Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Filter by
Sorted by
Tagged with
10
votes
2answers
5k views

OCSP and CRLs: Specified in CA or client certificate?

Here's an example PKI setup: * Root CA (offline) * Issuing CA * Client 1 * Client 2 I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
10
votes
2answers
1k views

What happened with Kazakhstan's Root CA MITM policy?

In 2015 there were news that Kazakhstan was going to start intercepting all HTTPS traffic via "man-in-the-middle attack" starting Jan 1, 2016, by requiring kazakhstanis to install their root CA. ...
10
votes
1answer
2k views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
10
votes
2answers
2k views

What kind of certificate do I need to be able to sign my own subdomain certificates?

We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...). ...
10
votes
1answer
353 views

Protecting information in TLS client certificates

If I understood correctly, when using TLS with client authentication, the client certificate is transmitted to the server in plain text. The client certificate might include personal information, (...
10
votes
2answers
5k views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
10
votes
1answer
655 views

“Manually” verify a certificate

I want to 'manually' verify a certificate and the first step in doing so, I accessed paypal.com and obtained the following RSA modulus and signature value. modulus = '...
10
votes
2answers
365 views

Correct settings to generate private intermediate CA

I am using 'xca' in Linux to set up a private CA. xca only includes templates for the Root CA and End-User CA, no intermediates. What are the correct settings (fields and flags) for an intermediate (...
10
votes
4answers
10k views

How To Recover EFS Cert From Backup?

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access ...
10
votes
2answers
2k views

Prevent and/or detect installation of root certificates on Windows?

I noticed that some applications installed root certificates on my computer. Is it possible to prevent this? Or is there a firewall or such that notifies me?
9
votes
2answers
25k views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey rsa:...
9
votes
2answers
14k views

Is there any way to get Chrome 27 to trust a self-signed cert? [closed]

I'm running latest gen Chrome (27) and preparing a demo that requires using a self-signed cert to support HTTPS on a local IIS website. The cert has been created with the correct common name for the ...
9
votes
3answers
14k views

SSL Newbie : Does HTTPS client also need a certificate?

I am calling an HTTPS URL through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words, do I need my own certificate or is the ...
9
votes
4answers
3k views

How bad it is to install another company's root certificate to your server?

Our company uses a web server with a couple of web sites on it (private and public, over HTTP and HTTPS, some low risk and some high risk including online payments or other sensitive data for example)....
9
votes
2answers
272 views

Why do some certificates specifically identify a corporation and most don't?

Looking at a handful of websites that allow for/require HTTPS, I realized that the certificate for a few of them specifically identifies the owning corporation, but some (most) don't. What's the ...
9
votes
2answers
7k views

What is an intermediate certificate authority?

What is meant by an "intermediate certificate authority?"
9
votes
3answers
19k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
9
votes
4answers
8k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
9
votes
2answers
1k views

Will Google block HMAC-SHA1 along with SHA1 signed certificates?

So, right now, there is a push for moving from SHA1 signed certificates to SHA256 signed certificates by Google. My understanding is that you cannot use SHA1 for signing certificates but HMAC-SHA1 can ...
9
votes
1answer
3k views

Creating sub CA signed with Let's Encrypt certificate

I have a certificate issued from Let's Encrypt. Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the ...
9
votes
2answers
2k views

Why SSL uses a third party (certificate authority) yet SSH does not [duplicate]

SSL operations require the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client. SSH on the other hand relies on the client having the ...
9
votes
2answers
2k views

security of PKI, Certificates, certificate authorities, forward secrecy

I want to understand how certificates add to the security of information exchange. Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
9
votes
4answers
11k views

Man-in-the-middle Blue Coat proxy SSL or what?

I have just discovered that my workplace has enabled some new features in the Blue Coat network proxy. It seems like all HTTPS certificates in Chrome on Windows are being issued by this internal ...
9
votes
3answers
2k views

Do client certificates need to be trusted by the client?

I'm looking for some clarification around the trust requirements (if any) of client certificates. I'm working with a third party to access their services via Mutual TLS. I generate a CSR, send it ...
9
votes
3answers
822 views

On-line cryptographically signed date/time?

I’m looking for a source of on-line cryptographically signed date/time. I do not need a full timestamp service, as I am happy with the information « date/time was that », without a link to a challenge/...
9
votes
2answers
491 views

Why is there no Domain CA?

I was asked to deliver a signed SSL certificate for an IIS server for a client. I have previously done this for the same client/domain before, so it start to seem like an unnecessary expense to hold ...
9
votes
1answer
3k views

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
9
votes
2answers
7k views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
9
votes
4answers
13k views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
9
votes
2answers
2k views

How is an HTTPS login secure when pages use HTTP?

When someone go to eBay's website, they use an unencrypted connection between their PC and eBay's server. If they sign in, they are redirected to a secure site identified by its certificate and may ...
9
votes
7answers
611 views

Proving running code on a website is unchanged

Can it be proved to the user that the running code behind a website with security related code is the same as published? I'm currently looking at a few new project ideas and one involves secure ...
9
votes
2answers
2k views

X.509 certificate policies question

I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies. To quote from the X.509 RFC: In an end entity certificate, these ...
9
votes
2answers
2k views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
9
votes
2answers
1k views

Why does Chrome tell me this certificate is valid when it can't be verified?

Update: Now Chrome rejects this website for me. It seems the trusting is just cached somewhere? I guess this question isn't as interesting as I thought, but it'd be nice if someone could clarify it. ...
9
votes
1answer
11k views

Which extensions to use for a S/MIME certificate?

Analogously to the SSL server certificate question, which extensions should I use for S/MIME, and should the CA be restricted somehow as well? (I'm using openssl, which at the moment creates CA and ...
9
votes
3answers
592 views

Are there any smartcard/hardware-tokens for certificate-based authentication which are easily destroyed?

It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can ...
9
votes
2answers
1k views

PKI solution vendor selection

What would you look for in a (X.509-) PKI solution, and why would you look for that, given the following constraints: Available programming/sw-engineering know how is limited (ie, "OpenSSL with a ...
9
votes
1answer
3k views

How do I store Diffie-Hellman parameters in a X.509 certificate?

In their paper Authentication and authenticated key exchange, Diffie, van Oorschot and Wiener recommend to insert the DH parameters into the certificate of Alice. As a result, an attacker can not ...
9
votes
2answers
9k views

My site has Certificate Transparency enabled but Chrome is still showing NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED

I have a site called www.goflyla.com and I purchased the SSL cert from RapidSSL with Certificate Transparency enabled. SSLLabs give a green line saying Certificate Transparency: Yes (certificate): ...
9
votes
1answer
233 views

How can I protect myself against software installing insecure root certificates?

With the recent news that Dell installed a root certificate with a publicly accessible private key on their notebooks, I'm wondering how I can protect myself against this kind of incompetence. Of ...
9
votes
2answers
4k views

Best practices to implement HTTPS in embedded devices

Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...
8
votes
3answers
344 views

Would using distinct IP addresses help support browsers with older SSL implementations?

We have a site with two wildcard certificates: *.foo.com and *.bar.foo.com. All of our subdomains resolve to the same IP address. Newer browsers work fine with this, but IE7, for example, does not. ...
8
votes
4answers
5k views

How to check if wifi is safe while travelling?

I'm quite a bit of a traveller. So i tend to just stay with my smartphone and sometimes notebook. I'm not a security expert but i would like to check how to know if wifi is safe to use. For example, ...
8
votes
6answers
2k views

I see two different sets of certificates for Google websites when I am at work and when I am at home

I see two different sets of certificates for Google websites when I am at work and when I am at home. I mean if I save the certificates (in firefox, click on the "Google.com" block on the left of ...
8
votes
1answer
1k views

A workplace installs custom certificates on personal devices, can this be used to decrypt HTTPS traffic? [duplicate]

So another engineer buddy of mine and I were having a drink the other night. He mentioned that you're allowed to use personal devices on the office wifi, but that they install a custom certificate so ...
8
votes
2answers
4k views

One website - two different SSL certificates: two different CA's

I have seen multiple questions focusing on multiple certificates for a single domain (e.g.: a.com/example and a.com/example_one). However, what stops an individual from purchasing a certificate and ...
8
votes
2answers
1k views

Why is it fine for certificates above the end-entity certificate to be SHA-1 based?

I have heard about the phasing out of SHA-1 based certificates for end entity use, and the steps that are outlined for Google Chrome to display progressively more aggressive warnings for SHA-1 ...
8
votes
2answers
3k views

Why do I need to add intermediate CA certificates to JVM's cacerts file?

My company uses its own PKI. The web browser which I use to access to code repository shows a certificate chain as follows: Company Root CA Company Issuing CA Intranet Server Certificate ...
8
votes
2answers
869 views

How are browsers able to find and construct an alternate trusted chain path?

We had a web server that had the wrong SSL certs installed yet the browser was able to find another trusted path to a root and supply the page properly over HTTPS. We also have proprietary software ...
8
votes
4answers
1k views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude lower&...