Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
0
votes
1answer
40 views

Deployment tips to support indirect CRLs

I'm looking into the feasibility of using indirect CRLs to eliminate the need to manually publish CRLs from an offline root. Is anyone familiar with any similar deployments? If so, how did they set it ...
-1
votes
0answers
51 views

How does a Certificate Authority read your Certificate Signing Request? [closed]

My understanding is that a Certificate Authority uses an applicant's CSR to issue the applicant's server a signed certificate. However, the CSR is encrypted, so how is the CA able to use it?
1
vote
2answers
154 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
1
vote
2answers
649 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: (source: globalsign.com) I have been researching how trusted root authorities (such as ...
3
votes
2answers
352 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
16
votes
4answers
3k views

CRL over HTTPS: is it really a bad practice?

On the Internet, I can find several statements done over the years claiming that serving a X.509 CRL over HTTPS is a bad practice because either it causes a chicken-and-egg problem when checking for ...
0
votes
1answer
218 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
7
votes
2answers
12k views

Securely generate and store public/private keys on Android

I am making a web application that distributes data encrypted with the public keys of its clients. At this moment this is working for dedicated devices which I distribute myself. Before they are ...
1
vote
1answer
91 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
0
votes
1answer
240 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
1
vote
1answer
86 views

Expiration of superadmin.p12 certificate

I have a super admin certificate which is expired two days ago.When I try to click on Administration tab in my EJBCA instance to renew this certificate ,I am getting error like certificate has expired....
0
votes
1answer
81 views

pki infrastructure for REST API

My question is based on to secure REST API's. We have to publish a REST API and we want only certain consumers to consume the API. I was thinking of one way is to use asymmetric encryption. The steps ...
5
votes
1answer
67 views

Why install a certificate in the Trusted Root CA of the server?

As part of configuration tasks I am doing at work I am having to learn more about how https works and how to set things up. One bit that I am not sure about is the need to install a certificate in the ...
79
votes
3answers
133k views

Can I add a password to an existing private key?

Say I have previously created a private/public key combination, and decided at the time to not protect the private key with a password. If I later decide to "beef up" security and use a password-...
12
votes
1answer
2k views

Secure way to hold private keys in the Android app

What would be the most appropriate way to store private keys for barcode signing in the Android app? Probably most experts here would say - just don't do it, cause it's insecure... But I would like to ...
0
votes
1answer
48 views

Difference between private key exposure and tampering in mutual authentication

Consider a remote and local system doing mutual authentication either by TLS through server/client certificates or similarly wireguard. What are the differences when the private keys (in particular ...
3
votes
1answer
4k views

Verifying SSH fingerprint of a public server

I have read somewhere that servers which have SSH access for users in the public can have their public key posted publicly (e.g., on a website), so that people who access such a server using SSH can ...
1
vote
2answers
147 views

Is it common for malwares to use public-key cryptography to authenticate their C2 commmunications?

I'm sure there are instances of this, but I ask it because malwares are often so makeshift that I could definitely see their authors purposely using weaker forms of authentication to perform ...
2
votes
1answer
164 views

How do clients extract the public key from a self-signed certificate?

I have gone over: Why do we need to sign the self-signed certificate? Basic self-signed certificate questions Is a self-signed SSL certificate much better than nothing? I am new to cryptography and ...
0
votes
0answers
25 views

Seamless Key Management with Key Management Systems?

I'm keeping it vague on purpose so that it can help other cases as well. Goal The goal is to store information that is encrypted on client side and then delivered to the database. Server should never ...
0
votes
1answer
49 views

Are there any identity providers which support securing RESTful interfaces using digital signature?

I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract: When signing, the sender uses ...
0
votes
1answer
69 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
0
votes
3answers
2k views

IP Security (IPsec) vs Public Key Infrastructure (PKI)

I've found the following question on the internet and don't think the answer is right. Which of the following does IPsec use? A) SSL B) AES C) DES D) PKI The given answer is D, PKI ...
4
votes
3answers
7k views

Root CA with Extended Key Usage fields

I recently started using AWS's Certificate Manager to get free TLS certificates for my load balancer. When I was inspecting the certificate chain I noticed that the Root CA, Starfield Class 2 ...
0
votes
2answers
252 views

certificate used in SSL and keys used in SSH

To do SSH to any server we should create private key pair through which we encrypt the connection. Now in SSH we are just doing encryption and here we don't need to verify the server, that's why we ...
1
vote
2answers
269 views

is this a good practice for storing private keys?

I'm working on a centralized exchange for cryptocurrencies. the approach that I'm taking for some reasons is to create an account(private key) per user inside platform. so these accounts should be ...
0
votes
1answer
137 views

Can PKCS#12 files contain multiple certificate chains?

I know that PKCS#12 files can contain multiple certificates and private keys. However, I could not find any resource where any limit was mentioned for the number of certificate chains or private keys ...
2
votes
4answers
580 views

What kind of IoT devices use certificates?

I have read that PKI certificates are the main way to provide security on IoT platforms. And the common enrollment protocols for certificates are: SCEP (Simple Certificate Enrollment Protocol) EST (...
12
votes
3answers
7k views

Why one should prefer EST protocol instead of SCEP?

For many years SCEP was a simple and widely used protocol for obtaining X.509 certificates. However, not too so long ago another protocol called EST (RFC 7030) was developed. What are the main ...
1
vote
1answer
111 views

PKI - Hybrid - root ca in the Datacenter

PKI - Can we maintain root CA and HSM in the data center and have issuing CA on the cloud to issue certs, integrated with cloud HSM?
1
vote
1answer
78 views

Is encrypting a private key inside a pkcs12 file using openssl secure?

This answer states that encrypting a private key using openssl rsa -aes256 isn't secure, because the md5 hash of the password is used as encryption key. But what if I do openssl pkcs12 -export -in ...
7
votes
3answers
9k views

Is the Offline Root CA Obsolete?

There are countless “how-to” articles and best practices recommending use of an offline root certificate authority (CA). Though as the title suggests, is this recommendation obsolete? The context of ...
0
votes
1answer
66 views

Why must I send certificate and private key when make HTTPS requests? [duplicate]

In my company, we are issued .p12 files and extract the certificate and private key like so: openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys openssl pkcs12 -in path.p12 -out newfile....
8
votes
1answer
3k views

Moving from a one tier to a two tier Microsoft Certificate Authority hierachy

Right now we have a single Microsoft Enterprise Root CA which issues certificates to our VPN users for two-factor authentication. We're planning to extend the use of the CA to issue certificates for ...
0
votes
2answers
443 views

openssl verify error: unable to get local issuer certificate

I have a test certificate chain that I generated and it fails the openssl verify command: openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem The output I get from the ...
0
votes
0answers
50 views

PKI: how to get OCSP Signing certificate information?

If I want to find the actual signing certificate for OCSP responder, how can I go about it? Is it possible to get it anywhere in .pem format?
0
votes
1answer
98 views

How do I identify, characterize and detect if trusted CAs compromised?

What is the best approach to use in identifying, characterizing and detecting compromised CAs? I do not mean an invalid certificate or invalid CA that can be identified by an X.509 during validation ...
2
votes
1answer
291 views

What is the correct terminology for a private key corresponding to a public key certificate?

I have learned that the certificate is something that contain information about a public key. An article on wikipedia says Public Key Certificate as well. If we are talking about private key, it's not ...
0
votes
1answer
50 views

MFA using PKI certificates [closed]

I'm trying to set up a multi factor authentication using PKIs certificates. A PKI infrastructure is ready to use and i'm planning to put these certificates on smart cards. I was looking for a smart ...
2
votes
1answer
179 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
1
vote
2answers
203 views

How to store ECDSA public key securely in Android

I am writing an Android application that needs to verify that a request is sent from a trusted party (me). This is my current solution: Storing keys: Generate ECDSA public key / private key from a ...
5
votes
2answers
2k views

Public keys without the certificates

There are two clients and a server. Each client generates an RSA key pair and uploads public key to the server. The server associates the public key with the user identifier that is specified during ...
1
vote
2answers
87 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
0
votes
1answer
60 views

Certificate Authority generates private key for Extended Validation code signing certificate?

My company upgraded to an Extended Validation code signing security certificate, which was delivered via mail on a physical USB key, called a "token." The token contains a private key and ...
6
votes
1answer
148 views

Why not signing a certificate with more than one Certification Authority [duplicate]

A student asked me a good question today when I was explaining the concept of certificates chain. As I said "if a CA is compromised by an attacker he can emit false certificates for the entities ...
0
votes
2answers
141 views

Create CSR for S/MIME certificate from existing OpenPGP key pair

While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone). I believe the ...
2
votes
3answers
1k views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...
0
votes
1answer
78 views

Diffie Hellman implementation- NodeJS

Diffie Hellman is a key exchange algorithm where client and server both generate public and private key, exchange their public key and combine this key with his own private key to generate same secret ...
1
vote
0answers
39 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
4
votes
2answers
168 views

Is Java's probablePrime used in production?

Prime numbers are core in security. I saw this question about Java's probablePrime and was wondering if that API/approach is indeed used for real production-ready security code or other approaches are ...

1
2 3 4 5
25