1
vote
2
answers
456
views
How to distiguish if SSL certificate is for both domain and subdomains or for domain only?
Provider suggests me two types of SSL certificates: for domain only or for domain and subdomains. First one is cheaper.
Currently I already have certificate for previous year. How to know, if it was ...
- 125
0
votes
2
answers
248
views
What prevents an attacker from registering a TLS certificate for an existing site?
This would be used in a phishing attack for example - coffee shop attack where google.com becomes a website controlled by the attacker completed with the magic lock next to the URL. Can I use ...
- 474
0
votes
2
answers
243
views
For organizations running modern, functioning PKI, can mTLS be used as SSO mechanism?
I am trying to determine best practices for implementing a webapp running in an extremely tight PKI environment. Assume:
Yubikey like devices that have Certs with reasonable expiration dates
The ...
- 127
0
votes
1
answer
101
views
Why would device manufacturer refuse to publish root CA that signs devices but provides the CA via support ticket attachment
Background:
We got a few new model SIP phones. Each phone has built-in unique certificate issued by the manufacturer.
Previous models had certs issued by a different CA and that CA cert was published, ...
- 103
3
votes
3
answers
470
views
Does EFS protect against data theft by ransomware?
Recent ransomware events often include data theft in addition to just encrypting data. The Encrypting File System on Windows Pro/Enterprise editions encrypts individual files using a private key ...
user257952
0
votes
0
answers
106
views
How to implement internal certification mechanism for my web applications?
Our company develops web applications and uses them on the internal network. We need to set up a mechanism to control and monitor internal network traffic so that only approved applications on the ...
- 1
7
votes
1
answer
876
views
Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP
Given the scenario that:
Victim rents VM1 from a cloud provider, and points his/her DNS record to that VM1's IP address
Victim deletes VM1 and switches to a different cloud provider, and creates VM2 ...
- 93
4
votes
3
answers
2k
views
What differentiates a CA cert from a server cert? [duplicate]
From what I can gather, as long as a client trusts a particular CA root, and a server produces a valid chain that leads up to it, the client will trust the server's cert. This only makes sense if the ...
- 143
0
votes
0
answers
128
views
Self-Signed Certificates on Management Interfaces - Cyber Security Standards
We have dozens of internal management interfaces on our appliances that use self-signed certificates - ILO, DRAC, switch management, etc. These certificates display a warning in the browser, but their ...
- 71
0
votes
1
answer
209
views
WPA2 Enterprise Authentication Certificate Security
While reading up about WPA2-Enterprise, it states that it is more preferred over WPA2-Personal as it allows authentication via digital certificates which prevents over-the-air attacks.
However, I am ...
0
votes
1
answer
623
views
On TLS 1.2 with Diffie-Hellman Key Exchange, how does the client make sure the server has the certificate's private key?
When RSA is used for Key Exchange, the pre-master key is encoded with the server certificate public key, so the server would not be able to decode it if it didn't possess the private key.
However, ...
- 135
1
vote
4
answers
142
views
Ingress client certificate authenticate requires CA certificate to be stored in secret?
I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...
- 113
0
votes
0
answers
33
views
Validate that CA really signed certificate [duplicate]
What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust?
What is the part of the certificate (The one I try to validate) is the one cant be faked?
...
-1
votes
1
answer
176
views
Certificates Do Nothing [duplicate]
Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...
- 107
0
votes
0
answers
74
views
x509 validation check service
I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
- 21
0
votes
1
answer
255
views
Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)
I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time.
I understand that both methods require to prove that the certificate (...
- 163
7
votes
3
answers
2k
views
Key differences between X509 TLS Client certificate and server certificate
Is there any difference between a X509 TLS client cert and a server cert?
I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
- 163
2
votes
1
answer
174
views
Validation of server identity via SSL certificate in during SSL connection handshake
My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
- 163
0
votes
1
answer
200
views
Generating a DER-encoded DSA public key of a particular file size
I am reverse engineering a binary that contains a raw, DER-encoded X.509 certificate containing a DSA public key. I want to replace this certificate with one that I have generated so that I have ...
- 1
1
vote
1
answer
139
views
If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?
I have some questions about certificate pinning.
Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
- 11
0
votes
1
answer
182
views
What are requirements of Key Usage extension of parent and child certificates?
This question is about validating certificates. Imagine some machine gets a leaf certificate (i.e. a certificate signed by the certificate of some CA) with specific Key Usage attributes.
Example #1: ...
- 234
-1
votes
1
answer
117
views
Is it ok to use the same SSL certificate (pfx) used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis?
Is it secure enough to use the SSL certificate used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis?
Or must I use a separate certificate just for this ...
- 99
2
votes
1
answer
414
views
How does a Certificate get associated to the private key pair? [duplicate]
I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
- 131
1
vote
2
answers
483
views
openssl certificate chain - windows
I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities.
...
- 113
1
vote
3
answers
767
views
Self-Signed Certificates with SSL
Today I was playing around with an SslStream implementation in C#, and was able to create a client/server connection over TCP. Also to verify it, I used wireshark to ensure that the data was in fact ...
- 111
0
votes
2
answers
153
views
On a server to server SSL connection is there any trustable information identifying the calling server?
Imagine server A calling server B over SSL and that both servers have SSL certificates installed.
Later server A again calls server B.
Is there a way for server B to know that server A is the same ...
2
votes
3
answers
1k
views
Application to detect SSL certificate fingerprint differences
My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
- 442
0
votes
2
answers
83
views
Any difference between these certificates from a security perspective?
I understand some might buy a particular brand because, I guess, it's like buying a Rolex instead of a Swatch? But marketing considerations aside, is there any real security difference between the ...
- 181
1
vote
1
answer
123
views
Are long-lived SSL/TLS certificates acceptable for non-public resources?
Our organization maintains a private certificate authority to issue SSL/TLS certificates to non-public backend services running on our cloud infrastructure. For example, Postgres and Elasticsearch ...
- 113
0
votes
1
answer
2k
views
Exporting a JKS entry to X509 certificate - why public key differs?
There is a JKS file containing an entry named "mycert": https://filebin.net/l93faa9qa3rkt32h
Password is test123
Based on the following screenshot, mycert has a public key (RSA 2048 bits) ...
- 103
1
vote
1
answer
146
views
Hosting the certificates from CSP in Windows Store to be visible for other applications
I am developing a CSP that performs electronic signature in the cloud and I want to use it from applications like Adobe Reader and Microsoft Word.
For this, the certificates from CSP (from the cloud) ...
0
votes
1
answer
101
views
SSL Cert SAN field
I'm not really sure exactly how to ask this, but I'll try my best.
I have two SSL certs, and I'm tyring to figure out if I accidentally invalidated one of them.
Cert 1 was just renewed, and issued to ...
- 111