The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
24
votes
4answers
6k views

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as ...
24
votes
3answers
45k views

Is it technically possible to configure two different SSL certificates for the same domain?

Say I have these URLs: https://example.org/ https://example.org/criticalpath I want the first one to be served with a domain validated commercial SSL certificate and the second one with an extended ...
24
votes
5answers
6k views

Who is responsible for revoking a certificate?

The CA issues certificates to clients/servers. Whenever a request is made by the client/server, the certificate is used to verify the identity. Now, if a certificate needs to be revoked then who does ...
24
votes
1answer
6k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
24
votes
4answers
18k views

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
24
votes
3answers
2k views

A Different Approach to PKI

After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
24
votes
1answer
19k views

Which properties of a X.509 certificate should be critical and which not?

RFC5280's section 4.2 states Each extension in a certificate is designated as either critical or non-critical. A certificate-using system MUST reject the certificate if it encounters ...
23
votes
6answers
19k views

Possibility to sniff HTTPS traffic on devices without installing a certificate

My goal is to sniff the HTTPS traffic of some digital devices (AppleTV, game consoles, etc.), and decrypt the HTTPS packets in my local network. I cannot figure out a way by using some HTTPS ...
23
votes
3answers
3k views

Superfish vs. Corporate MITM

I work for a consulting company, and I have been implementing a tool from a security vendor, which is a cloud proxy for all user traffic. It will perform malware scanning and filtering of all web ...
23
votes
3answers
7k views

What happens when an Intermediate CA is revoked?

Currently I’m working on a certificate manager that allows our product to securely connect to remote web services (over TLS/SSL). For security, we use Certificate Revocation List checking (or CRL-...
23
votes
3answers
16k views

What does it mean for a digital certificate to be “signed”?

When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
22
votes
3answers
18k views

What issues arise from sharing a SSL certificate's private key?

Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website. I have ...
22
votes
2answers
2k views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
22
votes
3answers
6k views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, etc....
21
votes
5answers
13k views

Is it safe to send a CSR via email?

I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?
21
votes
4answers
8k views

What is the potential impact of these SSL certificate validation vulnerabilities?

I just finished reading through this paper by Georgiev et al, which demonstrates a wide range of serious security flaws in SSL certificate validation in various non-browser software, libraries and ...
21
votes
2answers
29k views

Generate CSR from existing certificate

Can we generate the CSR (certificate signing request) used for certificate signing from the signed certificate? It should work with the original private key when signed again with different authority.
21
votes
4answers
13k views

What elliptic curves are supported by browsers?

I Wireshark'ed a Firefox 3 request, because I couldn't find the curve names documented: Elliptic curve: secp256r1 (0x0017) Elliptic curve: secp384r1 (0x0018) Elliptic curve: secp521r1 (0x0019) What ...
21
votes
5answers
4k views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but that'...
21
votes
2answers
3k views

How much of a problem is it that Windows “hides” some of the trusted root CA certs?

Based on information on this page, Windows actually trusts many more root CA certificates than what are displayed when a user launches certmgr.msc and navigates to Trusted Root Certification ...
20
votes
7answers
5k views

Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?

Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
20
votes
4answers
2k views

Dealing with SSL Certificates on Products

We are developing a product (device / system) that will be installed on customer sites. Many of our customers will (should) be concerned about security, and should be thinking about it seriously. Our ...
20
votes
4answers
9k views

Can an intermediate CA be trusted like a self-signed root CA?

Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
20
votes
7answers
14k views

How do I check if a gmail/gtalk SSL certificate is valid?

Pidgin started prompting me to accept/reject new gtalk SSL certificate a few days ago and I am not able at the moment to tunnel the traffic to check if it would continue to happen or if it wouldn't (...
19
votes
3answers
23k views

Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”

I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain. https://chart.apis.google.com/chart?cht=qr&chs=100x100&chl=otpauth%3A%2F%...
19
votes
3answers
4k views

Are certificates without DNS fundamentally flawed?

I am new to security work and I am implementing someone else's design. The design calls for a TCP server with TLS in an environment where there is no DNS - only IPs. I am working with a typical ...
19
votes
2answers
4k views

Is it safe to publish a private CA's root and intermediate certificates?

Context: We have a private certification authority in my company. We are provisioning VMs in our private cloud which will need to trust SSL certs issued by this CA, i.e. they will need the cert chain ...
19
votes
2answers
44k views

OpenSSL generate different types of self signed certificate

Does anyone know how to use OpenSSL to generate certificates for the following public key types: DSA - For DHE_DSS key exchange. Diffie-Hellman - For DH_DSS and DH_RSA key exchange. ECDH - For ...
19
votes
2answers
2k views

Encryption and the “security time decay” of prior encrypted data

This question is on the assumption that any data once encrypted, may (eventually) be decrypted through Brute force (compute power/time) Exploits in the cryptography used Theft of private keys Most ...
19
votes
3answers
37k views

Is it possible to use wildcard certificates on multiple devices?

I have a server that I want to use a wildcard cert on. It runs multiple services. I purchase a wildcard cert so that I can protect mail.something.dom, www.something.dom, im.something.dom, calendar....
19
votes
3answers
4k views

What are the risks of a Certificate Authority hack for 'the average user'?

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
19
votes
2answers
1k views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
19
votes
1answer
14k views

Getting a Root CA accepted in systems and browsers

I would like to ask about the procedures for a given CA to get one of its root CAs (SSL issuance CA) to get accepted and installed as a trusted root CA in operating systems and browsers.
19
votes
4answers
44k views

Recommendations for a Certificate Management tool for Linux [closed]

A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients. This creates a new challenge to manage all these certificates and ...
18
votes
8answers
15k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
18
votes
5answers
7k views

Does Google use extended validation certificates?

I just changed a password on a Google account while using the Chrome browser. After doing so, I noticed that the https connection to Google was not highlighted in green signifying that it was an "...
18
votes
5answers
6k views

Why are certificates limited in time?

If a certificate has a limited duration of, say 5 years, but it gets somehow compromised after 2 years, waiting the 3 remaining years for it to get invalid is not a real solution to the breach problem....
18
votes
2answers
1k views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
18
votes
2answers
3k views

SSL fingerprint inconsistency: what does it mean?

I apologize if this is not the best place to ask my question on the Stack Exchange network, I couldn't figure out where to get enough attention and be relevant. Facebook provides a SSL host, it can ...
17
votes
2answers
26k views

SSL certificate chain verification

After reading many articles and watching many tutorials I decided to be specific because there are some things about SSL certificate chain verification and SSL cetificate verification in general that ...
17
votes
5answers
3k views

How can trusting ONE certificate jeopardize everything I do online?

I am not sure I understand how TLS works correctly. To my understanding trusting a certain website's certificate is all about trusting that website or not, but the questions below suggest that ...
17
votes
3answers
3k views

Multi-tenancy, SSL Certificates, and Subject Alternative Name

The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension. From the spec: The subject alternative name ...
17
votes
2answers
2k views

How can you prevent employees of your company from creating valid ssl certs? [duplicate]

When registering for an SSL cert, I was able to validate that I "owned" the domain I was creating the cert for by having a valid @domain.com email address. If I worked for a large company, say ...
16
votes
2answers
2k views

Is Certificate validation done completely local?

Am I right in my conclusion that validation of a certificate by a client that wishes to communicate with a server that offers said certificate, is done completely local? As in, the client is supposed ...
16
votes
4answers
3k views

Broken SSL on every website [duplicate]

One of my friends called me saying every website anyone in her family goes to has untrusted SSL certificates. From any computer in her house, HTTPS is broken and Firefox or Chrome asks to add an ...
16
votes
2answers
9k views

Secure communication between applications using SSL Certificates

I am looking for a way how to secure communication between our applications. There is a "server" application listening on some TCP port and "client" application which is communicating with the "server"...
16
votes
1answer
4k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
16
votes
2answers
7k views

Is “Fingerprint Check” enough to verify HTTPS certificates?

So I'm at place A, see this sign: and I'm writing the fingerprints to a piece of paper (this website is just an example): Ok. Then, I go to place B (other country, etc.) then I check this site. ...
16
votes
4answers
5k views

Why is it a good idea that X.509 digital certificates have an expiry date?

What is the benefit of having certificates expire at some fixed date?
16
votes
5answers
6k views

Multiple CAs signing a single Cert/CSR?

Just saw this suggested on Slashdot So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea to ...