Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
1148
votes
3answers
614k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
289
votes
6answers
226k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
243
votes
7answers
43k views

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
179
votes
7answers
159k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
156
votes
4answers
117k views

What exactly does it mean when Chrome reports 'no certificate transparency information was supplied by the server?'

When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I receive a message 'no certificate transparency information was supplied by the server' (...
145
votes
11answers
181k views

Provide subjectAltName to OpenSSL directly on the command line

Is it possible to provide a subjectAltName-Extension to the OpenSSL req module directly on the command line? I know it's possible via a openssl.cnf file, but that's not really elegant for batch-...
139
votes
14answers
46k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
120
votes
2answers
248k views

Difference between .pfx and .cert certificates

What is the difference between .pfx and .cert certificate files? Do we distribute .pfx or .cert for client authentication?
114
votes
6answers
31k views

I can't access websites that use HTTPS, instead getting the message “your connection is not private”!

I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But ...
111
votes
4answers
104k views

What certificates are needed for multi-level subdomains?

I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy. Here's what I need to secure: foo....
110
votes
5answers
344k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
98
votes
6answers
58k views

Let's Encrypt for intranet websites?

Many companies have intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate, which causes a bad habit for the users since they get used to just ...
94
votes
4answers
103k views

What is the difference between an X.509 “client certificate” and a normal SSL certificate?

I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
92
votes
7answers
129k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
91
votes
10answers
34k views

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
90
votes
10answers
44k views

Should I change the private key when renewing a certificate?

My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
89
votes
4answers
10k views

Should I revoke no longer used Let's Encrypt certificates before destroying them?

The Let's Encrypt documentation recommends that when a certificate’s corresponding private key is no longer safe, you should revoke the certificate. But should you do the same if there are no ...
88
votes
4answers
16k views

What prevents me from buying a SSL certificate for a domain I don't control?

Can I simply build a webserver, make its hostname "google.com", create a CSR off that server, and send that to a Certificate Authority for signing? Let's say I pick the cheapest and dodgiest outfit I ...
86
votes
5answers
37k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
82
votes
12answers
14k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
81
votes
1answer
23k views

Is Starbucks spoofing me?

When I connected to Starbucks's Wi-Fi, I got a security alert from MS Outlook that looks like this: I looked up secure.datavalet.io, but there's no mention of this thing anywhere. This does not ...
81
votes
2answers
47k views

ssltest: Chain issues - Contains anchor

I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)") What does it mean? Should it be fixed? Can it be exploited?
75
votes
6answers
10k views

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

I just requested a CSR from my shared web hosting provider, to generate a certificate which I will send back to them to install. (The certificate itself is to be generated properly by an organisation ...
75
votes
5answers
30k views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
72
votes
2answers
90k views

What is the difference between serial number and thumbprint?

I have problems to understand what is the difference between the serial number of a certificate and its SHA1 hash. The MSDN says: Serial number A number that uniquely identifies the ...
72
votes
1answer
15k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
71
votes
3answers
60k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?

(Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
67
votes
3answers
11k views

Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?

After installing Firefox 54.0.1 on my work laptop, the first page I see warns me that "Your connection is not secure" when opening https://www.mozilla.org/. "The owner of Firefox has configured their ...
64
votes
7answers
16k views

Why would a school need to install certificates on student laptops?

This question indicates parents are to buy laptops for a school to install software and certificates. I am seeking to understand reasons for site certificates installation: Why would site ...
62
votes
4answers
429k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
62
votes
4answers
8k views

Why was the private key of the Superfish certificate so easily extractable?

Robert Graham detailed on the Errata Security blog how he was able to get the private key of the Superfish certificate. I understand that attackers can now use this key to generate certificates of ...
61
votes
3answers
12k views

Why is this certificate for Imgur only valid for one day?

I'm connected over a café WiFi and received a warning from my mobile browser. When I looked further, it seems like the certificate is only valid for one day, which seems super suspicious.   It ...
60
votes
4answers
9k views

Is there a way to make sure my government does not swap out SSL certificates?

I was recently wondering whether there exists a way to make sure my government is not swapping out SSL certificates in order to intercept the traffic. I know almost all browsers are complaining in ...
60
votes
3answers
168k views

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm What exactly is the difference here and why are two encryption bits ...
58
votes
2answers
5k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
57
votes
1answer
13k views

How does my browser inherently trust a CA?

I am reading this post and not understanding the answer. The answer ends with the words ...your browser can verify one cert against the next, all the way to the root CA, which your browser ...
57
votes
1answer
4k views

Does a client certificate identify the owner to unrelated websites?

If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it? I once visited an ssl diagnostic site that immediately ...
56
votes
2answers
47k views

What are the risks of self signing a certificate for SSL

Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
53
votes
4answers
86k views

How does the digital signature verification process work?

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
50
votes
2answers
89k views

What's the difference between X.509 and PKCS#7 Certificate?

Am I correct calling file with .p7b file extension saved as 'Cryptographic Message Syntax Standard - PKCS#7 Certificates (.P7B)' in Windows - a 'PKCS#7 certificate'? Or is it better called 'X.509 ...
47
votes
2answers
8k views

Why aren't infinite-depth wildcard certificates allowed?

As far as I can tell, an SSL certificate for *.example.com is good for foo.example.com and bar.example.com, but not foo.bar.example.com. Wildcards certificates cannot have *.*.example.com as their ...
45
votes
2answers
50k views

What is the difference between SSL and X.509 Certificates?

I used openssl to create a X.509 certificate but I don't quite understand the relationship between a X.509 and a SSL certificate. Are they the same? Is a SSL certificate just a X.509 certificate that ...
44
votes
2answers
35k views

Why would I choose SHA-256 over SHA-512 for a SSL/TLS certificate?

I'm looking to renew an SSL (okay, TLS) wildcard certificate with a well-known service. I need to provide a CSR, which I have created using a 2048-bit key. I also need to choose a signature hash. The ...
44
votes
2answers
7k views

Digital Certificate deployment: using two certs for each user?

At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs: One for signing documents, emails, etc. that is ...
44
votes
3answers
9k views

My friend revealed both private and public keys for his server. How serious is this?

A friend of mine managed to expose both id_rsa and id_rsa.pub file from his server via apache. I mentioned to him that this is serious security issue but he brushed this off like it was no big deal. ...
44
votes
5answers
20k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
44
votes
4answers
32k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
44
votes
3answers
4k views

Why do we not require websites to have several independent certificates?

It is often cited as a primary point of concern that a single compromised CA can make for significant damage, as all websites (and other entities) that rely on this CA cannot be trusted anymore. ...
43
votes
11answers
19k views

Is anybody using client browser certificates?

Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
42
votes
7answers
5k views

Is there any legitimate reason to install yourself as a root CA?

Follow up from comments on another question. Is there any reason as to why you might install yourself as a root CA on your own network? The only reason I can think of is forcing computers in the ...