Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
0
votes
0answers
55 views

How should I sign a CSR using a signature created in HSM, in C# .NET Core? [migrated]

I'm exhausted after looking for an answer for 3 days. I don't know if my suggested flow is wrong or my Google skills have really deteriorated. My API needs to create a valid certificate from a CSR it ...
0
votes
1answer
44 views

Are The ca Policy Values In the OpenSSL Configuration File Applied When Both Creating AND Signing Certificates?

Are the 'ca' policy values that are present in the OpenSSL configuration file applied when the 'ca' command is used to create a certificate AND when the 'ca' command is used to sign an existing ...
0
votes
1answer
52 views

pfx file encryption algorithm

This seems like it should easily documented but I am unable to find. My c# code does this to create a pfx file. X509Certificate2 cert = store.Certificates.Find(X509FindType.FindByThumbprint, ...
0
votes
1answer
80 views

X.509 - How Is Certificate Chain of Trust “Subject Name”-“Issuer Name” Match Comparison Made?

I keep reading that in an X.509 certificate chain of trust that the "Issuer Name" in a certificate that has been signed by the Issuer must "match" the "Subject Name" of ...
4
votes
0answers
105 views

Where can I find a list of all government agencies with CAs in PKI root stores?

Is there a source that monitors popular root stores for CAs controlled by government agencies? There are several "root stores" that maintain a list of trusted root CAs. These root stores are ...
0
votes
1answer
54 views

Where are field names of decoded human readable X.509 certificates specified?

The ASN.1 module for X.509 certificates as specified in RFC 5912 - Section 14 is as follows: TBSCertificate ::= SEQUENCE { version [0] Version DEFAULT v1, serialNumber ...
2
votes
1answer
59 views

How to fully view cross-signed certificate signatures

Long story short: Security scan raised a flag about a cert, found that it was an expired root on a cross-signed cert. Yadda yadda, updated intermediates, fixed issue. However, I noticed that openssl ...
2
votes
2answers
81 views

Can public keys in digital certificates be used to verify name of certificate holder?

I recently had a conversation with a teacher who argued that in a digital certificate (x509), the public key is used to verify the name of the certificate holder. From my understanding, there are ...
0
votes
1answer
43 views

Process and order of verification of a X.509 certificate chain

While going through the rfc5280 Certificate Path Validation to understand how the X.509 certificate chain is validated, I found out that the X.509 path processing Algorithm processes the chain in an ...
1
vote
0answers
68 views

openSSL shows a revoked certificate as secure

I downloaded a revoked certificate from the website https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/. Specifically, the revoked certificate of the site https://revoked-rsa-ev....
3
votes
2answers
793 views

is the certificate signature a hash of just the public key?

Is the X.509 Certificate Signature an encrypted hash of just the public key or is it a hash of more then the just the key?
2
votes
2answers
116 views

keyUsage Extensions on a Certificate Authority

I have a question about what key usage should I choose when creating a private CA (root or subordinate). I have inspected some root and issuing web certificate authorities and they tend to use ...
0
votes
1answer
46 views

How does client verify the certificate provided by the server which is signed by different intermediate CA

I am creating a c++ secure client-server application using openssl library. I am still not clear about some aspects of the SSLHandshake procedure I have enabled Mutual TLS in-order verify the both ...
0
votes
0answers
45 views

Why is /cacerts request necessary in RFC 7030 Enrollment Over Secure Transport?

In RFC 7030 Enrollment Over Secure Transport (EST) https://tools.ietf.org/html/rfc7030, the /cacerts request (Section 4.1 of RFC 7030) is used by the client to request the current CA certificates. The ...
23
votes
3answers
4k views

Why don't folks seem to use ECC for TLS root certificate signature?

I looked around, and all I see is websites using RSA2048 for Root signature, and a few using ECC for encryption. Are there any reasons folks don't seem to use ECC for TLS root signature? Are there ...
3
votes
0answers
112 views

How does Cloudflare negotiate its server certificate?

When I access https://example.com on my company's laptop that has a X509 client certificate installed, using my home internet connection, without using a VPN, the requested page is signed using the ...
1
vote
1answer
141 views

What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?

As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA. Loading my CA ...
0
votes
1answer
73 views

How to add subject alternative name when converting PEM certificate to DER format?

Is it possible to add a subject alternative name when converting PEM certificate to DER format. openssl x509 -outform der -in Certificate.pem -out Certificate.der -extensions SAN -subject-alternative-...
0
votes
1answer
86 views

When will CMP be part of OpenSSL? [closed]

CMP means Certificate Management Protocol. CMP for OpenSSL is currently a fork of OpenSSL. Do you know when it will be part of OpenSSL? https://github.com/mpeylo/cmpossl
1
vote
1answer
231 views

openssl: does -keyform engine enables accessing TPM persistent handles with any key arguments ? Even with third party plugin like CMP?

If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ? Will it work with extensions, like CMP for OpenSSL, for ...
0
votes
1answer
198 views

Differences in certificate verification between ssl libraries

I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
0
votes
1answer
123 views

Why generate dedicated issuer CA for TSU certificates?

I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME ...
3
votes
2answers
73 views

Client Certificates from Public Certificate Authorities

I'm looking into mutual TLS authentication for a B2B API. Is it possible to use mutual TLS authentication using X.509 certificates while relying on Public CAs? I see that some Public CAs (from CA/...
2
votes
1answer
147 views

Can I concatenate multiple x509 certificates?

I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. ...
0
votes
0answers
136 views

RDP with self-signed cert requiring password before launching display

I've noticed that the search engine Shodan grabs screenshots from hosts running an RDP service, even if they offer a certificate. To my understanding, the certificate is used to authentify the server,...
4
votes
0answers
180 views

OCSP invalidation of intermediate CA using OCSP_SIGNING

I'm implementing an OCSP server to answer OCSP requests for my custom CA. I already implemented the invalidation of leaves certificates, with the intermediate CA certificate signing the OCSP response,...
0
votes
1answer
149 views

SSL certificate with IP

I have an embedded device and it is running a https server. This device will be accessed from a standard web browser using the IP address. I am generating a TLS certificate. I have added a commonName (...
1
vote
1answer
89 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
0
votes
2answers
86 views

Can you make a device certificate expire after the root certificate?

I have created a CA root certificate and a device certificate to go on my device signed by the CA certificate. My question is as follows: Can you make the device certificate last for 30 years, and ...
26
votes
2answers
4k views

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well?

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well? What about for certificates issued by an authority beneath it? For example, if root ...
0
votes
1answer
61 views

Is it possible to fabricate x.509 certificate with varying issuer and subject fields?

I'm testing a service that might not do a proper checks for the certificate chain but instead it checks issuer and subject fields only. I would need to create a (self signed?) certificate with ...
3
votes
3answers
182 views

Sharing an expired certificate?

Today one of our certificates expired and I needed to order a new one. When collecting all the data needed to create a new one, I got the idea that all needed information is already contained in the ...
0
votes
1answer
260 views

Where precisely are client X509 certificates stored?

Apologies for what might seem like a naive question, but there is a detail to PKI architecture between clients and servers, the answer to which I have so far not been able to come across no matter ...
0
votes
1answer
524 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
1
vote
0answers
113 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
0
votes
3answers
109 views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
1
vote
1answer
57 views

Feedback for self-signed certificates setup for custom product auth?

HW (linux) <---Eth---> Official PC (win,mac,linux) | | ----> Man-in-the-middle eavesdrop I'm looking to prevent an unauthorized party inside the ...
0
votes
0answers
57 views

percentage of X.509 certs using rsaEncryption as publicKey algorithm

Quoting 2017_TLS_Telemetry_Report.pdf: Not surprisingly, 2048-bit keys now protect 90% of the world’s TLS hosts. The use of 4096-bit keys have quadrupled, as a share of hosts, but we expect it to ...
1
vote
0answers
18 views

What would happen to the connection when certificate expires? [duplicate]

We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure) The expiry date of the certificate is 3 years from now. Once the ...
2
votes
0answers
149 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
1
vote
0answers
224 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
0
votes
0answers
488 views

Converting a raw EC public key into EVP_PKEY using openssl

I am trying to convert a raw EC key and EVP_PKEY structure. The process seems straightforward but am running into issues. Here is the code I am using -- unsigned char tmpPubKey[] = { 0x04, ...
0
votes
2answers
605 views

Convert CSR to self-signed x509 Certificate

Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive ...
0
votes
1answer
75 views

Server to Server Communication RSA or x509 Certificate

I want to build Server (My) to Server (Other Client parties) web service and I want to add security layer for client verification. Do I need to force clients to create x509 Certificates or RSA key ...
5
votes
1answer
209 views

Should TLS clients put a limit on certificate chain depth?

Specifcally, when configuring nginx to validate proxy target SSL certificates (which it mystifyingly does not do by default), a maximum cert chain depth must be specified in the proxy_ssl_verify_depth ...
0
votes
1answer
2k views

X509 “Serial Number of certificate” vs serial number attribute in Issuer and Subject?

Is the serial number attribute of an X509 certificate Issuer or Subject, as defined in RFC5280, required to be the same as the Serial Number of the issuing or subject certificate? It seems quite ...
2
votes
1answer
285 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
3
votes
0answers
87 views

Examples for use of encipheronly and decipheronly bits in the keyUsage field of a X.509 certificate

I am requesting for real life example of using the encipheronly or decipheronly bits together with the keyAgreement bit in the keyUsage field of a X.509 certificate. The RFC 5280 specifies about these ...
2
votes
1answer
83 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
2
votes
2answers
628 views

Is SubjectAlternativeName in X.509 always used for DNS Names?

X.509 certificates as of RFC5280 offer the two fields "Subject" and "Subject Alternative Name" that can be used to describe the Subject of the certificate (e.g. a Domain example.com). Section 4.2.1.6 ...

1
2 3 4 5
8