Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

Does Juniper have an equivalent of 'show security pki local-certificate' for remote certificates? [migrated]

On a Juniper Firewall, the command show security pki local-certificate will give all sorts of detail for a local certificate. (The sort of certificate you would use to stand up an IKE connection) My ...
0
votes
0answers
39 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
0
votes
1answer
70 views

Is using trusted CA to issue certificate for a VPN server insecure?

I’d like to have an AlgoVPN server that uses a trusted CA to issue a certificate for the VPN server. I am currently using an AlgoVPN server, which is completely setup via Ansible scripts and ...
0
votes
0answers
19 views

How to get decrypted content from a pfx certificate

I am developing ERP software. One of the features that I am implementing is the issuance of invoices, which is something related to the federal revenue of my country. In the documentation says that ...
0
votes
0answers
36 views

Which certificate is recommended for releasing software in Healthcare domain?

Is there any third party company who assess software and provide a certificate saying the product is secured? I was reading about HITRUST alliance. I also read bit on EU cybersecurity certification ...
0
votes
0answers
137 views

How to solve: Problem with converting pkcs12 file into a pem

I am trying to convert a client certificate from a pkcs12 type to a pem file using openssl, but this error is showed on my terminal. Does anyone have any idea why this is happening? I haven't edited ...
0
votes
1answer
59 views

Openssl not showing complete certificate chain

Tried following openssl command to show the certificate chain,but the ROOT certificate 'depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign' is not shown in the output...Why? ...
0
votes
0answers
27 views

Seeking a reliable way of creating trusted certificate files for OCSP

In my deployments I use OCSP must-staple flags on certificates, and ensure that my server is set to do verification and OCSP stapling. That's all good, but I'm forever having problems creating the ...
0
votes
0answers
20 views

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication? [duplicate]

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication?
0
votes
0answers
27 views

Verifying Public Key Using The Digital Signature on Mac

I have just started with encryption and stuff, so please bear with me. Just playing around. I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify ...
0
votes
1answer
82 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
0
votes
1answer
57 views

SSL certificate distribution of API

We have an API which has SSL certificate signed from authorized CA. The access to the API is limited. API is accessed from webapp and only from those client who have valid public key for SSL. Now, how ...
0
votes
0answers
26 views

How can TLS/HTTPS remain secure if the entire transmission is monitored? [duplicate]

Okay, so I'm pretty sure this question comes from a fundamental misunderstanding of how HTTPS works, but here goes: Say that someone has hooked into the "internet line" coming from your home so that ...
0
votes
0answers
34 views

Automating certificate management across a large number of printers?

Is there a way to manage certificates on a large group of printers that will install and renew them? It doesn't look like any of the fleet management programs will do this. How are these managed in an ...
0
votes
1answer
133 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
0
votes
0answers
28 views

Certificate Pinning with SockJS

What is the SockJS way of pinning SSL Certificates in the client side when contacting wss:// to avoid CA trust? FYI, when using modules like HTTPS or WS, we can listen to the socket event and then on ...
0
votes
0answers
80 views

Why is my gf seeing a localhost self signed certificate when going to netflix?

Recently my gf told me she was receiving errors when trying to go to netflix. I took a look and the certificate is super wierd saying it is self signed. Why could this be happening? She only uses the ...
0
votes
0answers
44 views

CSP/KSP module for MacOS

My company developed a custom Key Storage Provider for Microsoft CAPI so that CNG-using Windows apps can perform signatures using a remote signature service. I would like to know if there is support ...
0
votes
0answers
46 views

Unable to get information from a PKCS certificate

I sniffed the communication between the client and the server using Wireshark, and I found out that during the handshake session, the client sends its certificate to the server. I've managed to get ...
0
votes
0answers
52 views

What are the security protections in using a TPM generated VSC to create a CSR

I am extremely new to the field of information security but was given a project to create a secure TLS certificate signed by our CA for a new security process. I found this thread (How to generate a ...
0
votes
0answers
301 views

SSL handshake: Client Hello and Server Hello

I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy. This is my topology:...
0
votes
0answers
35 views

Software build processes - Dependencies without admin privileges

we have the following problem and I would like to hear your opinions for this case: Currently several users are working with domain accounts which are in the local admin group (Yes, shame...) You ...
0
votes
0answers
53 views

Certificate Validation with SDS enabled on Ingress Gateway and mode set to MUTUAL

I have been having some difficulty understanding the mechanism by which certificates are validated by either party in a mutual TLS handshake. I have SDS enabled on my ingress gateway(s) and the ...
0
votes
0answers
36 views

Addons still work with Firefox on one account

I'm using Firefox 66.0.3 on Ubuntu, and like everyone else I'm experiencing the certificate bug which causes addons to be disabled. However, in one of my user accounts, the addons still work like a ...
0
votes
0answers
76 views

Usage of a self-signed certificate between Akamai and Azure

First of all, some background of what is proposed: The client's browser initialises request The request is resolved by public DNS (CNAME) to Akamai Edge The request is processed by Akamai accordingly ...
0
votes
0answers
33 views

SQRC use to verify e-delivered certificate

I have a need to provide a means of validating a certificate that is e-delivered. My thought is to use an SQRC to enable that verification by linking to a secure site that contains the original ...
0
votes
1answer
74 views

ADCS two tier PKI

Planning a two tier ADCS PKI infrastructure as follows: ORCA ____________|____________ | | | SCA1 SCA2 SCA3 one.int two.int three.int ...
0
votes
0answers
23 views

Securing a large application with multiple services and endpoints

Without getting too deep into the architecture, I would like to get suggestions / good reads on applying encryption to a large scale application with multiple endpoints. There are internal and ...
0
votes
0answers
36 views

authenticating SSL client certificates on server

current setup: i have a pki setup which issues client certificates to the users (so that only clients with the certificate can access the web application). was looking for ways to implement this and i ...
0
votes
1answer
1k views

How to make sure certifi python package is up to date

In python's requests module documentation, I find this important recommendation: For the sake of security we recommend upgrading certifi frequently! Q: How can I make sure that my system's certifi ...
0
votes
0answers
43 views

Is Azure Key Vault more secure than the machine certificate store?

I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on ...
0
votes
0answers
52 views

See data sent by application over https

Let's say I have an application (A) installed on my PC that communicates with some server over https. What would another application (B) on my machine need to do to be able to read the unencrypted ...
0
votes
1answer
139 views

Two message key agreement and mutual authentication protocol?

I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS. If we assume ...
0
votes
0answers
42 views

Is there any Nmap command/script to identify certificate name mismatch and untrusted certificate?

I am using Nmap commands in my script for server validation. I know in Nmap there is the ssl-cert.nse script that retrieves details about the server certificate. I want one more step where I find ...
0
votes
0answers
29 views

Proving that a certain site had given page at certain time [duplicate]

Lets someone opens https://foo.com and saves the page using "save page as". Is there any way to prove later that the locally saved files have not been altered assuming that we trust the server public ...
0
votes
0answers
39 views

How can I create a self-signed certificate with a custom field? [duplicate]

For experiment, I want to add a custom field in a TLS certificate then validate it. Because it is experiment, it will be a self-signed certificate. I use OpenSSL 1.1.0g and Ubunut 18.04. Any hint will ...
0
votes
0answers
89 views

How to check if installed Trusted CAs are not dangerous? [duplicate]

I've checked my Windows 7 installed Trusted Certificate Authorities using MMC tool as below: Questions are: How can I be sure that they are genuine and are installed by Microsoft and not by a third-...
0
votes
0answers
419 views

What is a reasonable default_crl_days value for OpenVPN CLR? Why?

I am having trouble finding a definitive answer (with a rationale) on what a reasonable default value for default_crl_days (in openssl.cnf) for use with OpenVPN. The current default is 30 days. But ...
0
votes
0answers
76 views

How to obtain a private client certificate

We have a fairly weird integration scenario where we need to connect the following two systems: 1) Partner's API Portal - the server, which uses MASSL authentication with a requirement that the ...
0
votes
0answers
22 views

Using client certificate from a file and a key pair from a hardware token

The question is about TLS client authentication using a browser. I have been using a smart card to authenticate to certain web sites. However, the card is a bit old and for whatever reason importing ...
0
votes
0answers
112 views

Renewing self signed SSL cert without updating client

I have a server and a single client. I have full control of both, the client is not a distributed application used by the public. For various reasons, I'm having the client use HTTPS to communicate ...
0
votes
0answers
230 views

In what important ways can a digital signature be invalid?

I am trying to write some code to verify that a digitally signed file came from my company. I was horrified to stumble across this deeply buried answer on Stack Overflow, an out-of-left-field ...
0
votes
0answers
158 views

Proxying an Android application with Burp Suite

I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
0
votes
0answers
25 views

How to read Security Technical Details for Connection Encrypted [duplicate]

I'm doing some research on encryptions websites and could use some help. How do you read/interpret this connection detail: Connection Encrypted (TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256_256 BIT ...
0
votes
0answers
103 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...
0
votes
2answers
51 views

Can certificate signing requests be stored at the server to prolong existing certificates?

I want to build a PKI (public key infrastructure) to host certificates for users. My use case is, that I want to use the certificates for e2e encryption between the users. Users must be able to ...
0
votes
1answer
140 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
0
votes
1answer
117 views

Mutual Authentication using certifcates

How are digital certificates used to enable mutual authentication between two users? Suppose, at a bank, the employees are required to authenticate each other before transmitting sensitive data. How ...
0
votes
1answer
4k views

ssl handshake failure unable to get local issuer certificate

I have an issue with new integration that I am working on it. I should consume a web service provided by external company and this service is over https, so in order to integrate with them, they have ...
0
votes
2answers
1k views

How to eavesdrop and decrypt the HTTPs communication of an IoT device?

I am trying to setup a MitM scenario between an IoT device and WAN. It is possible and quite easy to achieve same thing for the application run on a mobile device by setting my proxy server(Fiddler)'s ...