5
The former is correct, as verified by RFC 2986: PKCS #10: Certification Request Syntax Specification:
The process by which a certification request is constructed involves
the following steps:
1. A CertificationRequestInfo value containing a subject
distinguished name, a subject public key, and optionally a
set of attributes ...
4
This sentence is technically correct, but confusing. The CSR contains the public key. The CA does “create” a public key as an intermediate step in generating the certificate, but all it does is to copy it from the CSR, and then embed it in the certificate.
It's true that the knowledge of the public key doesn't compromise the private key, but the CA never had ...
answered Jul 7 at 12:55
Gilles 'SO- stop being evil'
44.4k13 gold badges103 silver badges158 bronze badges
2
I feel your confusion. From your provided link, I copied the first paragraph:
The Web Services Enhancements for Microsoft .NET (WSE) allows a sender, which can either be an XML Web service or its client, to encrypt portions of the SOAP message by using the public key for the recipient's X.509 certificate. A receiver, which can be either a Web service or its ...
2
Certificates protect against man-in-the-middle attacks, which are already pretty hard to accomplish on the open Internet. The attacker usually needs to either control a router between user and website or the DNS server used by the user. That's not something a wannabe cybercriminal can pull off from their basement. That's something which is usually done by ...
2
This can be simplified with some form of central management, such as using a directory/identity server that speaks LDAP or another protocol. This would only require a single CA in the ecosystem, and it prevents you from needing to set up access controls on each server individually.
On the directory server, each user is added, along with their public key and ...
1
There is already a grace period build in. To cite from digicert:
... Apple announced that beginning Sept. 1, newly issued publicly trusted TLS certificates are valid for no longer than 398 days.
Thus, this is only about certificates issued after Sept. 1. and it does not affect already issued certificates. This also means that there is nothing to worry ...
1
Indeed, a certificate contains a public key plus information about who this public key belongs to. It is impossible to sign with a certificate. But there is a moderately common imprecision which consists of using “certificate” to mean “private key for which a certificate exists”. This is what's going on here. The private key is mathematically related to the ...
answered Jul 15 at 15:49
Gilles 'SO- stop being evil'
44.4k13 gold badges103 silver badges158 bronze badges
1
This is because of the verify command used, signtool verify myfile.exe. When this command is used signtool will use the Windows Driver Verification Policy. In order for the file to verify properly include the /pa switch so that SignTool uses the Default Authentication Verification Policy.
use this command:
signtool verify /pa myfile.exe
Only top voted, non community-wiki answers of a minimum length are eligible
