Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
2
votes
2answers
53 views

Can I use the same truststore and keystore on the client and the server?

TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides? More info if helpful: I'm trying to test ...
2
votes
2answers
150 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
0
votes
1answer
56 views

Why generate dedicated issuer CA for TSU certificates?

I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME ...
1
vote
1answer
770 views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
1
vote
1answer
71 views

What is “-srvcert” in OpenSSL cmp command line?

I use the following command to get a signed certificate from PKI. What is the content of the file srvcert.crt of the option -srvcert ? It seems the srvcert.crt file is not the public certificate of ...
0
votes
1answer
153 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
1
vote
1answer
74 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
2
votes
0answers
37 views

Microsoft CA Problem for Windows 10 Clients with Wireshark Installed [migrated]

This is a most bizarre scenario, but hoping someone else has ran into this at some point to shed some light. We are in the process of migrating to a new host Microsoft CA service. There are CA ...
2
votes
1answer
153 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
0
votes
1answer
153 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
15
votes
3answers
35k views

Reset Windows trusted certificates store to its default [closed]

Over the time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, some other times for development and testing. Is there ...
93
votes
7answers
132k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
2
votes
1answer
72 views

Can I concatenate multiple x509 certificates?

I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. ...
1
vote
1answer
120 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
11
votes
1answer
462 views

Pin required for accessing (smartcard) Card Authentication Slot

So let me set the stage: I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html I made a couple ...
0
votes
1answer
55 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
0
votes
2answers
81 views

private key of SSL certificate

To create a certificate, first we need to fill a CSR and in CSR we have to place our public key and that key pair can be generated by different ways in different devices. To do ssh, we run command (...
38
votes
3answers
31k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
303
votes
6answers
238k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
1
vote
1answer
62 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
3
votes
3answers
954 views

Is it possible to do Public Private Key Encryption on a chip (hardware)?

Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely? The ultimate goal ...
3
votes
2answers
5k views

CSR with only public key with openssl

So I have been doing my research and haven't found anything specific enough to my problem. As the question title states, I want to make a CSR with only the public key. What I have been able to do is ...
24
votes
1answer
20k views

Which properties of a X.509 certificate should be critical and which not?

RFC5280's section 4.2 states Each extension in a certificate is designated as either critical or non-critical. A certificate-using system MUST reject the certificate if it encounters ...
1
vote
1answer
81 views

PKI - Hybrid - root ca in the Datacenter

PKI - Can we maintain root CA and HSM in the data center and have issuing CA on the cloud to issue certs, integrated with cloud HSM?
1
vote
1answer
125 views

RFC 5755 Attribute Certificate Validation

According to this explanation: Manually walking through the signature validation of a certificate I'd like to know how is the validation process of an RFC 5755 attribute certificates, because it ...
1
vote
1answer
85 views

Is it common for malwares to use public-key cryptography to authenticate their C2 commmunications?

I'm sure there are instances of this, but I ask it because malwares are often so makeshift that I could definitely see their authors purposely using weaker forms of authentication to perform ...
2
votes
1answer
65 views

How does an offline Root CA sign OCSP Response?

As Root CA are kept offline for security purposes, how does it sign OCSP Response sent by Client for Intermediate Certificate Status Check?
7
votes
1answer
484 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
0
votes
0answers
40 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
0
votes
0answers
58 views

Implementing PKI with Blockchain

In many current researches, ways of decentralizing PKI are proposed in which one of them is to implement PKI on blockchain but there is still a certification authority so isn't PKI still centralized ? ...
1
vote
0answers
27 views

How do I check if my key is updated in a keyserver after I resend it with new signatures?

I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures. The thing is that when ...
4
votes
4answers
1k views

How can we trust PKI, for example, Verisign?

We want to send an encrypted message to Alice. We can ask her a public key over the network, encrypt with it a message and send that message back. It is bad, because someone can pretend to be Alice ...
2
votes
2answers
73 views

Does Windows require the full certificate chain in order to trust a certificate?

I'm putting together a Root CA to sign multiple intermediate CAs which will then be used to sign VPN server and VPN user certificates. When I provide a user with their certificate, ideally I only ...
0
votes
1answer
21 views

gpg importing public key

I'm trying to follow this: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Step_by_Step_Guide/s1-gnupg-import.html to import a key.asc using gpg --import key.asc, so that ...
0
votes
3answers
131 views

Will it be safer to use self sign CA and client certification in the company for a private website?

Our company have 10+ private websites and 20+ person and need to open a different one automatic when the developers are testing some functional. We do not want anyone outside the company to view the ...
0
votes
2answers
116 views

Is there any way to send data securely from multiple As to B in the presence of eavesdropper, without losing anonymity like in a public key exchange?

Suppose I have n subordinates at work. Any subordinate should be able to submit his or her report anonymously to me via digital means. Also suppose that I have no means of broadcasting any form of ...
1163
votes
3answers
623k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
26
votes
2answers
4k views

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well?

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well? What about for certificates issued by an authority beneath it? For example, if root ...
0
votes
1answer
463 views

GPG encryption failed - Unusable public key

I was trying to encrypt a file using a GPG public key. It's working fine on my test server which is ubuntu 18.04 but when I try to use the same key on my production server (Amazon Linux) it failed ...
24
votes
5answers
14k views

Creating my own CA for an intranet

I need to create my own CA for an intranet and unfortunately it seems there's no good answer about this on Security.SE. There are many resources online about this, but all of them are different and ...
0
votes
1answer
84 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
2
votes
1answer
86 views

SSH Public Key / Host Key - Can Client Request Key Length?

In SSH, does the client have any power in determining the key size of the host key, or is it completely dependent on what the servers host key is? For instance, say the client and server agree on ...
0
votes
0answers
22 views

Get Hash from PKIsignature

I have a PKIsignature and a certificate attached to same file, How can I: extract public key from certificate chain use public key to get hash file from PKIsignature DBNmqrbZ+...
13
votes
1answer
719 views

Does HSTS protect against a rogue CA issuing a illegitimate valid certificate?

Does HSTS protect a domain from a publicly trusted CA that has gone rogue issuing a illegitimate valid certificate? Examples of publicly trusted CA's would be any of the members of the Mozilla CA ...
0
votes
1answer
58 views

How can I authenticate the certifcate of a Private CA while I'm not on that network i.e. offline

I want my application to verify that it is being run on a computer with a certificate issued by my Private CA. How can I do this when the computer is not on the network?
0
votes
0answers
40 views

Just came to know about Digital Certificates. But did't understand the way clients can verify CA [duplicate]

So I just came to know about Digital certificates, and this is what I understand. Public Key, Message + PK_encrypt(Hash(message))/Message Signing, And other identifiers is what a digital signature is....
1
vote
2answers
202 views

ECDHE_RSA_WITH_AES_128_GCM_SHA256 - How to determine ECDHE Key Length?

Server: SSL Certificate, 2048-bit RSA Public Key, Signature Algorithm is sha256RSA What am I missing here? ! I've scoured the RFC's, and I have yet to find anything on how to determine the ECDHE key ...
1
vote
0answers
32 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
0
votes
2answers
62 views

Can I restrict a Certification Authority to signing certain device/application?

Basically another administrator wants a subordinate CA certificate for their fancy appliance. How do I restrict the subordinate CA certificate issued to them only able to issuing for their usages and ...
6
votes
3answers
4k views

What stops a hacker from installing its own CA certificate?

Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following: ...Such is the case with that small company in the Netherlands, DigiNotar....