Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
3
votes
2answers
61 views

x509 restrict the intermediate CA to sign only end user certificates

I am trying to restrict the intermediate CA to sign only end user certificates. However, I am not able to do so. Man page of x509v3_config says basicConstraints=critical,CA:TRUE, pathlen:0 A CA ...
0
votes
2answers
57 views

Does a X.509 Certificate contain an ID of the Private Key?

Does a X.509 Certificate contain some kind of ID that is associated with the Private Key that was used to create the Certificate? So if i had a database of all my Private Key IDs, i could then look at ...
0
votes
1answer
51 views

Get a key values mismatch when export cert and key from PKCS#12

I have a PKCS #12 file and want to export certificates and private key from the PKCS #12 file with openssl. openssl pkcs12 -in test.p12 -nocerts -out key.pem openssl pkcs12 -in test.p12 -out certs.pem ...
0
votes
0answers
23 views

Mysql SSL Type property for mysql.user

In Mysql database, I have a user for which in mysql.user table I have ssl_type set as X509 and there is no password. Is this a security risk? According to https://www2.navicat.com/manual/online_manual/...
1
vote
1answer
60 views

CRL date formats and conversion from GMT to epoch

I am running few security algorithms on my product and would like know few general details about the CRLs (Certificate Revocation Lists). I am using the following command openssl asn1parse -inform DER ...
2
votes
0answers
36 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
0
votes
2answers
92 views

Why is the x509 standard for certificates called “x509”? What is meaning behind “x” and/or “509”?

X509 is the name of the standard which defines Public Key Infrastructure and the format of SSL/TLS Certificates. My question is: What does x509 mean?
0
votes
0answers
48 views

SAN is getting replaced into CSR with CA's SAN

I am using the following command to create a certificate sign request file. openssl.exe req -new -key clinetkey.pem -out client.csr" -config client_cacert.cnf where client_cacert.cnf has the ...
1
vote
0answers
36 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
1
vote
2answers
84 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
0
votes
1answer
103 views

JWK with X.509 Certificate - is self signed okay?

I'm working with a client that, in order to use their OAuth 2.0 web API, requires me to provide them with a JSON Web Key (JWK) that contains an embedded X.509 certificate. Then, when I'm requesting ...
0
votes
2answers
56 views

Does end entity SSL Certificates need to be re-keyed periodically to improve security?

Is it necessary to periodically re-key end entity SSL certificates apart from typical scenarios like Key lost/key compromise? What benefits does it provides in terms of security and others? Is there ...
0
votes
1answer
58 views

Are The ca Policy Values In the OpenSSL Configuration File Applied When Both Creating AND Signing Certificates?

Are the 'ca' policy values that are present in the OpenSSL configuration file applied when the 'ca' command is used to create a certificate AND when the 'ca' command is used to sign an existing ...
0
votes
1answer
131 views

pfx file encryption algorithm

This seems like it should easily documented but I am unable to find. My c# code does this to create a pfx file. X509Certificate2 cert = store.Certificates.Find(X509FindType.FindByThumbprint, ...
0
votes
1answer
156 views

X.509 - How Is Certificate Chain of Trust “Subject Name”-“Issuer Name” Match Comparison Made?

I keep reading that in an X.509 certificate chain of trust that the "Issuer Name" in a certificate that has been signed by the Issuer must "match" the "Subject Name" of ...
4
votes
0answers
131 views

Where can I find a list of all government agencies with CAs in PKI root stores?

Is there a source that monitors popular root stores for CAs controlled by government agencies? There are several "root stores" that maintain a list of trusted root CAs. These root stores are ...
0
votes
1answer
62 views

Where are field names of decoded human readable X.509 certificates specified?

The ASN.1 module for X.509 certificates as specified in RFC 5912 - Section 14 is as follows: TBSCertificate ::= SEQUENCE { version [0] Version DEFAULT v1, serialNumber ...
2
votes
1answer
69 views

How to fully view cross-signed certificate signatures

Long story short: Security scan raised a flag about a cert, found that it was an expired root on a cross-signed cert. Yadda yadda, updated intermediates, fixed issue. However, I noticed that openssl ...
2
votes
2answers
94 views

Can public keys in digital certificates be used to verify name of certificate holder?

I recently had a conversation with a teacher who argued that in a digital certificate (x509), the public key is used to verify the name of the certificate holder. From my understanding, there are ...
0
votes
1answer
57 views

Process and order of verification of a X.509 certificate chain

While going through the rfc5280 Certificate Path Validation to understand how the X.509 certificate chain is validated, I found out that the X.509 path processing Algorithm processes the chain in an ...
1
vote
0answers
75 views

openSSL shows a revoked certificate as secure

I downloaded a revoked certificate from the website https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/. Specifically, the revoked certificate of the site https://revoked-rsa-ev....
3
votes
2answers
810 views

is the certificate signature a hash of just the public key?

Is the X.509 Certificate Signature an encrypted hash of just the public key or is it a hash of more then the just the key?
2
votes
2answers
161 views

keyUsage Extensions on a Certificate Authority

I have a question about what key usage should I choose when creating a private CA (root or subordinate). I have inspected some root and issuing web certificate authorities and they tend to use ...
0
votes
1answer
105 views

How does client verify the certificate provided by the server which is signed by different intermediate CA

I am creating a c++ secure client-server application using openssl library. I am still not clear about some aspects of the SSLHandshake procedure I have enabled Mutual TLS in-order verify the both ...
0
votes
0answers
49 views

Why is /cacerts request necessary in RFC 7030 Enrollment Over Secure Transport?

In RFC 7030 Enrollment Over Secure Transport (EST) https://tools.ietf.org/html/rfc7030, the /cacerts request (Section 4.1 of RFC 7030) is used by the client to request the current CA certificates. The ...
24
votes
3answers
4k views

Why don't folks seem to use ECC for TLS root certificate signature?

I looked around, and all I see is websites using RSA2048 for Root signature, and a few using ECC for encryption. Are there any reasons folks don't seem to use ECC for TLS root signature? Are there ...
3
votes
0answers
138 views

How does Cloudflare negotiate its server certificate?

When I access https://example.com on my company's laptop that has a X509 client certificate installed, using my home internet connection, without using a VPN, the requested page is signed using the ...
1
vote
1answer
233 views

What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?

As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA. Loading my CA ...
0
votes
1answer
78 views

How to add subject alternative name when converting PEM certificate to DER format?

Is it possible to add a subject alternative name when converting PEM certificate to DER format. openssl x509 -outform der -in Certificate.pem -out Certificate.der -extensions SAN -subject-alternative-...
0
votes
1answer
108 views

When will CMP be part of OpenSSL? [closed]

CMP means Certificate Management Protocol. CMP for OpenSSL is currently a fork of OpenSSL. Do you know when it will be part of OpenSSL? https://github.com/mpeylo/cmpossl
1
vote
1answer
356 views

openssl: does -keyform engine enables accessing TPM persistent handles with any key arguments ? Even with third party plugin like CMP?

If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ? Will it work with extensions, like CMP for OpenSSL, for ...
0
votes
1answer
259 views

Differences in certificate verification between ssl libraries

I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and ...
0
votes
1answer
136 views

Why generate dedicated issuer CA for TSU certificates?

I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME ...
3
votes
2answers
91 views

Client Certificates from Public Certificate Authorities

I'm looking into mutual TLS authentication for a B2B API. Is it possible to use mutual TLS authentication using X.509 certificates while relying on Public CAs? I see that some Public CAs (from CA/...
2
votes
1answer
222 views

Can I concatenate multiple x509 certificates?

I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. ...
0
votes
0answers
189 views

RDP with self-signed cert requiring password before launching display

I've noticed that the search engine Shodan grabs screenshots from hosts running an RDP service, even if they offer a certificate. To my understanding, the certificate is used to authentify the server,...
4
votes
1answer
249 views

OCSP invalidation of intermediate CA using OCSP_SIGNING

I'm implementing an OCSP server to answer OCSP requests for my custom CA. I already implemented the invalidation of leaves certificates, with the intermediate CA certificate signing the OCSP response,...
0
votes
1answer
174 views

SSL certificate with IP

I have an embedded device and it is running a https server. This device will be accessed from a standard web browser using the IP address. I am generating a TLS certificate. I have added a commonName (...
1
vote
1answer
111 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
0
votes
2answers
87 views

Can you make a device certificate expire after the root certificate?

I have created a CA root certificate and a device certificate to go on my device signed by the CA certificate. My question is as follows: Can you make the device certificate last for 30 years, and ...
26
votes
2answers
5k views

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well?

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well? What about for certificates issued by an authority beneath it? For example, if root ...
0
votes
1answer
72 views

Is it possible to fabricate x.509 certificate with varying issuer and subject fields?

I'm testing a service that might not do a proper checks for the certificate chain but instead it checks issuer and subject fields only. I would need to create a (self signed?) certificate with ...
3
votes
3answers
188 views

Sharing an expired certificate?

Today one of our certificates expired and I needed to order a new one. When collecting all the data needed to create a new one, I got the idea that all needed information is already contained in the ...
0
votes
1answer
364 views

Where precisely are client X509 certificates stored?

Apologies for what might seem like a naive question, but there is a detail to PKI architecture between clients and servers, the answer to which I have so far not been able to come across no matter ...
0
votes
1answer
656 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
1
vote
0answers
118 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
0
votes
3answers
126 views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
1
vote
1answer
70 views

Feedback for self-signed certificates setup for custom product auth?

HW (linux) <---Eth---> Official PC (win,mac,linux) | | ----> Man-in-the-middle eavesdrop I'm looking to prevent an unauthorized party inside the ...
0
votes
0answers
58 views

percentage of X.509 certs using rsaEncryption as publicKey algorithm

Quoting 2017_TLS_Telemetry_Report.pdf: Not surprisingly, 2048-bit keys now protect 90% of the world’s TLS hosts. The use of 4096-bit keys have quadrupled, as a share of hosts, but we expect it to ...
1
vote
0answers
18 views

What would happen to the connection when certificate expires? [duplicate]

We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure) The expiry date of the certificate is 3 years from now. Once the ...

1
2 3 4 5
8