Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
0
votes
1answer
171 views

Is it possible to enroll on behalf if only public key of client is known?

I have the following scenario: I have a lot of embedded devices that should talk to another. To enable trust between these devices I would like to use certificates. The devices generate a keypair and ...
0
votes
3answers
85 views

Alternative way of applying authentication in network security

I have been reading and thinking lately about authentication and how this is achieved in cyber security. I notice that the only way of applying authentication is through the use of cryptographic keys (...
0
votes
2answers
332 views

How self signed certificate works in https connection establishment [duplicate]

OS/Browser have Public Keys of all trusted CAs. Eg mozilla foundation have a list of 50+ trusted CA means that mainly the public key is already present in the browser. Now....some site say ...
0
votes
0answers
401 views

How to install client certificates globally for Google Chrome in Ubuntu?

I am trying to install a client certificate to Google Chrome running on Ubuntu. I want any user who logs in to Ubuntu to be able to use this client certificate in Chrome. Even better if I can create ...
0
votes
1answer
2k views

New SSL cert implementation showing errors on Android only

When testing a HTTPS URL it loads successfully from all browsers on mulitple desktop operating system. However when we test specifically from Android mobile phone we get the following results: ...
0
votes
1answer
3k views

How to verify the signature value in a SSL certificate?

According to RFC 3280 a certificate's basic syntax is Sequence := { tbsCertificate signatureAlgorithm signatureValue } In tbsCertificate, SubjectPublicKey is the public key of the ...
0
votes
1answer
156 views

How secure is it to bundle unencrypted private key and a CSR into PKCS12 certificate?

I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, ...
0
votes
1answer
417 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
0
votes
2answers
182 views

Using mutual authentication, should I still worry about message integrity and replay attack?

I'm trying to secure a REST API, our situation is that every client connecting to this API will also have a certificate signed by our own CA. Because of this, I think we can use the client certificate ...
0
votes
1answer
416 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
0
votes
2answers
4k views

How does a Certificate Private Key get transferred on import / export?

I am fairly new to certificates in general and have setup my own standalone CA for testing purposes. I have noticed some interesting behavior of private keys which I'm trying to find some ...
0
votes
0answers
71 views

deceptive digital signature?

I am new to cyphering and I try to understand this case : my government sends me so-called "digitally signed" PDFs, as you can see below (text only, after "Thanks"). Although there is a certificate ...
0
votes
0answers
25 views

Different KeySizes from Different Stores same pfx

Sorry, i'm new to all of this. I have a question as to why the KeySize of a RSACryptoServiceProvider will differ between Store Locations? I've imported the same pfx in the LocalMachine store, as ...
0
votes
1answer
151 views

x.690 universal class tags implementation reference

Can anyone with enough knowledge of X.690 tell me where can I find the official reference implementation for the universal class tags for X.690. (For example: For TLS we can reference RFC 5246.) When ...
0
votes
0answers
1k views

Implications of IP Address as Subject Alt Name in certificates

Are there specific known negative security implications of including the IP address of a server as a Subject Alternate Name in the server's certificate?
0
votes
2answers
2k views

Authenticating Hotmail's certificate and connection security

I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or ...
0
votes
2answers
359 views

Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?

When accessing a HTTPS site by IP address, if the IP address is not in the alternate names field, the browser will throw an error about the certificate not matching. Would this be considered a low ...
0
votes
1answer
74 views

CSR signing follow up question

This is a follow up question , after getting a signed certificate from one CA. researched a lot , but no luck. After getting the CA reply, While downloading the certificate, it popped up saying "...
0
votes
0answers
65 views

Certificate verification

I work on a desktop application which generates Security certificates. The Business use of these certificates is - they will be used as an authentication and authorization mechanism to enable users to ...
0
votes
1answer
190 views

How do SSL certificates become compromised after expiring [duplicate]

I'm reading into security issues surrounding SSL, and one of that has come up is certificate expiration. The general idea is that once a certificate expires, the site is insecure. What is the ...
0
votes
0answers
145 views

Proxpy- certificate issue

I am using proxpy, a proxy server written in Python. It comes with its certificates and after installing one of the certificates in Firefox, I got 'Connection is untrusted'. Any help in this regard ...
0
votes
0answers
259 views

What registrars support *.onion TLD as a Subject Alternative Name, and how does validation work?

I'm interested in obtaining a .onion TLD in my SAN name from a public CA. Which Public CAs support .onion TLDs and what is the validation process like (e.g. Whois isn't available for ToR) Update: ...
0
votes
0answers
1k views

Why is the public key extracted from the CSR different than the one extracted from the associated certificate?

I am playing around with pyopenssl. I am trying to extract the public key from a CSR and to check if it is the same than the one I find in the associated certificate. There is a small difference ...
0
votes
0answers
47 views

Question regarding SSL / TLS / Certificates in general [duplicate]

for the last two days I played around a bit with nginx's SSL configuration. A question came up: I created asymmetric key using $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:4096 -keyout ...
0
votes
1answer
996 views

EAP-TLS fragmentation implementation

I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a ...
0
votes
1answer
662 views

Updating Root/Intermediate Certificates over NDES/SCEP

In attempts to setup our first instance of NDES/SCEP in the wild on Cisco routers we have run into a concern. Currently our organization has a three tier PKI. We have an AD CS server on the third ...
0
votes
1answer
343 views

Secure Communication Between .Net Application and Website

Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our ...
0
votes
1answer
4k views

Convert RSA SSH public key file into x509 certificate

I have a RSA SSH public key which I have converted from a x509 certificate and I want to be able to convert the SSH key back into a x509 certificate to compare the values with the original certificate....
0
votes
1answer
985 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
0
votes
2answers
852 views

How to detect authenticity Of Client and Server Certificate?

How its possible to detect authenticity Of Client and Server Certificate. For example, If server A has certificate and someone C stolen its certificate and send it to B then How we decide that it's ...
0
votes
1answer
2k views

OpenSSL get key length of all certs [closed]

I am trying to ensure that all certificates in a chain for a host have a key length of 2048 bits. Using openssl s_client, only the key length for that host's cert is given, is there a simple way to ...
0
votes
1answer
111 views

how does IE or chrome verifies certificate? [duplicate]

If the HTTPS webserver uses self signed certificate, the web browser warns the user as follow. http://www.sslshopper.com/assets/images/iis7/iis7-self-signed-certificate-8-certificate-not-trusted.png ...
0
votes
0answers
95 views

Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery [duplicate]

Can you tell me shortly how to fix this problem in Chrome? Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery
0
votes
1answer
95 views

Determine the Identity of Caller

Let me explain my situation. I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
0
votes
1answer
282 views

Is the StartCom tool safe to generate CSR and private keys?

I've used StartCom tool to generate CSR and private keys for my websites,but now i am concerned after reading about StartCom trustworthiness problems.Are my private keys and certificates secure or i ...
0
votes
3answers
1k views

Can a Man In The Middle attack cause a certificate error? [closed]

I was playing around with Ettercap and I performed an ARP spoofing, MiTM attack on a friends computer as a joke. Now (about a day later) she tried to login to a website for work and it said "Your ...
-1
votes
2answers
7k views

School Wifi Certificate [duplicate]

My school is requiring that I download a wifi certificate to use the school wifi on my phone but i was wondering what downloading the certificate entails since it doesn't really tell you if I download ...
-1
votes
2answers
82 views

SSL/TLS Extended Validation implemented in fraudulent domains

People trust green bars, because it is proven to not to be of malicious origin. This seems to be the questions of hundreds and many are concerned about it, picture that; a team of fraudsters(or at ...
-1
votes
1answer
370 views

SSL and Fake Domain

I am reading information related to SSL handshake on the Internet. It seems like in the last step the domain name is compared to the domain in the certificate. How exactly is this protecting against ...
-1
votes
1answer
298 views

Why don't CAs sell certificates as files, instead of hardware or as a service?

I'm trying to purchase multiple certificates, some just signing, some just encrypting, and some a combination of the two. I wanted to purchase one signed by a CA, rather than using a self-signed one. ...
-1
votes
2answers
223 views

user identity certificate

I want to create a new scheme for user identification, like X.509 certificates, but not X.509. Is it possible to use this new certificate over the existing Internet? and if yes, what are basic ...
-1
votes
1answer
9k views

Reasons for a “Bad certificate” error

I have a problem with self-signed certificates in an etcd cluster. The certificates are ok because if I use them in nginx, there is no error at all as long as I add the CA file to my certs store. ...
-1
votes
2answers
2k views

Generate openSSL certificates from within C code using commands?

This is an openSSL command for generating a private key and a certificate, openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key The question I have is whether there is some ...
-1
votes
1answer
181 views

Certificate weird behaviour

I tried to understand a certificate issue and capturing using Wireshark to inspect the different sequences. The case that is not working (wifi connection through my cable provider), I see: client ...
-1
votes
1answer
160 views

SSL Certificate Subject Alternative Name Information Disclosure

I'd appreciate if someone could shed some lights on the subject findings. Is this a security problem having bank.com appearing on the SAN? Hostname was discovered in the Subject Alternative Name (...
-1
votes
2answers
453 views

At which offset is the public key in an DER encoded certificate chain?

I have the following bytes array storing a certificate chain (DER encoded): ...
-1
votes
1answer
54 views

HTTPS - if this protocol protect against connecting to false server?

I know about SSL certificates. However it is ok to say: protocol HTTPS protects against connecting to false server ?
-1
votes
1answer
58 views

Signed E-Mail certificate invalid [closed]

I sent a valid signed e mail a few weeks ago. Now I reinstalled everything on my computer (including the OS). Is the certificate now invalid?
-1
votes
1answer
95 views

Do certificates need to be protected at rest? [closed]

I have downloaded numerous certificates to my device. How do I ensure the confidentiality and integrity of the data at rest?
-1
votes
1answer
215 views

XER encoded X.509 certs [closed]

Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it? Thanks!