A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
2
votes
1answer
66 views

Once a certificate has been validated, is it safe to string-match on the issuer field?

First, some background to the question: I have a Pulse Connect Secure VPN appliance in a multi-tenant environment, and I have been approached with the task of supporting certificate authentication (...
1
vote
1answer
155 views

OpenSSL unable to verify certificate issued by local CA

We have an application that issues (and maintains) SSL certificates for various uses. It does this using the Bouncycastle library in .NET. We create a CA cert, and then use this certificate to ...
1
vote
1answer
1k views

How does do client authentication work over https?

I recently wrote an application that calls out to a 3rd party service to perform some work. This 3rd party service requires that I authenticate the client calling by using a client certificate. For ...
1
vote
1answer
77 views

is it possible for an attacker to change a csr in x509?

Is it possible for an attacker to forge a certificate signing request so he will be able to impersonate someone else ? (by stealing the csr before it gets signed and changing it)
0
votes
1answer
280 views

why is it necessary to have both code signing and time stamping certificates?

I have read about the option to create certificates for signing codes and time stamping. why do we need both of them? I understand that it helps me when I need to increase the validity of my code, ...
1
vote
2answers
185 views

Where can I find the specs for the X.509 certificate used in client-authenticated TLS handshake?

The TLS specs define how the handshake between client and server must be performed when the client wants to use a certificate to authenticate itself. There is a lot of documentation onlin that assumes ...
2
votes
0answers
106 views

WCF WS - Passing passwords through service

I am implementing security on a WCF service from basicHttp to WShttp, the issue is the service sends some passwords for connections to the database that the user can define,test and save. The ...
1
vote
1answer
104 views

Is there a way to enforce policies in x509 certificates?

I have noticed there are some policy features in x509 certificates. Are there some ways to enforce these policies in the certificates? For example, let's take a certificate with imaginary oid 1.2.3 ...
1
vote
1answer
112 views

How can I limit which key sizes and signature algorithm of the next certificate in the certificate chain are allowed?

I have walked through the different fields of x509 certificates and came across some fields which enable to limit the usage of the certificate (for example for certain domains). Is it possible to ...
3
votes
1answer
3k views

x.509 certificate-chain signatures verification

Once a client application downloads a leaf certificate file from some entity, issued by a CA, how does the verification of the cert's signatures work? Specifically, I'm not clear on whether a leaf ...
4
votes
1answer
345 views

No attributes in Certificate Request

We use a CA that expects a challengePassword, so I set up a openssl.cnf like this: oid_section = OIDs [ req ] distinguished_name = req_distinguished_name attributes = ...
5
votes
1answer
885 views

Where can I find a canonical list of elliptic curve names and their aliases?

I recently had a problem where I created an EC client certificate which used the sect571k1 curve and I got some strange errors attempting to use it as a client certificate through Mozilla Firefox. It ...
0
votes
2answers
534 views

Self-signed CA and digital signatures

I am asked to design the public key crypto system for an IoT-like devices. These devices are going to be talking to each other over TCP/IP as well as communicating with a cloud-based API server. The ...
2
votes
0answers
1k views

cfssl example certificate chain verification failure

I am getting the following error when trying to verify the certificate chain of a dummy root/intermediary/end PKI. root generated as follows: mkdir {root,inter,end} cfssl print-defaults config > ...
1
vote
1answer
304 views

Remote Private Key for Certificate Authority

Background I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
4
votes
1answer
2k views

S/MIME signing and verification - how do I find proper certificate?

I'm trying to debug a S/MIME signing framework that is functioning wrong. On the input I have a signed message with detached certificate a certificate which private key the message was probably ...
1
vote
1answer
430 views

Impersonating Client Certificate Authentication with Same Subject Name

I am looking into the security of a service which uses client certificates for authenticating only known callers. We run a C# Web API Service that checks every request certificate subject if it is ...
2
votes
1answer
441 views

WinHTTP - Prevent successful handshake if peer certificate is invalid

I am using WinHTTP on a Delphi project to make calls over to the server. Script: userAgent := 'TestClient.exe'; hsession := WinHttpOpen(pwidechar(userAgent), WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, nil,...
3
votes
1answer
247 views

Using NameConstrains in a CA certificate

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart. I have a CA certificate with Name Constrains (RFC): Permitted [1]Subtrees (0..0): ...
1
vote
1answer
1k views

Remove X509v3 extensions from PEM file?

I have a self-signed certificate that was created using makecert on Windows. Now this certificate has to be used by a new application; this new app is using openssl in the background for certificate ...
3
votes
1answer
5k views

Potential False Positive while scanning a network with Nexpose - X509 Certificate mismatch [closed]

Little bit of context, we are seeing this finding a lot. We use wildcard certificates on public facing websites. The finding is titled: "X.509 Certificate Subject CN Does Not Match the Entity ...
2
votes
2answers
511 views

Does x509 have an “issued at” timestamp? Can you tell when an x509 certificate was issued?

The JWT Spec (RFC 7519) has an issued at field ("iat"). Does x509 have any analogous value? I see a Validity field, but nothing else time related.
1
vote
1answer
938 views

Which attributes in the subject of a X.509 certificate from a certificate authority are used as the “identifier”?

I've been trying to follow certificate chains of random websites I visit and see if I do indeed find them in my Windows 10 trusted root certificate authority store. I almost never find an exact match,...
2
votes
1answer
3k views

Is the Extended Key Usage extension mandatory on the web?

Do web servers reject certificates that do not have an extended key usage with TLS WWW Client Authentication set (if client authentication is required)? Similarily, do Browsers reject certificates ...
9
votes
2answers
3k views

Definitions for CRL Reasons

Is there any authoritative definition of the various reasons possible in a CRL file? Section 6.3.2(b) of RFC5280 lists a few: unspecified keyCompromise cACompromise affiliationChanged superseded ...
0
votes
1answer
205 views

Why does Digicert have so many Root Certificates? Which one is right for me?

I'm trying to add a system root certificate to a container that doesn't have any. Digicert is a CA that I've used before, but I've never had to add a root certificate to my system before. Then I ...
1
vote
1answer
208 views

What's the policy of CAs for validity period of certificates?

Let a CA generate a new X.509 certificate for the web. I wonder about the rules for the validity period: (Q1) On what does the validity period depend on ? (Q2) Does it depend on the pricing model ...
0
votes
0answers
9k views

Converting .pem to .key file

I downloaded certificated for my website using letsencrypt: letsencrypt -d crackerscreed.me --manual --preferred-challenges dns certonly The process was successful but the site I want to implement ...
1
vote
2answers
267 views

Can I re-sign SMIME certificates with my own CA?

Many large corporations choose to use their own CA to sign their employee's SMIME certificates. Which is fine for internal use, but they typically expect external users to import their corporate CA ...
0
votes
1answer
337 views

Generate X509 ERR_CERT_COMMON_NAME_INVALID

I am trying to set up https server on python3, but I could not generate a certificate and a key properly. That is the server code: import http.server, ssl server_address = ('localhost', 4443) httpd =...
7
votes
2answers
259 views

Why did RFC 4158 (Path Building) restrict Trust Anchors to self-signed certificates?

I'm having trouble using Wget to download a file over HTTPS from ftp.gnu.org using the Let's Encrypt X3 root. The Let's Encrypt X3 is cross-certified, which means it has an issuer and its not self-...
1
vote
0answers
60 views

Mutual auth client certs for a pool of requesting servers behind a proxy

I've got a situation that is puzzling me. We have a vendor that is requiring mutual authentication when making a request to them. They are requesting we give them a client cert identifying our ...
0
votes
1answer
1k views

Missing 'Key Usage' on a CA certificate: can sign certificates?

In Windows certificate store, an intermediate CA certificate without Key Usage extension is considered eligible (as long as it has isCA flag from Basic Constraints of course) for singing end entity ...
1
vote
1answer
481 views

Not supported critical extensions

I've read the great post written by @Thomas Pornin Which properties of a X.509 certificate should be critical and which not? and it raised my question. STORY: Let's assume that I have a client C ...
0
votes
1answer
885 views

Is it possible to add an x509 extension to a certificate after creation?

I'm under the impression that x509 extensions must be added at certificate creation time. Just want to check that my understanding is correct and that I can not take a certificate after it was created ...
0
votes
1answer
252 views

CA with lower key size than issued certificates

If a root certificate has a 2048 bit key is it correct to assume that if a certificate request signs a request made by a 4096 bit key and generates a certificate that the security has been weakened to ...
4
votes
1answer
3k views

What is the meaning of public key parameter in the X.509 certificate?

While I am checking the fields of X.509 I've noticed there is field called public key parameter and its value is 05, what is the use of this field? I have searched and did not find a clear answer for ...
5
votes
2answers
248 views

Certificate Transparency: Log a legit precertificate and issue a rogue certificate

I'm trying to understand how Certificate Transparency solves the problem with dishonest Certificate Authorities embedding an SCT in their certificates. I understand that the log is append-only, and ...
1
vote
1answer
46 views

File signed with maliciously installed certificate on machine

Let's assume we have a system delivering files (such as updating a program) that are digitally signed with a trusted CA. If an attacker somehow manages to install custom certificate as a trusted ...
70
votes
1answer
10k views

Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com?

The following output shows that google.net is presenting a certificate that has been issued to www.google.com. $ openssl s_client -connect google.net:443 < /dev/null > out.txt 2>&1; cat ...
1
vote
1answer
818 views

Is it possible to create GnuPG keys from a x509 cert/key pair?

I have a digital cert issued by my organization for signing email. It's imported into Thunderbird and the key and cert can be exported to a .p12 from within Thunderbird. I'd like to use the .p12 to ...
1
vote
1answer
787 views

Can an SSL certificate be used to generate a SAML token

An external application (B) requires a SAML token to allow users who log into my application (A) to access it directly without having to log in again. This access is not built yet. My organization has ...
0
votes
1answer
666 views

Self Signed SSL Certificate - How to verify it correctly on the client side?

For our current implementation we are using a self signed root certificate, which then is used to sign ssl certificates for our secure http connection. My question relates to the verification logic ...
1
vote
0answers
89 views

What is a KEA certificate and how it is used?

I'm currently studying IKE and IPsec in the context of VPN applications and I know that a X.509 certificate is used to provide server's public key to the client (and vice-versa in case of mutual ...
2
votes
1answer
820 views

What's the state-of-the-art approach to secure a backend API?

Scope Currently we are developing a backend REST API which is consumed by handful of MVC applications. In this case we are talking only about server-server communication and the API won't be consumed ...
1
vote
1answer
207 views

How is a certificate extension different from a certificate file name extension?

The following article has explained both differently. X.509 wiki Now my question is: Can we use more than one extension in a certificate? Is it how there can be more than one use of extensions in a ...
0
votes
1answer
111 views

Is the windows root trust store used by IE?

With the Symantec-Google drama, it would help to know if the Internet Explorer browser has its own root trust store built in to the browser, or uses the automatically updating Windows System root ...
3
votes
3answers
1k views

ASN.1 encapsulated BITSTRING type in openSSL

I am currently building an ASN.1 parser which supposed to decode X.509v3 certificates and epoch files in ASN.1 DER format. The parser is working well apart from one issue which I couldn't seem to get. ...
1
vote
1answer
133 views

Verification and authentication flow for X509 code-singing certificate

I am developing an embedded devices FW updates (not connected to the internet) and I am using code-signing certificates in order to verify the FW update issuer identity (the FW update is signed with ...
1
vote
2answers
771 views

CA signature algorithm vs certificate public key algorithm

Is there any restriction on the CAs signature algorithm with respect to the public algorithm in the actual server/device certificate? For example, can a ECDHE_ECDSA_* certificate be signed by a CA ...