Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
1 vote
0 answers
31 views

SSL handshake failure | Client hello(success) -> Server ACK (success) -> server RST (connection closed)

I was running MQTT broker in my pc and tried to connect to it via mqtt client in same PC. using x509 cert for mutual tls. SSL Handshake was failing with RST from server. This was happening only in my ...
0 votes
0 answers
31 views

SSL/x509 certificate/public key expiration [duplicate]

I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
  • 1
0 votes
0 answers
12 views

Setting up OID for the CSR and the CA [duplicate]

I am currently trying to setup a Apache2 Server with the prompt to have a specific OID which is this one: The CSR generation with the OID works with the -addext flag: But i have Problems with the ...
0 votes
2 answers
78 views

Keys vs Certificate & x509 vs GPG

I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG. Where I get lost is how the certificate comes into play and what ...
  • 3
0 votes
1 answer
63 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
2 votes
1 answer
78 views

Determine if the client certificate comes from a smarcard in mTLS [closed]

I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
  • 31
0 votes
2 answers
49 views

A DNS that has been eliminated is still resulting in X.509 Certificate Subject CN Does Not Match the Entity Name

I ran a Nexpose scan on a DNS that no longer resolves and a vulnerability was found : X.509 Certificate Subject CN Does Not Match the Entity Name I don't know why it's still producing a vulnerability ...
0 votes
0 answers
41 views

Help understanding PKI MTLS and digital signature architecture

I'm building an identity service using PKI and MTLS for authentication where users are supposed to be able to sign data e.g. a json string or a document. Where I am now I have implemented working MTLS ...
0 votes
1 answer
267 views

Connecting to company VPN issues a failed certificate verification

As one can see on the screenshot below, connecting to the company VPN via FortiClient issues a X509 verify certificate failed. I have informed the CIO who is the security person as well but it is not ...
  • 101
1 vote
1 answer
127 views

Digital Signature Generation

In short, I need to place a Digital Signature into slot 9c of my Yubikey. If you generate the certificate from the Yubikey; then the private key is not exportable. So I'm attempting to generate the ...
  • 11
1 vote
1 answer
33 views

Distrusting a cross signed certificate

Consider the following scenario OpenSSL and x.509v3 is used. You have 2 CA's: CA1 and CA2. Both CA's have cross signed each other, meaning CA1 has signed CA2 and CA2 has signed CA1. When CA1 signed ...
  • 88
1 vote
1 answer
311 views

How to create and embed Signed Certificate Timestamp (SCT) in certificate

I have deployed a Certificate Transparency (CT) log server that uses Google's CTFE (named "certificate-transparency-go" on Github) and Trillian Projects. And I have issued a pre-certificate, ...
0 votes
2 answers
130 views

What can happen if lifetime info is not included into an X.509 certificate?

When a certification authority generates a signature, but if the message to be signed does not include the lifetime information (period of validity), what can happen in terms of security being ...
0 votes
0 answers
21 views

ChaCha Single-Use RNG with All Zero Plaintext + Nonce

I am creating an internal application that will be used to generate and manage self-signed certificates and certificate authorities. Its primary use will be for generating certificates used in SSL ...
  • 135
3 votes
1 answer
101 views

Name Constraints, empty sets in permitted subtree (RFC 3280 vs RFC 5280)

I'm trying to understand the effect of empty sets in permittedSubtrees in both, RFC 5280 and RFC 3280. There is something that doesn't compile in my head. Scenario: We have a CA certificate with the ...
  • 5,916
2 votes
2 answers
76 views

What happens when you ignore HTTPS warning?

I’m setting up a router at home, and I just created a CA and signed a cert with it. The first time I navigated to the router console, I was greeted with the familiar scary Safari warning about ...
6 votes
1 answer
130 views

What is the best practice for relying parties to selectively trust certificates in a corporate pki hierarchy?

I have a pki infrastructure for internal company use. In this pki there are multiple registration authorities whose responsibility is to. receive certificate issuance requests verify the identity of ...
0 votes
1 answer
179 views

application of key usage extension

I understand how Key Usage Extension of x.509 certificate works. I have gone through the Key Usage section of RFC5280 and I know of all the valid values and what they mean. But what I don't understand ...
1 vote
1 answer
167 views

How can I recover the full certificate chain knowing the final X.509 certificate?

Given Final X.509 certificate A in PEM format. Access to the certificate store of the server, which encloses all certificates, including singing chain for the certificate A. OpenSSL shows following ...
0 votes
0 answers
27 views

Can an EAP-TLS Server X.509 certificate authenticate an mDNS Avahi/ZeroConf/Bonjour name?

Using an internal CA, can valid X.509 certificates be created for mDNS domain names (as distinct from conventional DNS domain names)? E.g. a hostname like radius.local? Would such a certificate be ...
1 vote
1 answer
79 views

Best practice for "stateOrProvinceName" in certificate

In RFC-4519 stateOrProvinceName is abbreviated to ST. Should we assume that it is best practice to put ST=<name-of-state> in the certificate if the state or province is indicated? After all X-...
1 vote
0 answers
77 views

Is it must to have "Key Usage" extension in the selfsigned root certificate?

I have gone through multiple questions but still I am confused. RFC X.509 also does not clarify it. Conforming CAs MUST include this extension in certificates that contain public keys that are ...
1 vote
2 answers
147 views

How can I prevent non-SAN TLS certificates from bypassing name constraints?

I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints. However, even if I create the CA with restrictions on DNS names as well as ...
  • 113
0 votes
1 answer
140 views

How to protect private key for client cert in machine store? Is it acceptable for it to be exportable?

Is it acceptable to store a client cert's private key as exportable in the computer's certificate store? I have a .NET desktop app that installs client certificates in local machine\personal. The ...
  • 125
1 vote
1 answer
142 views

Why do the X.509 certificates need the public key?

I am currently reading about X.509 certificates from RFC 5280 and there is a thing in section 3.1 that I cannot understand. It says: Users of a public key require confidence that the associated ...
  • 11
4 votes
1 answer
1k views

Difference between -CAfile and -trusted in OpenSSL verify

openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual: -CAfile <FILE> A file of trusted certificates. The file ...
1 vote
0 answers
35 views

Role of public and private keys of client certificate in mTLS [duplicate]

I'm curious to know how mTLS works in more detail in regard to client authentication. Firstly, I issued 3 certificates: root CA, server and client. The last two are signed with the root CA. Secondly, ...
  • 143
0 votes
1 answer
130 views

Client authentication using X509 certificates behind the scenes

In my application I've successfully implemented client authentication using X509 certificates Here's what I've done: Issued a self-signed CA root certificate with a private key Issued a web-server ...
  • 143
1 vote
1 answer
182 views

Why does Microsoft SmartScreen require OV certificates to be signed by a trusted CA?

Signing your applications with an OV code signing certificate enables them to build reputation together in Microsoft SmartScreen, rather than each binary building reputation separately. This allows ...
  • 233
0 votes
2 answers
77 views

Avoid re-encrypting persisted cipher texts when using certificates

An application uses RSA to encrypt small texts before persisting in database, using public key of the end node of the application. Only these end nodes must be able to decrypt thge ciphers and only ...
0 votes
1 answer
74 views

mTLS Client Authentication by Signing Arbitrary Message using Browser

this is my first post here in the area of ​​security and encryption. I will try to be succinct, and let you know that I am not an expert in security. Context: My client (visitor) has an X509 ...
2 votes
3 answers
484 views

Can a SHA2 x509 cert thumbprint be spoofed/specified?

Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control. Supposing someone was able to view the thumbprint of a cert ...
  • 125
1 vote
2 answers
469 views

What happens if one certificate path is valid while the other one is not?

I have recently figured out that Lets Encrypt provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it ...
0 votes
1 answer
377 views

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

I have the following from Google's public certs for verifying JWT ID -----BEGIN CERTIFICATE----- MIIDHDCCAgSgAwIBAgIIW4K0b18ff70wDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE ...
  • 162
0 votes
0 answers
211 views

Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?

We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate. With help of old article oscp-must-staple I managed to create CRA with ...
0 votes
1 answer
196 views

How should I securely rsync to a host with a self-signed certificate on a private network?

I have a backup server that has a self-signed certificate (x509) and another server on the same network. I would like to rsync data to the backup server from the other server. However, I prefer not to ...
  • 3
0 votes
1 answer
241 views

How best to cryptographically sign scientific papers?

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone. Usually these aren't high-...
  • 171
5 votes
1 answer
472 views

Ramifications of including "localhost" in the subject alternative field of an x509 certificate?

Are we inviting any problems if we add localhost and 127.0.0.1 to the subject alternative name field of an x509 certificate? We are still trusting the appropriate root CA, but relaxing the rules of ...
1 vote
2 answers
423 views

How to reliably identify a certificate as intermediate certificate?

As per the title, is there a way to reliably identify a certificate as an intermediate certificate? I can identify if a certificate is a root certificate. But i can not tell the difference between an ...
  • 165
3 votes
3 answers
407 views

TLS: Verify server certificate before sending client certificate?

I am wondering if there is any harm in having a TLS client send its certificate to a server before having established trust with that server. I have found a similar question, however that mostly ...
  • 131
1 vote
1 answer
165 views

Software signing : multiple certificates

I'm quite new to the cryptography field, and I'm trying to understand a few things: I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below: I'm ...
user avatar
0 votes
0 answers
66 views

Is the RSA Public Key size always the same as the private key size? [duplicate]

When working with x509 certificates and a public and private key pair, let's say you generate a private key that is 4096 bits. Is it possible to have a public key that is only 2048 bits then? Or are ...
1 vote
1 answer
196 views

How may I check if an expired certificate was valid at the time?

I have an old let's encrypt (but disregard that, it could be any) certificate that is no longer active. How may I check if it was valid at the time?
0 votes
2 answers
1k views

Do X.509 Certificate Serial Numbers Change When A Cert Is Renewed?

Do X.509 certificate serial numbers change when a certificate is renewed? I understand the thumbprint changes, but I am unsure about the serial number. I suspect so since it's a new cert, but if you ...
  • 101
0 votes
1 answer
207 views

What sort of RSA private key format is this and how are they generared [duplicate]

I am used to seeing a regular private key, with the standard key block, but I just came across this type which carries extra information as you can see. What format is this and how are these generated ...
0 votes
2 answers
2k views

Obtaining .p12 certificate from PEM file and CRT file provided by GoDaddy

A few months ago a colleague who left generated a CA certificate from GoDaddy. I am not sure the exact steps he took but currently we would like to install the CA certificate on a server to fully ...
  • 101
0 votes
0 answers
74 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
7 votes
3 answers
2k views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
0 votes
1 answer
199 views

Generating a DER-encoded DSA public key of a particular file size

I am reverse engineering a binary that contains a raw, DER-encoded X.509 certificate containing a DSA public key. I want to replace this certificate with one that I have generated so that I have ...
  • 1
2 votes
1 answer
367 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...

1
2 3 4 5
9