3
Does saying yes on prompt automatically means that Im trusting the certificate and Ive verified the fingerprint through some OOB means?
Correct, so it's the user's responsibility to verify that these are the correct certificates.
And also, the Hashing and encryption is done for the whole certificate content or just the public key of the CA server?
It's ...
2
... achieve 2 way mutual TLS authentication in this case without installing TLS key pair
...
Obviously you cannot do authentication with a client certificate without having a client certificate installed. But you basically face the same problem with any other authentication method: if you want to authenticate each agent then somehow you have to setup each ...
2
@ecdsa gave a great answer, I'll try to answer in a different way.
Question: Once the device gets the CA certificate from the CA server, how does the device verify that its the right server from the fingerprint?
Does saying yes on prompt automatically means that Im trusting the certificate and Ive verified the fingerprint through some OOB means?
And also, ...
1
Individual ciphers are preferable to monoliths.
The idea of using SANs makes sense if you have, for example, one web server which takes care of several smaller websites (e.g. example.com and internal.example.com). In this case, having one certificate per web server, with SANs for each website reduces the amount of configuration overhead.
However, once you ...
1
It is common for code signing certificates to be hardware backed, since in the past there was lots of misuse by stolen code signing certificates. Hardware backing a certificate means that the actual hardware needs to be present when signing. The signing itself happens on the hardware itself, i.e. the private key never leaves the hardware. The hardware is ...
1
There are a few options that you may have available:
You can check to see which sites have been potentially MITM'd by checking the cert tree for each site you visit. Click the lock icon, view the cert, then look at the issuing certs until you get to the root. If the root is the state root that you installed, then they very well could be monitoring any of ...
1
There are some other elements to cert chain verification besides signature verification.
It was already mentioned that TLS certificates for websites are checked to be sure that the domain name in the cert matches the domain name invoked by the browser. Other things that should be checked are the Basic Constraints should be not a CA, the key usage ...
Only top voted, non community-wiki answers of a minimum length are eligible
