Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

0
votes
1answer
24 views

Server to Server Communication RSA or x509 Certificate

I want to build Server (My) to Server (Other Client parties) web service and I want to add security layer for client verification. Do I need to force clients to create x509 Certificates or RSA key ...
4
votes
1answer
78 views

Should TLS clients put a limit on certificate chain depth?

Specifcally, when configuring nginx to validate proxy target SSL certificates (which it mystifyingly does not do by default), a maximum cert chain depth must be specified in the proxy_ssl_verify_depth ...
0
votes
1answer
75 views

X509 “Serial Number of certificate” vs serial number attribute in Issuer and Subject?

Is the serial number attribute of an X509 certificate Issuer or Subject, as defined in RFC5280, required to be the same as the Serial Number of the issuing or subject certificate? It seems quite ...
1
vote
1answer
47 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
3
votes
0answers
37 views

Examples for use of encipheronly and decipheronly bits in the keyUsage field of a X.509 certificate

I am requesting for real life example of using the encipheronly or decipheronly bits together with the keyAgreement bit in the keyUsage field of a X.509 certificate. The RFC 5280 specifies about these ...
2
votes
1answer
52 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
2
votes
2answers
66 views

Is SubjectAlternativeName in X.509 always used for DNS Names?

X.509 certificates as of RFC5280 offer the two fields "Subject" and "Subject Alternative Name" that can be used to describe the Subject of the certificate (e.g. a Domain example.com). Section 4.2.1.6 ...
0
votes
0answers
46 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...
8
votes
1answer
883 views

The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates

I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My ...
0
votes
2answers
121 views

What is being verified in OpenSSL's SSL_get_verify_result

In OpenSSL the following function is used to verify certs. SSL_get_verify_result I looked at the manual here. But it does not detail what is being verified. Can you clarify to me what does this ...
1
vote
0answers
34 views

What is this error for rootca for wrong system time?

Getting this error for openssl smime verify 140392937076368:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:342:Verify error:certificate is not yet valid After ...
0
votes
1answer
57 views

Can rootca validity start date be lower than current date?

What will happen if we create rootca X509 certificate with validity date lower than current date? Will date of creation taken into account while cms_verify? What will happen if we change the system ...
0
votes
1answer
44 views

Is this CA store related to Ubuntu or OpenSSL

I am checking TLS certificates chain validity against CA sore in this path: etc/ssl/certs/ca-certificates.crt I use Ubuntu 18.04 and OpenSSL 1.1.0g. I need to know whether this CAs store is from ...
3
votes
1answer
143 views

How can I use X.509 cross signing to replace a CA?

I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate. I'...
1
vote
0answers
50 views

Is there a compiled list of TEE (Trusted Execution Environment) manufacturer/CA certificates?

I may be misunderstanding TEEs (I just learned about them from an HN post), but I have question regarding the features that seem to allow what seems to be the perfect form of DRM (to my maybe limited ...
1
vote
1answer
64 views

Self-signed CA certificates - Can we throw away the private keys

I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion. I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
1
vote
1answer
235 views

Understanding Microsoft list of disallowed certificates

Microsoft publishes their untrusted certificates as disallowedcerts.stl Warning: direct download. It is ASN.1 encoded. After decoding it there is a list of sequences like so: SEQUENCE { ...
0
votes
2answers
79 views

How to detect if X.509 certificate belongs to CA or regular end user (host)

If I understand correctly in SSL/TLS authenticity validation there are 2 (maybe more) types of certificates according to the following: the ones that belong to CA (these contain the public key that ...
1
vote
0answers
18 views

Root CA and Intermediate CA security [duplicate]

I'm confused how intermediate CA's adds to the security of the PKI. I realize the compromise of root CA key is catastrophic as it would've to be consequently purged from the trust store of every ...
2
votes
2answers
38 views

What is the specific basis that allows an entity to connect a cert chain to a trusted root?

Let's say I want to validate an entity that presents an X509v3 certificate, "Leaf". Leaf is a cert signed by SigningCA. SigningCA's cert, "SigningCert", was signed by RootCA. RootCA's cert, "...
0
votes
1answer
273 views

Limit OpenVPN client certificate to specific VPN with shared CA chain

I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of ...
1
vote
1answer
167 views

Should we use x509 V1 certificate for a new root CA?

I read a couple of articles that kind of gives the impression that the norm is to use a V1 x509 pkc for a root CA. This is one of them. However the rfc5280 makes no such suggestion. My question is, ...
1
vote
1answer
67 views

RelativeDistinguishedName allowed SET items

According to RFC5280, a subject/issuer Name is a sequence of RelativeDistinguishedName, which in turn in a set of AttributeTypeAndValue (see https://tools.ietf.org/html/rfc5280#section-4.1.2.4). ...
1
vote
1answer
41 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
1
vote
1answer
3k views

Subject Alternative Name in Certificate Signing Request apparently does not survive signing

So I have been able to create a Certificate Signing Request with a Subject Alternative Name of the form subjectAltName=IP:1.2.3.4 by following the recipe in a previous (splendid) answer. When I ...
0
votes
1answer
52 views

What is the difference between certificates held by intermediate CAs and those issued by them?

Given that one CA can issue another a certificate so that they can go on and do the same, what would stop someone from using the certificate for their website to issue certificates and become an ...
7
votes
3answers
814 views

Can a revoked certificate be re-instated?

If a certificate is revoked, can it be re-instated, or is the only option to generate a new one?
2
votes
1answer
60 views

Once a certificate has been validated, is it safe to string-match on the issuer field?

First, some background to the question: I have a Pulse Connect Secure VPN appliance in a multi-tenant environment, and I have been approached with the task of supporting certificate authentication (...
1
vote
1answer
105 views

OpenSSL unable to verify certificate issued by local CA

We have an application that issues (and maintains) SSL certificates for various uses. It does this using the Bouncycastle library in .NET. We create a CA cert, and then use this certificate to ...
1
vote
1answer
362 views

How does do client authentication work over https?

I recently wrote an application that calls out to a 3rd party service to perform some work. This 3rd party service requires that I authenticate the client calling by using a client certificate. For ...
1
vote
1answer
52 views

is it possible for an attacker to change a csr in x509?

Is it possible for an attacker to forge a certificate signing request so he will be able to impersonate someone else ? (by stealing the csr before it gets signed and changing it)
0
votes
1answer
137 views

why is it necessary to have both code signing and time stamping certificates?

I have read about the option to create certificates for signing codes and time stamping. why do we need both of them? I understand that it helps me when I need to increase the validity of my code, ...
1
vote
2answers
108 views

Where can I find the specs for the X.509 certificate used in client-authenticated TLS handshake?

The TLS specs define how the handshake between client and server must be performed when the client wants to use a certificate to authenticate itself. There is a lot of documentation onlin that assumes ...
2
votes
0answers
63 views

WCF WS - Passing passwords through service

I am implementing security on a WCF service from basicHttp to WShttp, the issue is the service sends some passwords for connections to the database that the user can define,test and save. The ...
1
vote
1answer
82 views

Is there a way to enforce policies in x509 certificates?

I have noticed there are some policy features in x509 certificates. Are there some ways to enforce these policies in the certificates? For example, let's take a certificate with imaginary oid 1.2.3 ...
1
vote
1answer
71 views

How can I limit which key sizes and signature algorithm of the next certificate in the certificate chain are allowed?

I have walked through the different fields of x509 certificates and came across some fields which enable to limit the usage of the certificate (for example for certain domains). Is it possible to ...
1
vote
1answer
1k views

x.509 certificate-chain signatures verification

Once a client application downloads a leaf certificate file from some entity, issued by a CA, how does the verification of the cert's signatures work? Specifically, I'm not clear on whether a leaf ...
3
votes
1answer
176 views

No attributes in Certificate Request

We use a CA that expects a challengePassword, so I set up a openssl.cnf like this: oid_section = OIDs [ req ] distinguished_name = req_distinguished_name attributes = ...
6
votes
1answer
432 views

Where can I find a canonical list of elliptic curve names and their aliases?

I recently had a problem where I created an EC client certificate which used the sect571k1 curve and I got some strange errors attempting to use it as a client certificate through Mozilla Firefox. It ...
0
votes
2answers
322 views

Self-signed CA and digital signatures

I am asked to design the public key crypto system for an IoT-like devices. These devices are going to be talking to each other over TCP/IP as well as communicating with a cloud-based API server. The ...
1
vote
0answers
691 views

cfssl example certificate chain verification failure

I am getting the following error when trying to verify the certificate chain of a dummy root/intermediary/end PKI. root generated as follows: mkdir {root,inter,end} cfssl print-defaults config > ...
0
votes
0answers
18 views

Use of server.pfx in SSL [duplicate]

I am not clear about the whole process of authentication and encrption using x509 certificate. Here is my scenario: I am attempting to connect to a third party software using SSL in my API. First I ...
1
vote
1answer
175 views

Remote Private Key for Certificate Authority

Background I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
4
votes
1answer
1k views

S/MIME signing and verification - how do I find proper certificate?

I'm trying to debug a S/MIME signing framework that is functioning wrong. On the input I have a signed message with detached certificate a certificate which private key the message was probably ...
1
vote
1answer
335 views

Impersonating Client Certificate Authentication with Same Subject Name

I am looking into the security of a service which uses client certificates for authenticating only known callers. We run a C# Web API Service that checks every request certificate subject if it is ...
2
votes
1answer
291 views

WinHTTP - Prevent successful handshake if peer certificate is invalid

I am using WinHTTP on a Delphi project to make calls over to the server. Script: userAgent := 'TestClient.exe'; hsession := WinHttpOpen(pwidechar(userAgent), WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, nil,...
3
votes
1answer
138 views

Using NameConstrains in a CA certificate

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart. I have a CA certificate with Name Constrains (RFC): Permitted [1]Subtrees (0..0): ...
1
vote
1answer
743 views

Remove X509v3 extensions from PEM file?

I have a self-signed certificate that was created using makecert on Windows. Now this certificate has to be used by a new application; this new app is using openssl in the background for certificate ...
3
votes
1answer
3k views

Potential False Positive while scanning a network with Nexpose - X509 Certificate mismatch [closed]

Little bit of context, we are seeing this finding a lot. We use wildcard certificates on public facing websites. The finding is titled: "X.509 Certificate Subject CN Does Not Match the Entity ...
2
votes
2answers
339 views

Does x509 have an “issued at” timestamp? Can you tell when an x509 certificate was issued?

The JWT Spec (RFC 7519) has an issued at field ("iat"). Does x509 have any analogous value? I see a Validity field, but nothing else time related.