Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
1 vote
1 answer
99 views

Certification path building for 509 certificates

To this date, is there a specification or a de-facto industry standard or how applications are supposed to perform certification path building in the context of X.509? I am specifically asking about ...
0 votes
1 answer
66 views

Convert PGP key to X.509?

Can I convert a PGP key to X.509, using OpenSSL or GNUPG? Aren't these only container/wrapper formats?
1 vote
3 answers
2k views

JWK with X.509 Certificate - is self signed okay?

I'm working with a client that, in order to use their OAuth 2.0 web API, requires me to provide them with a JSON Web Key (JWK) that contains an embedded X.509 certificate. Then, when I'm requesting ...
25 votes
2 answers
15k views

Relationship between RSA, Diffie-Hellman Key Exchange, PKI and X.509?

I am getting confused with RSA, Diffie-Hellman Key Exchange, PKI and X.509v3. RSA's mathematics algorithm seems like an encryption algorithm, right? Generating public key and private key, using for ...
1 vote
1 answer
355 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
0 votes
2 answers
63 views

Web Browser and server using ECDHE_RSA cypher suite, then what is the use of X.509 certificate public key for?

User Crover has given a very great explanation for this question: RSA or ECDHE for x.509 certificates-what does each do? I have one question to Crover and/or any other member. What I understand from ...
33 votes
1 answer
37k views

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
1 vote
1 answer
314 views

How best to cryptographically sign scientific papers?

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone. Usually these aren't high-...
1 vote
0 answers
60 views

Certify using Yubikey

I just started using a Yubikey 5. I've set up GPG according to this excellent guide, and now I have 3 working ECC key pairs on my Yubikey: Sign/S :: ed25519, Encrypt/E :: cv25519, Authentication/A :: ...
0 votes
1 answer
97 views

How are X.509 certificate revoked?

I would like to know how are X.509 certificates revoked. That is: Say I have an X509 certificate, and I want it to be revoked for whatever reason (e.g., compromise). How do I reach out to the CA? What ...
4 votes
1 answer
192 views

How can I ensure that a CSR doesn't rely on a revoked private key

CRL lists the revoked certificates of a CA by sending back to the user the Serial Number of each certificate, nothing related to the public key. I don't know how it works for OCSP. Is there a ...
2 votes
1 answer
506 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
0 votes
1 answer
163 views

Why does the Public Key Info field in an X509 certificate for EC indicate the algorithm

The Subject Public Key Info field can have a value like ECDSA_P256 or ECDH_P256 when ECC is used. Why is it not sufficient to specify "ECC_P256"? In other words, why is it not enough to ...
0 votes
1 answer
92 views

Does self-signed encryption certificate violate "no multi-use keys" principle?

Say that I have generated an RSA keypair, which I intend to publish only for use with RSA-KEM; I can see that this is provisioned for: The intended application for the key MAY be indicated in the key ...
44 votes
5 answers
49k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
4 votes
1 answer
1k views

Using NameConstrains in a CA certificate

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart. I have a CA certificate with Name Constrains (RFC): Permitted [1]Subtrees (0..0): ...
0 votes
1 answer
97 views

x509 chain verification which fields are sufficient

To perform the chain verfiction between rootCA, IssueCA, endentity CA which fields should be common, Note: doing through code, not from command line. Below is the extracted part from generated certs, ...
0 votes
1 answer
965 views

application of key usage extension

I understand how Key Usage Extension of x.509 certificate works. I have gone through the Key Usage section of RFC5280 and I know of all the valid values and what they mean. But what I don't understand ...
4 votes
1 answer
816 views

OCSP invalidation of intermediate CA using OCSP_SIGNING

I'm implementing an OCSP server to answer OCSP requests for my custom CA. I already implemented the invalidation of leaves certificates, with the intermediate CA certificate signing the OCSP response, ...
0 votes
0 answers
64 views

How do I create a certificate with subject containing Octet string?

I need to create a certificate with: subject.attribute1: 2.5.4.3 {Common Name} UTF8String subject.attribute2: 2.5.4.92 {tagAFI} OCTET STRING subject.attribute3: 0.9.2342.1920.0300.100.1.1 {userId} ...
9 votes
3 answers
30k views

Subject Alternative Name in Certificate Signing Request apparently does not survive signing

So I have been able to create a Certificate Signing Request with a Subject Alternative Name of the form subjectAltName=IP:1.2.3.4 by following the recipe in a previous (splendid) answer. When I ...
1 vote
1 answer
673 views

openssl SubjectDN parameter, abbreviaton of argument keys and how to add extra ones

openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter. The parameter accepts a string of slash-delimited values in the form of: "/...
1 vote
2 answers
8k views

X509 "Serial Number of certificate" vs serial number attribute in Issuer and Subject?

Is the serial number attribute of an X509 certificate Issuer or Subject, as defined in RFC5280, required to be the same as the Serial Number of the issuing or subject certificate? It seems quite ...
1 vote
1 answer
1k views

How to add additional information to Certificate Signing Request (CSR)?

I would like to generate a Certificate Signing Request (CSR) and add additional custom information in it. The standard CSR fields are common name, country, organization, organizational unit, etc. Is ...
0 votes
1 answer
94 views

How to resolve an issue with potential mismatch between device certificate and CA certificate?

I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
0 votes
1 answer
402 views

Why is a v3 extension needed for a X.509 certificate to be used to test HTTPS on localhost?

I'm learning how to test HTTPS locally and found that articles written before ca. 2019 (e.g., 1, 2, 3) contain only a few steps, whereas later posts (e.g., 4, 5, 6, 7, 8, 9) always make sure that v3 ...
0 votes
0 answers
260 views

openssl x509 -sigopt algorithms and options list?

Per the OpenSSL 3.1 documentation for the x509 subcommand, the -sigopt flag allows one to pass signing options. The documentation for that flag currently states: -sigopt nm:v Pass options to the ...
1 vote
0 answers
85 views

Best practice of x.509 client certificates accross multiple systems

I have several MongoDB's where I use x.509 Certificates to Authenticate Clients Let's say I create certificate and user for admin: subject: CN=admin issuer: CN=MongoDB Issuing CA -> db.createUser({...
0 votes
0 answers
86 views

Limit the intermediate CA to be trusted only on one host

I'm exploring PKI and reached the following issue - I'm generating root CA for an organization and intermediate CA per every user (unique). But then it hit me that essentially any user (Alice) in the ...
33 votes
6 answers
70k views

Missing X509 extensions with an openssl-generated certificate

My goal is to create a certificate with opensslsimilar to this one generated with cfssl Certificate: Data: Version: 3 (0x2) Serial Number: 60:44:dc:0d:80:f4:54:55:e8:...
0 votes
0 answers
95 views

Error when validating certificate

I created a certificate signed by an intermediate CA that is signed by root CA following an online tutorial. Reference to tutorial that I followed: https://www.golinuxcloud.com/openssl-create-...
0 votes
0 answers
64 views

Are X.509 certificates tied to a particular operation [duplicate]

I am looking to create a X.509 certificate to encrypt a payload (plaintext) (using Hybrid encryption) and send it across to a server. Can I create a SSL/TLS X.509 certificate and use that to do the ...
1 vote
1 answer
154 views

How to get OpenSSL to keep subj intact between x509 CSR and certificate

When creating my own root CA, intermediate CA and server certificate I would like to add a contentType=X to the subject line of all three x509 certificates. On the root that appears to be working with:...
24 votes
4 answers
6k views

What's the point of certificates in SSL/TLS?

A valid certificate cannot guarantee that I'm not being MITM'd right now, as either the private key or CA may have been compromised. For this reason, I have to contact a CA through CRL/OCSP to check ...
2 votes
1 answer
299 views

Can we use a custom non-x.509 cert for TLS?

I know TLS normally uses a x.509 certificate. But is it possible to use a non-x.509 cert to do TLS if both the server and client understand the format of that certificates?
0 votes
3 answers
3k views

Creating root CA to issue certificates programmatically

I have to generate a self signed root CA and use it to issue to certificates programmatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
3 votes
1 answer
148 views

Is there an imbalance of issuer and responders in OCSP verification?

I'm trying out OCSP verification, and I'm not sure I'm following all that's going on. The requester can send 1-N certificate IDs, each has issuer hashes/serial no. The responder generates the counter-...
1 vote
0 answers
72 views

x509 certificate verification issue [closed]

Having issue with x509 certificate verification. Steps I followed. Generated the root certificate. created the Intermediate certificate. signed the Intermediate certificate with root certificate. ...
0 votes
0 answers
185 views

TPM tss2 certificate signing request sign by CA

I am trying to sign certificate by CA which generated by CA. But I am facing below error code while singing. Generate certificate: # tpm2tss-genkey -a rsa -s 2048 mykey # openssl req -new -engine ...
1 vote
0 answers
1k views

SSL handshake failure | Client hello(success) -> Server ACK (success) -> server RST (connection closed)

I was running MQTT broker in my pc and tried to connect to it via mqtt client in same PC. using x509 cert for mutual tls. SSL Handshake was failing with RST from server. This was happening only in my ...
0 votes
0 answers
208 views

SSL/x509 certificate/public key expiration [duplicate]

I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
1 vote
1 answer
329 views

Digital Signature Generation

In short, I need to place a Digital Signature into slot 9c of my Yubikey. If you generate the certificate from the Yubikey; then the private key is not exportable. So I'm attempting to generate the ...
0 votes
1 answer
249 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
1 vote
2 answers
638 views

Keys vs Certificate & x509 vs GPG

I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG. Where I get lost is how the certificate comes into play and what ...
19 votes
5 answers
10k views

CRL over HTTPS: is it really a bad practice?

On the Internet, I can find several statements done over the years claiming that serving a X.509 CRL over HTTPS is a bad practice because either it causes a chicken-and-egg problem when checking for ...
1 vote
4 answers
1k views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
0 votes
2 answers
4k views

Obtaining .p12 certificate from PEM file and CRT file provided by GoDaddy

A few months ago a colleague who left generated a CA certificate from GoDaddy. I am not sure the exact steps he took but currently we would like to install the CA certificate on a server to fully ...
2 votes
1 answer
224 views

Determine if the client certificate comes from a smarcard in mTLS [closed]

I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
0 votes
1 answer
2k views

Connecting to company VPN issues a failed certificate verification

As one can see on the screenshot below, connecting to the company VPN via FortiClient issues a X509 verify certificate failed. I have informed the CIO who is the security person as well but it is not ...
0 votes
2 answers
755 views

A DNS that has been eliminated is still resulting in X.509 Certificate Subject CN Does Not Match the Entity Name

I ran a Nexpose scan on a DNS that no longer resolves and a vulnerability was found : X.509 Certificate Subject CN Does Not Match the Entity Name I don't know why it's still producing a vulnerability ...

1
2 3 4 5
10