New answers tagged

2

Cross-certification in Windows is done via certreq.exe tool: certreq -policy <policy.inf> <certtocrosssign.cer> <outreq.csr> where <policy.inf> is INF file that defines cross-certificate contents and constratints. <certtocrosssign.cer> is a path to a certificate file you are cross-signing. And the last parameter <outreq.csr&...


0

As @Steffen says, unless there's some horrible vulnerability with the CAC card, you shouldn't be able to extract the private key from an existing card. That's kind of the whole point of those things. That said, at card creation time, you could load the same private key into a physical CAC card and into the Android device (assuming that your department ...


1

The CAC seems to be a typical smartcard where the private key is stored on the card itself and crypto operations involving the private key like signing are also done on the card. Such smartcards do not allow extraction of the private key. In fact, that is the main purpose of these cards that any use of the private key should explicitly require physical ...


4

Using CAA DNS records for internal networks doesn't really make sense, especially when you're using a .local domain. Simply put: The way CAA records work is that an issuing CA will check the CAA records of a domain through public DNS records but only if the issuing CA is told to do so. Public CAS are required to do that. But a public certificate authority ...


3

There are a few different ways: You can cross check with Common CA DB. Mozilla operates this site, but all of the major Root certificates stores vendors (Mozilla, Microsoft, Google, Cisco, and Apple) contributes data to the common database. All the major root certificate store maintainers publishes all the root certificate that they have in their root store ...


3

In most browsers, you should be able to view the certificate for a site, and follow the chain up to the root certificate. For example, in Firefox for security.stackexchange.com, you can follow the following steps, and see that the root certificate of the chain is DST Root X3. 1) Navigate to security.stackexchange.com, and click the green padlock in the ...


2

Mitigating Effects of Malicious/Compromised Certificate Authorities There aren't very many things you can do yourself as the client, but I will outline several solutions available anyway. Remove Untrusted Certificates If there are CAs that are trusted by your browser and/or operating system that you do not personally trust, you should remove them. This is ...


1

Set up a proxy in your organization that handles TLS traffic. (You will need to add your proxy's certificate to all computers in your organization.) You will then be able to filter traffic at your proxy based on various rules, including the Certificate Authority. Of course, if you are blocking Let's Encrypt on the principle that they don't do Extended ...


3

Frame challenge! The issue is not with Let's Encrypt. The issue is that SSL has a few purposes, and you are ignoring one of the most important purposes for SSL (which Let's Encrypt is very important for), and have focused on one of the less important purposes. You're not the only one with this confusion though because (truth be told), user's have been ...


15

No, HSTS does not protect against certificate misissuance. HSTS simply tells the browser to only allow connecting to that site over HTTPS, it doesn't have anything to do with checking whether the certificate should be trusted. There are two things that can help with misissuance to some extent, Certificate Transparency (CT) and Certificate Authority ...


1

You query the certificate store where the private CA's cert would be stored. CA certs are stored in a collection of trusted certificates, often managed by the operating system but optionally separate from it (as Mozilla does) or even specific to a particular application. You'd need to know what store your private CA cert would be installed in, and check to ...


Top 50 recent answers are included