We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

174 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
0answers
73 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
1
vote
0answers
191 views

Certificate advice for deploying code-signed software as a 3rd party vendor

I am in the process of developing an application for an organization, and am looking for a sanity check on my strategy, especially given the the nature of the SuperFish nonsense that was exposed. The ...
1
vote
0answers
673 views

Distribute S/MIME public keys and CA cert for email security

I have my own CA. I want to distribute S/MIME certificates for 10 different users. I saw S/MIME keyservers from http://wiki.cacert.org/KeyServers, but I don't want to use public servers. What is the ...
1
vote
0answers
115 views

Can't get my SSL CA to work with Apache

So I have an SSL enabled website running on Apache2. https://eamorr.com (I get a warning in my browser, as expected) I have a config file for this website at: /etc/apache2/sites-available/eamorr....
1
vote
0answers
131 views

Setup local Certificate Authority & integrate with SCEP

I want setup local Certificate Authority and issue X.509 certificates under my CA. In order to achieve this I am exploring following options such as: OpenSSL/OpenCA BouncyCastle Cryptographic APIs ...
1
vote
0answers
925 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
1
vote
0answers
1k views

How to add basicConstraints extention to a self signed certificate

Using openssl to create a self signed certificate. The certificate needs to have the Basic Constraints value defined and showing in the cert but I can't seem to be finding the right location to modify ...
1
vote
0answers
82 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
1
vote
0answers
199 views

Is a android app signing certificate unique?

The Certificates that are used to sign Android applications are generated by the user and not checked or signed by any authority. They are RSA or DSA Certificates and as i read on crypt.stackexchange....
1
vote
0answers
79 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
1
vote
0answers
477 views

Does Mac OS X 10.8+ support self-signed Package Installer

I'm not sure whether self-signed Package Installer are supported by Mac OS X 10.8+ Using informations in How to create an Apple Installer Package Signing Certificate I could create a Package ...
1
vote
0answers
45 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
1
vote
0answers
231 views

Deploying software that requires X.509 certificates

I have a self-hosted WCF application, with a server application running on the server (obviously) and a client application that will be installed on the users PC. Up until this point I have been ...
1
vote
0answers
74 views

Does Active Directory Certificate Services support Card Verifiable Certificates?

Does Active Directory Certificate Services support accepting requests for, and generation of, Card Verifiable Certificates (TR-03110)? If so, in which version of Windows Server was the functionality ...
1
vote
0answers
541 views

“Keyset does not exist” when using SignData function with RSA

"Keyset does not exist". I know that there are tons of question about this error, but mine is totally different. I'm not gona use the key from windows certificate store, but load the public key & ...
1
vote
0answers
244 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); store.Open(OpenFlags....
1
vote
1answer
3k views

Google Chrome and Certificate Problem

When I try to connect google.com and youtube.com with Chrome, I got the error below; 1. 2. Your connection is not private Attackers might be trying to steal your information from www.google.com.tr ...
0
votes
0answers
41 views

Server sending RST after Client Hello

We are facing intermittent TLS handshake issue while connecting from a C++ (Openssl 1.0.2e) client to a Java Server (Java 7). The issue is observed on load test after having around 100 session sending ...
0
votes
0answers
34 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
0
votes
0answers
17 views

How to get decrypted content from a pfx certificate

I am developing ERP software. One of the features that I am implementing is the issuance of invoices, which is something related to the federal revenue of my country. In the documentation says that ...
0
votes
0answers
36 views

Which certificate is recommended for releasing software in Healthcare domain?

Is there any third party company who assess software and provide a certificate saying the product is secured? I was reading about HITRUST alliance. I also read bit on EU cybersecurity certification ...
0
votes
0answers
89 views

How to solve: Problem with converting pkcs12 file into a pem

I am trying to convert a client certificate from a pkcs12 type to a pem file using openssl, but this error is showed on my terminal. Does anyone have any idea why this is happening? I haven't edited ...
0
votes
0answers
25 views

Seeking a reliable way of creating trusted certificate files for OCSP

In my deployments I use OCSP must-staple flags on certificates, and ensure that my server is set to do verification and OCSP stapling. That's all good, but I'm forever having problems creating the ...
0
votes
0answers
27 views

Verifying Public Key Using The Digital Signature on Mac

I have just started with encryption and stuff, so please bear with me. Just playing around. I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
0
votes
1answer
81 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
0
votes
0answers
34 views

Automating certificate management across a large number of printers?

Is there a way to manage certificates on a large group of printers that will install and renew them? It doesn't look like any of the fleet management programs will do this. How are these managed in an ...
0
votes
1answer
109 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
0
votes
0answers
25 views

Certificate Pinning with SockJS

What is the SockJS way of pinning SSL Certificates in the client side when contacting wss:// to avoid CA trust? FYI, when using modules like HTTPS or WS, we can listen to the socket event and then on ...
0
votes
0answers
79 views

Why is my gf seeing a localhost self signed certificate when going to netflix?

Recently my gf told me she was receiving errors when trying to go to netflix. I took a look and the certificate is super wierd saying it is self signed. Why could this be happening? She only uses the ...
0
votes
0answers
43 views

CSP/KSP module for MacOS

My company developed a custom Key Storage Provider for Microsoft CAPI so that CNG-using Windows apps can perform signatures using a remote signature service. I would like to know if there is support ...
0
votes
0answers
46 views

Unable to get information from a PKCS certificate

I sniffed the communication between the client and the server using Wireshark, and I found out that during the handshake session, the client sends its certificate to the server. I've managed to get ...
0
votes
0answers
49 views

What are the security protections in using a TPM generated VSC to create a CSR

I am extremely new to the field of information security but was given a project to create a secure TLS certificate signed by our CA for a new security process. I found this thread (How to generate a ...
0
votes
0answers
259 views

SSL handshake: Client Hello and Server Hello

I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy. This is my topology:...
0
votes
0answers
35 views

Software build processes - Dependencies without admin privileges

we have the following problem and I would like to hear your opinions for this case: Currently several users are working with domain accounts which are in the local admin group (Yes, shame...) You ...
0
votes
0answers
50 views

Certificate Validation with SDS enabled on Ingress Gateway and mode set to MUTUAL

I have been having some difficulty understanding the mechanism by which certificates are validated by either party in a mutual TLS handshake. I have SDS enabled on my ingress gateway(s) and the ...
0
votes
0answers
36 views

Addons still work with Firefox on one account

I'm using Firefox 66.0.3 on Ubuntu, and like everyone else I'm experiencing the certificate bug which causes addons to be disabled. However, in one of my user accounts, the addons still work like a ...
0
votes
0answers
73 views

Usage of a self-signed certificate between Akamai and Azure

First of all, some background of what is proposed: The client's browser initialises request The request is resolved by public DNS (CNAME) to Akamai Edge The request is processed by Akamai accordingly ...
0
votes
0answers
33 views

SQRC use to verify e-delivered certificate

I have a need to provide a means of validating a certificate that is e-delivered. My thought is to use an SQRC to enable that verification by linking to a secure site that contains the original ...
0
votes
0answers
23 views

Securing a large application with multiple services and endpoints

Without getting too deep into the architecture, I would like to get suggestions / good reads on applying encryption to a large scale application with multiple endpoints. There are internal and ...
0
votes
0answers
36 views

authenticating SSL client certificates on server

current setup: i have a pki setup which issues client certificates to the users (so that only clients with the certificate can access the web application). was looking for ways to implement this and i ...
0
votes
0answers
41 views

Is Azure Key Vault more secure than the machine certificate store?

I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on ...
0
votes
0answers
52 views

See data sent by application over https

Let's say I have an application (A) installed on my PC that communicates with some server over https. What would another application (B) on my machine need to do to be able to read the unencrypted ...
0
votes
0answers
38 views

Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?

I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
0
votes
0answers
377 views

What is a reasonable default_crl_days value for OpenVPN CLR? Why?

I am having trouble finding a definitive answer (with a rationale) on what a reasonable default value for default_crl_days (in openssl.cnf) for use with OpenVPN. The current default is 30 days. But ...
0
votes
0answers
71 views

How to obtain a private client certificate

We have a fairly weird integration scenario where we need to connect the following two systems: 1) Partner's API Portal - the server, which uses MASSL authentication with a requirement that the ...
0
votes
0answers
22 views

Using client certificate from a file and a key pair from a hardware token

The question is about TLS client authentication using a browser. I have been using a smart card to authenticate to certain web sites. However, the card is a bit old and for whatever reason importing ...
0
votes
0answers
80 views

Renewing self signed SSL cert without updating client

I have a server and a single client. I have full control of both, the client is not a distributed application used by the public. For various reasons, I'm having the client use HTTPS to communicate ...
0
votes
0answers
213 views

In what important ways can a digital signature be invalid?

I am trying to write some code to verify that a digitally signed file came from my company. I was horrified to stumble across this deeply buried answer on Stack Overflow, an out-of-left-field ...
0
votes
0answers
148 views

Proxying an Android application with Burp Suite

I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
0
votes
0answers
96 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...