Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Validate that CA really signed certificate [duplicate]

What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust? What is the part of the certificate (The one I try to validate) is the one cant be faked? ...
-1 votes
1 answer
171 views

Certificates Do Nothing [duplicate]

Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...
0 votes
0 answers
74 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
0 votes
1 answer
224 views

Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)

I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time. I understand that both methods require to prove that the certificate (...
7 votes
3 answers
2k views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
2 votes
1 answer
137 views

Validation of server identity via SSL certificate in during SSL connection handshake

My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
0 votes
1 answer
184 views

Generating a DER-encoded DSA public key of a particular file size

I am reverse engineering a binary that contains a raw, DER-encoded X.509 certificate containing a DSA public key. I want to replace this certificate with one that I have generated so that I have ...
  • 1
1 vote
1 answer
132 views

If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?

I have some questions about certificate pinning. Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
  • 11
0 votes
1 answer
165 views

What are requirements of Key Usage extension of parent and child certificates?

This question is about validating certificates. Imagine some machine gets a leaf certificate (i.e. a certificate signed by the certificate of some CA) with specific Key Usage attributes. Example #1: ...
  • 234
-1 votes
1 answer
106 views

Is it ok to use the same SSL certificate (pfx) used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis?

Is it secure enough to use the SSL certificate used for public website, for encrypting the AspNet Core Data Protections Keys persisted to Redis? Or must I use a separate certificate just for this ...
  • 99
2 votes
1 answer
374 views

How does a Certificate get associated to the private key pair? [duplicate]

I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
  • 131
1 vote
2 answers
393 views

openssl certificate chain - windows

I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities. ...
  • 113
1 vote
3 answers
682 views

Self-Signed Certificates with SSL

Today I was playing around with an SslStream implementation in C#, and was able to create a client/server connection over TCP. Also to verify it, I used wireshark to ensure that the data was in fact ...
  • 111
0 votes
2 answers
137 views

On a server to server SSL connection is there any trustable information identifying the calling server?

Imagine server A calling server B over SSL and that both servers have SSL certificates installed. Later server A again calls server B. Is there a way for server B to know that server A is the same ...
2 votes
3 answers
1k views

Application to detect SSL certificate fingerprint differences

My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
  • 442
0 votes
2 answers
83 views

Any difference between these certificates from a security perspective?

I understand some might buy a particular brand because, I guess, it's like buying a Rolex instead of a Swatch? But marketing considerations aside, is there any real security difference between the ...
  • 181
1 vote
1 answer
119 views

Are long-lived SSL/TLS certificates acceptable for non-public resources?

Our organization maintains a private certificate authority to issue SSL/TLS certificates to non-public backend services running on our cloud infrastructure. For example, Postgres and Elasticsearch ...
0 votes
1 answer
2k views

Exporting a JKS entry to X509 certificate - why public key differs?

There is a JKS file containing an entry named "mycert": https://filebin.net/l93faa9qa3rkt32h Password is test123 Based on the following screenshot, mycert has a public key (RSA 2048 bits) ...
  • 103
1 vote
1 answer
142 views

Hosting the certificates from CSP in Windows Store to be visible for other applications

I am developing a CSP that performs electronic signature in the cloud and I want to use it from applications like Adobe Reader and Microsoft Word. For this, the certificates from CSP (from the cloud) ...
0 votes
1 answer
92 views

SSL Cert SAN field

I'm not really sure exactly how to ask this, but I'll try my best. I have two SSL certs, and I'm tyring to figure out if I accidentally invalidated one of them. Cert 1 was just renewed, and issued to ...
  • 111
0 votes
1 answer
171 views

When do I need to install root certificate on the client trust store?

I have a https server with following the certificate chain : Root CA -> Intermediate CA -> server certificate I noticed that for the client (eg. browser) trusts the server I need to install in ...
0 votes
1 answer
195 views

Replace hashed password by public key generated from password

I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
-1 votes
1 answer
206 views

Preventing MITM Attack with Squid

There are two options, what is the best approach? I want to either Create a squid proxy server that detects MITM attacks or Create a python UI application to detect differences between local ...
  • 442
2 votes
1 answer
341 views

ssh-keygen: How to guarantee the uniqueness of serial numbers?

(FYI: I'm using Ubuntu 18.04 Desktop although I don't think my question is platform-dependent.) I read the article Scalable and secure access with SSH and it says: ... if you want to use revocation ...
  • 141
0 votes
3 answers
244 views

Authenticating root certificate

I'm building a web service and have questions regarding authentication. I have a strict requirement that this application only run on company machines. We have a root certificate this is installed on ...
  • 3
1 vote
1 answer
151 views

SSL certificate for desktop app?

I built an app, which authenticates users via oauth2. I have a simple server that can accept requests. After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and ...
12 votes
4 answers
2k views

Is it possible to update the contact info (FN/LN, OU, Organization,..) of a certificate?

When creating a self-signed certificate you are asked to enter some information (First Name, Last Name, Organization Unit, Organization, City, State,...). Is it possible to update any of those fields ...
  • 223
0 votes
2 answers
124 views

How to authenicate personal computers and phones?

I feel like this information should be readily available but looks like it's not: When I buy a new laptop or phone, it seems like there's a whole set of initial connections that might require my (...
  • 113
1 vote
1 answer
103 views

Embed Private Key Inside Agent [closed]

We are owing a domain with wildcard certificate (*.mycompany.com). Now we have an application running as an agent on the customer machine. The browser is communicating with the agent by sending ...
  • 2,491
2 votes
0 answers
165 views

Using TPM to generate certificates associated with different users on the same device

I plan to use the TPM to generate CSR's backed by a private key stored on the TPM. The CSR's will then be signed by an external HSM. Since a certificate is tied to a particular private key, how do you ...
0 votes
1 answer
108 views

SSL Certificates Management and Tracking

I'm not aware of any frameworks/tools to achieve what we're trying to do, but posting here to hear experts opinions and comments on how this is done at large organizations and recommended automation ...
  • 101
1 vote
0 answers
22 views

How does the client get the certificate chain when verifying a TLS connection? [duplicate]

When a client creates a TLS connection, he is given a certificate. To make sure this certificate is authentic the client must look at the certificate chain. My question is: How does the client get ...
2 votes
0 answers
151 views

What are the risks of trusting a certificate that is not logged in CT logs?

A website that I do banking on has a login page on a different subdomain than their main website, and this login page is secured with an Amazon-issued domain-validation certificate (their main website ...
  • 175
2 votes
1 answer
307 views

Trying to create cert for RSA and Not ECDH

I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key....
  • 21
23 votes
2 answers
4k views

Are we gossiping in Certificate Transparency?

Ben Laurie's original paper on Certificate Transparency proposed that clients (browsers) should "gossip". In particular, it proposed that when a browser connects to a web server, it should ...
  • 98.6k
1 vote
4 answers
960 views

Certificate SHA1 Thumbprint reported as a vulnerability [closed]

So a few weeks ago I came across a security report that stated that the SHA1 thumbprint of the certificate was a vulnerability. The vulnerability was raised due to fact that the thumbprint used the ...
1 vote
0 answers
114 views

Certificate Checking for MITM w/ Squid

I have already set up a squid cache proxy server on a Raspberry Pi 4. I need to create some sort of GUI to turn on and off certificate checking for man in the middle attacks. First, how do I get squid ...
  • 442
1 vote
0 answers
443 views

What is the relation between cipher suite and certificate? [duplicate]

I generated my self signed certificate using openssl and I chose ECC keys (prime 256v1) for root certificate but while authenticating with the server i.e. IBM cloud and my device the negotiated cipher ...
1 vote
1 answer
270 views

Encryption for intranet site?

I am developing a web application which will be downloaded, installed and used by my customers on their intranet. The data in the application is confidential, so all requests and responses need to be ...
  • 135
1 vote
1 answer
324 views

Is it safe to distribute the server's certificate file with the client?

I've been working on making an SSL server/client on C++ using Boost. To load the certificates, I use the following code for each side: server.cpp boost::asio::ssl::context ssl_context(boost::asio::ssl:...
1 vote
1 answer
412 views

Use the public key of a certificate as the key for HMAC SHA

Consider the following scenario. A company has several computers for each users on the same domain. They purchase an RSA certificate from a recognized authority which will be deployed with private / ...
0 votes
1 answer
311 views

Why do I need to check the issuer/subject of a certificate rather than just the thumbprint?

I'm following Microsoft's example here - https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth#aspnet-sample When validating the certificate, they check that the ...
1 vote
0 answers
103 views

verifying certificates

In my test setup I have a root CA only. I also have a node cert (joe0.lab.local.pem). I did the following: openssl verify -CAfile ca.pem joe0.lab.local.pem joe0.lab.local.pem: CN = joe0.lab.local ...
  • 11
1 vote
1 answer
243 views

Website certificates in different browsers

I looked at a certificate of (e.g. stackoverflow) a website and the fingerprint in chrome was different then microsoft edge, so I was wondering how it that possible? chrome: ...
  • 113
2 votes
2 answers
119 views

ssh into a server with knowledge of ca bundle

Let's say I had a ca bundle with many certificates in it on my server. I accidentally gave this to a team of programmers I have hired. Could they theoretically use this to somehow ssh into my server ...
1 vote
1 answer
2k views

How to remove a ca certificate in debian?

I have added a root ca in my debian machine by using the following commands: mkdir /usr/local/share/ca-certificates/custom/ mv myserver.crt /usr/local/share/ca-certificates/custom/ update-ca-...
  • 33
17 votes
4 answers
4k views

Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?

I'm learning about X509 certs used in client-cert authentication to https endpoints. If I have an OCSP checker (Python script that creates, submits, decodes OCSP responses), do I need to check the not-...
0 votes
2 answers
233 views

Approach to authorizing users and X.509 certificates

I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
0 votes
1 answer
97 views

CT logs for non browser applications

Most what I read on CT logs is about browsers checking the logs for websites. But what about normal applications or updates for operating systems (like apt-get over https, windows/osx updates ...) Is ...
  • 19
2 votes
1 answer
206 views

Securing HTTPS between two local applications on same system

I would like to know how to securely setup HTTPS between two applications running on the same workstation in a production environment please: A local server application (C#) A web frontend which ...
  • 25

1
3 4
5
6 7
56