Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
3
votes
1answer
249 views

Why does Firefox no longer recognise certificates issued by Multicert / Camerfirma?

Today I noticed that Firefox 88.0 beta (on macOS) is rejecting TLS certificates for many Portuguese websites – including most government websites – with the error SEC_ERROR_UNKNOWN_ISSUER. Example ...
13
votes
3answers
3k views

Webserver DDOS protection without giving away private keys (https, tls, ssl)

What are the possible ways to protect an organization's web servers from a DDoS attack without giving away your web server's https private keys? Many of the common solutions for DDoS protection of a ...
0
votes
1answer
62 views

SSL Certificates Management and Tracking

I'm not aware of any frameworks/tools to achieve what we're trying to do, but posting here to hear experts opinions and comments on how this is done at large organizations and recommended automation ...
23
votes
2answers
3k views

Are we gossiping in Certificate Transparency?

Ben Laurie's original paper on Certificate Transparency proposed that clients (browsers) should "gossip". In particular, it proposed that when a browser connects to a web server, it should ...
7
votes
1answer
197 views

Certificate Pinning Best Practice or Alternative

I'm looking for the "best practice" to use in Certificate Pinning or an Alternative. Scenario:  I have a native mobile app and I have pinned the certificate so that the app can validate ...
1
vote
0answers
48 views

How roaming works with ssh private keys?

This occurred to me when looking at the security model wireguard is using. Instead of relying on users credentials and Radius authenticating central server each user has a private key used to ...
2
votes
2answers
106 views

How secure is using public computer?

I got questioned about the security of using public computers and sending data with them. I am using HTTPS which is based on SSL, while SSL uses PKI which is hard to hack. Thus, there is nothing to ...
1
vote
2answers
55 views

publication of GDPR implementation

I'm aware of this post that GDPR apparently does not enforce a specific standard to secure sensible data. Based on this post e.g., there is no requirement to encrypt or hash login data in a local ...
4
votes
3answers
187 views

How can you bind a public key to a certificate if the public key depends on the choice of algorithms?

Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
0
votes
0answers
29 views

Libraries or boilerplates providing fundamentals for Public-key generation and encryption of client data?

This may be more suitable for StackOverflow in terms of a recommendation for a library or implementation, but security-related questions are often overlooked or misinterpreted. I'd like to first ...
0
votes
0answers
31 views

OpenVPN certificates vs. SSO with MFA

I am wondering, is using certificates with OpenVPN gives any advantages vs. using SSO with MFA to authenticate to OpenVPN? Are there any disadvantages for combining both?
1
vote
1answer
96 views

Diffie–Hellman key exchange in TLS 1.3

I am reading about the Diffie–Hellman key exchange in TLS 1.3. So the first step here is that the two parts Alice and Bob t agree on a large prime p and a nonzero integer g modulo p. Then Alice and ...
1
vote
1answer
40 views

Which attribute in DN is commonly used to specify the class/type/usage of certificate/end-entity?

I have a private CA which provides certificates for three types of IoT devices (Type1, Type2 and Type3). On the IoT device certificate's subject DN, which attribute can be used for specifying this ...
1
vote
1answer
50 views

Intermediate CA authenticity in an embedded device

My company are using an offline embedded device, that must encrypt connections to its client (a PC connected with USB). We have chosen to use TLS with both PC and device authentification to encrypt ...
0
votes
1answer
32 views

How revocation status of delegated OCSP responder is verified at the client side?

If the OCSP signing is delegated explicitly to another entity and that delegated OCSP responder is compromised, how to revoke the certificate and convey the revocation information to a client? We need ...
16
votes
4answers
3k views

CRL over HTTPS: is it really a bad practice?

On the Internet, I can find several statements done over the years claiming that serving a X.509 CRL over HTTPS is a bad practice because either it causes a chicken-and-egg problem when checking for ...
5
votes
1answer
77 views

Why install a certificate in the Trusted Root CA of the server?

As part of configuration tasks I am doing at work I am having to learn more about how https works and how to set things up. One bit that I am not sure about is the need to install a certificate in the ...
12
votes
1answer
2k views

Secure way to hold private keys in the Android app

What would be the most appropriate way to store private keys for barcode signing in the Android app? Probably most experts here would say - just don't do it, cause it's insecure... But I would like to ...
0
votes
1answer
53 views

Difference between private key exposure and tampering in mutual authentication

Consider a remote and local system doing mutual authentication either by TLS through server/client certificates or similarly wireguard. What are the differences when the private keys (in particular ...
0
votes
1answer
44 views

Deployment tips to support indirect CRLs

I'm looking into the feasibility of using indirect CRLs to eliminate the need to manually publish CRLs from an offline root. Is anyone familiar with any similar deployments? If so, how did they set it ...
0
votes
0answers
25 views

Seamless Key Management with Key Management Systems?

I'm keeping it vague on purpose so that it can help other cases as well. Goal The goal is to store information that is encrypted on client side and then delivered to the database. Server should never ...
0
votes
1answer
49 views

Are there any identity providers which support securing RESTful interfaces using digital signature?

I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract: When signing, the sender uses ...
1
vote
2answers
418 views

is this a good practice for storing private keys?

I'm working on a centralized exchange for cryptocurrencies. the approach that I'm taking for some reasons is to create an account(private key) per user inside platform. so these accounts should be ...
1
vote
1answer
210 views

Is encrypting a private key inside a pkcs12 file using openssl secure?

This answer states that encrypting a private key using openssl rsa -aes256 isn't secure, because the md5 hash of the password is used as encryption key. But what if I do openssl pkcs12 -export -in ...
0
votes
1answer
84 views

Why must I send certificate and private key when make HTTPS requests? [duplicate]

In my company, we are issued .p12 files and extract the certificate and private key like so: openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys openssl pkcs12 -in path.p12 -out newfile....
0
votes
0answers
51 views

PKI: how to get OCSP Signing certificate information?

If I want to find the actual signing certificate for OCSP responder, how can I go about it? Is it possible to get it anywhere in .pem format?
2
votes
1answer
298 views

What is the correct terminology for a private key corresponding to a public key certificate?

I have learned that the certificate is something that contain information about a public key. An article on wikipedia says Public Key Certificate as well. If we are talking about private key, it's not ...
0
votes
1answer
67 views

MFA using PKI certificates [closed]

I'm trying to set up a multi factor authentication using PKIs certificates. A PKI infrastructure is ready to use and i'm planning to put these certificates on smart cards. I was looking for a smart ...
0
votes
1answer
65 views

Certificate Authority generates private key for Extended Validation code signing certificate?

My company upgraded to an Extended Validation code signing security certificate, which was delivered via mail on a physical USB key, called a "token." The token contains a private key and ...
6
votes
1answer
160 views

Why not signing a certificate with more than one Certification Authority [duplicate]

A student asked me a good question today when I was explaining the concept of certificates chain. As I said "if a CA is compromised by an attacker he can emit false certificates for the entities ...
0
votes
2answers
255 views

Create CSR for S/MIME certificate from existing OpenPGP key pair

While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone). I believe the ...
0
votes
2answers
1k views

openssl verify error: unable to get local issuer certificate

I have a test certificate chain that I generated and it fails the openssl verify command: openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem The output I get from the ...
1
vote
0answers
40 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
1
vote
2answers
89 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
0
votes
1answer
50 views

How to use another SSL certificate for DHE-RSA while I already have one with domain?

I'm working in IOT team to build a web based IOT system. I'm using Dataplicity's Wormhole to host my nodeJS app on raspberry pi. I want to use DHE-RSA symmetric key encryption channel for sending/...
0
votes
2answers
231 views

Security risks from exposing ssh to a home server

I'm not sure if this is the right place to ask. My goal is to establish an external connection to my home server through ssh and tunnel some ports to the laptop. For this reason, I've exposed the SSH ...
4
votes
2answers
172 views

Is Java's probablePrime used in production?

Prime numbers are core in security. I saw this question about Java's probablePrime and was wondering if that API/approach is indeed used for real production-ready security code or other approaches are ...
0
votes
0answers
31 views

Is JPAKE over SSL/HTTPS overkill?

We have an API that runs exclusively in HTTPS, any unencrypted traffic is dropped. We want to add public-key encryption to some of our methods (like login, payments, and so), by making the client ...
0
votes
1answer
100 views

Diffie Hellman implementation- NodeJS

Diffie Hellman is a key exchange algorithm where client and server both generate public and private key, exchange their public key and combine this key with his own private key to generate same secret ...
3
votes
2answers
633 views

Why would a certificate authority have multiple root certificates?

When I look at the trusted certificates in my browser, I see that many certificate authorities have multiple root certificates associated with them. For example, org-Amazon has Amazon Root CA 1, ...
1
vote
2answers
71 views

What is the name of the crypto system used by ICANN's DNS recovery system?

I once heard about a type of crypto system that behaves in the following way: I have x secret keys that work together to decrypt messages encrypted with a public key d. If I get at least n of the x ...
2
votes
1answer
175 views

What is LS0… encoding of a PKI certificate?

I am looking through a set of PKI certificates and key strings that are specified in a kubernetes yaml file. They are used for testing. Some of the strings are keyed (as in yaml key-value) as crt.pem. ...
0
votes
0answers
67 views

Reused key issue in Asymmetric Encryption

We all hear often about the reused key issue in block cipher. For example, for a picture being encrypted by the electronic codebook mode, we will still see the shape of the picture. https://images.app....
1
vote
1answer
108 views

Expiration of superadmin.p12 certificate

I have a super admin certificate which is expired two days ago.When I try to click on Administration tab in my EJBCA instance to renew this certificate ,I am getting error like certificate has expired....
1
vote
1answer
49 views

Is it allowed to store billing address for merchants SAQ A merchants? (PCI DSS)

I know there are many limitations for data storing and processing by PCI DSS. Some of them are explained here. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf But I can't find any ...
0
votes
1answer
167 views

pki infrastructure for REST API

My question is based on to secure REST API's. We have to publish a REST API and we want only certain consumers to consume the API. I was thinking of one way is to use asymmetric encryption. The steps ...
2
votes
0answers
107 views

Why don't CAs advertize public keys of verified entities on a central location instead of giving out signed certificates?

If CAs (Certification Authorities) start advertizing public keys of verified websites via some API, browsers can simply query them for each domain instead of asking websites to give them certificates ...
2
votes
2answers
283 views

How do clients extract the public key from a self-signed certificate?

I have gone over: Why do we need to sign the self-signed certificate? Basic self-signed certificate questions Is a self-signed SSL certificate much better than nothing? I am new to cryptography and ...
6
votes
2answers
610 views

Impact of Root certificate Renewal

I have generated a good number of leaf certificates with my root CA but now it(Root) has expired. Even though leaf certificates have a longer expiry date than root CA, they also expired due to ...
0
votes
0answers
38 views

GPG Questions About Exporting Subkeys to File

GPG novice here so please bear with me. From what I understand, when you generate a keypair with GPG it will automatically create a subkey pair (sub, ssb). If I wanted to give these to another party ...

1
2 3 4 5
25