We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

173 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
0answers
60 views

Why is digital signature enforcement on webservers not common practice?

Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
1
vote
0answers
273 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
1
vote
0answers
191 views

Replying to a digitally signed email using thunderbird

So Basically I sent a digitally signed email using a certificate issued by Sectigo RSA Client Authentication and Secure Email CA. Now the recipient of the email replied to me with a certificate ...
1
vote
0answers
35 views

Is distributing software with KeyStores as resource secure?

I'm working on a client / server application. I want to encrypt the communication between the two. This GitHub project served as a starting point for me. It uses SSLEngine to establish a secure ...
1
vote
0answers
19 views

Using build time generated, self-signed certs for inter application authentication

I need to be able to authenticate requests between different applications I am responsible for. My company does have CA signed certs, but there are two problem with using it for this purpose. ...
1
vote
0answers
35 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
1
vote
0answers
92 views

Non-TLS-authoritative ZSKs?

Under DANE, the digital chain of trust goes (roughly): [Public visibility of the ceremony for the generation of the] ICANN Root Zone Key, which something something involving the TLD authorities and ...
1
vote
0answers
221 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
1
vote
0answers
91 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
1
vote
0answers
17 views

Best way to back up locally stored Certificates

What is the best way to back-up all the locally stored certificates on Windows 7? An adware Trojan has installed fraudulent certificates as part of its payload. Before I alter anything, I want to ...
1
vote
1answer
51 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
1
vote
0answers
93 views

How do I examine a fresh Windows 10 installation

I suspect an unauthorized modification has been applied to a fresh new installation of Win 10 x64 and/or a PC running it by a person who knows me personally with the purpose of tracking my activity ...
1
vote
0answers
154 views

Client authentication using certificates in M2M communication

We're planning to implement following scenario for a secure machine-to-machine (M2M) communication network. We have some gateways and a lot of secure sensors which should only be able to "speak" to ...
1
vote
0answers
96 views

Signing with multiple end entity certificates

Let's assume we are having a structure with a root certificate with lots of "child" certificates. A message is transmitted which is signed by any of the child certificates. The receiver has stored ...
1
vote
0answers
299 views

How to make CNG certificates available for mutual authentication in browser?

I have implemented a CNG key storage provider and propagate my certificate according to the answer to this question to the MY store. I can see my certificate there using the MMC console. However, when ...
1
vote
0answers
41 views

Does using the same curve certificate on both ends cause security issues?

I have the following scenario: an application that establishes a full mesh connection with itself on a remote server. We use 0MQ and curve certificates for security and authentication, but at the same ...
1
vote
0answers
735 views

Check the signature algorithm of RDP certificate

I received a Nessus warning of RDP as following, The following certificates were part of the certificate chain sent by the remote host, but contain hashes that are considered to be weak. |-Subject ...
1
vote
0answers
222 views

Invalid certificate error appears on my web server for 10 minutes and then disappears

I have a raspberry pi that hosts a web server and has a DDNS registered through no-ip. I just had an issue connecting to my webserver because a certificate appeared to be installed on this server that ...
1
vote
2answers
529 views

Is using both client side certificate and JWT for IoT device redundant?

Is there a case to be made for authorizing with both a client side certificate and JWT for an IoT device? Are JWTs good enough (assuming following of the specs)? And if client side certs are truly ...
1
vote
0answers
1k views

Private key to sign a XML file

I’ve never dealt with cryptography before so my question may be sound trivial. I need to create an app that sends messages as digitally signed XML files. The messages are sent to a CA entity. ...
1
vote
0answers
247 views

what is the logic in choosing a certificate chain during a “server-hello” message in a SSL/TLS handshake

In a client-server ssl handshake, my server sends a certificate chain back to the client in a server-hello message. But I want to understand as to how that particular certificate chain is getting ...
1
vote
0answers
35 views

Removing suspect MITM certificate while only knowing Date Issued?

A Blue Coat type of certificate was added to my personal PC to access a business network which I could trust at the time, but I don't trust the certificate issuer (Blue Coat) in general and don't ...
1
vote
0answers
525 views

ways to check a certificate fingerprint against known logs

Suppose I have a certificate sha-256 fingerprint, which I can obtain say visiting the relevant domain in firefox or from a shell script using openssl, and i want to verify this fingerprint. one option ...
1
vote
0answers
34 views

Are unique root certificates required to have different subjects?

I've heard that in the X.509 world, the certificate subject attribute is supposed to be unique... and that if someone has multiple trusted roots with the same subject (but still different in other ...
1
vote
0answers
75 views

implementing a CA and a CSP

We are in the process of implementing a CA and a CSP for our organization. I came across these issues while implementing. Can the CA and CSP be owned by the same party? Will there be a conflict of ...
1
vote
0answers
36 views

Which attributes of a WPA AP certificate are used by a client device in deciding if the certificate has been trusted before?

When connecting to a new AP, the client device will pop a warning to ask if the certificate of the new AP should be trusted. If trusted, the warning doesn't show anymore if the certificate is known to ...
1
vote
0answers
1k views

How to force a full Client SSL handshake and ignore abbreviated client SSL handshake? Is it insecure?

I understand the SSL handshake flow, but I'm facing a logic problem with an abbreviated SSL handshake. Use case: The user is authenticated on system for common ways, such as passwords. But for some ...
1
vote
0answers
546 views

SSO - Client Certificate vs SAML

For me SSO is sign on where one need not type the password explicitly. I see one of the possible way to achieve it is by using Certificates loaded in browser. SAML/OAuth delegates the job of ...
1
vote
0answers
2k views

Verify pem certificate chain using openssl

I am trying to write a code which receives a pcap file as an input and returns invalid certificates from it. I have parsed certificate chains, and I'm trying to verify them. Because I get the ...
1
vote
0answers
511 views

Self-signed Certificate not working under win 7, works on win 10

We're using self-created certificates for an SSTP VPN connection: A 'CA' certificate and, signed with it, customer specific certificates with the customers information: Address etc. However, there ...
1
vote
0answers
862 views

Create OpenSSL certificate to exceed Python SSLError certificate validate error

I have a client/server application where the server uses the HTTPS protocol and has address and port localhost:44301 . The client application uses Python 2.7.13 on Windows platform to connect with ...
1
vote
0answers
646 views

Implementing Internal Certificate Authority

We're considering setting up an internal certificate authority to issue ssl certificates. The certificates would primarily be used to secure internal websites, but I could foresee us potentially ...
1
vote
0answers
131 views

Should leeway be included in the NotBefore date of an X.509 certificate?

Which of these options are actually in line with standards? In software that generates SSL client certificates to hand out to client software for authentication into a closed system, should the ...
1
vote
0answers
211 views

How do 2 intermediate certificates work? (chaining)

I'm trying to learn a bit more about acting as my own CA. I've learned some of the basics so far. Create a root pair, keep your root key safe, private and use it to sign other things. I'm now trying ...
1
vote
0answers
110 views

MQTT + TLS client not accepting to connect with new root when cross certificate is present

I am trying to connect an MQTT client to a server over MQTTS (MTTQ + TLS). The server provides 3 certificates: the cert of the MQTT endpoint, an intermediate certificate (RapidSSL) signed with ...
1
vote
0answers
596 views

How to export decrypted https traffic from mitm proxy

I am using mitm proxy in order to intercept https traffic to an android device and it seems to work great. I downloaded and installed the certificate from mitm.it when the android emulator's internet ...
1
vote
0answers
446 views

Simple private AKKA encryption certs

There are several questions on stackoverflow regarding Akka, SSL and certificate management to enable secure (encrypted) peer to peer communication between Akka actors. The Akka documentation on ...
1
vote
0answers
35 views

Windows has the option to protect an exported private key using a domain account. How does this work?

When exporting a cert+key in Windows, you're given 2 choices to protect it: either a password/passphrase or a domain account. My question is, how does this account-based protection work? Is it more ...
1
vote
0answers
88 views

Encrypt SQL Server traffic on a LAN

I have a .NET client application that runs on several machines on a local area network. All machines (including the server which is running MSSQL Server 2016) are running either Windows 7, 8 or 10. ...
1
vote
0answers
331 views

Why are NIST binary curves not as popular as NIST prime curves for ECDSA?

Most ECDSA certificates commonly encountered on the internet are signed using NIST prime curves, e.g., P-256, P-384, etc. Why are the NIST binary curves, Koblitz curves in particular, e.g., K-283, K-...
1
vote
0answers
157 views

Does DTLS CertificateVerify consider fragmentation of packets when signing the handshake messages?

For DTLS with client authentication, the client is required to send a CertificateVerify message, which has the following structure: struct { digitally-signed struct { opaque ...
1
vote
0answers
789 views

Is comparing the thumbprint of a SSL certificate secure enough?

I was wondering if comparing the X509Certificate2.Thumbprint of two certificates count as a save way to identify if a certificate is correct or not. Of course this would only work for specific ...
1
vote
0answers
393 views

Are GeoTrust SHA-256 intermediate chain and cross-root legacy support, mutually exclusive?

I have purchased a GeoTrust TrueBusiness ID SHA-256 with EV SSL Certificate. According to GeoTrust website, I must also install the corresponding intermediate certificate, which is "GeoTrust EV SSL ...
1
vote
0answers
4k views

SSL self signed certificate CER exception added to Keychain but fails in Chrome

Operating System: Mac OSX El Capitan 10.11.5 When browsing to the page I have a Privacy error, although an exception was added. I have the correct CER file so I added it to my Keychain TRUST THE ...
1
vote
0answers
103 views

How to provide our customers ability to self service client certificate creation?

We have an API for B2B customers to access our platform. We require each B2B customer to have a client certificate. This is not the URL SSL certificate (https). The CN of each customer's client ...
1
vote
0answers
463 views

What comes into calculation of certificate signature?

I have written my own code with openssl in order to create certificates. In order to verify this code, I tried to reconstruct an openssl commandline generated self-signed certificate ... openssl req -...
1
vote
0answers
63 views

Theory behind certificate for job account

I made it work a job account protected by a certificate in a java spring application but is not that clear to me the minimal steps.(Could you believe that :) I need some theory. Here my steps: ...
1
vote
0answers
1k views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: http://www....
1
vote
0answers
688 views

Making the Firefox key and CSR creation process transparent

Background I was a bit surprised that several CAs do not allow anymore to send a plain old CSR in text form to them which was created in the classic fashion with OpenSSL or similar. But this would ...
1
vote
0answers
163 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password For ...