Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

OpenSSL encrypts public key after conversion to pfx [migrated]

I'm exporting a certificate and private key into .pfx file with: openssl pkcs12 -export -out export.pfx -in public.crt -inkey private.key -nodes However despite encrypting private key with provided ...
38
votes
3answers
31k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
14
votes
3answers
34k views

Reset Windows trusted certificates store to its default [closed]

Over the time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, some other times for development and testing. Is there ...
298
votes
6answers
233k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
0
votes
0answers
8 views

Does Juniper have an equivalent of 'show security pki local-certificate' for remote certificates? [migrated]

On a Juniper Firewall, the command show security pki local-certificate will give all sorts of detail for a local certificate. (The sort of certificate you would use to stand up an IKE connection) My ...
1
vote
1answer
52 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
3
votes
3answers
943 views

Is it possible to do Public Private Key Encryption on a chip (hardware)?

Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely? The ultimate goal ...
3
votes
2answers
5k views

CSR with only public key with openssl

So I have been doing my research and haven't found anything specific enough to my problem. As the question title states, I want to make a CSR with only the public key. What I have been able to do is ...
24
votes
1answer
19k views

Which properties of a X.509 certificate should be critical and which not?

RFC5280's section 4.2 states Each extension in a certificate is designated as either critical or non-critical. A certificate-using system MUST reject the certificate if it encounters ...
1
vote
0answers
11 views

AD CS Configuration Using Install-AdcsCertificationAuthority Cmdlet [migrated]

I am trying to configure a subordinate CA using a .PFX file with PowerShell. I am using the below parameters: $params = @{ CAType = "EnterpriseSubordinateCA" Credential = $credential ...
1
vote
1answer
79 views

PKI - Hybrid - root ca in the Datacenter

PKI - Can we maintain root CA and HSM in the data center and have issuing CA on the cloud to issue certs, integrated with cloud HSM?
1
vote
1answer
115 views

RFC 5755 Attribute Certificate Validation

According to this explanation: Manually walking through the signature validation of a certificate I'd like to know how is the validation process of an RFC 5755 attribute certificates, because it ...
1
vote
1answer
92 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
1
vote
1answer
84 views

Is it common for malwares to use public-key cryptography to authenticate their C2 commmunications?

I'm sure there are instances of this, but I ask it because malwares are often so makeshift that I could definitely see their authors purposely using weaker forms of authentication to perform ...
2
votes
1answer
61 views

How does an offline Root CA sign OCSP Response?

As Root CA are kept offline for security purposes, how does it sign OCSP Response sent by Client for Intermediate Certificate Status Check?
7
votes
1answer
477 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
0
votes
0answers
37 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
0
votes
0answers
57 views

Implementing PKI with Blockchain

In many current researches, ways of decentralizing PKI are proposed in which one of them is to implement PKI on blockchain but there is still a certification authority so isn't PKI still centralized ? ...
1
vote
0answers
26 views

How do I check if my key is updated in a keyserver after I resend it with new signatures?

I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures. The thing is that when ...
4
votes
4answers
1k views

How can we trust PKI, for example, Verisign?

We want to send an encrypted message to Alice. We can ask her a public key over the network, encrypt with it a message and send that message back. It is bad, because someone can pretend to be Alice ...
2
votes
2answers
66 views

Does Windows require the full certificate chain in order to trust a certificate?

I'm putting together a Root CA to sign multiple intermediate CAs which will then be used to sign VPN server and VPN user certificates. When I provide a user with their certificate, ideally I only ...
0
votes
1answer
20 views

gpg importing public key

I'm trying to follow this: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Step_by_Step_Guide/s1-gnupg-import.html to import a key.asc using gpg --import key.asc, so that ...
0
votes
3answers
130 views

Will it be safer to use self sign CA and client certification in the company for a private website?

Our company have 10+ private websites and 20+ person and need to open a different one automatic when the developers are testing some functional. We do not want anyone outside the company to view the ...
0
votes
2answers
114 views

Is there any way to send data securely from multiple As to B in the presence of eavesdropper, without losing anonymity like in a public key exchange?

Suppose I have n subordinates at work. Any subordinate should be able to submit his or her report anonymously to me via digital means. Also suppose that I have no means of broadcasting any form of ...
1161
votes
3answers
621k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
26
votes
2answers
4k views

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well?

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well? What about for certificates issued by an authority beneath it? For example, if root ...
0
votes
1answer
246 views

GPG encryption failed - Unusable public key

I was trying to encrypt a file using a GPG public key. It's working fine on my test server which is ubuntu 18.04 but when I try to use the same key on my production server (Amazon Linux) it failed ...
24
votes
5answers
13k views

Creating my own CA for an intranet

I need to create my own CA for an intranet and unfortunately it seems there's no good answer about this on Security.SE. There are many resources online about this, but all of them are different and ...
0
votes
1answer
82 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
2
votes
1answer
81 views

SSH Public Key / Host Key - Can Client Request Key Length?

In SSH, does the client have any power in determining the key size of the host key, or is it completely dependent on what the servers host key is? For instance, say the client and server agree on ...
0
votes
0answers
22 views

Get Hash from PKIsignature

I have a PKIsignature and a certificate attached to same file, How can I: extract public key from certificate chain use public key to get hash file from PKIsignature DBNmqrbZ+...
13
votes
1answer
716 views

Does HSTS protect against a rogue CA issuing a illegitimate valid certificate?

Does HSTS protect a domain from a publicly trusted CA that has gone rogue issuing a illegitimate valid certificate? Examples of publicly trusted CA's would be any of the members of the Mozilla CA ...
0
votes
1answer
55 views

How can I authenticate the certifcate of a Private CA while I'm not on that network i.e. offline

I want my application to verify that it is being run on a computer with a certificate issued by my Private CA. How can I do this when the computer is not on the network?
0
votes
0answers
40 views

Just came to know about Digital Certificates. But did't understand the way clients can verify CA [duplicate]

So I just came to know about Digital certificates, and this is what I understand. Public Key, Message + PK_encrypt(Hash(message))/Message Signing, And other identifiers is what a digital signature is....
0
votes
1answer
145 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
1
vote
2answers
145 views

ECDHE_RSA_WITH_AES_128_GCM_SHA256 - How to determine ECDHE Key Length?

Server: SSL Certificate, 2048-bit RSA Public Key, Signature Algorithm is sha256RSA What am I missing here? ! I've scoured the RFC's, and I have yet to find anything on how to determine the ECDHE key ...
1
vote
1answer
70 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
1
vote
0answers
30 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
0
votes
1answer
140 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
0
votes
2answers
60 views

Can I restrict a Certification Authority to signing certain device/application?

Basically another administrator wants a subordinate CA certificate for their fancy appliance. How do I restrict the subordinate CA certificate issued to them only able to issuing for their usages and ...
6
votes
3answers
4k views

What stops a hacker from installing its own CA certificate?

Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following: ...Such is the case with that small company in the Netherlands, DigiNotar....
2
votes
1answer
89 views

SSL MITM Proxy Security - Can we rely on it?

In my organization, we have an SSL MITM (Man-in-the-middle) proxy (like ZScaler proxy). If I browse an HTTPS website and check the certificate, I can see that the proxy has issued a separate ...
3
votes
2answers
107 views

What is the best strategy for handling a compromised private key within the domain of firmware?

I have a firmware project that uses asymmetric cryptography for assuring integrity and authority of updates. The private key is stored within the company, and the public key is on the firmware to ...
0
votes
1answer
51 views

Why does the CSR state/province name need to be the same as the CA certificate?

This is more a conceptual question than it is about a bug/error I'm encountering. I am learning about PKI (public key infrastructure), and attempting to sign my own certifications by walking through ...
0
votes
0answers
49 views

Can I use a public / private keypair to secure traffic on my wifi on OpenWRT?

Wifi passwords are a pretty weak way to secure a Wifi Access point; is it possible to use a public / private key to secure traffic on a wifi access point which runs OpenWRT. I know I can secure SSH ...
25
votes
3answers
7k views

Which SSH security is stronger? 2 Factor or Public key

For SSH authentication, which is more secure? 2 Factor Authentication using a USB token/Google Authenticator(time based) OR Public/private key with password Or could they be both used at the same ...
1
vote
1answer
116 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
0
votes
1answer
92 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
0
votes
1answer
48 views

How do I verify that an ssh public/private keypair go together, is it different for openssl and ssh-key generated keys?

Generating a Private Key... $ openssl genrsa -out ./oci_api_key.pem 2048 Generate a Public Key...from the private key: I'm trying to generate a public key from a private key in PEM format (the ...
15
votes
5answers
19k views

A standard way to manually add a digital signature to a pdf file?

I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...