Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

Why is /cacerts request necessary in RFC 7030 Enrollment Over Secure Transport?

In RFC 7030 Enrollment Over Secure Transport (EST) https://tools.ietf.org/html/rfc7030, the /cacerts request (Section 4.1 of RFC 7030) is used by the client to request the current CA certificates. The ...
22
votes
3answers
4k views

Why don't folks seem to use ECC for TLS root certificate signature?

I looked around, and all I see is websites using RSA2048 for Root signature, and a few using ECC for encryption. Are there any reasons folks don't seem to use ECC for TLS root signature? Are there ...
3
votes
0answers
93 views

How does Cloudflare negotiate its server certificate?

When I access https://example.com on my company's laptop that has a X509 client certificate installed, using my home internet connection, without using a VPN, the requested page is signed using the ...
1
vote
1answer
65 views

What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?

As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA. Loading my CA ...
0
votes
1answer
54 views

How to add subject alternative name when converting PEM certificate to DER format?

Is it possible to add a subject alternative name when converting PEM certificate to DER format. openssl x509 -outform der -in Certificate.pem -out Certificate.der -extensions SAN -subject-alternative-...
0
votes
1answer
75 views

When will CMP be part of OpenSSL? [closed]

CMP means Certificate Management Protocol. CMP for OpenSSL is currently a fork of OpenSSL. Do you know when it will be part of OpenSSL? https://github.com/mpeylo/cmpossl
1
vote
1answer
98 views

openssl: does -keyform engine enables accessing TPM persistent handles with any key arguments ? Even with third party plugin like CMP?

If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ? Will it work with extensions, like CMP for OpenSSL, for ...
0
votes
1answer
111 views

Differences in certificate verification between ssl libraries

I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
0
votes
1answer
98 views

Why generate dedicated issuer CA for TSU certificates?

I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME ...
3
votes
2answers
67 views

Client Certificates from Public Certificate Authorities

I'm looking into mutual TLS authentication for a B2B API. Is it possible to use mutual TLS authentication using X.509 certificates while relying on Public CAs? I see that some Public CAs (from CA/...
2
votes
1answer
92 views

Can I concatenate multiple x509 certificates?

I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. ...
0
votes
0answers
76 views

RDP with self-signed cert requiring password before launching display

I've noticed that the search engine Shodan grabs screenshots from hosts running an RDP service, even if they offer a certificate. To my understanding, the certificate is used to authentify the server,...
4
votes
0answers
122 views

OCSP invalidation of intermediate CA using OCSP_SIGNING

I'm implementing an OCSP server to answer OCSP requests for my custom CA. I already implemented the invalidation of leaves certificates, with the intermediate CA certificate signing the OCSP response,...
0
votes
1answer
117 views

SSL certificate with IP

I have an embedded device and it is running a https server. This device will be accessed from a standard web browser using the IP address. I am generating a TLS certificate. I have added a commonName (...
1
vote
1answer
75 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
0
votes
2answers
82 views

Can you make a device certificate expire after the root certificate?

I have created a CA root certificate and a device certificate to go on my device signed by the CA certificate. My question is as follows: Can you make the device certificate last for 30 years, and ...
26
votes
2answers
4k views

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well?

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well? What about for certificates issued by an authority beneath it? For example, if root ...
0
votes
1answer
59 views

Is it possible to fabricate x.509 certificate with varying issuer and subject fields?

I'm testing a service that might not do a proper checks for the certificate chain but instead it checks issuer and subject fields only. I would need to create a (self signed?) certificate with ...
3
votes
3answers
181 views

Sharing an expired certificate?

Today one of our certificates expired and I needed to order a new one. When collecting all the data needed to create a new one, I got the idea that all needed information is already contained in the ...
0
votes
1answer
167 views

Where precisely are client X509 certificates stored?

Apologies for what might seem like a naive question, but there is a detail to PKI architecture between clients and servers, the answer to which I have so far not been able to come across no matter ...
0
votes
1answer
311 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
1
vote
0answers
85 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
0
votes
3answers
105 views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
1
vote
1answer
57 views

Feedback for self-signed certificates setup for custom product auth?

HW (linux) <---Eth---> Official PC (win,mac,linux) | | ----> Man-in-the-middle eavesdrop I'm looking to prevent an unauthorized party inside the ...
0
votes
0answers
57 views

percentage of X.509 certs using rsaEncryption as publicKey algorithm

Quoting 2017_TLS_Telemetry_Report.pdf: Not surprisingly, 2048-bit keys now protect 90% of the world’s TLS hosts. The use of 4096-bit keys have quadrupled, as a share of hosts, but we expect it to ...
1
vote
0answers
17 views

What would happen to the connection when certificate expires? [duplicate]

We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure) The expiry date of the certificate is 3 years from now. Once the ...
2
votes
0answers
116 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
1
vote
0answers
206 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
0
votes
0answers
368 views

Converting a raw EC public key into EVP_PKEY using openssl

I am trying to convert a raw EC key and EVP_PKEY structure. The process seems straightforward but am running into issues. Here is the code I am using -- unsigned char tmpPubKey[] = { 0x04, ...
0
votes
2answers
499 views

Convert CSR to self-signed x509 Certificate

Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive ...
0
votes
1answer
64 views

Server to Server Communication RSA or x509 Certificate

I want to build Server (My) to Server (Other Client parties) web service and I want to add security layer for client verification. Do I need to force clients to create x509 Certificates or RSA key ...
5
votes
1answer
168 views

Should TLS clients put a limit on certificate chain depth?

Specifcally, when configuring nginx to validate proxy target SSL certificates (which it mystifyingly does not do by default), a maximum cert chain depth must be specified in the proxy_ssl_verify_depth ...
0
votes
1answer
1k views

X509 “Serial Number of certificate” vs serial number attribute in Issuer and Subject?

Is the serial number attribute of an X509 certificate Issuer or Subject, as defined in RFC5280, required to be the same as the Serial Number of the issuing or subject certificate? It seems quite ...
2
votes
1answer
268 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
3
votes
0answers
72 views

Examples for use of encipheronly and decipheronly bits in the keyUsage field of a X.509 certificate

I am requesting for real life example of using the encipheronly or decipheronly bits together with the keyAgreement bit in the keyUsage field of a X.509 certificate. The RFC 5280 specifies about these ...
2
votes
1answer
74 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
2
votes
2answers
481 views

Is SubjectAlternativeName in X.509 always used for DNS Names?

X.509 certificates as of RFC5280 offer the two fields "Subject" and "Subject Alternative Name" that can be used to describe the Subject of the certificate (e.g. a Domain example.com). Section 4.2.1.6 ...
12
votes
1answer
8k views

The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates

I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My ...
2
votes
2answers
467 views

What is being verified in OpenSSL's SSL_get_verify_result

In OpenSSL the following function is used to verify certs. SSL_get_verify_result I looked at the manual here. But it does not detail what is being verified. Can you clarify to me what does this ...
1
vote
0answers
56 views

What is this error for rootca for wrong system time?

Getting this error for openssl smime verify 140392937076368:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:342:Verify error:certificate is not yet valid After ...
0
votes
1answer
122 views

Can rootca validity start date be lower than current date?

What will happen if we create rootca X509 certificate with validity date lower than current date? Will date of creation taken into account while cms_verify? What will happen if we change the system ...
0
votes
1answer
77 views

Is this CA store related to Ubuntu or OpenSSL

I am checking TLS certificates chain validity against CA sore in this path: etc/ssl/certs/ca-certificates.crt I use Ubuntu 18.04 and OpenSSL 1.1.0g. I need to know whether this CAs store is from ...
3
votes
1answer
486 views

How can I use X.509 cross signing to replace a CA?

I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate. I'...
1
vote
0answers
72 views

Is there a compiled list of TEE (Trusted Execution Environment) manufacturer/CA certificates?

I may be misunderstanding TEEs (I just learned about them from an HN post), but I have question regarding the features that seem to allow what seems to be the perfect form of DRM (to my maybe limited ...
1
vote
1answer
87 views

Self-signed CA certificates - Can we throw away the private keys

I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion. I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
1
vote
1answer
510 views

Understanding Microsoft list of disallowed certificates

Microsoft publishes their untrusted certificates as disallowedcerts.stl Warning: direct download. It is ASN.1 encoded. After decoding it there is a list of sequences like so: SEQUENCE { ...
0
votes
2answers
399 views

How to detect if X.509 certificate belongs to CA or regular end user (host)

If I understand correctly in SSL/TLS authenticity validation there are 2 (maybe more) types of certificates according to the following: the ones that belong to CA (these contain the public key that ...
1
vote
0answers
26 views

Root CA and Intermediate CA security [duplicate]

I'm confused how intermediate CA's adds to the security of the PKI. I realize the compromise of root CA key is catastrophic as it would've to be consequently purged from the trust store of every ...
2
votes
2answers
40 views

What is the specific basis that allows an entity to connect a cert chain to a trusted root?

Let's say I want to validate an entity that presents an X509v3 certificate, "Leaf". Leaf is a cert signed by SigningCA. SigningCA's cert, "SigningCert", was signed by RootCA. RootCA's cert, "...
0
votes
1answer
539 views

Limit OpenVPN client certificate to specific VPN with shared CA chain

I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of ...

1
2 3 4 5
7