Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
1
vote
1answer
34 views

Software signing : multiple certificates

I'm quite new to the cryptography field, and I'm trying to understand a few things: I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below: I'm ...
0
votes
0answers
53 views

Is the RSA Public Key size always the same as the private key size? [duplicate]

When working with x509 certificates and a public and private key pair, let's say you generate a private key that is 4096 bits. Is it possible to have a public key that is only 2048 bits then? Or are ...
1
vote
1answer
111 views

How may I check if an expired certificate was valid at the time?

I have an old let's encrypt (but disregard that, it could be any) certificate that is no longer active. How may I check if it was valid at the time?
0
votes
2answers
75 views

Do X.509 Certificate Serial Numbers Change When A Cert Is Renewed?

Do X.509 certificate serial numbers change when a certificate is renewed? I understand the thumbprint changes, but I am unsure about the serial number. I suspect so since it's a new cert, but if you ...
0
votes
0answers
39 views

Is it required to have the subject name also in the subject alternative name?

From the rfc5280 it's a bit unclear to me if the subject name needs to be repeated in the Subject Alternative Name (SAN). The RFC says "addition" or "in place". So it could be both?...
0
votes
0answers
15 views

SSL connection establishment where only client has a certificate [duplicate]

Consider a situation, where an end-point owns a certificate and wants to establish a connection to another end-point w.o a certificate. In ssl context, the end-point starting the connection is named ...
0
votes
1answer
36 views

What sort of RSA private key format is this and how are they generared [duplicate]

I am used to seeing a regular private key, with the standard key block, but I just came across this type which carries extra information as you can see. What format is this and how are these generated ...
0
votes
0answers
29 views

In the context of the NSS certutil tool -t “trustargs” option, what is a “peer certificate”?

The NSS "certutil" tool specifies the -t trustargs option, and allows the administrator to declare certificates as a "peer certificate" or a "trusted peer certificate" as ...
0
votes
1answer
148 views

Obtaining .p12 certificate from PEM file and CRT file provided by GoDaddy

A few months ago a colleague who left generated a CA certificate from GoDaddy. I am not sure the exact steps he took but currently we would like to install the CA certificate on a server to fully ...
0
votes
0answers
34 views

Can a client with x509 certificate and server side validation of ip-address and deviceId considered a trusted system for less secure login method?

we are working on an web application in which users needs to be able to switch easily between user accounts while working on the same computer. The idea is to have: a strong login (email,password) ...
0
votes
0answers
32 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
6
votes
3answers
830 views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
0
votes
1answer
40 views

Generating a DER-encoded DSA public key of a particular file size

I am reverse engineering a binary that contains a raw, DER-encoded X.509 certificate containing a DSA public key. I want to replace this certificate with one that I have generated so that I have ...
2
votes
1answer
102 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
2
votes
1answer
89 views

Is it possible to use X509 to verify other information, like a vacination?

Background: Germany has decided to implement the proof of vacination for Corona based on 5 Blockchains. It's supposed to be anonymus and safe and the verification could hapen with a QR-Code. My Idea: ...
0
votes
0answers
71 views

Windows X.509 certificate private keys lost

Have the same certificates installed on several machines, but this happens on only one of them. The certificates are self-signed certificates. The certificates are used for WCF message security. ...
0
votes
0answers
27 views

Can a man-in-the-middle replay a valid X.509 certificate? [duplicate]

Consider the following scenario: M (who will later be the man-in-the-middle) connects via https to bank.com. He saves the X.509 certificate (or certificate chain) received from bank.com. Alice ...
0
votes
1answer
99 views

Exporting a JKS entry to X509 certificate - why public key differs?

There is a JKS file containing an entry named "mycert": https://filebin.net/l93faa9qa3rkt32h Password is test123 Based on the following screenshot, mycert has a public key (RSA 2048 bits) ...
11
votes
4answers
2k views

Is it possible to update the contact info (FN/LN, OU, Organization,..) of a certificate?

When creating a self-signed certificate you are asked to enter some information (First Name, Last Name, Organization Unit, Organization, City, State,...). Is it possible to update any of those fields ...
0
votes
1answer
60 views

openssl SubjectDN parameter, abbreviaton of argument keys and how to add extra ones

openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter. The parameter accepts a string of slash-delimited values in the form of: "/...
2
votes
1answer
75 views

X509 certification and communication

I am having trouble understanding the concept of X509 encryption and its application to web service communication. The situation is that I (client) would like to communicate with another party (server)...
1
vote
0answers
45 views

Real world X.509 v2 certificate examples?

Just out of curiosity, could you provide (old) real world X.509 v2 certificate examples that include the deprecated (in some version of X.509) and forbidden (in RFC 5280) issuerUniqueIdentifier or ...
1
vote
1answer
125 views

What client-cert validation can be gleaned from DNS/reverse DNS lookup?

I'm learning about X509 certs used in client-cert authentication to https endpoints. I have a nice Python script that checks many facets of the client-cert. Is there any validation that can be ...
17
votes
4answers
4k views

Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?

I'm learning about X509 certs used in client-cert authentication to https endpoints. If I have an OCSP checker (Python script that creates, submits, decodes OCSP responses), do I need to check the not-...
0
votes
2answers
96 views

Approach to authorizing users and X.509 certificates

I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
0
votes
0answers
48 views

Using fields in X.509 cert for authorization [duplicate]

I understand that X.509 certificates are used for authentication. How can I use the information provided in an X.509 certificate for authorization? For example, are there any fields in the certificate ...
0
votes
0answers
101 views

OpenSSL: how to download full certificate chain

I have the following X509 certificate in PEM format: -----BEGIN CERTIFICATE----- MIIHsTCCBZmgAwIBAgIQKopxYDq6VHRa7GfyxvV6hjANBgkqhkiG9w0BAQsFADCB ...
2
votes
1answer
73 views

Is there a standard order for the X.509 extensions of a certificate?

Is there a standard order for the X.509 extensions of a certificate? For example: [ myca_extensions ] basicConstraints = critical,CA:FALSE keyUsage = digitalSignature,keyEncipherment ...
0
votes
1answer
86 views

Can my Root, Intermediate and SAN certificates have the same serial number?

Can my Root, Intermediate and SAN certificates have the same serial number? The serial number is 00. If the Root, Intermediate and SAN should not have same serial numbers, then should I use the random ...
1
vote
1answer
41 views

Which attribute in DN is commonly used to specify the class/type/usage of certificate/end-entity?

I have a private CA which provides certificates for three types of IoT devices (Type1, Type2 and Type3). On the IoT device certificate's subject DN, which attribute can be used for specifying this ...
0
votes
0answers
206 views

How to generate a X509 certificate with an EC public key and RSA signature using OpenSSL?

I'm trying to generate a X509 certificate with an EC public key but an RSA signature. I'm using OpenSSL like this: openssl genpkey -algorithm EC -out ec256key.pem -pkeyopt ec_paramgen_curve:P-256 -...
0
votes
0answers
43 views

What does LDAP have to do with X.509 Certificates

I'm working with certificates programmatically through .NET. I usually give the certificate a DN by giving it string like this: "c=eg,s=cairo,st=Nozha,cn=Foo Ltd.,..” But there is another way to ...
1
vote
1answer
73 views

Is there any 100% transparent way to set up client side TLS certs from a web browser?

Edit #2: It seems the answer to Q#1 is "No" (which suggests I would need to look for some other solution, which is something I can do on my own, please don't spend time making suggestions ...
1
vote
1answer
75 views

Which factor of authentication is an X.509 certificate

Given 3 factors of authentication: Type 1: something you know Type 2: something you have Type 3: something you are Which factor of authentication would be an X.509 certificate, assuming this ...
16
votes
4answers
3k views

CRL over HTTPS: is it really a bad practice?

On the Internet, I can find several statements done over the years claiming that serving a X.509 CRL over HTTPS is a bad practice because either it causes a chicken-and-egg problem when checking for ...
1
vote
1answer
141 views

Make openssl list root CA certificate

I want openssl to list entire cert chain, including root CA, when executing: openssl s_client -showcerts -connect host:443 However, this is not the case. Depth 2 cert root CA cert is not included: ...
1
vote
1answer
129 views

MD5 as X.509 Signature hash algorithm with TLS 1.2 and SChannel

Is it correct that TLS 1.2 prohibits MD5 as a Signature hash algorithm in X.509 certificates used? Is this just an SChannel + TLS 1.2 limitation? Trying to find any webpage/documentation that is ...
1
vote
1answer
151 views

Should hashing algorithm used for X.509 certificate's signing match the algorithm used in the communication

I've seen this but the related answers don't answer my question. For TLS 1.2 is the hashing algorithm specified in an X.509 certificate's cipher suite used for the signature inside the certificate or ...
3
votes
2answers
272 views

x509 restrict the intermediate CA to sign only end user certificates

I am trying to restrict the intermediate CA to sign only end user certificates. However, I am not able to do so. Man page of x509v3_config says basicConstraints=critical,CA:TRUE, pathlen:0 A CA ...
0
votes
3answers
189 views

Does a X.509 Certificate contain an ID of the Private Key?

Does a X.509 Certificate contain some kind of ID that is associated with the Private Key that was used to create the Certificate? So if i had a database of all my Private Key IDs, i could then look at ...
0
votes
1answer
159 views

Get a key values mismatch when export cert and key from PKCS#12

I have a PKCS #12 file and want to export certificates and private key from the PKCS #12 file with openssl. openssl pkcs12 -in test.p12 -nocerts -out key.pem openssl pkcs12 -in test.p12 -out certs.pem ...
0
votes
0answers
56 views

Mysql SSL Type property for mysql.user

In Mysql database, I have a user for which in mysql.user table I have ssl_type set as X509 and there is no password. Is this a security risk? According to https://www2.navicat.com/manual/online_manual/...
1
vote
1answer
94 views

CRL date formats and conversion from GMT to epoch

I am running few security algorithms on my product and would like know few general details about the CRLs (Certificate Revocation Lists). I am using the following command openssl asn1parse -inform DER ...
2
votes
0answers
41 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
0
votes
2answers
161 views

Why is the x509 standard for certificates called “x509”? What is meaning behind “x” and/or “509”?

X509 is the name of the standard which defines Public Key Infrastructure and the format of SSL/TLS Certificates. My question is: What does x509 mean?
0
votes
0answers
65 views

SAN is getting replaced into CSR with CA's SAN

I am using the following command to create a certificate sign request file. openssl.exe req -new -key clinetkey.pem -out client.csr" -config client_cacert.cnf where client_cacert.cnf has the ...
1
vote
0answers
48 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
1
vote
2answers
91 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
0
votes
3answers
509 views

JWK with X.509 Certificate - is self signed okay?

I'm working with a client that, in order to use their OAuth 2.0 web API, requires me to provide them with a JSON Web Key (JWK) that contains an embedded X.509 certificate. Then, when I'm requesting ...
0
votes
2answers
58 views

Does end entity SSL Certificates need to be re-keyed periodically to improve security?

Is it necessary to periodically re-key end entity SSL certificates apart from typical scenarios like Key lost/key compromise? What benefits does it provides in terms of security and others? Is there ...

1
2 3 4 5
9