Questions tagged [x.509]

X.509 is a standard for a public key infrastructure used for authentication and access control. X.509 specifies standard formats for certificates, revocation lists, attribute certificates, and path validation.

Filter by
Sorted by
Tagged with
6
votes
1answer
388 views

OpenSSL Certificate Expiry

I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL ...
1
vote
1answer
1k views

Should I use the certificate serial number or the subject key identifier to look up public key?

I'm designing an API authentication mechanism similar to the one AWS use. As part of that, I need to look up which public key belongs to which user to verify. The public keys come from x509 ...
1
vote
0answers
142 views

Distribution of a public key with a dotnet client application?

I have a pretty good understanding of X509 cryptography etc, from my career in the smart card industry. So I know that the card scheme (e.g. Visa, MasterCard) is the highest level of trust - they sign ...
2
votes
2answers
15k views

How to identify which root CA does the client certificate use?

How can we identify which root CA client used when there are multiple root CAs on the server? We can compare the public keys of the client certificate and the root certificate but if we have many ...
4
votes
3answers
1k views

Do serial numbers for X.509 certs need to be strictly sequential or can they be timestamps?

Serial numbers need to be unique for X.509 certs. But do they need to be strictly sequential or is making them equal to the time that the cert was generated sufficient?
4
votes
2answers
5k views

OpenSSL x509: Is there an order in subjectName fields?

Is there an order to respect in subjectName field when creating a x509 certificate with OpenSSL command? In other words, what are all possibilities of displaying subjectName of x509 certificate in ...
3
votes
2answers
1k views

Gmail X.509 certificate chain

I have asked about this on several forums but never got a straight answer. If the root certificate on a certificate chain has a different fingerprint to the root certificate available for download on ...
3
votes
0answers
717 views

How to generate “CRL numbers” for X.509 CRL

(Context: I'm working a process to publish a CRL periodically -- eg once every day.) With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to ...
2
votes
1answer
140 views

is x509 certificate signed by ca valid?

I've got certificate 'sample cert' which is valid to '2015-12-31' but it was signed by root CA certificate. But when it was signing CA cert was valid to 2015-06-30'. So my question is, is today (2015-...
3
votes
1answer
9k views

Create PKCS7 signature, signed by X.509 CA, which embeds an XML file

I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within. How to do that with OpenSSL or any other tool?
6
votes
2answers
2k views

Difference between public key and private key validity period

In the section about certificate extensions, the ITU-T X.509 recommendation writes: The private key corresponding to a certified public key is typically used over a different period from the ...
7
votes
2answers
2k views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
2
votes
0answers
77 views

Potential hazards for reusing an X.509 private key for multiple services?

One thing I've been thinking about for a while is using a X.509 private key stored in a hardware security device (think YubiKey et al) on a one-per-machine basis. Theoretically, it should be possible ...
3
votes
1answer
5k views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
4
votes
1answer
330 views

Cross-certification between worlds like X.509 and PGP?

Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
3
votes
1answer
1k views

How common are UTF8 strings in X509

In theory, names in X509 certs are defined as: CHOICE { teletexString TeletexString (SIZE (1..ub-state-name)), printableString PrintableString (SIZE (1..ub-state-name)), universalString ...
0
votes
1answer
99 views

Validating the ROA certificate

Suppose I have a system, where the server requires the clients to attach their ROA certificate to prove that they have the right to that IP Prefix. Now if the client attaches the ROA certificate ( ...
3
votes
1answer
449 views

RemoveFromCRL and DeltaCRL

I have a question about DeltaCRL with an entry which contains RemoveFromCRL reason. At the start, PKI has revoked the certificate with certificateHold reason. And create next CRL: Last Update: May ...
1
vote
1answer
60 views

TLS Certificates only for Clients

I'm aware that sites like StartSSL use Client-Certificates, I opened mine in Firefox and it showed me: "SSL-Client-Certificate", "E-Mail-Receiver-Certificate", "E-Mail-Signer-Certificate". Now I'm ...
1
vote
2answers
2k views

Is there any use in an AIA Extension in a Certificate directly issued by a Root CA?

While most documentation I've read states that there is no requirement to have the AIA extension in a self-signed Root certificate (logical enough), I can't find anything that tells me not to do so in ...
3
votes
1answer
232 views

Limiting a CA to only issue valid certificates to internal web sites and clients

What are the possible defense measures that can be applied to a simple PKI (no intermediate CAs, etc.) used to authenticate clients and servers over TLS on an internal network only? Certificates ...
3
votes
1answer
256 views

Security Structure of an API

I've been developing a web application and APIs for 8 months. I implemented OAuth 2.0 client credentials for authentication. And now I have to implement TLS to my APIs. I've been dealing with SSL/TLS ...
2
votes
2answers
582 views

Is the private key the only entropy in a X509 certificate?

Specifically, if I preserve the private key can I reproduce the exact same (self-signed) certificate at any time? The use case I have is a server-to-server protocol that allows (even encourages) self-...
10
votes
3answers
2k views

Allowing the public to generate a CSR from your private key

As a hosting provider, I'd like to make the process of generating a certificate for a customer's domain as convenient as possible. I was pondering creating a webpage where anyone could: generate a ...
2
votes
1answer
5k views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
6
votes
1answer
979 views

Is Man-In-The-Middle necessary for a CA to read HTTP plaintext?

Although I understand the basic theory behind certificates and asymmetric cryptography, I'm not quite sure on the details of the X.509 protocol. I'm wondering what attacker model a given CA requires ...
13
votes
2answers
12k views

What is the difference of TrustManager PKIX and SunX509?

Java's JSSE provides two different TrustManagers: PKIX and SunX509 I tried to find out what the differences between both are, but couldn't find any in the documentation. Can you tell me the ...
2
votes
1answer
124 views

Embed root certificate in software library

I am developing a network communication software library that uses handshaking similar to STARTTLS to enable upgrading to TLS security. I will be embedding a custom critical OIN policy into the ...
1
vote
2answers
518 views

How to be sure laptop's trusted certificates are safe

I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification authorities\...
4
votes
1answer
299 views

Why there is a signed hash in Certificate request (.csr file)?

I wonder why there is a hash signed by private key in the CSR? It does prove that I have the private key that belongs to the public key in the .csr. But who cares whether I actually do possess the ...
3
votes
2answers
5k views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a certificate?...
22
votes
1answer
11k views

Relationship between RSA, Diffie-Hellman Key Exchange, PKI and X.509?

I am getting confused with RSA, Diffie-Hellman Key Exchange, PKI and X.509v3. I took a look of RSA's mathematics algorithm, it seems like a encryption algorithm, right? Generating public key and ...
1
vote
0answers
1k views

Guidance on Login using Digital Signature DSC (PKCS12 and x509 certificate)

I'm interesting in exploring possibility to authenticate user using their Digital Certificate. The methodology is to first register the DSC from the user and keep their Public key along with Serial ...
4
votes
1answer
10k views

Sign PKCS#7 and verify PKCS#7 signature with OpenSSL

If someone have to transfer X.509 certificates in a single bundle, usually, it is recommended to pack them into PKCS#7. And content of PKCS#7 can be signed. OpenSSL allows to pack certificates into ...
1
vote
1answer
540 views

Generating x509 PEM files for testing PEM parser

I need to test a parser of PEM formatted certificates. Thus, I need to generate many variations including variations that are invalid for various reasons. Obviously I can use openssl or a library like ...
0
votes
1answer
493 views

Obtain X.509 Certificate Fingerprint from Certificate Info

I would like to obtain the SHA1/MD5 fingerprint of an X.509 certificate in order to compare it with the one presented by a server before connecting. However, I currently don't have access to the ...
3
votes
1answer
1k views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...
0
votes
1answer
682 views

Why do private networks use both X.509 and User/Password authentication

For example, the school network I am on requires both a name & password to log in along with having its X.509 certificate installed in my browser. Why does it need both? Shouldn't name and ...
3
votes
3answers
826 views

How to determine if an X.509 certificate is a renewal of another known certificate?

In my application, the human user accepts the server's X.509 certificate, verifying the fingerprint during the first-time connection. The fingerprint is stored in the client software. At later ...
0
votes
2answers
391 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
0
votes
2answers
1k views

cross-signed end-entity certificates: usage in apache/openssl/gnutls

A previous question, What is the use of cross signing certificates in X.509? described cross-signed certificates well. I have a situation where the clients trust CA1 xor CA2, and both need to reach a ...
56
votes
2answers
99k views

What's the difference between X.509 and PKCS#7 Certificate?

Am I correct calling file with .p7b file extension saved as 'Cryptographic Message Syntax Standard - PKCS#7 Certificates (.P7B)' in Windows - a 'PKCS#7 certificate'? Or is it better called 'X.509 ...
11
votes
2answers
13k views

Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?

we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
3
votes
1answer
1k views

using commonName for DNS vs subjAltName

According to https://stackoverflow.com/a/26195101/569976#comment41093099_26195101 "[Using the DNS name as the common name is] deprecated by both the IETF and CA/B Forums, and it should not be done. ...
0
votes
2answers
1k views

How are “Certificate Signing” key usage certificates restricted to what domains they can sign?

Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate ...
1
vote
1answer
68 views

Can I sign a new certificate with a previously paid for certificate [duplicate]

For the last few months, I have been using self signed certificates to provide ssl for a system that I have been building. We are now getting ready to start getting external users on the system, but ...
12
votes
2answers
17k views

Recommended key usage for a client certificate

My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicates with the server to a path that requires a ...
2
votes
2answers
1k views

The reason to insert Subject Alternative Names into CA certificate

I am trying to understand meaning of the Subject Alternative Name extension. The reason of usage it in SSL X.509 certificates or other end-entities certificates is mostly clear for me. However, I ...
0
votes
2answers
851 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
14
votes
2answers
9k views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...

1
3 4
5
6 7