New answers tagged

0

You should probably read "Against DNSSEC" by Thomas Ptacek and its FAQ.


1

Your CDN or you could initiate the revocation. The CDN can request the revocation most likely through the account they have with the CA and from being the "owner" of that specific order. You can request a revocation still, even though you are not the owner or purchaser of that specific certificate. The CA will request you to prove you are the owner of that ...


4

Indeed, the WebPKI is a cached distributed Trust-On-First-Use system. A CA is hosted very close to the internet backbone, and good CAs perform multi-perspective checks, meaning they are hosted at multiple places worldwide, each location connected close to the internet backbone, and they run the DNS or HTTP validation check from multiple locations. If you ...


1

Ordinarily, the validity of period of the certificate is not determined by the requestor, and is not specified in the CSR. The validity period is determined by the CA (most CA's offer various durations according to price). So, you would have to find a CA that has a mechanism in place for what you are trying to do. See CSR expiry date / validity date for ...


2

Regarding using of certificate to sign other certificates: The answer of @Crypt32 is correct regarding the structure / contents of a certificate. Regarding "with legal validity": If you use private PKI, this will not be recognizable by the others outside of your organization. Means, it will not have legal validity for the others. When somebody outside your ...


4

No, you can't use your purchased signing certificate to sign other certificates. It is not allowed. Although, you can try, but signature will be untrusted. The ability to sign other certificates is governed by Basic Constratins and Key Usage certificate extensions and values of these extensions in your certificate don't meet criteria. For more details about ...


Top 50 recent answers are included