Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
12
votes
2answers
32k views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey rsa:...
12
votes
3answers
864 views

Can we make sure that the new Lavabit certificate is not under control of the FBI?

After the Lavabit shutdown, Ladar Levison (founder of Lavabit) announced that he’s "looking into setting up a site where users can download their data". Such a site is now online: https://liberty....
12
votes
2answers
9k views

SSL Certificate revocation check

In the SSL protocol I don't see where the certificate is checked for revocation status. https://developer.mozilla.org/en/Introduction_to_SSL Is the Certificate Revocation and Status Checking not ...
12
votes
2answers
17k views

Recommended key usage for a client certificate

My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicates with the server to a path that requires a ...
12
votes
1answer
8k views

Why do certificates need thumbprints?

I recently learned mechanism of certificates. But I can't understand why a "thumbprint" is included in a certificate. For intermediate and end-user certificates, it is verified by its issuer. so it ...
12
votes
4answers
40k views

Adding self signed certificate to trusted store

I have been reading about certificates and often is said that self signed certificate should not be added to the trusted authority store and even if you did, remove it after usage immediately. MSDN ...
12
votes
4answers
2k views

How do certificate issuers become trusted?

From what I understand, the certificate scheme that TLS/SSL relies on works because your computer has trust for major CA issuers built into it. That is, your OS is installed with certificates for ...
12
votes
1answer
9k views

The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates

I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My ...
12
votes
1answer
2k views

What are the problems with creating an own CA for intranet?

In the comments to Creating my own CA for an intranet several people strongly advise against creating your own CA for an intranet. Especially: don't do it. Nope. Bad idea. Buy $10 CA signed ...
12
votes
1answer
5k views

How does adding a random serial number improve a certificate's security?

This article says: "Finding collisions is a tricky process, since it requires you to muck with the bits of the public key embedded in the certificate (see this paper for more details). Also, ...
12
votes
4answers
47k views

What is the purpose/role of the “alias” attribute in Java keystore files?

I've heard conflicting information about the purpose of the alias attribute in Java keystore files. Can someone please clarify on what exactly this attribute is, and what it should be set to when ...
12
votes
2answers
4k views

Obtaining an S/MIME certificate without disclosing my private key to the TTP

I would like to obtain a trusted S/MIME certificate, but all the certificate authorities I have asked so far generate the keypair on their server, sign the certificate and send me both the private key ...
12
votes
2answers
2k views

What kind of certificate do I need to be able to sign my own subdomain certificates?

We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...). ...
12
votes
2answers
3k views

Is there greater risk to browsing websites with invalid certificates than websites with no certificate at all?

The information security community is generally very adamant that users should not proceed to visit websites that have invalid SSL certificates. Web browsers have gotten less and less cooperative with ...
12
votes
2answers
7k views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
12
votes
1answer
2k views

Are X.509 nameConstraints on certificates supported on OS X?

I have the following "chain" of certificates on a test machine right now: A self-signed CA cert, in my Keychain and trusted & trusted by Firefox. A CA cert with with the following, X509v3 Name ...
12
votes
3answers
1k views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
11
votes
2answers
2k views

Can we always remove WWW from a host name? [closed]

When I'm opening https://india.gov.in, it's opening all right. But for https://www.india.gov.in, the browser is throwing a certificate error. Why is that happening?
11
votes
3answers
10k views

How does an SSL server prove its identity?

This document says that a challenge response authentication proves the servers identity. But is a man in the middle attack still possible if the client does not verify domain name ? Please help me ...
11
votes
2answers
2k views

Is an identity certificate the same as a public key?

I'm new to public key infrastructure but I think I understand how public key encryption works, conceptually. So a public key is, by definition, public and not a secret. Recently when I came across ...
11
votes
3answers
11k views

How trustable are third party root certificates?

I recently tried to use Fiddler2 from a third-party vendor Telerik. While decrypting the HTTPS traffic of my network, it asked me to install its own root certificate in my Windows operating system: ...
11
votes
5answers
43k views

How to validate a client certificate

My understanding is that when using a client certificate for security one issues a private and public key cert (for example X509) of some sort and sends that of to the consumer of the service that one ...
11
votes
3answers
1k views

Trying to understand how Digital Certificates and CA are indeed secure

I understand that Digital Certificates and Certificate Authorities (trusted 3rd parties) help prevent man in the middle attacks during HTTPS connections. However, I am confused on a few details. Let'...
11
votes
2answers
7k views

Benefits of a wildcard vs per-subdomain certificates

As you might know, Let's Encrypt doesn't offer wildcard certificates and it won't in a short-term because you can just order as many certificates as you want for the sub-domains. This make me wonder.....
11
votes
3answers
1k views

How does obtaining a SSL certificate work?

I have been carrying out some work on SSL certificates and found that there are some places that charge you for an SSL certificate, but, how do they obtain the rights to do so? And, how, are they ...
11
votes
4answers
2k views

How to stop/detect someone else registering a certificate for my domain

With the proliferation of low-cost automated CAs what can be done to mitigate the attack of someone doing a spear phishing attack to get a login to our webmail system, then using an automated service ...
11
votes
2answers
16k views

Internal SSL Certificates?

As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to ...
11
votes
3answers
17k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (...
11
votes
1answer
4k views

Creating sub CA signed with Let's Encrypt certificate

I have a certificate issued from Let's Encrypt. Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the ...
11
votes
3answers
15k views

What part of TLS specifies how to verify a certificate chain

I have sometimes run into a situation where I see a root CA certificate which is set to expire sooner than the intermediate CA certificate. My question is - if you were interested in keeping your ...
11
votes
2answers
13k views

Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?

we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
11
votes
2answers
2k views

Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?

When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me. I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
11
votes
1answer
3k views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
11
votes
3answers
8k views

Creating an X.509 certificate with an invalid signature

Creating an X.509 certificate with a valid signature with OpenSSL is pretty well documented all over the Internet. There are instructions on creating certificates that are signed by themselves and ...
11
votes
2answers
22k views

Public Key → Certificate?

Is it possible to convert a public key to a certificate using the public key only? I've seen the following, which takes a private key to form a cert request, which can then be self-signed: openssl ...
11
votes
5answers
7k views

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
11
votes
3answers
24k views

Use openssl to individually verify components of a certificate chain

This is related to another question, How to verify a signature of one entity by another using OpenSSL CLI? I used openssl s_client -showcerts -connect www.google.com:443 to collect three certificates ...
11
votes
1answer
24k views

What is a Certification Path in SSL certificate?

I've been trying to learn more about Digital certificates for the past few days and I'm struggling in order to understand how actually this concept is applied in the real world. Anyways, as I visited ...
11
votes
1answer
5k views

Why is one of three browsers (Chromium) reporting an invalid HTTPS certificate?

A few days ago, Chromium started to report Flickr's certificate as problematic: The server presented a certificate that was not publicly disclosed using the Certificate Transparency policy. This is ...
11
votes
2answers
26k views

Obsolete cryptography (SHA1) warning although certificate uses SHA256

I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message: Your connection is encrypted with obsolete cryptography. The connection is encrypted using ...
11
votes
4answers
13k views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
11
votes
1answer
619 views

Is using a CA more secure if I'm self-signing anyway?

We have a web application that we run for clients at their booth on fairs. The communication between clients and the server was done over HTTP until recently. We're currently working on improving ...
11
votes
1answer
3k views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
11
votes
1answer
47k views

How to use OpenSSL generated keys in Java?

I have my pair of Public and Private keys and my certificate. Those where created in OpenSSL (why? because I was asked to do it in OpenSSL). Now I want to use those things to make a Java app that ...
11
votes
1answer
222 views

How CA ensures that a certificate request is coming from me?

To establish trusted SSL connection I need to create a certificate request. For example, if I use openSSL I can do it by the following command: openssl req -new -key privkey.pem -out cert.csr Anyone ...
11
votes
3answers
534 views

Why is Firefox shipped with expired root certificates?

What's the purpose of shipping Firefox with expired root certs? I checked and there are two expired certs listed. In fact the company's website for the first expired cert (A-Trust) states that the ...
11
votes
1answer
1k views

How should I store and secure self-signed certificates?

I'm fairly certain I shouldn't commit certificates into source control. Even if the repository is private and only authenticated coworkers (for example) have access to it. That would allow for ...
11
votes
3answers
5k views

Why are SSL certificates valid only from a certain date?

Each SSL certificate is valid starting from a specific date and up to the expiration date. What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
11
votes
3answers
1k views

Transferring Microsoft SmartScreen reputation to renewed certificate

I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning: Windows Defender SmartScreen prevented an unrecognized app from starting The ...
11
votes
2answers
655 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...

1
3 4
5
6 7
49