Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
0 votes
1 answer
29 views

Recommendations on PKI roles as per ETSI EN 319 401 - V2.3.1

I want to configure roles (least privilege) on my CA instance (EJBCA) and I'm trying to find what are the best practices to do this. I've tried to read the ETSI EN 319 401 - V2.3.1 standard and try to ...
user avatar
  • 83
16 votes
5 answers
5k views

Where does the root of trust actually lie?

We are told that the roots of trust in the PKI are the handful of Certificate Authorities that issue root certificates and sign other certificates and ensure at least some extent of trust to be ...
user avatar
0 votes
2 answers
78 views

Secure data (+ private key) storage in an insecure public cloud environment

We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure. The data should be so secure ...
user avatar
  • 200
0 votes
0 answers
20 views

What is a link certificate in public key infra?

What is a link certificate? in my use case we have a private ca and one our vendor has their own private ca and we should be able to link vendor with our private ca, is it possible? what are the ...
user avatar
1 vote
2 answers
57 views

How to prove the authenticity of the telemetry message?

I'm curious what is the most widespread way nowadays to sign the telemetry message from a software program to prove its authenticity to the receiver? Imagine the software (which can run on-premise, at ...
user avatar
1 vote
1 answer
34 views

Best and safest way to store secret key used for PKA on server?

I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example: Create a 0500 access directory on my server ...
user avatar
  • 115
2 votes
2 answers
64 views

How to add extension to existing TLS certficate?

We have our own root certificate authority which is used to sign the certificates for the agents connected to our server. We have generated the root certificate authority using keytool command as ...
user avatar
2 votes
2 answers
54 views

How can I prevent non-SAN TLS certificates from bypassing name constraints?

I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints. However, even if I create the CA with restrictions on DNS names as well as ...
user avatar
  • 123
21 votes
9 answers
9k views

Could videos be authenticated using private and public keys?

I saw a news report about now freely available software to make "deepfake" videos. Couldn't videos be internally marked using a private key, so that everyone could verify the originator ...
user avatar
1 vote
1 answer
84 views

Why do the X.509 certificates need the public key?

I am currently reading about X.509 certificates from RFC 5280 and there is a thing in section 3.1 that I cannot understand. It says: Users of a public key require confidence that the associated ...
user avatar
  • 11
0 votes
2 answers
43 views

Can any field in a CSR be overwritten in the issued cert?

Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
user avatar
2 votes
0 answers
65 views

What is expected of domain owners in the Certificate Transparency system?

As I understand it, Certificate Transparancy provides proof to the client that the presented certificate is publicly accessible in CT logs. The certificate being in the logs enables a domain owner to ...
user avatar
  • 33
1 vote
1 answer
120 views

How does the certificate transparency check in Chrome work?

I've been reading up on Certificate Transparency (CT), but can't find anywhere how a client (like a browser) is supposed to check if the certificate is present in any of the certificate transparency ...
user avatar
  • 33
0 votes
1 answer
36 views

Exposing ADCS OCSP on the Public Internet

I am building a Certificate Authority using Windows Server ADCS as a 'Standalone' CA but my application would be greatly improved if I can utilise OCSP. Is the ADCS Online Responder Role Service ...
user avatar
  • 1
0 votes
1 answer
105 views

Difference between trust anchors and certificate authorities

Trust anchors and (root) certificates authorities are often used interchangeably and it's easy to think that they are the same thing. The answer in Can an intermediate CA be trusted like a self-signed ...
user avatar
5 votes
1 answer
429 views

Difference between -CAfile and -trusted in OpenSSL verify

openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual: -CAfile <FILE> A file of trusted certificates. The file ...
user avatar
0 votes
0 answers
25 views

The difference between a virtual door-lock and a public key [duplicate]

The thing that helped me to understand what is a "public key" was to parallel it with a door lock: The door lock is public in the sense that anyone can try to unlock it and the door key is ...
user avatar
0 votes
0 answers
52 views

Any harm in having a SHA-384 and 3072-Key for an intermediate Certificate?

I am building up a PKI and have 2 different chains of trust used for TLS Certificates. 1st Chain: SHA1-Root / 2048 RSA Key ( provided by CA ) --> SHA256-Intermediate / 2048 Key ( mine ) ----> ...
user avatar
  • 155
3 votes
1 answer
502 views

What signature and certificate signing is all about

I know that X.509 certificate signing process includes creating a CSR (certificate signing request) and then the following happens: Some data's from the certificate to be signed hash is computed ...
user avatar
  • 143
0 votes
0 answers
115 views

SafeNet eToken 5110CC w/ IDPrime 940MD: Generating ECC384/521 Errors + ICC/CVC Authentication

I am trying to utilize the SafeNet eToken 5110CC, which basically has the IDPrime 940MD with the applet 4.4.2.A., to generate ECC keys with lengths 384bits and 521bits to no avail. The product brief ...
user avatar
  • 111
3 votes
1 answer
459 views

should I treated the let's encrypt fullchain.pem as a public key

I am using let's encrypt to generate a certificate. It contains 'fullchain.pem' and 'privkey.pem'. should I treated the let's encrypt fullchain.pem as a public key? I find the public key certificate ...
user avatar
  • 133
0 votes
2 answers
80 views

How does a TLS client know the CA certificate?

Assuming the server doesn't send the root CA certificate along with it's certificate and all the intermediates, how does the client know the root CA certificate in order to validate the server's ...
user avatar
  • 115
0 votes
0 answers
48 views

How do Cloud-based services provide Qualified Electronic Signatures?

From what I know about QES, they come on smart cards and USB tokens and are password protected. When a site asks you for a client certificate, you need to have it plugged in and enter the password ...
user avatar
  • 101
0 votes
0 answers
53 views

How dangerous is a leaked private key from outside the infrastructure in context of: "Azure Active Directory keyCredential property Disclosure?"

Microsoft published the Guidance for Azure Active Directory (AD) keyCredential property Information Disclosure in Application and Service Principal APIs which describes how to check if an Azure AD is ...
user avatar
0 votes
1 answer
77 views

"Mutuality" of public key authentication

I'm a newbie when it comes to cryptographic security, but there's something I'm not quite getting concerning the "mutual" aspect of public key authentication. Say you have a client X, and ...
user avatar
  • 115
0 votes
1 answer
94 views

Is there any point in separating private key gen for a self signed certificate?

Disclaimer + Background Since self signed certs are not that popular, here's some context: I have a 3rd party client/server application that we're currently using (inside the LAN!) via unencrypted TCP/...
user avatar
  • 1,247
1 vote
2 answers
255 views

Possible attacks using public key in a certificate

this is purely an exploratory question. If this is not the right place to ask for it, please point me to the right one. TLS version: TLS 1.2 CIPHER SUITE : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (any ...
user avatar
1 vote
2 answers
135 views

Why is there a key exchange for symetric in TLS needed?

As i understand it, PKI with an asymetric key approach is much more secure than a symetric key encryption. The keys are much bigger but it takes more CPU power to en- and decrypt. So why do we ...
user avatar
2 votes
2 answers
129 views

Digital Signatures validity when changing Certificate Authority

An enterprise has its internal PKI-1 (Root CA) that issues certificates to sign document using CAdES-C (CAdES-LT); with Complete Validation Data References and revocation references. Now this ...
user avatar
0 votes
3 answers
116 views

Is the Initial Public Key Transfer Process in Public Key Encryption Vulnerable to MITM on Public Networks?

(shown in step 1): Is the initial process in public key encryption where the public key is transferred across the network done in plaintext? It seems like it must be, which essentially means that no ...
user avatar
  • 101
0 votes
1 answer
88 views

can an SSH session be initiated with a public key

I am able to SSH into an Embedded Linux device remotely using a private key with the following command as example (where id_rsa is the private key file): ssh -i id_rsa root@192.168.30.199 This will ...
user avatar
2 votes
0 answers
205 views

How/when does Windows link private key to imported certificate?

When creating CSR on Windows (using built-in certificate store), I found some weird behaviors: When I use enrollment policy, but then extract CSR and sign it somewhere else, on import the certificate ...
user avatar
1 vote
3 answers
154 views

Stolen server key on TLS intercepting proxy

TLS intercepting proxies create fake server public and private keys on the fly and sign them with a root CA. Depending on the software the keys might be cached or regenerated on each new connection. ...
user avatar
1 vote
1 answer
122 views

Is a OCSP request verified via TLS?

I was wondering if the connection towards the ocsp responder/server is TLS encrytped itself. Meaning that the client requesting a validity check for a certificate verifies the OCSPs server certificate?...
user avatar
  • 65
0 votes
1 answer
138 views

How to prevent server know what data is being transferred through it between two clients

Imagine a web application in which two computers can communicate with each other by transferring files, through the server linked with some unique password. Every file sent between the clients are ...
user avatar
1 vote
2 answers
134 views

Do certificate issuers perform checks against homograph attack?

I just got a very phishy looking email from Vodafone. It had encoding errors and nothing more than my name in it. It asked me to confirm my email address and in order to do that I had to enter some ...
user avatar
  • 499
1 vote
0 answers
85 views

What's the best practice for server certificate issuance protocols in mixed environments?

In mixed Windows/Linux environments what's the best practice for issuing server certificates? If you use Windows MSCA PKI, you're kind of stuck with using previous certificates to authenticate the ...
user avatar
1 vote
1 answer
183 views

Custom PKI for TLS in iOS vs. Android

The scenario An app on iOS has to perform an HTTPS connection, validating the server's TLS certificate against a root CA of a custom PKI. The target Android seems to have best-practice procedures to ...
user avatar
5 votes
1 answer
331 views

Impact of having more X509v3 Key Usage fields than required?

I was wondering if having an "oversubscription" of "Key usage fields" inside a X509v3 certificate can negatively impact the performance and/or the security of a server. For example ...
user avatar
  • 65
0 votes
2 answers
122 views

How to reliably identify a certificate as intermediate certificate?

As per the title, is there a way to reliably identify a certificate as an intermediate certificate? I can identify if a certificate is a root certificate. But i can not tell the difference between an ...
user avatar
  • 155
1 vote
1 answer
102 views

Software signing : multiple certificates

I'm quite new to the cryptography field, and I'm trying to understand a few things: I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below: I'm ...
user avatar
0 votes
1 answer
196 views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
user avatar
0 votes
1 answer
166 views

Should certificate pinning be implemented if the app can use many servers?

In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application. The vendor sells software that it's customers ...
user avatar
  • 33
1 vote
1 answer
464 views

Wildcard Certificates and Client Authentication for Machine Authentication

If a wildcard certificate is provisioned for *.domain.fqdn, and has Client Authentication as a defined usage, does this mean the certificate can be used to essentially impersonate any domain machine? ...
user avatar
0 votes
3 answers
211 views

Nextgen firewalls - encrypted traffic inspection

I read recently about next generation firewalls that use deep-packet-inspection, intrusion-prevention and something the manufacturers call encrypted-traffic-inspection, encrypted-traffic-analytics. ...
user avatar
0 votes
1 answer
141 views

PKI or Digitally signed certificate

Please do mind, its a long read. I just confused myself again with how the CA server helps with the digital signature and the pki working flow. Please let me know if what I am describing below is the ...
user avatar
  • 123
0 votes
2 answers
166 views

For organizations running modern, functioning PKI, can mTLS be used as SSO mechanism?

I am trying to determine best practices for implementing a webapp running in an extremely tight PKI environment. Assume: Yubikey like devices that have Certs with reasonable expiration dates The ...
user avatar
2 votes
3 answers
295 views

Does / Can a HSM or TPM encrypt my private keys

I'm still not completely sure about the role of using an HSM or TPM on a device when it comes to storing private keys for security purposes. My use case would be using TLS with an embedded device ...
user avatar
1 vote
2 answers
110 views

Deriving digital signature key pair deterministically from an arbitrary secret

Is there a scheme that let people derive public/private key pair from arbitrary secrets? As you may know, digital signature schemes have versatile use cases. The problem is, the key pair handling is ...
user avatar
1 vote
1 answer
163 views

How securely should one treat their primary public key?

First of all, is my understanding correct that primary keys and subkeys are all key pairs consisting of a private and a public key? I get the rationale behind using primary keys and subkeys1, and why ...
user avatar
  • 115

1
2 3 4 5
26