Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 655

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

5
votes
If some bad guy steals the private key of a CA that your computer trusts, then he will be able to issue fake certificates for arbitrary server names, and your computer will accept them as the genuine …
answered Jul 22 '13 by Thomas Pornin
5
votes
"Unexportable" means that the dedicated functions from the operating system will refuse to export the private key. However, it is of course there; this is just software, so the private key, when used, …
answered Feb 5 '13 by Thomas Pornin
4
votes
so-called PKCS#7 (CMS) object. CMS was never meant to convey certificates (it is an encryption and signature format) but it is traditional to use it to send a certificate and a set of "helper … certificates" (intermediate CA for its validation). Some CA generate the private key themselves (on the CA side), and, in that case, the private key must be sent to the requester; usually, a PKCS#12 (aka PFX …
answered Jul 10 '15 by Thomas Pornin
8
votes
to have its own policy with regards to how old a CRL can become before becoming "too old". Yet a RP cannot guess when a new CRL will be available for all possible CA; we use certificates precisely …
answered Apr 14 '14 by Thomas Pornin
2
votes
What you are describing is actually your own, reduced auto-update feature, limited to updating what amounts to a "trust store" for certificates. The bad thing about it is that it works outside of …
answered Apr 18 '14 by Thomas Pornin
5
votes
validate certificates emitted by both. The two CA are now really one, at least as far as trust is concerned. A divorce would require revoking both cross-certificates, or at least failing to issue new ones … when the cross-certificates expire. (In practice, this kind of things happens when a new CA is created but is "morally" a replacement for the old one; or when a merger occurs between two businesses and they try to fuse their internal computer systems together.) …
answered Feb 17 '15 by Thomas Pornin
7
votes
Big CA are supposed to implement thorough controls to prevent or at least detect wrongly issued certificates. Procedures applied by Verisign are described in their certification practice statement … procedures for launching a nuclear attack, and, frankly, I think that a few hundred nuclear warheads are just a tad more worrisome than a couple fake certificates. …
answered Mar 1 '13 by Thomas Pornin
4
votes
The Web browser is indeed supposed to complain loudly if the intended server name (the one from the target URL) does not appear at a suitable place in the server certificate (normally as a Subject Alt …
answered Jun 11 '15 by Thomas Pornin
6
votes
'). Commercial CA can sell you a certificate with the cA flag set to true, but this will typically not be cheap. "Normal" certificates (the ones which can be afforded by individuals) have the cA flag set to … false. Note that up to circa 2003, Internet Explorer was failing to verify the cA flag, and your scheme would have worked. This was a huge security hole, of course, because anybody could then act as a pseudo-CA and issue certificates with any name in it. …
answered Sep 21 '12 by Thomas Pornin
3
votes
There is nothing wrong with "wildcard certificates". A wildcard certificate is equivalent to a certificate containing a lot of possible server names. If this maps well to your problem (e.g. you have … a server with a lot of frontends who advertise distinct names, but all these names are in the same domain and you control that domain), then wildcard certificates are certainly a possibility. The main …
answered Aug 14 '13 by Thomas Pornin
21
votes
Your particulars are wrong (it is not a problem of encryption per se) but you have the right general idea. In SSL/TLS, the client first connect to the server and sends a "ClientHello" message stating …
answered Jan 10 '12 by Thomas Pornin
6
votes
binding. The Wikipedia page on "implicit certificates" (pointed to by @Clayton) describes a concept where the public key algorithm is such that the public key, the key owner name, and the signature from … public key. ID-based crypto is "better" than implicit certificates because it allows public key usage out of the blue. Consider for instance the problem of sending an encrypted email to somebody …
answered Jun 23 '14 by Thomas Pornin
3
votes
semantics are not altered by the criticality. Since all reasonable HTTPS clients (and servers, when they request client certificates) support the SAN extension, making it critical changes absolutely nothing. …
answered Jan 14 '14 by Thomas Pornin
13
votes
The official reason why certificates expire is because of revocation. A certificate is "revoked" when its issuer asserts that the certificate contents are no longer to be trusted, for some reason … CRL are signed (usually by the CA) and people who use certificates (e.g. Web browsers, for SSL server certificates) are supposed to automatically download the newest CRL to see whether the certificate …
answered Aug 12 '13 by Thomas Pornin
2
votes
It is normal, expected and actually recommended that big sites use several certificates. Google is huge and has many servers around the world; DNS and routing are done in such a way that, on average … client, you may observe several of these certificates, in particular if you "move" (in the network world, your work office and your home can be quite far from each other). Other situations which …
answered Aug 12 '13 by Thomas Pornin

15 30 50 per page