Skip to main content
234 votes
Accepted

Provide subjectAltName to openssl directly on the command line

As of OpenSSL 1.1.1, providing subjectAltName directly on command line becomes much easier, with the introduction of the -addext flag to openssl req (via this commit). The commit adds an example to ...
Peter W's user avatar
  • 2,464
211 votes
Accepted

Is Starbucks spoofing me?

As @Adonalsium mentions in the comments, Data Valet manages the Starbucks public WiFi. They're trying to redirect you to the "agree to terms" page to login to the WiFi. Go to a page in a web browser ...
nbering's user avatar
  • 4,028
133 votes

Why are Let's Encrypt certificates accepted by default by browsers?

I think you are misunderstanding what a SSL certificate actually certifies, and what it is designed to protect against. A standard certificate only certify that the owner of the certificate actually ...
Anders's user avatar
  • 65.7k
119 votes

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

Yes, you should absolutely reject the CSR. Additionally, you should change your hosting provider as it looks like they don't know what they are doing. It is already bad enough that they sent you the ...
dr_'s user avatar
  • 5,208
117 votes
Accepted

Why would I choose SHA-256 over SHA-512 for a SSL/TLS certificate?

From a security perspective, it would be pretty pointless. In practical terms, SHA-256 is just as secure as SHA-384 or SHA-512. We can't produce collisions in any of them with current or foreseeable ...
Xander's user avatar
  • 35.8k
111 votes

Why would a school need to install certificates on student laptops?

There are two different kinds of certificates you could install on a machine: The first type of certificate is root certificate authority. A root certificate contains just a public key of the ...
Lie Ryan's user avatar
  • 31.5k
106 votes
Accepted

Should I revoke no longer used Let's Encrypt certificates before destroying them?

This is a subjective Cost vs Risk decision. We can't make it for you, but I can help you examine the factors involved. Cost To you: the effort of revoking the cert. If you have to do this manually, ...
Mike Ounsworth's user avatar
88 votes
Accepted

Is there a way to make sure my government does not swap out SSL certificates?

If your adversary is a powerful nation-state threat actor, web PKI will not protect you. Nothing is preventing them from issuing their own certificate. In fact, many governments run their own ...
forest's user avatar
  • 67k
87 votes
Accepted

Why is this certificate for Imgur only valid for one day?

This isn't one of Imgur certificates. Certificate Transparency logs Certificate Authorities must report all certificates they generate to transparency logs, which are public databases. This allows ...
Benoit Esnard's user avatar
81 votes

Why would I choose SHA-256 over SHA-512 for a SSL/TLS certificate?

The only real advantage that SHA-512 might have over SHA-256 is collision resistance, a term that in cryptography has a very narrow meaning. SHA-256 claims 128-bit collision resistance, SHA-512 ...
Luis Casillas's user avatar
79 votes
Accepted

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

How does that work? They seem use an In-the-middle SSL Bump proxy. First, it works as a transparent proxy, meaning it will silently redirect all HTTPS traffic to SSL Bump proxy servers. You have to ...
F. Hauri  - Give Up GitHub's user avatar
78 votes
Accepted

How does my browser inherently trust a CA?

How my browser can inherently trust a CA? Does in contain hard coded public key of the CA? Your browser (and possibly your OS) ships with a list of trusted CAs. These pre-installed certificates serve ...
Arminius's user avatar
  • 44.9k
75 votes
Accepted

Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?

There is a lot to unpack so I’ll do my best here (based on some assumptions). Firefox maintains its own certificate store which is likely the reason only Firefox is throwing these errors. ...
DKNUCKLES's user avatar
  • 9,217
73 votes

Can I restrict a Certification Authority to signing certain domains only?

Thomas Pornin's answer is good, but a little outdated. Support for Name Constraints is growing. I've found that OpenSSL 1.0.1k and Windows 7 support the extension. Test Using XCA, I created a self-...
Jonathon Reinhart's user avatar
72 votes
Accepted

Should I trust a website which uses a SHA-1 HTTPS certificate?

It's a bad sign, but it is still very unlikely that the connection is being eavesdropped on. The website appears to have a valid certificate signed by a certificate authority, but it is signed with a ...
Philipp's user avatar
  • 49.4k
70 votes
Accepted

Does a client certificate identify the owner to unrelated websites?

Interesting question! I just so happen to have a browser full of test certs, and a number of test sites to connect to! Let's test this! (Skip to the bottom for a summary) Investigation Testing on ...
Mike Ounsworth's user avatar
69 votes
Accepted

Can a CA decrypt HTTPS traffic?

Yes, this could enable your state to spy on HTTPS traffic. That's not just an imaginary threat, it happened in the past in a private company and it was attempted by a state. CAs are a centerpiece of a ...
A. Hersean's user avatar
  • 10.6k
68 votes

Provide subjectAltName to openssl directly on the command line

This is my solution to finally generate a working self signed cert, based on the answers above(The accepted answer don't work for me): openssl genrsa -out ca.key 2048 openssl req -new -x509 -days 365 ...
tsl0922's user avatar
  • 781
66 votes

Why is this certificate for Imgur only valid for one day?

This is apparently an MITM attack. Someone is trying to intercept the connection. Whether it is a malicious third-party attacker or the cafe trying to filter content/insert advertisements (relatively ...
Peter Harmann's user avatar
65 votes

Why are SSL certificates an annual expense?

Let's start with the cynical view: Certificate Authorities are for-profit companies, so they will charge as much as they are able to get away with! More seriously, running a certificate authority is ...
Mike Ounsworth's user avatar
52 votes

Can a CA decrypt HTTPS traffic?

To illustrate in more detail what A. Hersean explains: In normal usage, when you visit https://security.stackexchange.com, the security.stackexchange.com server presents a certificate which is signed ...
jcaron's user avatar
  • 3,675
51 votes

How can I be sure that I am using the real Facebook?

You can confirm that you're on the real Facebook by a variety of ways: Inspect the certificate used to secure the site. Open up your certificate (instructions vary by browser) and see what it says - ...
Monica Apologists Get Out's user avatar
50 votes
Accepted

Is there a risk to a business that is using a shared certificate?

It is a certificate of a content delivery network – a U.S. company Incapsula Inc. – intercepting your whole communication with the bank. The certificate itself does not pose a direct risk to customers'...
techraf's user avatar
  • 9,139
50 votes
Accepted

Why is the issuer certificate different at my workplace and at home?

Yes, a company doing SSL interception could in theory read all your traffic if you use the company network. Depending on where you live and what kind of contract you have the ability for the company ...
Steffen Ullrich's user avatar
50 votes
Accepted

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

If I were in your place I would refuse to accept this SSL certificate. The reason for that is, if someone broke into either of the emails that received the private key, they would be able to download ...
vakus's user avatar
  • 3,843
50 votes
Accepted

Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?

No. Revocation is an active event, not something that passively or automatically happens. Expiration is passive, though. An expired cert is no longer valid, so there's no need to stick it in a CRL or ...
CBHacking's user avatar
  • 49.5k
48 votes

Can you sign using a digital certificate itself?

Just a matter of imprecise language that should be understood by everyone involved. You sign using the private key that only you have. The public key is not used, and the certificate is not used. In ...
Z.T.'s user avatar
  • 8,534
48 votes
Accepted

Why do SSL certificates have country codes (or other metadata)?

The reason certificates have the metadata they do is historical. Certificates are defined in the X.509 standard from the ITU-T. It is part of implementation of the X.500 standard, the Directory ...
LvB's user avatar
  • 8,973

Only top scored, non community-wiki answers of a minimum length are eligible