Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
2answers
3k views

How to convert my cert chain to PFX without a password

I am trying to enable an Azure Front Door instance on the front of my website using my EV cert (Extended Validation Certificate). However, from Azure Front Door Cert Instructions, Azure Front Door ...
0
votes
1answer
84 views

Giving a PFX cert to a 3rd party email service for DKIM?

My organization is working with a vendor that needs to send emails on our behalf. They want us to import a PFX certificate into a DKIM key. We want to understand the implications first. What ...
0
votes
1answer
116 views

re-reading decoded openssl pubkey

I was playing with openssl just to see how reading of the public key from a certificate works; Gave a "letsencrypt.pem" certificate I have, I gave these commands. See the entire certificate text: ...
0
votes
1answer
425 views

Limit OpenVPN client certificate to specific VPN with shared CA chain

I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of ...
0
votes
1answer
564 views

Root CA or Intermediate CA in firewall trust store

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and ...
0
votes
1answer
203 views

understanding MITM attack [duplicate]

hi Everyone please correct me if im wrong for my understanding for the man in the middle attack used in a variant of diffie hellman key exchange . am i right to say that a protocol is susceptible to ...
0
votes
1answer
198 views

TLS certificate requirements [closed]

Can any certificate be used for TLS? What requirements should the certificate meet for TLS? SHA1/Sha2 {key specs} etc.
0
votes
1answer
361 views

Why I get “Invalid certificate” error when I use school network?

Why I get "Invalid certificate" error when I use school network? This error usually appears on sites about programming, Linux and about security, privacy or anonymity. Sometimes I receive error "...
0
votes
1answer
57 views

How to Prevent a Specific Trusted Root Cert From Re-Installing After Deletion

Due to a recent Google change, one of the SSL certificates for our URL & Content filtering systems keeps throwing an error preventing users from accessing this specific site. The fix is to just ...
0
votes
1answer
30 views

With uploading to AppStores - what problem do all the certificates fix above Two Step Authorization?

So if you ask around on the internet you see a lot of people frustrated with the whole signing and certificate jungle when trying to upload apps to the App Store. Of course on this channel for a lot ...
0
votes
1answer
162 views

Could an attacker connect to a SSTP VPN if they know a users credentials but do not have the public certificate?

When setting up a SSTP VPN we distributed certificates to the trusted root authority of each client computer to validate the server, can this certificate also prevent attacks if credentials are lost? ...
0
votes
1answer
98 views

alias in certificate

Why when I create a certificate in XCA software and import this to token and list certificate token in opensc, I don't see alias? But when I generate a certificate with openssl I have alias.
0
votes
1answer
53 views

Manual digital certificate verifcation

I was reading about digital signatures and certificates and from what I've read, when you receive a certificate from a website, you verify CA's identity with a list of CA stored in the web browser. ...
0
votes
1answer
2k views

Multiple Certificates with same DN

I have few questions related to DN in SSL Certificates, Can multiple domains have SSL certificates with the same DN issued by same CA? Is it ok for a single domain to have multiple SSL certificates ...
0
votes
2answers
77 views

unique certificates and TLS protocol

I know we can use TLS protocol to create a secure connection between a server and a client. My question is : Certificates ,which use in TLS, are unique for each connection (pair)?. e.g. in a data-...
0
votes
1answer
579 views

Break into WPA2-Enterprise RADIUS wifi network by stealing credentials

I need to ensure that no un-authorized DEVICE gains access to a wireless LAN network. Notice I said, "device". This means that I need to ensure that only authorized personnel can join the LAN and ...
0
votes
2answers
70 views

Why Software Configuration Management tools (SCMs) authenticate only client instead of server?

I've noted that probably all of the 4 popular Software Configuration Management Tools (SCMs), ie.: Puppet, Ansible, Chef, Salt use only clients' authentication instead of the server authentication – ...
0
votes
1answer
143 views

certificate about to expire, CSR needed? [duplicate]

Say, I create a CSR with OpenSSL and send it to a Root CA for signing. Let's assume that the certificate was issued for 2 years. Two years are almost over and the certificate is about to expire. Do I ...
0
votes
1answer
73 views

What are the reasons why TLS certificates are not issued or revoked?

I'm curious what threshold is used for CAs to issue / deny issuance / revoke TLS certificates. As far as I understand they are essentially identity guarantees, so if JunkCorp can't prove they are who ...
0
votes
2answers
57 views

Pass SSL certificates after verification to other components

Is it possible to verify the certificate of a server and pass the certificate over to another software component over https for it to use this as trusted certificate for further communications (using ...
0
votes
1answer
5k views

self signed root cert can not be verified with openssl - error 18 at 0 depth lookup [closed]

I'm simply trying to create a self signed cert. I created a root cert from which I created server key + cert and client key + cert While connecting to TLS server installed with server key + server ...
0
votes
1answer
380 views

Certificate substitution by antivirus [duplicate]

I have installed antivirus and noticed that all https sites I am visiting use the certificate of antivirus's manufacturer. It looks like man-in-the-middle attack and I understand why the antivirus's ...
0
votes
2answers
1k views

Multiple instances with the same SSL certificate legalities? [closed]

In here it said some CA's wouldn't permit using the same SSL certificate on multiple servers: Can I use a single SSL cert on two different servers?. But what about two instances from the same server. ...
0
votes
2answers
4k views

How does a client use the Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service?

According to a the technet articles: The Certificate Enrollment Web Service is an Active Directory Certificate Services (AD CS) role service that enables users and computers to perform ...
0
votes
2answers
557 views

Is there a difference between the various certificate templates in windows server?

On my NPS server which is also a Domain Controller, the Issuing CA has for some reason automatically given the Domain Controller a certificate based on the "Domain Controller" certificate template. I ...
0
votes
2answers
97 views

Can a user have a certificate or does only a machine have a certificate?

If say you want to set up a PKI and use EAP-TLS to authenticate all users and computers. A computer's certificate is stored on that computer. But how can a user have a certificate? Where is it stored?...
0
votes
1answer
1k views

Serial Number / Thumb Print of Digital Signature/Certificate

When I looked the digital signature properties of LSASS.EXE, I am presented with this: Which states Serial Number 33 00 00 ... 00 CC. Fair enough. When I looked the attached digital certificate ...
0
votes
1answer
55 views

Trouble understanding the explanation of “server certificate” message in RFC 5246?

The following texts are found in the explanation of "Server Certificate" message in the RFC 5246 TLS 1.2 at page 46. 7.4.2. Server Certificate When this message will be sent: The server MUST ...
0
votes
1answer
147 views

What's the common strategy for issuing OCSP requests

I am currently defining a PKI for code signing certificates on an embedded device (without internet connection). I define the behavior of the certificate issuer(FW release authority) as well as the FW ...
0
votes
1answer
82 views

Do I need my own server for signing certificates?

Sorry for any confusion with this question. I'm not even sure exactly what I'm asking. So what I'm trying to do is reverse-engineer an android app, and then building a python program on my Windows PC ...
0
votes
3answers
93 views

Can a local root certificate make a user more susceptible to phishing?

In order to scan encrypted network traffic, security software usually installs root certificates on the user's machine. Sometimes on websites with standard digital certificates, the local installed ...
0
votes
1answer
1k views

Website uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH

I just installed a new wildcard certificate on my Ubuntu server (there was a single certificate installed before). I modified /etc/apache2/sites-available/000-default.conf which is for one specific ...
0
votes
1answer
196 views

OCSP stapling Alice and Bob

In the case of OCSP stapling in the browsers, it works this way. But my question is, in a case where I have a communication between Alice and Bob how this works? I know that if I use OCSP normal, both ...
0
votes
1answer
87 views

Changing server side certificate during ongoing connection -> is it supported ? what are the effects on the existing connections?

I was wondering (based on the TLS RFC and its current implementation by the major vendors / platforms - i.e. Microsoft's IIS): how would an existing active SSL / TLS session behave / react if the ...
0
votes
1answer
85 views

Buying versus Creating TLS Certificate? [duplicate]

Let's say a web server would like to host traffic over HTTPS. My incomplete understanding is that TLS enables HTTPS. client <--- HTTPS (over TLS) ---> server The server must produce a ...
0
votes
2answers
608 views

When creating self signed certs, is the CA.crt supposed to be installed into client machine?

I'm trying to work with OpenSSL C API, I'm relatively new to all this still, and I find a lot of mixed information out there, so I think it's wise to ask for ideas/opinions/clarification. Anyway, the ...
0
votes
2answers
81 views

How to get public prime from DHE from TLS v1 DHE-RSA x.509 certificate?

I can view the certificate using openssl s_client -showcerts -connect www.masaood.com:443 </dev/null I can view the public key of a RSA, but cannot find any information for DHE: openssl ...
0
votes
1answer
130 views

Certificate Renewal: What stays between an existing expired certificate and a renewed one [closed]

I see that except public key mostly everything else changes after the certificate renewal; should I reconfigure the programs/softwares to use the renewed certificate? if there is 'something' that ...
0
votes
1answer
253 views

Storing SAML Idp certificates in APP_Data folder

We provided a SAML2 Service Provider to our client, so they can use that to configure their Identity Provider to our Service Provider. My questions is about our client certificate, I'm worried that ...
0
votes
1answer
112 views

SSL Client Authentication: Basic and extended usage (in theory)

Till now I understood Client Authentication as a way to limit access for certain clients. But after reading https://en.wikipedia.org/wiki/Transport_Layer_Security#Client-authenticated_TLS_handshake ...
0
votes
1answer
66 views

Would DNSSec and DANE be more secure if the same key was published to different TLDs?

Assuming that it's tough to get many government owned TLDs to cooperate to spoof DANE or DNSSec, would it be wise to publish the same certificate (different SAN names) to various TLDs? For example: ...
0
votes
1answer
8k views

java keytool - how to modify a keystore's Owner and Issuer information?

I have a product that initially used a keystore in which the certificate as the Owner and Issuer information as "unknown". Now for security policy reasons and still guaranteeing back compatibility I ...
0
votes
1answer
265 views

What if I want a certificate, but DON'T want my domain in a Certificate Transparency log? [closed]

Say I want to get a certificate for my domain, and say that I don't want this to result in the name of my domain appearing in certificate transparency logs or similar locations. (The domain is only ...
0
votes
2answers
152 views

What prevents a man in the middle attack when verifying a certificate with authority?

If a certificate looks suspicious you'd want to verify it with the authority. As such you'll need to open a channel to the authority's verification server. Who/what protects this verification ...
0
votes
1answer
45 views

Do certificates provide any benefit to subresource integrity?

What would be the potential attack vectors if a browser were to ignore the certificates when making a network request that is verified via subresource integrity? As an example, lets say I had the ...
0
votes
2answers
49 views

Faking a certificate check flow between 2 applications?

i was wondering, let's say i have an executable A, which verifies a certificate in assembly B. Assembly B is signed with root ca trusted certificate. what denies me from taking executable A, change ...
0
votes
1answer
94 views

OCSP from branch office to central office

Our firm wants to validate certificates using OCSP in its branch offices. However, when the OCSP responder as defined in the certificate is down, they want to fallback on CRLs, which is the right ...
0
votes
2answers
535 views

Cisco FirePOWER estreamer python client SSL Cert issue

I'm looking to the use the estreamer python library for Cisco firepower. To achieve this, the configuration document states the following about using clients: "you need to create a certificate on ...
0
votes
1answer
176 views

How to verify that the certificate of a file is trustworthy?

What steps should I take to make sure that the certificate of a file can be trusted. Or is there really a way to be absolutely sure about that? I am currently implementing this validation using the ...
0
votes
2answers
224 views

End to end encryption for files

I need to develop a system where a user can upload a file via browser which encrypts the file and stores it on my server. After the file is uploaded other user can download the file with an iOS or ...