Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
1answer
86 views

Is this CA store related to Ubuntu or OpenSSL

I am checking TLS certificates chain validity against CA sore in this path: etc/ssl/certs/ca-certificates.crt I use Ubuntu 18.04 and OpenSSL 1.1.0g. I need to know whether this CAs store is from ...
0
votes
2answers
53 views

How to deliver an application to several clients with a single trusted SSL certificate? [duplicate]

I am working for a software editor and we deliver to our clients a turnkey solution that the client has just to install on his server to use it. This solution is a web service who uses HTTPS to ...
0
votes
2answers
229 views

What does it mean to have a retired CA root certificate?

I was looking at various CAs and they always have a paged dedicated to list "retired roots". For example: https://www.thawte.com/roots/retired.html Does it mean these certificates should not be ...
0
votes
1answer
90 views

Identify owner of public key certificate

Today I logged in and found these certs in my home directory (macOS): 3d001d000851363136363935_rsa_new.der 3d001d000851363136363935_rsa_new.pem 3d001d000851363136363935_rsa_new.pub.pem ...
0
votes
1answer
4k views

Will the sever send a 'Server Hello' if ciphers are not negotiated?

I know in Server Hello message, the server chooses the strongest cipher that both the client and server support. If there are no cipher suites that both parties support, the session is ended with a ...
0
votes
1answer
699 views

Break into WPA2-Enterprise RADIUS wifi network by stealing credentials

I need to ensure that no un-authorized DEVICE gains access to a wireless LAN network. Notice I said, "device". This means that I need to ensure that only authorized personnel can join the LAN and ...
0
votes
1answer
420 views

Generate X509 ERR_CERT_COMMON_NAME_INVALID

I am trying to set up https server on python3, but I could not generate a certificate and a key properly. That is the server code: import http.server, ssl server_address = ('localhost', 4443) httpd =...
0
votes
1answer
122 views

Is EV (Extended Validation) Certificate Green Bar Affected by Available Cipher Suites?

I am wondering whether Extended Validation (EV) Certificate 'green bar' on the web browser is affected by Cipher Suites. I can't find seem to find a reference that says that apart from this answer. ...
0
votes
1answer
59 views

How do we exchange public key securely in a DV SSL connection? [closed]

Let's said we're running asymmetric encryption on a server with DV SSL encryption. With this condition set, how do we send the users' public key and private key generate in server to client in order ...
0
votes
1answer
443 views

ssl-cert common name and Alternative name in Nmap output

What is the meaning of these sections? I observe these field for port 443 and in particular I don't understand why, in my case, common name is different from the target name of the scan. How these two ...
0
votes
2answers
235 views

Can I complete SSL Certificate Domain Control Validation (DCV)

We host sites for multiple companies and sites are hosted with custom domains. For Example news.CompanyX.com news.CompanyY.com We have complete control on hosted site but do not have control over "...
0
votes
1answer
128 views

Does chrome still use SSL after certificate warning?

We use a third party service which if I put its URL in the browser , it display : Looking at the certificate itself : Questions: 1 - If I click "Proceed to x..." - Is the channel still using ...
0
votes
1answer
815 views

Should I be concerned if my employer is performing man-in-the-middle HTTPS attacks? [duplicate]

I have reason to believe that my employer may be performing HTTPS man-in-the-middle attacks on company-issued work laptops, as Java's SSL Certificate lists my employer as the Certificate Authority. ...
0
votes
1answer
878 views

Self Signed SSL Certificate - How to verify it correctly on the client side?

For our current implementation we are using a self signed root certificate, which then is used to sign ssl certificates for our secure http connection. My question relates to the verification logic ...
0
votes
2answers
63 views

Can I somehow require a specific certificate for a domain?

My use-case is the following: I have dyndns set up to access my home server from the internet. If I use a DV certificate or a self-signed certificate I'm not actually authenticating the machine but ...
0
votes
1answer
6k views

Certificate Based Authentication with AD and 802.1x or EAP-TLS

I like to think I have a better understanding of PKI then most people but this one issue has me scratching my head and I was hoping someone could cut to the core of it. In a system where you have ...
0
votes
1answer
181 views

Why would a commercial CA issue dup root?

I just ran across a keystore (generated and managed using IBM's GSKit) that has two root certificates with the same Subject DN and same key: Subject : "CN=Entrust.net Certification Authority (2048),...
0
votes
1answer
383 views

OCSP doubts about CA and OCSP Responder

My question is about this image. Suppose that client is Alice and Server is Bob. So, basically, I'm trying to setup a scenario... I have a remote Server (Bob) that has an https website. I make: ...
0
votes
1answer
82 views

How to properly implement encrypted connection between two parties who trust each other with SSL?

I would like to have a reliable (as in TCP) encrypted (authenticity, integrity, confidentiality) connection between program A and program B. I am the creator of both A and B. I want A to communicate ...
0
votes
2answers
168 views

What is the user's private key literally used for in a digital certificate? [duplicate]

As far as I know, before entities acquire a digital certificate from a CA, their app will generate a pair of keys (PRk and PUk). But what is the private key used for? P.S. Is user's public key is the ...
0
votes
1answer
100 views

startssl cert e-mail to receive verification code

I'd like to configure AD FS in my lab and one of the pre-requisites is to have "a publicly trusted certificate for SSL Server authentication" so far so good. I came across https://www.startssl.com and ...
0
votes
1answer
90 views

Should I keep old or expired SSL crt, cabundle and key files

Is there a standard or best practice as far as retaining old or expired SSL crt, cabundle and key files for your domains?
0
votes
1answer
323 views

Stealing client certificate using Cross Frame Scripting

An application asks for userID and then it asks for the client certificate to authenticate. All the pages of the application are vulnerable to XFS. Now an attacker can get userID using XFS, but can it ...
0
votes
1answer
35 views

Is the pfx that contains ssl the same pfx that is used to sign an application

I have a ssl certificate in a pfx. I am using this to secure an https application. Can this same pfx be used to sign an exe? The reason I am asking is that this pfx gets shipped with the ...
0
votes
1answer
855 views

can MiTM read server certificate in TLS1.2?

We have a client and server that works via TLS 1.2 connection. Client connects to server, client checks server's certificate, connection established. Question - can anyone who read all data packets (...
0
votes
2answers
77 views

Secure website with unique machine certificate

Is it possible to allow access to a website only for specific clients on specific machines? I'm no security expert, but one idea I had is to generate a certificate that would work only on a specific ...
0
votes
2answers
480 views

Why can the common name of a key-pair be empty?

I just realized that, using openssl req - new -key foo.key -out newcert.csr, you can actually have an empty CN value. What's the value of that?
0
votes
2answers
8k views

Is it possible to send a cURL request with SSL without the private key?

I am developing a service for a client that based on their requirements needs to have client certificate based authentication. They sent me 2 files, one is the certificate they will send in the ...
0
votes
2answers
267 views

Strange certificate in keychain

I've found a strange certificate in osx keychain. I don't remember installing it and it is marked as "it was signed by an unknown authority". It was installed in my login keychain and it "seems" to ...
0
votes
1answer
323 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
0
votes
1answer
97 views

Verifying that a request is internal

I've got a web app that will only output safe code. It needs to pass this to a Python backend. The logical way to pass things between JavaScript and Python is to have a Flask server running. Then, the ...
0
votes
3answers
148 views

What implications does the KeRanger infection have for Mac OSX security?

Recently some hackers replaced installers for a popular torrent client with an infected version. According to paloaltonetworks, they have no idea how the hackers managed to do this (let's just assume ...
0
votes
1answer
1k views

Mutual Authentication and Authorisation with Certificates from various CAs

Edit: Having read this question and answer I have a bit more of an understanding. My question now then, is: can I use a certificate that a user has had signed by a registered CA such as VeriSign, ...
0
votes
1answer
4k views

Certificate validation Local DNS hosts file

I've a question regarding a certificate validation error I'm getting. I'm performing an https request from one machine to another (windows machines). On the destination machine I've configured a self-...
0
votes
1answer
150 views

Analyzing a TLS connection?

Suppose I want a secure TLS communication between me and myschool.edu. Which of the following should I trust to preserve confidentiality, integrity, and authenticity. Here are the options and my ...
0
votes
1answer
1k views

Fiddler Can decrypt https traffic

So apparently, a software called fiddler is able to very easily decrypt secure https traffic with a click of a few buttons: http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/DecryptHTTPS I ...
0
votes
1answer
303 views

Fido U2F Public keys in registration response

What is the deference between the two public keys: user public key (2nd element in Token response) user public key inside signature in U2F Token response for registration ?
0
votes
1answer
2k views

Can I use a CA certificate for two ways (mutual) authentication

I cannot get an answer from a CA company for this question. I have to implement two ways SSL authentication between my server and my users computers. Users should access to my several API securly. I ...
0
votes
3answers
282 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...
0
votes
1answer
371 views

Combining wildcard and subdomain-specific SSL certificates

Not quite sure which Google terms to use to find the answer, so I thought I'd ask it here, presented as a scenario: Say you have a corporate entity (Example Co) with a wildcard SSL cert issued for *....
0
votes
1answer
843 views

Why deploy a .p12 client certificate bundled with a root CA?

I have been asked to connect to a government agency secure site that uses client certificates to authenticate its clients. I received by email an encrypted client certificate as a PKCS#12 file and by ...
0
votes
1answer
242 views

What does this mismatching SSL certificate hint at?

I'm currently visiting China, and I use a well known VPN service for both my laptop and my phone. Every now and then, I get certificate errors when using my phone when I'm connected to a VPN, but ...
0
votes
1answer
1k views

Is digital certificate with 'issued to' field as *.example.com valid?

Came across a Digital Certificate which has issued to field *.example.com Is this a valid certificate?
0
votes
2answers
2k views

Why does IP address need to be listed as a DNS name in SAN/UCC certs?

I have heard that when creating a CSR that if you want to validate an IP address that you should list the IP as a "DNS" name and not "IP Address". I have actually had to re-create CSR's like this to ...
0
votes
1answer
2k views

Can anyone with access to root CA private key decrypt HTTPS traffic?

Can anyone with access to root CA private key decrypt HTTPS traffic of sites using certificate signed by that CA ? and if yes do he need to be man-in-the-middle or just monitoring traffic is ...
0
votes
1answer
181 views

What would cause a server to only send over 1 SSL certificate to a client? [closed]

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
0
votes
1answer
896 views

Reverse proxy sharing one certificate for multiple servers using Subject Alternative Name

The following is a scenario for an attack where one website can impersonate another. I am told (including by this answer) that it's impossible, but I would like to understand exactly what prevents it. ...
0
votes
1answer
290 views

Windows - Revoked Binaries

I find it hard to believe that the majority of Windows system files aren't signed. I don't know whether my disbelief comes from naivety, or because Windows is used within secure environments worldwide ...
0
votes
1answer
617 views

Save to setup localhost.example.com to test wildcard SSL?

I have a domain with a wildcard SSL certificate (i.e. "*.example.com"). I also develop using WAMP setups, which I would like to be able to test HTTPS on. There are several tutorials on how to setup a ...
0
votes
1answer
9k views

RESTful web service and SSL certificate

We have a server that provides RESTful services to our application server. It runs on Amazon Elastic Beanstalk and mapped with a domain name and SSL certificate registered at GoDaddy. It ran ...

1
40 41
42
43 44
49