33
Certificate Transparency
The Certificate Transparency standard requires that when a certificate is issued, it should also be submitted to one or more Certificate Logs. These are simple network services that maintain cryptographically assured, publicly auditable, append-only records of certificates. Once a certificate has been added to a Certificate Log, an ...
22
The trust stores of major browsers (at least: Chrome, Firefox, Safari, Edge and Brave) at all cost avoid certificate authorities which could potentially be controlled by governments.
There once was an attempt by the government of Kazakhstan to add their official root certificate to the trust chains. It ultimately failed exactly due to the trust issues. ...
5
Yes, as long as the CA supports ACME. ZeroSSL and BuyPass offer free certificates with ACME. DigiCert seems to support requesting paid certificates through ACME.
To use this, you need to pass extra arguments to certbot, most notably --server.
1
is it possible for them to "add" their signature to my certificate? Would the answer be different with other issuer than Let's Encrypt?
there is nothing you need to do on your end. Remote party must use their own CA to re-sign Let's Encrypt CA certificate. Not yours. This will result in a cross-certificate with:
Issuer matches remote party's CA ...
1
Being a CA means that there is a great deal of trust placed in them. The global CAs present in your browser and OS all follow the CA/Browser Forum rules regarding who they will issue certificates to, how they validate clients, and what kinds of permissions they'll allow on certificates. Very specifically, a global CA will not issue anyone a certificate ...
1
What part of the downloaded certificate indicates that it is a CA's certificate?
A CA certificate can be used to issue other certificates by signing these. This signature is only accepted if the issuing certificate contains the extension CA:true:
X509v3 Basic Constraints: critical
CA:TRUE
If this extensions is not there or not TRUE it ...
1
Here some ideas and options for your network. Hopefully, they can help you manage SSL / TLS with your cameras and devices. The options focus on your Axis cameras but may apply more broadly. However, without specific details on your network certain assumptions may not be accurate. I have no experience with pfsense firewall.
Issue #1: you can automate ...
1
You should not pin the intermediate or leaf certificate in 99.9% of use cases.
Your leaf certificate may be revoked for a multitude of reasons. You might find that you need to revoke the certificate yourself, or that the CA has revoked your certificate due to them finding an operational error. Pinning the leaf certificate has a potential to lock you out of ...
1
I was having trouble with this too. In addition to the other answers, I found a mailing list post that says the following:
Looking at the TS code in OpenSSL, it seems that the peer's
chain is not used in the way one might expect (to help construct
the untrusted portion of the chain). Rather, surprisingly, it
looks like the peer's certificates appear to be ...
Only top voted, non community-wiki answers of a minimum length are eligible
