Questions tagged [x.509]
X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.
448
questions
0
votes
0
answers
23
views
How do I create a certificate with subject containing Octet string?
I need to create a certificate with:
subject.attribute1: 2.5.4.3 {Common Name} UTF8String
subject.attribute2: 2.5.4.92 {tagAFI} OCTET STRING
subject.attribute3: 0.9.2342.1920.0300.100.1.1 {userId} ...
0
votes
1
answer
60
views
Certification path building for 509 certificates
To this date, is there a specification or a de-facto industry standard or how applications are supposed to perform certification path building in the context of X.509? I am specifically asking about ...
- 1
0
votes
1
answer
57
views
How to resolve an issue with potential mismatch between device certificate and CA certificate?
I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
- 103
0
votes
0
answers
87
views
openssl x509 -sigopt algorithms and options list?
Per the OpenSSL 3.1 documentation for the x509 subcommand, the -sigopt flag allows one to pass signing options. The documentation for that flag currently states:
-sigopt nm:v
Pass options to the ...
- 163
0
votes
1
answer
166
views
Why is a v3 extension needed for a X.509 certificate to be used to test HTTPS on localhost?
I'm learning how to test HTTPS locally and found that articles written before ca. 2019 (e.g., 1, 2, 3) contain only a few steps, whereas later posts (e.g., 4, 5, 6, 7, 8, 9) always make sure that v3 ...
- 129
1
vote
0
answers
48
views
Best practice of x.509 client certificates accross multiple systems
I have several MongoDB's where I use x.509 Certificates to Authenticate Clients
Let's say I create certificate and user for admin:
subject: CN=admin
issuer: CN=MongoDB Issuing CA
-> db.createUser({...
0
votes
0
answers
57
views
Limit the intermediate CA to be trusted only on one host
I'm exploring PKI and reached the following issue -
I'm generating root CA for an organization and intermediate CA per every user (unique).
But then it hit me that essentially any user (Alice) in the ...
- 101
0
votes
1
answer
65
views
x509 chain verification which fields are sufficient
To perform the chain verfiction between rootCA, IssueCA, endentity CA which fields should be common, Note: doing through code, not from command line.
Below is the extracted part from generated certs, ...
- 161
0
votes
0
answers
64
views
Error when validating certificate
I created a certificate signed by an intermediate CA that is signed by root CA following an online tutorial.
Reference to tutorial that I followed: https://www.golinuxcloud.com/openssl-create-...
0
votes
0
answers
38
views
Are X.509 certificates tied to a particular operation [duplicate]
I am looking to create a X.509 certificate to encrypt a payload (plaintext) (using Hybrid encryption) and send it across to a server. Can I create a SSL/TLS X.509 certificate and use that to do the ...
- 1
24
votes
4
answers
6k
views
What's the point of certificates in SSL/TLS?
A valid certificate cannot guarantee that I'm not being MITM'd right now, as either the private key or CA may have been compromised. For this reason, I have to contact a CA through CRL/OCSP to check ...
- 549
2
votes
1
answer
272
views
Can we use a custom non-x.509 cert for TLS?
I know TLS normally uses a x.509 certificate. But is it possible to use a non-x.509 cert to do TLS if both the server and client understand the format of that certificates?
- 141
0
votes
1
answer
558
views
How to add additional information to Certificate Signing Request (CSR)?
I would like to generate a Certificate Signing Request (CSR) and add additional custom information in it.
The standard CSR fields are common name, country, organization, organizational unit, etc.
Is ...
- 11
0
votes
1
answer
78
views
How to get OpenSSL to keep subj intact between x509 CSR and certificate
When creating my own root CA, intermediate CA and server certificate I would like to add a contentType=X to the subject line of all three x509 certificates.
On the root that appears to be working with:...
- 111
1
vote
0
answers
49
views
x509 certificate verification issue [closed]
Having issue with x509 certificate verification.
Steps I followed.
Generated the root certificate.
created the Intermediate certificate.
signed the Intermediate certificate with root certificate.
...
- 161
4
votes
1
answer
153
views
How can I ensure that a CSR doesn't rely on a revoked private key
CRL lists the revoked certificates of a CA by sending back to the user the Serial Number of each certificate, nothing related to the public key. I don't know how it works for OCSP.
Is there a ...
- 661
0
votes
0
answers
124
views
TPM tss2 certificate signing request sign by CA
I am trying to sign certificate by CA which generated by CA. But I am facing below error code while singing.
Generate certificate:
# tpm2tss-genkey -a rsa -s 2048 mykey
# openssl req -new -engine ...
- 113
1
vote
0
answers
898
views
SSL handshake failure | Client hello(success) -> Server ACK (success) -> server RST (connection closed)
I was running MQTT broker in my pc and tried to connect to it via mqtt client in same PC. using x509 cert for mutual tls. SSL Handshake was failing with RST from server. This was happening only in my ...
- 11
0
votes
0
answers
138
views
SSL/x509 certificate/public key expiration [duplicate]
I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
- 1
0
votes
0
answers
12
views
Setting up OID for the CSR and the CA [duplicate]
I am currently trying to setup a Apache2 Server with the prompt to have a specific OID which is this one:
The CSR generation with the OID works with the -addext flag:
But i have Problems with the ...
0
votes
2
answers
394
views
Keys vs Certificate & x509 vs GPG
I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG.
Where I get lost is how the certificate comes into play and what ...
- 3
0
votes
1
answer
166
views
How to get a CA into a Trust Chain
I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service).
I intend to send the attestation bundle alongside public keys and ...
- 1
2
votes
1
answer
148
views
Determine if the client certificate comes from a smarcard in mTLS [closed]
I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
- 31
0
votes
2
answers
393
views
A DNS that has been eliminated is still resulting in X.509 Certificate Subject CN Does Not Match the Entity Name
I ran a Nexpose scan on a DNS that no longer resolves and a vulnerability was found : X.509 Certificate Subject CN Does Not Match the Entity Name
I don't know why it's still producing a vulnerability ...
0
votes
1
answer
1k
views
Connecting to company VPN issues a failed certificate verification
As one can see on the screenshot below, connecting to the company VPN via FortiClient issues a X509 verify certificate failed.
I have informed the CIO who is the security person as well but it is not ...
- 101
1
vote
1
answer
249
views
Digital Signature Generation
In short, I need to place a Digital Signature into slot 9c of my Yubikey. If you generate the certificate from the Yubikey; then the private key is not exportable. So I'm attempting to generate the ...
- 11
1
vote
1
answer
44
views
Distrusting a cross signed certificate
Consider the following scenario
OpenSSL and x.509v3 is used.
You have 2 CA's: CA1 and CA2. Both CA's have cross signed each other,
meaning CA1 has signed CA2 and CA2 has signed CA1.
When CA1 signed ...
- 88
2
votes
1
answer
681
views
How to create and embed Signed Certificate Timestamp (SCT) in certificate
I have deployed a Certificate Transparency (CT) log server that uses Google's CTFE (named "certificate-transparency-go" on Github) and Trillian Projects. And I have issued a pre-certificate, ...
- 33
0
votes
2
answers
311
views
What can happen if lifetime info is not included into an X.509 certificate?
When a certification authority generates a signature, but if the message to be signed does not include the lifetime information (period of validity), what can happen in terms of security being ...
- 3
3
votes
1
answer
185
views
Name Constraints, empty sets in permitted subtree (RFC 3280 vs RFC 5280)
I'm trying to understand the effect of empty sets in permittedSubtrees in both, RFC 5280 and RFC 3280. There is something that doesn't compile in my head.
Scenario:
We have a CA certificate with the ...
- 6,222
2
votes
2
answers
88
views
What happens when you ignore HTTPS warning?
I’m setting up a router at home, and I just created a CA and signed a cert with it. The first time I navigated to the router console, I was greeted with the familiar scary Safari warning about ...
- 21
6
votes
1
answer
184
views
What is the best practice for relying parties to selectively trust certificates in a corporate pki hierarchy?
I have a pki infrastructure for internal company use.
In this pki there are multiple registration authorities whose responsibility is to.
receive certificate issuance requests
verify the identity of ...
0
votes
1
answer
670
views
application of key usage extension
I understand how Key Usage Extension of x.509 certificate works. I have gone through the Key Usage section of RFC5280 and I know of all the valid values and what they mean.
But what I don't understand ...
1
vote
1
answer
437
views
How can I recover the full certificate chain knowing the final X.509 certificate?
Given
Final X.509 certificate A in PEM format.
Access to the certificate store of the server, which encloses all certificates, including singing chain for the certificate A.
OpenSSL shows following ...
- 161
1
vote
1
answer
169
views
Best practice for "stateOrProvinceName" in certificate
In RFC-4519 stateOrProvinceName is abbreviated to ST. Should we assume that it is best practice to put ST=<name-of-state> in the certificate if the state or province is indicated? After all X-...
- 4,633
1
vote
0
answers
99
views
Is it must to have "Key Usage" extension in the selfsigned root certificate?
I have gone through multiple questions but still I am confused. RFC X.509 also does not clarify it.
Conforming CAs MUST include this extension in certificates that
contain public keys that are ...
- 131
1
vote
2
answers
337
views
How can I prevent non-SAN TLS certificates from bypassing name constraints?
I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints.
However, even if I create the CA with restrictions on DNS names as well as ...
- 113
0
votes
1
answer
433
views
How to protect private key for client cert in machine store? Is it acceptable for it to be exportable?
Is it acceptable to store a client cert's private key as exportable in the computer's certificate store?
I have a .NET desktop app that installs client certificates in local machine\personal. The ...
- 125
1
vote
1
answer
269
views
Why do the X.509 certificates need the public key?
I am currently reading about X.509 certificates from RFC 5280 and there is a thing in section 3.1 that I cannot understand. It says:
Users of a public key require confidence that the associated ...
- 11
4
votes
1
answer
2k
views
Difference between -CAfile and -trusted in OpenSSL verify
openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual:
-CAfile <FILE>
A file of trusted certificates. The file ...
- 173
1
vote
0
answers
40
views
Role of public and private keys of client certificate in mTLS [duplicate]
I'm curious to know how mTLS works in more detail in regard to client authentication.
Firstly, I issued 3 certificates: root CA, server and client. The last two are signed with the root CA.
Secondly, ...
- 143
0
votes
1
answer
370
views
Client authentication using X509 certificates behind the scenes
In my application I've successfully implemented client authentication using X509 certificates
Here's what I've done:
Issued a self-signed CA root certificate with a private key
Issued a web-server ...
- 143
1
vote
1
answer
303
views
Why does Microsoft SmartScreen require OV certificates to be signed by a trusted CA?
Signing your applications with an OV code signing certificate enables them to build reputation together in Microsoft SmartScreen, rather than each binary building reputation separately. This allows ...
- 243
1
vote
2
answers
89
views
Avoid re-encrypting persisted cipher texts when using certificates
An application uses RSA to encrypt small texts before persisting in database, using public key of the end node of the application. Only these end nodes must be able to decrypt thge ciphers and only ...
- 13
0
votes
1
answer
160
views
mTLS Client Authentication by Signing Arbitrary Message using Browser
this is my first post here in the area of security and encryption. I will try to be succinct, and let you know that I am not an expert in security.
Context: My client (visitor) has an X509 ...
- 101
2
votes
3
answers
849
views
Can a SHA2 x509 cert thumbprint be spoofed/specified?
Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control.
Supposing someone was able to view the thumbprint of a cert ...
- 125
1
vote
2
answers
662
views
What happens if one certificate path is valid while the other one is not?
I have recently figured out that Lets Encrypt provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it ...
- 2,267
0
votes
1
answer
639
views
X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature
I have the following from Google's public certs for verifying JWT ID
-----BEGIN CERTIFICATE-----
MIIDHDCCAgSgAwIBAgIIW4K0b18ff70wDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE
...
- 172
0
votes
0
answers
347
views
Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?
We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate.
With help of old article oscp-must-staple I managed to create CRA with ...
0
votes
1
answer
296
views
How should I securely rsync to a host with a self-signed certificate on a private network?
I have a backup server that has a self-signed certificate (x509) and another server on the same network. I would like to rsync data to the backup server from the other server. However, I prefer not to ...
- 3