Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
1 vote
0 answers
19 views

Key Usage and Extended Key Usage for X.509 Certificares on Yubikey

I want to deploy X.509 certificates onto a Yubikey into the certificate slots 9a: PIV Authentication 9c: Digital Signature 9d: Key Management 9e: Card Authentication (see Yubico: PIV Introduction - ...
user2690527's user avatar
0 votes
1 answer
59 views

Using an application specific entity id in X.509 certificates

I'm generating self-signed X.509 certificates so I can use TLS in peer-to-peer applications. My problem is that the identifier of each peer is an arbitrary string of bytes derived from the public key, ...
Felipe Rossi's user avatar
0 votes
0 answers
55 views

Is this X509 Subject field, with no space between 'jurisdiction' and an RDN, correctly formatted?

I recently purchased a new EV certificate (having previously used an OV certificate) and have successfully used it to sign my files. However I'm getting a lot of warnings from Microsoft Defender about ...
Dan Gravell's user avatar
0 votes
0 answers
30 views

Types of certificate? [duplicate]

What types of certificates are there? I was checking online and I found several different types, some at the level of the format of the certificate (x509, PEM, DER), and one at the application level (...
anonymous's user avatar
0 votes
1 answer
82 views

How to verify hostname of certificate? and Is it mandatory if client knows the certificate?

I have a reported finding saying that hostname verification is disabled. This can be deduced from this line of code: final HttpClientBuilder httpClientBuilder = HttpClientBuilder.create(); ...
anonymous's user avatar
0 votes
0 answers
47 views

What is the security impact of disabling certificate check [duplicate]

I have this line of code in a client server project: sslContext.init(null, new TrustManager[]{new TrustAnyManager()}, null); A security guy pointed out that this is skipping the validation of the ...
anonymous's user avatar
0 votes
0 answers
87 views

AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment

Let's say we produce IoT devices and want them to access AWS IoT Core. The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
Francesco B.'s user avatar
0 votes
0 answers
43 views

How to include ChangeSubjectName in CSR?

The RFC - 7030 section 4.2.2, EST protocol, suggests to use the Change Subject Name attribute when the client would like to use a different subject for the new issued certificate during reenrollment. ...
MoBe's user avatar
  • 21
0 votes
1 answer
130 views

Convert PGP key to X.509?

Can I convert a PGP key to X.509, using OpenSSL or GNUPG? Aren't these only container/wrapper formats?
Geremia's user avatar
  • 1,753
1 vote
0 answers
86 views

Certify using Yubikey

I just started using a Yubikey 5. I've set up GPG according to this excellent guide, and now I have 3 working ECC key pairs on my Yubikey: Sign/S :: ed25519, Encrypt/E :: cv25519, Authentication/A :: ...
telephone's user avatar
  • 111
0 votes
1 answer
139 views

How are X.509 certificate revoked?

I would like to know how are X.509 certificates revoked. That is: Say I have an X509 certificate, and I want it to be revoked for whatever reason (e.g., compromise). How do I reach out to the CA? What ...
Ginswich's user avatar
  • 103
0 votes
2 answers
82 views

Web Browser and server using ECDHE_RSA cypher suite, then what is the use of X.509 certificate public key for?

User Crover has given a very great explanation for this question: RSA or ECDHE for x.509 certificates-what does each do? I have one question to Crover and/or any other member. What I understand from ...
Imran S's user avatar
0 votes
1 answer
244 views

Why does the Public Key Info field in an X509 certificate for EC indicate the algorithm

The Subject Public Key Info field can have a value like ECDSA_P256 or ECDH_P256 when ECC is used. Why is it not sufficient to specify "ECC_P256"? In other words, why is it not enough to ...
Lemon Sky's user avatar
  • 175
0 votes
1 answer
111 views

Does self-signed encryption certificate violate "no multi-use keys" principle?

Say that I have generated an RSA keypair, which I intend to publish only for use with RSA-KEM; I can see that this is provisioned for: The intended application for the key MAY be indicated in the key ...
JamesTheAwesomeDude's user avatar
0 votes
0 answers
83 views

How do I create a certificate with subject containing Octet string?

I need to create a certificate with: subject.attribute1: 2.5.4.3 {Common Name} UTF8String subject.attribute2: 2.5.4.92 {tagAFI} OCTET STRING subject.attribute3: 0.9.2342.1920.0300.100.1.1 {userId} ...
J K JoCriSem's user avatar
1 vote
1 answer
114 views

Certification path building for 509 certificates

To this date, is there a specification or a de-facto industry standard or how applications are supposed to perform certification path building in the context of X.509? I am specifically asking about ...
Nope's user avatar
  • 11
0 votes
1 answer
112 views

How to resolve an issue with potential mismatch between device certificate and CA certificate?

I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
monkey's user avatar
  • 103
0 votes
0 answers
356 views

openssl x509 -sigopt algorithms and options list?

Per the OpenSSL 3.1 documentation for the x509 subcommand, the -sigopt flag allows one to pass signing options. The documentation for that flag currently states: -sigopt nm:v Pass options to the ...
Les Hazlewood's user avatar
0 votes
1 answer
554 views

Why is a v3 extension needed for a X.509 certificate to be used to test HTTPS on localhost?

I'm learning how to test HTTPS locally and found that articles written before ca. 2019 (e.g., 1, 2, 3) contain only a few steps, whereas later posts (e.g., 4, 5, 6, 7, 8, 9) always make sure that v3 ...
toraritte's user avatar
  • 129
1 vote
0 answers
102 views

Best practice of x.509 client certificates accross multiple systems

I have several MongoDB's where I use x.509 Certificates to Authenticate Clients Let's say I create certificate and user for admin: subject: CN=admin issuer: CN=MongoDB Issuing CA -> db.createUser({...
Wernfried Domscheit's user avatar
0 votes
0 answers
103 views

Limit the intermediate CA to be trusted only on one host

I'm exploring PKI and reached the following issue - I'm generating root CA for an organization and intermediate CA per every user (unique). But then it hit me that essentially any user (Alice) in the ...
YafimK's user avatar
  • 101
0 votes
2 answers
134 views

x509 chain verification which fields are sufficient

To perform the chain verfiction between rootCA, IssueCA, endentity CA which fields should be common, Note: doing through code, not from command line. Below is the extracted part from generated certs, ...
chandu's user avatar
  • 161
0 votes
0 answers
112 views

Error when validating certificate

I created a certificate signed by an intermediate CA that is signed by root CA following an online tutorial. Reference to tutorial that I followed: https://www.golinuxcloud.com/openssl-create-...
ethicalhacker's user avatar
0 votes
0 answers
79 views

Are X.509 certificates tied to a particular operation [duplicate]

I am looking to create a X.509 certificate to encrypt a payload (plaintext) (using Hybrid encryption) and send it across to a server. Can I create a SSL/TLS X.509 certificate and use that to do the ...
gRam's user avatar
  • 1
24 votes
4 answers
6k views

What's the point of certificates in SSL/TLS?

A valid certificate cannot guarantee that I'm not being MITM'd right now, as either the private key or CA may have been compromised. For this reason, I have to contact a CA through CRL/OCSP to check ...
David Davidson's user avatar
2 votes
1 answer
315 views

Can we use a custom non-x.509 cert for TLS?

I know TLS normally uses a x.509 certificate. But is it possible to use a non-x.509 cert to do TLS if both the server and client understand the format of that certificates?
leopoodle's user avatar
  • 151
1 vote
1 answer
1k views

How to add additional information to Certificate Signing Request (CSR)?

I would like to generate a Certificate Signing Request (CSR) and add additional custom information in it. The standard CSR fields are common name, country, organization, organizational unit, etc. Is ...
Equinox's user avatar
  • 21
1 vote
1 answer
183 views

How to get OpenSSL to keep subj intact between x509 CSR and certificate

When creating my own root CA, intermediate CA and server certificate I would like to add a contentType=X to the subject line of all three x509 certificates. On the root that appears to be working with:...
Torxed's user avatar
  • 131
1 vote
0 answers
87 views

x509 certificate verification issue [closed]

Having issue with x509 certificate verification. Steps I followed. Generated the root certificate. created the Intermediate certificate. signed the Intermediate certificate with root certificate. ...
chandu's user avatar
  • 161
4 votes
2 answers
219 views

How can I ensure that a CSR doesn't rely on a revoked private key

CRL lists the revoked certificates of a CA by sending back to the user the Serial Number of each certificate, nothing related to the public key. I don't know how it works for OCSP. Is there a ...
Antonin M.'s user avatar
1 vote
0 answers
1k views

SSL handshake failure | Client hello(success) -> Server ACK (success) -> server RST (connection closed)

I was running MQTT broker in my pc and tried to connect to it via mqtt client in same PC. using x509 cert for mutual tls. SSL Handshake was failing with RST from server. This was happening only in my ...
azhahes.s's user avatar
0 votes
0 answers
238 views

SSL/x509 certificate/public key expiration [duplicate]

I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
Jeff's user avatar
  • 1
1 vote
2 answers
760 views

Keys vs Certificate & x509 vs GPG

I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG. Where I get lost is how the certificate comes into play and what ...
Arthae's user avatar
  • 13
0 votes
1 answer
270 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
Vlad A.'s user avatar
2 votes
1 answer
250 views

Determine if the client certificate comes from a smarcard in mTLS [closed]

I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
Luna's user avatar
  • 31
0 votes
2 answers
883 views

A DNS that has been eliminated is still resulting in X.509 Certificate Subject CN Does Not Match the Entity Name

I ran a Nexpose scan on a DNS that no longer resolves and a vulnerability was found : X.509 Certificate Subject CN Does Not Match the Entity Name I don't know why it's still producing a vulnerability ...
Marion Lee's user avatar
0 votes
1 answer
2k views

Connecting to company VPN issues a failed certificate verification

As one can see on the screenshot below, connecting to the company VPN via FortiClient issues a X509 verify certificate failed. I have informed the CIO who is the security person as well but it is not ...
David's user avatar
  • 101
1 vote
1 answer
387 views

Digital Signature Generation

In short, I need to place a Digital Signature into slot 9c of my Yubikey. If you generate the certificate from the Yubikey; then the private key is not exportable. So I'm attempting to generate the ...
Oort's user avatar
  • 11
1 vote
1 answer
78 views

Distrusting a cross signed certificate

Consider the following scenario OpenSSL and x.509v3 is used. You have 2 CA's: CA1 and CA2. Both CA's have cross signed each other, meaning CA1 has signed CA2 and CA2 has signed CA1. When CA1 signed ...
MadsRC's user avatar
  • 98
2 votes
1 answer
910 views

How to create and embed Signed Certificate Timestamp (SCT) in certificate

I have deployed a Certificate Transparency (CT) log server that uses Google's CTFE (named "certificate-transparency-go" on Github) and Trillian Projects. And I have issued a pre-certificate, ...
Levi Marvin's user avatar
0 votes
2 answers
467 views

What can happen if lifetime info is not included into an X.509 certificate?

When a certification authority generates a signature, but if the message to be signed does not include the lifetime information (period of validity), what can happen in terms of security being ...
jillatik's user avatar
3 votes
1 answer
271 views

Name Constraints, empty sets in permitted subtree (RFC 3280 vs RFC 5280)

I'm trying to understand the effect of empty sets in permittedSubtrees in both, RFC 5280 and RFC 3280. There is something that doesn't compile in my head. Scenario: We have a CA certificate with the ...
Crypt32's user avatar
  • 6,391
2 votes
2 answers
126 views

What happens when you ignore HTTPS warning?

I’m setting up a router at home, and I just created a CA and signed a cert with it. The first time I navigated to the router console, I was greeted with the familiar scary Safari warning about ...
Connor C.'s user avatar
6 votes
1 answer
228 views

What is the best practice for relying parties to selectively trust certificates in a corporate pki hierarchy?

I have a pki infrastructure for internal company use. In this pki there are multiple registration authorities whose responsibility is to. receive certificate issuance requests verify the identity of ...
Giovanni Spiricchi's user avatar
0 votes
1 answer
1k views

application of key usage extension

I understand how Key Usage Extension of x.509 certificate works. I have gone through the Key Usage section of RFC5280 and I know of all the valid values and what they mean. But what I don't understand ...
trekcampy's user avatar
1 vote
1 answer
632 views

How can I recover the full certificate chain knowing the final X.509 certificate?

Given Final X.509 certificate A in PEM format. Access to the certificate store of the server, which encloses all certificates, including singing chain for the certificate A. OpenSSL shows following ...
Anton Golubev's user avatar
1 vote
1 answer
287 views

Best practice for "stateOrProvinceName" in certificate

In RFC-4519 stateOrProvinceName is abbreviated to ST. Should we assume that it is best practice to put ST=<name-of-state> in the certificate if the state or province is indicated? After all X-...
Maarten Bodewes's user avatar
1 vote
0 answers
133 views

Is it must to have "Key Usage" extension in the selfsigned root certificate?

I have gone through multiple questions but still I am confused. RFC X.509 also does not clarify it. Conforming CAs MUST include this extension in certificates that contain public keys that are ...
Ravindra12jan's user avatar
2 votes
2 answers
471 views

How can I prevent non-SAN TLS certificates from bypassing name constraints?

I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints. However, even if I create the CA with restrictions on DNS names as well as ...
VelvetRebel's user avatar
0 votes
1 answer
587 views

How to protect private key for client cert in machine store? Is it acceptable for it to be exportable?

Is it acceptable to store a client cert's private key as exportable in the computer's certificate store? I have a .NET desktop app that installs client certificates in local machine\personal. The ...
Peter Dongan's user avatar

1
2 3 4 5
10