Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
9
votes
2answers
9k views

Chrome allow insecure localhost

I have just stumbled upon what is a very helpful flag in chrome (for developers): chrome://flags/#allow-insecure-localhost The flag is described as: Allow invalid certificates for resources loaded ...
4
votes
2answers
518 views

x509 restrict the intermediate CA to sign only end user certificates

I am trying to restrict the intermediate CA to sign only end user certificates. However, I am not able to do so. Man page of x509v3_config says basicConstraints=critical,CA:TRUE, pathlen:0 A CA ...
0
votes
1answer
75 views

How do I avoid the initial text portion when creating a PEM certificate with openssl? [closed]

I've created my own CA with openssl. The problem I'm having is that when I sign a CSR and generate a PEM certificate with it, there is an initial text portion in the certificate where I was only want ...
0
votes
1answer
153 views

Trust store management best practice

A typical scenario: a big company with lots of servers in all shapes and colors (on-premise, private and public cloud) Each server (or rather each service) needs to maintain a trust store (a file in ...
0
votes
3answers
424 views

Does a X.509 Certificate contain an ID of the Private Key?

Does a X.509 Certificate contain some kind of ID that is associated with the Private Key that was used to create the Certificate? So if i had a database of all my Private Key IDs, i could then look at ...
1
vote
2answers
338 views

How do you get a CA trusted by Certificate Transparency logs?

How would one go about getting in contact with a popular CT logs operator's, let's say Google Pilot, and how would one get a CA root included in their log? Are there open CT logs that allow untrusted ...
1
vote
0answers
514 views

OpenSSL OCSP Responder "Cert Status: good" -> "Cert Status: unknown"

Summary: Certificates calling to OCSP Responder (OCSPr) have their "Cert Status" change from "good" to "unknown" with no known to changes to environment. Completely lost ...
38
votes
2answers
8k views

Why do SSL certificates have country codes (or other metadata)?

Is there an effect of a certificate, or the request for, having the wrong country code? How about the other metadata? Effects can be legal, technological, anything. I could almost imagine a web ...
-1
votes
1answer
91 views

securing certificate based authentication for linux and windows applications

I am wondering what are the possible options for the following: Let's say you have a software-agent you want to deploy on systems running both on Windows and Linux, e.g. an agent written in C++. Let's ...
0
votes
2answers
90 views

What does the HTTPS server verify when it asks for a client certificate?

I assume that the only thing the server checks is whether the IP on the certificate matches the one for the current TCP/IP connection and that the certificate is signed by an authority the server ...
0
votes
1answer
209 views

Why must I send certificate and private key when make HTTPS requests? [duplicate]

In my company, we are issued .p12 files and extract the certificate and private key like so: openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys openssl pkcs12 -in path.p12 -out newfile....
0
votes
1answer
98 views

Is an IP not being redirected to it's associated domain considered unsecure?

I've got a server that has domain and an SSL Certificate issued to that domain. It's expected behavior that when an IP address is browsed, it redirects to the domain name of the server and the SSL ...
0
votes
1answer
76 views

Client Cert Authentication: Accept cert in request or retrieve from host?

Is it more secure to retrieve a client cert from their host rather than accept the cert presented in request? Example: B2B Client pre-shares public cert with me I store public cert in database Later, ...
0
votes
1answer
56 views

Can lower level intermediate cert declare SAN that broader than higher level cert?

Suppose 1st level intermediate cert specifies DNS=www.dev.com Can 2nd level intermediate cert which is signed by the 1st level specify DNS=*.dev.com or maybe DNS=*.dev2.com? Does certificate level ...
2
votes
2answers
444 views

Certificates(CA certificate and EE/Local certiificate)

There is a small confusion related to CA certificate and Local certificate. I had asked a similar question before. This time, its a little specific. For authentication using PKI, below are the steps. -...
0
votes
1answer
80 views

Separate certificates on a local machine for each service

I'd like to know if it's possible to have a separate certificate on a local machine, one for a heavy client and the another one for the web browser to be sure the correct client communicate with the ...
2
votes
0answers
70 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
20
votes
7answers
4k views

Is there a protocol that provides data integrity, but not encryption for HTTP?

HTTP I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed. HTTPS On the other hand, HTTPS sends encrypted text over the network that can ...
2
votes
1answer
181 views

Any disadvantages to long-lived self-signed certificates for personal use?

I run my own IMAP server on my own machine, and am the only user of it. The server uses a self-signed certificate that I generated with OpenSSL. I don't use the certificate for any other purpose. I ...
6
votes
2answers
2k views

How to block requests in web app when certificate is insecure?

I am developing a web app and wanted it to be secure from attacks from the application layer. Currently, my website is allowing interception from Burpsuite like certificate proxy software. Is there a ...
2
votes
1answer
332 views

What is the correct terminology for a private key corresponding to a public key certificate?

I have learned that the certificate is something that contain information about a public key. An article on wikipedia says Public Key Certificate as well. If we are talking about private key, it's not ...
0
votes
1answer
81 views

CA cert with many Subject Alternative Name (SAN) entries, versus individual certs in public production?

I'm looking into creating a CA certificate strategy where i work. And i was wondering if anyone had any points of interest to raise around the difference of a model where our .com and key subdomains ...
0
votes
2answers
465 views

How does encryption, certificates in an end to end SSO flow?

So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
0
votes
1answer
135 views

MFA using PKI certificates [closed]

I'm trying to set up a multi factor authentication using PKIs certificates. A PKI infrastructure is ready to use and i'm planning to put these certificates on smart cards. I was looking for a smart ...
0
votes
0answers
88 views

Certificates between services in a single machine

I'd like to know if it's possible to protect communications between a heavy client on a machine and a remote server accessible by a web interface on this machine using certificates. Or the only way is ...
0
votes
1answer
359 views

Why sometimes intermediate certificates don't include a "CA Issuers" part?

I'm learning about certificates, and would like to understand: How is it possible for intermediate certificates to not include a CA Issuers part? Is it not a must so that clients can figure it the ...
0
votes
0answers
67 views

Switching CSC certificate issuer and SmartScreen

We have most of our SSL certificates hosted at GoDaddy but have Standard Code signing certificate from GlobalSign, we would like to switch to GoDaddy CSC since our CSC from GlobalSign is expiring in 3 ...
0
votes
1answer
77 views

How to implement TLS in a product with complex distributed architecture?

We have a distributed product where one server acts as a 'Scheduler' of jobs and there are hundreds if not thousands of 'Agents' which receive commands from the 'Scheduler' and execute the jobs. The ...
0
votes
1answer
108 views

Certificate Authority generates private key for Extended Validation code signing certificate?

My company upgraded to an Extended Validation code signing security certificate, which was delivered via mail on a physical USB key, called a "token." The token contains a private key and ...
6
votes
1answer
219 views

Why not signing a certificate with more than one Certification Authority [duplicate]

A student asked me a good question today when I was explaining the concept of certificates chain. As I said "if a CA is compromised by an attacker he can emit false certificates for the entities ...
1
vote
2answers
724 views

Create CSR for S/MIME certificate from existing OpenPGP key pair

While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone). I believe the ...
0
votes
2answers
4k views

openssl verify error: unable to get local issuer certificate

I have a test certificate chain that I generated and it fails the openssl verify command: openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem The output I get from the ...
0
votes
1answer
118 views

who should create a CSR, the developer or system management? [closed]

I am developing an internal web application. I think it would be a good idea to secure the local web server with an https certificate. I read several postings recommending certificates on local ...
0
votes
2answers
102 views

How CAs verify they are issuing the certificate to the correct party?

Say youtube.com wants to generate their new certificate. How certification authority verify that the request came from youtube.com, not from a party pretending to be youtube.com?
0
votes
0answers
111 views

SAN is getting replaced into CSR with CA's SAN

I am using the following command to create a certificate sign request file. openssl.exe req -new -key clinetkey.pem -out client.csr" -config client_cacert.cnf where client_cacert.cnf has the ...
4
votes
1answer
241 views

Why does openSUSE sporadically prompt during boot to trust its built-in certificate?

The conundrum My wife’s laptop has been running openSUSE Leap 15.0 for several years, and she has once or twice been flummoxed by this prompt at the very beginning of the boot sequence, most recently ...
0
votes
1answer
135 views

How to use password certificate in code securely

I have a piece of code that is using a certificate for authentication with a cloud service. The certificate is stored locally, and is protected by a password - thus what the developers did is to ...
1
vote
2answers
121 views

If certificate authority generates key pair for us, do they maintain/have access to our private key?

If they do keep our private key and by chance if anyone within the CA organization listen to our conversation. Isn't it a confidentiality breakage?
2
votes
1answer
944 views

Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?

I have developed my DRF back-end API locally, deployed it on an AWS Lightsail instance (with a public static IP) and I now want to secure it with HTTPS. I understand that in order to use Let's Encrypt ...
1
vote
2answers
132 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
0
votes
1answer
2k views

"unsupported certificate purpose" for nginx client auth

Please concern the following setup: A client certificate is issued like this: Root CA → Intermediate CA → Client Cert Let's assume everything is fine up to here, the intermediate CA cert is properly ...
2
votes
2answers
598 views

MITM attack with HSTS implemented websites

I want to perform a Man-in-the-Middle attack against my own network for educational purposes. I want the following scenario: Perform a MITM attack with Bettercap, navigate to a website and accept the ...
1
vote
1answer
846 views

Is certificate signature encoded to ASN.1 format?

I'm working on a diagram to describe the process of issuing digital certificates, with the help of answers on my question here and some other research: I just read in the IETF that: The ...
0
votes
2answers
607 views

How to securely get a key from a key server?

In the installation procedure of Gentoo, there is a step to check signature of the downloaded iso file. To do so, we first need to download the set of keys from a key server: $ gpg --keyserver hkps://...
0
votes
1answer
533 views

Certificate Signed Using Weak Hashing Algorithm impact on a workstation

I did a vulnerability scan on some of our company workstations. These are workstations used by employees (dev, HR, accounting, etc.) to do their job. One of the common result I found is SSL/TLS ...
2
votes
1answer
466 views

How is public key included in the CSR?

I've read a lot of articles on the PKI and digital certificate topics because it's very rare to find one article covers all the aspects; also the topic is confusing at the beginning, (this beautiful ...
0
votes
1answer
83 views

how end certificate refers to intermediate certificate

As far as i know certificate chain is accomplished based on the issuer's CA name. It is possible that the algorithm to create certificate chain first reads end-certificate's issuer area and get the ...
0
votes
2answers
93 views

Does end entity SSL Certificates need to be re-keyed periodically to improve security?

Is it necessary to periodically re-key end entity SSL certificates apart from typical scenarios like Key lost/key compromise? What benefits does it provides in terms of security and others? Is there ...
2
votes
1answer
132 views

What are the security implications of adding an Intermediate Certificate into the Trusted Root Store in Windows?

I have 2 certificates (one root and one intermediate). In Windows OS, the Root certificate is in the trusted root store (for current user). The other intermediate certificate (signed by the root CA), ...
5
votes
2answers
1k views

Why would a certificate authority have multiple root certificates?

When I look at the trusted certificates in my browser, I see that many certificate authorities have multiple root certificates associated with them. For example, org-Amazon has Amazon Root CA 1, ...

1
3 4
5
6 7
54