Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
0
votes
2answers
41 views

Avoid re-encrypting persisted cipher texts when using certificates

An application uses RSA to encrypt small texts before persisting in database, using public key of the end node of the application. Only these end nodes must be able to decrypt thge ciphers and only ...
0
votes
1answer
35 views

mTLS Client Authentication by Signing Arbitrary Message using Browser

this is my first post here in the area of ​​security and encryption. I will try to be succinct, and let you know that I am not an expert in security. Context: My client (visitor) has an X509 ...
0
votes
0answers
20 views

Hot to validate X.509 Certificate [duplicate]

A client wants to show a stream of his Motobix Webcam on his website. Its easy to show a jpg stream. But the problem is: The stream source is not protected with a valid ssl certificate. On the camera ...
2
votes
3answers
104 views

Can a SHA2 x509 cert thumbprint be spoofed/specified?

Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control. Supposing someone was able to view the thumbprint of a cert ...
1
vote
2answers
96 views

What happens if one certificate path is valid while the other one is not?

I have recently figured out that Lets Encrypt provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it ...
0
votes
1answer
35 views

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

I have the following from Google's public certs for verifying JWT ID -----BEGIN CERTIFICATE----- MIIDHDCCAgSgAwIBAgIIW4K0b18ff70wDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE ...
0
votes
0answers
61 views

Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?

We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate. With help of old article oscp-must-staple I managed to create CRA with ...
1
vote
1answer
63 views

How should I securely rsync to a host with a self-signed certificate on a private network?

I have a backup server that has a self-signed certificate (x509) and another server on the same network. I would like to rsync data to the backup server from the other server. However, I prefer not to ...
0
votes
1answer
161 views

How best to cryptographically sign scientific papers?

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone. Usually these aren't high-...
1
vote
1answer
113 views

Ramifications of including "localhost" in the subject alternative field of a x509 certificate?

Are we inviting any problems if we add localhost and 127.0.0.1 to the subject alternative name field of an x509 certificate? We are still trusting the appropriate root CA, but relaxing the rules of ...
0
votes
2answers
62 views

How to reliably identify a certificate as intermediate certificate?

As per the title, is there a way to reliably identify a certificate as an intermediate certificate? I can identify if a certificate is a root certificate. But i can not tell the difference between an ...
3
votes
3answers
146 views

TLS: Verify server certificate before sending client certificate?

I am wondering if there is any harm in having a TLS client send its certificate to a server before having established trust with that server. I have found a similar question, however that mostly ...
1
vote
1answer
60 views

Software signing : multiple certificates

I'm quite new to the cryptography field, and I'm trying to understand a few things: I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below: I'm ...
0
votes
0answers
60 views

Is the RSA Public Key size always the same as the private key size? [duplicate]

When working with x509 certificates and a public and private key pair, let's say you generate a private key that is 4096 bits. Is it possible to have a public key that is only 2048 bits then? Or are ...
1
vote
1answer
142 views

How may I check if an expired certificate was valid at the time?

I have an old let's encrypt (but disregard that, it could be any) certificate that is no longer active. How may I check if it was valid at the time?
0
votes
2answers
161 views

Do X.509 Certificate Serial Numbers Change When A Cert Is Renewed?

Do X.509 certificate serial numbers change when a certificate is renewed? I understand the thumbprint changes, but I am unsure about the serial number. I suspect so since it's a new cert, but if you ...
0
votes
0answers
49 views

Is it required to have the subject name also in the subject alternative name?

From the rfc5280 it's a bit unclear to me if the subject name needs to be repeated in the Subject Alternative Name (SAN). The RFC says "addition" or "in place". So it could be both?...
0
votes
0answers
16 views

SSL connection establishment where only client has a certificate [duplicate]

Consider a situation, where an end-point owns a certificate and wants to establish a connection to another end-point w.o a certificate. In ssl context, the end-point starting the connection is named ...
0
votes
1answer
48 views

What sort of RSA private key format is this and how are they generared [duplicate]

I am used to seeing a regular private key, with the standard key block, but I just came across this type which carries extra information as you can see. What format is this and how are these generated ...
0
votes
0answers
54 views

In the context of the NSS certutil tool -t "trustargs" option, what is a "peer certificate"?

The NSS "certutil" tool specifies the -t trustargs option, and allows the administrator to declare certificates as a "peer certificate" or a "trusted peer certificate" as ...
0
votes
1answer
473 views

Obtaining .p12 certificate from PEM file and CRT file provided by GoDaddy

A few months ago a colleague who left generated a CA certificate from GoDaddy. I am not sure the exact steps he took but currently we would like to install the CA certificate on a server to fully ...
0
votes
0answers
51 views

Can a client with x509 certificate and server side validation of ip-address and deviceId considered a trusted system for less secure login method?

we are working on an web application in which users needs to be able to switch easily between user accounts while working on the same computer. The idea is to have: a strong login (email,password) ...
0
votes
0answers
45 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
6
votes
3answers
1k views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
0
votes
1answer
56 views

Generating a DER-encoded DSA public key of a particular file size

I am reverse engineering a binary that contains a raw, DER-encoded X.509 certificate containing a DSA public key. I want to replace this certificate with one that I have generated so that I have ...
2
votes
1answer
164 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
2
votes
1answer
117 views

Is it possible to use X509 to verify other information, like a vacination?

Background: Germany has decided to implement the proof of vacination for Corona based on 5 Blockchains. It's supposed to be anonymus and safe and the verification could hapen with a QR-Code. My Idea: ...
0
votes
0answers
96 views

Windows X.509 certificate private keys lost

Have the same certificates installed on several machines, but this happens on only one of them. The certificates are self-signed certificates. The certificates are used for WCF message security. ...
0
votes
0answers
33 views

Can a man-in-the-middle replay a valid X.509 certificate? [duplicate]

Consider the following scenario: M (who will later be the man-in-the-middle) connects via https to bank.com. He saves the X.509 certificate (or certificate chain) received from bank.com. Alice ...
0
votes
1answer
356 views

Exporting a JKS entry to X509 certificate - why public key differs?

There is a JKS file containing an entry named "mycert": https://filebin.net/l93faa9qa3rkt32h Password is test123 Based on the following screenshot, mycert has a public key (RSA 2048 bits) ...
11
votes
4answers
2k views

Is it possible to update the contact info (FN/LN, OU, Organization,..) of a certificate?

When creating a self-signed certificate you are asked to enter some information (First Name, Last Name, Organization Unit, Organization, City, State,...). Is it possible to update any of those fields ...
0
votes
1answer
109 views

openssl SubjectDN parameter, abbreviaton of argument keys and how to add extra ones

openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter. The parameter accepts a string of slash-delimited values in the form of: "/...
2
votes
1answer
90 views

X509 certification and communication

I am having trouble understanding the concept of X509 encryption and its application to web service communication. The situation is that I (client) would like to communicate with another party (server)...
1
vote
0answers
65 views

Real world X.509 v2 certificate examples?

Just out of curiosity, could you provide (old) real world X.509 v2 certificate examples that include the deprecated (in some version of X.509) and forbidden (in RFC 5280) issuerUniqueIdentifier or ...
1
vote
1answer
213 views

What client-cert validation can be gleaned from DNS/reverse DNS lookup?

I'm learning about X509 certs used in client-cert authentication to https endpoints. I have a nice Python script that checks many facets of the client-cert. Is there any validation that can be ...
17
votes
4answers
4k views

Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?

I'm learning about X509 certs used in client-cert authentication to https endpoints. If I have an OCSP checker (Python script that creates, submits, decodes OCSP responses), do I need to check the not-...
0
votes
2answers
132 views

Approach to authorizing users and X.509 certificates

I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
0
votes
0answers
48 views

Using fields in X.509 cert for authorization [duplicate]

I understand that X.509 certificates are used for authentication. How can I use the information provided in an X.509 certificate for authorization? For example, are there any fields in the certificate ...
0
votes
0answers
141 views

OpenSSL: how to download full certificate chain

I have the following X509 certificate in PEM format: -----BEGIN CERTIFICATE----- MIIHsTCCBZmgAwIBAgIQKopxYDq6VHRa7GfyxvV6hjANBgkqhkiG9w0BAQsFADCB ...
2
votes
1answer
106 views

Is there a standard order for the X.509 extensions of a certificate?

Is there a standard order for the X.509 extensions of a certificate? For example: [ myca_extensions ] basicConstraints = critical,CA:FALSE keyUsage = digitalSignature,keyEncipherment ...
0
votes
1answer
172 views

Can my Root, Intermediate and SAN certificates have the same serial number?

Can my Root, Intermediate and SAN certificates have the same serial number? The serial number is 00. If the Root, Intermediate and SAN should not have same serial numbers, then should I use the random ...
1
vote
1answer
53 views

Which attribute in DN is commonly used to specify the class/type/usage of certificate/end-entity?

I have a private CA which provides certificates for three types of IoT devices (Type1, Type2 and Type3). On the IoT device certificate's subject DN, which attribute can be used for specifying this ...
0
votes
0answers
354 views

How to generate a X509 certificate with an EC public key and RSA signature using OpenSSL?

I'm trying to generate a X509 certificate with an EC public key but an RSA signature. I'm using OpenSSL like this: openssl genpkey -algorithm EC -out ec256key.pem -pkeyopt ec_paramgen_curve:P-256 -...
0
votes
0answers
124 views

What does LDAP have to do with X.509 Certificates

I'm working with certificates programmatically through .NET. I usually give the certificate a DN by giving it string like this: "c=eg,s=cairo,st=Nozha,cn=Foo Ltd.,..” But there is another way to ...
1
vote
1answer
89 views

Is there any 100% transparent way to set up client side TLS certs from a web browser?

Edit #2: It seems the answer to Q#1 is "No" (which suggests I would need to look for some other solution, which is something I can do on my own, please don't spend time making suggestions ...
1
vote
1answer
87 views

Which factor of authentication is an X.509 certificate

Given 3 factors of authentication: Type 1: something you know Type 2: something you have Type 3: something you are Which factor of authentication would be an X.509 certificate, assuming this ...
17
votes
4answers
4k views

CRL over HTTPS: is it really a bad practice?

On the Internet, I can find several statements done over the years claiming that serving a X.509 CRL over HTTPS is a bad practice because either it causes a chicken-and-egg problem when checking for ...
1
vote
1answer
259 views

Make openssl list root CA certificate

I want openssl to list entire cert chain, including root CA, when executing: openssl s_client -showcerts -connect host:443 However, this is not the case. Depth 2 cert root CA cert is not included: ...
1
vote
1answer
175 views

MD5 as X.509 Signature hash algorithm with TLS 1.2 and SChannel

Is it correct that TLS 1.2 prohibits MD5 as a Signature hash algorithm in X.509 certificates used? Is this just an SChannel + TLS 1.2 limitation? Trying to find any webpage/documentation that is ...
1
vote
1answer
267 views

Should hashing algorithm used for X.509 certificate's signing match the algorithm used in the communication

I've seen this but the related answers don't answer my question. For TLS 1.2 is the hashing algorithm specified in an X.509 certificate's cipher suite used for the signature inside the certificate or ...

1
2 3 4 5
9