2022 Developer Survey is open! Take survey.

Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

Is it must to have "Key Usage" extension in the selfsigned root certificate?

I have gone through multiple questions but still I am confused. RFC X.509 also does not clarify it. Conforming CAs MUST include this extension in certificates that contain public keys that are ...
user avatar
2 votes
2 answers
54 views

How can I prevent non-SAN TLS certificates from bypassing name constraints?

I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints. However, even if I create the CA with restrictions on DNS names as well as ...
user avatar
  • 123
0 votes
1 answer
52 views

How to protect private key for client cert in machine store? Is it acceptable for it to be exportable?

Is it acceptable to store a client cert's private key as exportable in the computer's certificate store? I have a .NET desktop app that installs client certificates in local machine\personal. The ...
user avatar
  • 125
1 vote
1 answer
84 views

Why do the X.509 certificates need the public key?

I am currently reading about X.509 certificates from RFC 5280 and there is a thing in section 3.1 that I cannot understand. It says: Users of a public key require confidence that the associated ...
user avatar
  • 11
5 votes
1 answer
427 views

Difference between -CAfile and -trusted in OpenSSL verify

openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual: -CAfile <FILE> A file of trusted certificates. The file ...
user avatar
1 vote
0 answers
28 views

Role of public and private keys of client certificate in mTLS [duplicate]

I'm curious to know how mTLS works in more detail in regard to client authentication. Firstly, I issued 3 certificates: root CA, server and client. The last two are signed with the root CA. Secondly, ...
user avatar
  • 143
0 votes
1 answer
72 views

Client authentication using X509 certificates behind the scenes

In my application I've successfully implemented client authentication using X509 certificates Here's what I've done: Issued a self-signed CA root certificate with a private key Issued a web-server ...
user avatar
  • 143
0 votes
1 answer
79 views

Why does Microsoft SmartScreen require OV certificates to be signed by a trusted CA?

Signing your applications with an OV code signing certificate enables them to build reputation together in Microsoft SmartScreen, rather than each binary building reputation separately. This allows ...
user avatar
  • 223
0 votes
2 answers
71 views

Avoid re-encrypting persisted cipher texts when using certificates

An application uses RSA to encrypt small texts before persisting in database, using public key of the end node of the application. Only these end nodes must be able to decrypt thge ciphers and only ...
user avatar
0 votes
1 answer
69 views

mTLS Client Authentication by Signing Arbitrary Message using Browser

this is my first post here in the area of ​​security and encryption. I will try to be succinct, and let you know that I am not an expert in security. Context: My client (visitor) has an X509 ...
user avatar
0 votes
0 answers
20 views

Hot to validate X.509 Certificate [duplicate]

A client wants to show a stream of his Motobix Webcam on his website. Its easy to show a jpg stream. But the problem is: The stream source is not protected with a valid ssl certificate. On the camera ...
user avatar
  • 101
2 votes
3 answers
220 views

Can a SHA2 x509 cert thumbprint be spoofed/specified?

Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control. Supposing someone was able to view the thumbprint of a cert ...
user avatar
  • 125
1 vote
2 answers
250 views

What happens if one certificate path is valid while the other one is not?

I have recently figured out that Lets Encrypt provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it ...
user avatar
0 votes
1 answer
120 views

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

I have the following from Google's public certs for verifying JWT ID -----BEGIN CERTIFICATE----- MIIDHDCCAgSgAwIBAgIIW4K0b18ff70wDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE ...
user avatar
  • 162
0 votes
0 answers
130 views

Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?

We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate. With help of old article oscp-must-staple I managed to create CRA with ...
user avatar
1 vote
1 answer
118 views

How should I securely rsync to a host with a self-signed certificate on a private network?

I have a backup server that has a self-signed certificate (x509) and another server on the same network. I would like to rsync data to the backup server from the other server. However, I prefer not to ...
user avatar
  • 13
0 votes
1 answer
202 views

How best to cryptographically sign scientific papers?

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone. Usually these aren't high-...
user avatar
  • 171
1 vote
1 answer
170 views

Ramifications of including "localhost" in the subject alternative field of a x509 certificate?

Are we inviting any problems if we add localhost and 127.0.0.1 to the subject alternative name field of an x509 certificate? We are still trusting the appropriate root CA, but relaxing the rules of ...
user avatar
0 votes
2 answers
122 views

How to reliably identify a certificate as intermediate certificate?

As per the title, is there a way to reliably identify a certificate as an intermediate certificate? I can identify if a certificate is a root certificate. But i can not tell the difference between an ...
user avatar
  • 155
3 votes
3 answers
246 views

TLS: Verify server certificate before sending client certificate?

I am wondering if there is any harm in having a TLS client send its certificate to a server before having established trust with that server. I have found a similar question, however that mostly ...
user avatar
  • 131
1 vote
1 answer
102 views

Software signing : multiple certificates

I'm quite new to the cryptography field, and I'm trying to understand a few things: I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below: I'm ...
user avatar
0 votes
0 answers
63 views

Is the RSA Public Key size always the same as the private key size? [duplicate]

When working with x509 certificates and a public and private key pair, let's say you generate a private key that is 4096 bits. Is it possible to have a public key that is only 2048 bits then? Or are ...
user avatar
1 vote
1 answer
177 views

How may I check if an expired certificate was valid at the time?

I have an old let's encrypt (but disregard that, it could be any) certificate that is no longer active. How may I check if it was valid at the time?
user avatar
0 votes
2 answers
405 views

Do X.509 Certificate Serial Numbers Change When A Cert Is Renewed?

Do X.509 certificate serial numbers change when a certificate is renewed? I understand the thumbprint changes, but I am unsure about the serial number. I suspect so since it's a new cert, but if you ...
user avatar
  • 101
0 votes
0 answers
80 views

Is it required to have the subject name also in the subject alternative name?

From the rfc5280 it's a bit unclear to me if the subject name needs to be repeated in the Subject Alternative Name (SAN). The RFC says "addition" or "in place". So it could be both?...
user avatar
  • 516
0 votes
0 answers
16 views

SSL connection establishment where only client has a certificate [duplicate]

Consider a situation, where an end-point owns a certificate and wants to establish a connection to another end-point w.o a certificate. In ssl context, the end-point starting the connection is named ...
user avatar
0 votes
1 answer
94 views

What sort of RSA private key format is this and how are they generared [duplicate]

I am used to seeing a regular private key, with the standard key block, but I just came across this type which carries extra information as you can see. What format is this and how are these generated ...
user avatar
  • 131
0 votes
0 answers
107 views

In the context of the NSS certutil tool -t "trustargs" option, what is a "peer certificate"?

The NSS "certutil" tool specifies the -t trustargs option, and allows the administrator to declare certificates as a "peer certificate" or a "trusted peer certificate" as ...
user avatar
0 votes
1 answer
1k views

Obtaining .p12 certificate from PEM file and CRT file provided by GoDaddy

A few months ago a colleague who left generated a CA certificate from GoDaddy. I am not sure the exact steps he took but currently we would like to install the CA certificate on a server to fully ...
user avatar
  • 101
0 votes
0 answers
74 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
user avatar
7 votes
3 answers
1k views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
user avatar
0 votes
1 answer
130 views

Generating a DER-encoded DSA public key of a particular file size

I am reverse engineering a binary that contains a raw, DER-encoded X.509 certificate containing a DSA public key. I want to replace this certificate with one that I have generated so that I have ...
user avatar
  • 1
2 votes
1 answer
250 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
user avatar
2 votes
1 answer
168 views

Is it possible to use X509 to verify other information, like a vacination?

Background: Germany has decided to implement the proof of vacination for Corona based on 5 Blockchains. It's supposed to be anonymus and safe and the verification could hapen with a QR-Code. My Idea: ...
user avatar
  • 23
1 vote
0 answers
147 views

Windows X.509 certificate private keys lost

Have the same certificates installed on several machines, but this happens on only one of them. The certificates are self-signed certificates. The certificates are used for WCF message security. ...
user avatar
  • 135
0 votes
0 answers
58 views

Can a man-in-the-middle replay a valid X.509 certificate? [duplicate]

Consider the following scenario: M (who will later be the man-in-the-middle) connects via https to bank.com. He saves the X.509 certificate (or certificate chain) received from bank.com. Alice ...
user avatar
0 votes
1 answer
1k views

Exporting a JKS entry to X509 certificate - why public key differs?

There is a JKS file containing an entry named "mycert": https://filebin.net/l93faa9qa3rkt32h Password is test123 Based on the following screenshot, mycert has a public key (RSA 2048 bits) ...
user avatar
  • 103
12 votes
4 answers
2k views

Is it possible to update the contact info (FN/LN, OU, Organization,..) of a certificate?

When creating a self-signed certificate you are asked to enter some information (First Name, Last Name, Organization Unit, Organization, City, State,...). Is it possible to update any of those fields ...
user avatar
  • 223
0 votes
1 answer
180 views

openssl SubjectDN parameter, abbreviaton of argument keys and how to add extra ones

openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter. The parameter accepts a string of slash-delimited values in the form of: "/...
user avatar
2 votes
1 answer
131 views

X509 certification and communication

I am having trouble understanding the concept of X509 encryption and its application to web service communication. The situation is that I (client) would like to communicate with another party (server)...
user avatar
1 vote
0 answers
104 views

Real world X.509 v2 certificate examples?

Just out of curiosity, could you provide (old) real world X.509 v2 certificate examples that include the deprecated (in some version of X.509) and forbidden (in RFC 5280) issuerUniqueIdentifier or ...
user avatar
1 vote
1 answer
387 views

What client-cert validation can be gleaned from DNS/reverse DNS lookup?

I'm learning about X509 certs used in client-cert authentication to https endpoints. I have a nice Python script that checks many facets of the client-cert. Is there any validation that can be ...
user avatar
17 votes
4 answers
4k views

Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?

I'm learning about X509 certs used in client-cert authentication to https endpoints. If I have an OCSP checker (Python script that creates, submits, decodes OCSP responses), do I need to check the not-...
user avatar
0 votes
2 answers
204 views

Approach to authorizing users and X.509 certificates

I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
user avatar
0 votes
0 answers
48 views

Using fields in X.509 cert for authorization [duplicate]

I understand that X.509 certificates are used for authentication. How can I use the information provided in an X.509 certificate for authorization? For example, are there any fields in the certificate ...
user avatar
0 votes
0 answers
287 views

OpenSSL: how to download full certificate chain

I have the following X509 certificate in PEM format: -----BEGIN CERTIFICATE----- MIIHsTCCBZmgAwIBAgIQKopxYDq6VHRa7GfyxvV6hjANBgkqhkiG9w0BAQsFADCB ...
user avatar
2 votes
1 answer
167 views

Is there a standard order for the X.509 extensions of a certificate?

Is there a standard order for the X.509 extensions of a certificate? For example: [ myca_extensions ] basicConstraints = critical,CA:FALSE keyUsage = digitalSignature,keyEncipherment ...
user avatar
0 votes
1 answer
302 views

Can my Root, Intermediate and SAN certificates have the same serial number?

Can my Root, Intermediate and SAN certificates have the same serial number? The serial number is 00. If the Root, Intermediate and SAN should not have same serial numbers, then should I use the random ...
user avatar
1 vote
1 answer
79 views

Which attribute in DN is commonly used to specify the class/type/usage of certificate/end-entity?

I have a private CA which provides certificates for three types of IoT devices (Type1, Type2 and Type3). On the IoT device certificate's subject DN, which attribute can be used for specifying this ...
user avatar
  • 191
0 votes
0 answers
316 views

What does LDAP have to do with X.509 Certificates

I'm working with certificates programmatically through .NET. I usually give the certificate a DN by giving it string like this: "c=eg,s=cairo,st=Nozha,cn=Foo Ltd.,..” But there is another way to ...
user avatar
  • 147

1
2 3 4 5
9