Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
2
votes
0answers
43 views

OCSP invalidation of intermediate CA using OCSP_SIGNING

I'm implementing an OCSP server to answer OCSP requests for my custom CA. I already implemented the invalidation of leaves certificates, with the intermediate CA certificate signing the OCSP response,...
0
votes
1answer
45 views

SSL certificate with IP

I have an embedded device and it is running a https server. This device will be accessed from a standard web browser using the IP address. I am generating a TLS certificate. I have added a commonName (...
1
vote
1answer
53 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
0
votes
2answers
75 views

Can you make a device certificate expire after the root certificate?

I have created a CA root certificate and a device certificate to go on my device signed by the CA certificate. My question is as follows: Can you make the device certificate last for 30 years, and ...
26
votes
2answers
4k views

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well?

If you revoke a certificate authority's certificate, do all of the certificates it issued become invalid as well? What about for certificates issued by an authority beneath it? For example, if root ...
0
votes
1answer
52 views

Is it possible to fabricate x.509 certificate with varying issuer and subject fields?

I'm testing a service that might not do a proper checks for the certificate chain but instead it checks issuer and subject fields only. I would need to create a (self signed?) certificate with ...
3
votes
3answers
175 views

Sharing an expired certificate?

Today one of our certificates expired and I needed to order a new one. When collecting all the data needed to create a new one, I got the idea that all needed information is already contained in the ...
0
votes
1answer
80 views

Where precisely are client X509 certificates stored?

Apologies for what might seem like a naive question, but there is a detail to PKI architecture between clients and servers, the answer to which I have so far not been able to come across no matter ...
0
votes
1answer
101 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
1
vote
0answers
66 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
0
votes
3answers
100 views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
1
vote
1answer
56 views

Feedback for self-signed certificates setup for custom product auth?

HW (linux) <---Eth---> Official PC (win,mac,linux) | | ----> Man-in-the-middle eavesdrop I'm looking to prevent an unauthorized party inside the ...
0
votes
0answers
53 views

percentage of X.509 certs using rsaEncryption as publicKey algorithm

Quoting 2017_TLS_Telemetry_Report.pdf: Not surprisingly, 2048-bit keys now protect 90% of the world’s TLS hosts. The use of 4096-bit keys have quadrupled, as a share of hosts, but we expect it to ...
1
vote
0answers
17 views

What would happen to the connection when certificate expires? [duplicate]

We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure) The expiry date of the certificate is 3 years from now. Once the ...
2
votes
0answers
62 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
1
vote
0answers
178 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
0
votes
0answers
266 views

Converting a raw EC public key into EVP_PKEY using openssl

I am trying to convert a raw EC key and EVP_PKEY structure. The process seems straightforward but am running into issues. Here is the code I am using -- unsigned char tmpPubKey[] = { 0x04, ...
0
votes
2answers
327 views

Convert CSR to self-signed x509 Certificate

Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive ...
0
votes
1answer
52 views

Server to Server Communication RSA or x509 Certificate

I want to build Server (My) to Server (Other Client parties) web service and I want to add security layer for client verification. Do I need to force clients to create x509 Certificates or RSA key ...
4
votes
1answer
131 views

Should TLS clients put a limit on certificate chain depth?

Specifcally, when configuring nginx to validate proxy target SSL certificates (which it mystifyingly does not do by default), a maximum cert chain depth must be specified in the proxy_ssl_verify_depth ...
0
votes
1answer
972 views

X509 “Serial Number of certificate” vs serial number attribute in Issuer and Subject?

Is the serial number attribute of an X509 certificate Issuer or Subject, as defined in RFC5280, required to be the same as the Serial Number of the issuing or subject certificate? It seems quite ...
1
vote
1answer
197 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
3
votes
0answers
57 views

Examples for use of encipheronly and decipheronly bits in the keyUsage field of a X.509 certificate

I am requesting for real life example of using the encipheronly or decipheronly bits together with the keyAgreement bit in the keyUsage field of a X.509 certificate. The RFC 5280 specifies about these ...
2
votes
1answer
64 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
2
votes
2answers
313 views

Is SubjectAlternativeName in X.509 always used for DNS Names?

X.509 certificates as of RFC5280 offer the two fields "Subject" and "Subject Alternative Name" that can be used to describe the Subject of the certificate (e.g. a Domain example.com). Section 4.2.1.6 ...
0
votes
0answers
102 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...
11
votes
1answer
6k views

The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates

I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My ...
2
votes
2answers
329 views

What is being verified in OpenSSL's SSL_get_verify_result

In OpenSSL the following function is used to verify certs. SSL_get_verify_result I looked at the manual here. But it does not detail what is being verified. Can you clarify to me what does this ...
1
vote
0answers
50 views

What is this error for rootca for wrong system time?

Getting this error for openssl smime verify 140392937076368:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:342:Verify error:certificate is not yet valid After ...
0
votes
1answer
91 views

Can rootca validity start date be lower than current date?

What will happen if we create rootca X509 certificate with validity date lower than current date? Will date of creation taken into account while cms_verify? What will happen if we change the system ...
0
votes
1answer
69 views

Is this CA store related to Ubuntu or OpenSSL

I am checking TLS certificates chain validity against CA sore in this path: etc/ssl/certs/ca-certificates.crt I use Ubuntu 18.04 and OpenSSL 1.1.0g. I need to know whether this CAs store is from ...
3
votes
1answer
375 views

How can I use X.509 cross signing to replace a CA?

I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate. I'...
1
vote
0answers
67 views

Is there a compiled list of TEE (Trusted Execution Environment) manufacturer/CA certificates?

I may be misunderstanding TEEs (I just learned about them from an HN post), but I have question regarding the features that seem to allow what seems to be the perfect form of DRM (to my maybe limited ...
1
vote
1answer
76 views

Self-signed CA certificates - Can we throw away the private keys

I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion. I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
1
vote
1answer
406 views

Understanding Microsoft list of disallowed certificates

Microsoft publishes their untrusted certificates as disallowedcerts.stl Warning: direct download. It is ASN.1 encoded. After decoding it there is a list of sequences like so: SEQUENCE { ...
0
votes
2answers
218 views

How to detect if X.509 certificate belongs to CA or regular end user (host)

If I understand correctly in SSL/TLS authenticity validation there are 2 (maybe more) types of certificates according to the following: the ones that belong to CA (these contain the public key that ...
1
vote
0answers
25 views

Root CA and Intermediate CA security [duplicate]

I'm confused how intermediate CA's adds to the security of the PKI. I realize the compromise of root CA key is catastrophic as it would've to be consequently purged from the trust store of every ...
2
votes
2answers
40 views

What is the specific basis that allows an entity to connect a cert chain to a trusted root?

Let's say I want to validate an entity that presents an X509v3 certificate, "Leaf". Leaf is a cert signed by SigningCA. SigningCA's cert, "SigningCert", was signed by RootCA. RootCA's cert, "...
0
votes
1answer
462 views

Limit OpenVPN client certificate to specific VPN with shared CA chain

I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of ...
2
votes
1answer
357 views

Should we use x509 V1 certificate for a new root CA?

I read a couple of articles that kind of gives the impression that the norm is to use a V1 x509 pkc for a root CA. This is one of them. However the rfc5280 makes no such suggestion. My question is, ...
1
vote
1answer
71 views

RelativeDistinguishedName allowed SET items

According to RFC5280, a subject/issuer Name is a sequence of RelativeDistinguishedName, which in turn in a set of AttributeTypeAndValue (see https://tools.ietf.org/html/rfc5280#section-4.1.2.4). ...
1
vote
1answer
51 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
2
votes
1answer
6k views

Subject Alternative Name in Certificate Signing Request apparently does not survive signing

So I have been able to create a Certificate Signing Request with a Subject Alternative Name of the form subjectAltName=IP:1.2.3.4 by following the recipe in a previous (splendid) answer. When I ...
0
votes
1answer
68 views

What is the difference between certificates held by intermediate CAs and those issued by them?

Given that one CA can issue another a certificate so that they can go on and do the same, what would stop someone from using the certificate for their website to issue certificates and become an ...
10
votes
4answers
1k views

Can a revoked certificate be re-instated?

If a certificate is revoked, can it be re-instated, or is the only option to generate a new one?
2
votes
1answer
65 views

Once a certificate has been validated, is it safe to string-match on the issuer field?

First, some background to the question: I have a Pulse Connect Secure VPN appliance in a multi-tenant environment, and I have been approached with the task of supporting certificate authentication (...
1
vote
1answer
149 views

OpenSSL unable to verify certificate issued by local CA

We have an application that issues (and maintains) SSL certificates for various uses. It does this using the Bouncycastle library in .NET. We create a CA cert, and then use this certificate to ...
1
vote
1answer
910 views

How does do client authentication work over https?

I recently wrote an application that calls out to a 3rd party service to perform some work. This 3rd party service requires that I authenticate the client calling by using a client certificate. For ...
1
vote
1answer
75 views

is it possible for an attacker to change a csr in x509?

Is it possible for an attacker to forge a certificate signing request so he will be able to impersonate someone else ? (by stealing the csr before it gets signed and changing it)
0
votes
1answer
268 views

why is it necessary to have both code signing and time stamping certificates?

I have read about the option to create certificates for signing codes and time stamping. why do we need both of them? I understand that it helps me when I need to increase the validity of my code, ...