New answers tagged certificates
0
By root certificate which is included in each browsers already.
There are lots of root certificate in browsers, and it is referred in every TLS or SSL session using chain of trust. At last, the root certificate in TLS/SSL session is verified if the root certificate is installed in the system, browser.
If a user/admin insert the self-signed root certificate ...
3
Good question. The certificates of the most trusted CAs are normally included into software install package, e.g. into browser installer, into OS installer, or are preinstalled on device like smartphone. That's why the browser (or some other application) will notice if certificate is really from the specified CA.
17
Is the only protection here that Bob actually checks that the public
key on the returned certificate matches what he originally sent in his
request to the CA?
If the public key was switched before the CA used it to create the certificate, then Bob's web site won't work at all. The private key, which he has kept safe, will only work with his original ...
-1
Let's talk about this meaningfully.
SSL certificate is to make a trust between the parties, and the certificate authorities such as Verisign, Comodo are Trusted Third party(TTP), which are trusted by first party(user) and second party(web server). Hence, both parties implicitly promise to trust those 3rd parties and browser vendors or organizations ...
4
You used "security through obscurity" in quotes, so I don't think I need to convince you that that is not going to work.
To achieve your goals, you will need to encrypt the connection between the clients connecting and the server (with a logon). HTTPS is the simplest, lowest effort, and cheapest way to do that.
But you can also consider things like ...
3
The scheme you are describing is called "Hybrid Encryption for Multiple Recipients" and is already well-implemented in GnuPG.
The user David Segonds described it well in this answer on StackOverflow:
GnuPG does multi-key encryption in standard.
The following command will encrypt doc.txt using the public key for Alice and the public key for Bob. ...
0
@MechMK1 is absolutely correct. You are looking for a technical solution to a problem of policy, which is rarely something you want even if you can make it happen. I'd also think long and hard about why you feel that policy is necessary; there are a lot of bad reasons I can think of, and only a few good ones. After all, a VPN is a layer-3 solution, best ...
0
You can’t. As long as your VPN needs to be usable there is no feasible way to constrain it like that. As long as the profile or data exists on a disk that can be read and decrypted externally or in between boot stages no method will protect you.
The closest you might get is a firmware-to-OS level of MDM on company hardware, but that is basically exclusive ...
2
For inspiration, look at how SSH key exchange works:
The client maintains a table of "known servers" that matches an IP address to a hash. When connecting to a server, the client receives the server certificate (public key) and computes the hash of it, and looks up the server's IP address in the "known servers" table.
If the client has seen this server ...
5
When the attacker sends the server's certificate, the client will encrypt a shared secret (used to generate the symmetric encryption key for the session) with the public key of that certificate. The attacker will then be unable to recover the secret since they don't have the certificate's private key, so they won't be able to complete the TLS handshake.
47
However, in this scheme, couldn't an impostor just present the
certificate after getting it from the real server?
An impostor cannot present, and take advantage of, the real server's certificate unless it also has the matching private key. This is true whether the SAN DNS entry or IP entry are used to identify the certificate being presented.
0
At the start of a TLS/SSL handshake, the server will send its certificate, containing its public key, to any client who initiates a connection. You cannot keep the public key secret.
Instead, consider using TLS/SSL client authentication. Like the server, the client will also possess a certificate, public key and private key. Both the client and the server ...
0
@gowenfawr's answer is correct, but I'd also like to chime in with a couple interesting ideas. Cloud providers are coming out with instances that do just what you need.
https://azure.microsoft.com/en-us/solutions/confidential-compute/
https://aws.amazon.com/cloudhsm/
These platforms leverage HSMs to safeguard data in-memory in hardware that encrypts its ...
2
What's the best method/solution for protecting the integrity and identity of end-user certs?
Install an HSM on their devices and use keys stored within it for VPN. Expensive and difficult to set up.
I want to make sure that users only able to use VPN with company provided devices.
Then instead of trying to control the keys, which is difficult, use VPN ...
0
the people suggesting putting internal names in a public certificate authority should look at public certificate transparency logs and understand this leaks information about internal systems names to the internet
https://blog.appsecco.com/certificate-transparency-part-3-the-dark-side-9d401809b025
https://www.ssl.com/faqs/questions-about-certificate-...
0
For self signed certificates add this to the openssl req -new -x509 command:
-extensions v3_req
or change req_extensions to x509_extensions, or have both if you want to use the config for both the request and a self signed cert for testing.
See here for some info about it: https://www.ibm.com/support/knowledgecenter/en/SSB23S_1.1.0.13/gtps7/cfgcert.html
2
Browsers will alert the user if they are presented with a self-signed certificate which they don't trust.
The browser user or system administrator should preempts this scenario and add the self-signed certificate to the browser's trust-anchor store beforehand. That way, the user won't see a warning.
Done this way, users can be informed that if they ever ...
2
Browsers will only accept an invalid certificate - and self-signed is one form of "invalid" - when the user acknowledges the risk and overrides the browser. The specific steps for doing so vary from browser to browser, but they're usually onerous by design - they want the decision to bypass security to be hard, not easy.
-1
The revocation command uses the path taken from the /etc/ssl/openssl.cnf file, instead of your command, so it actually looks for certs in the cert/ directory.
Move them manually to this folder and it should work.
3
The checking of the hostname is done in X509_check_host. This function calls the internal function valid_star to make sure that the given wildcard in CN or SAN can actually be used.
This function checks that wildcard-CN/SAN like * or *.com are treated as invalid since they are too broad. *.example.com is instead acceptable. Thus check is done by counting ...
1
Installing additional Root CAs to your PC can give others significant access to your network communications depending on how trustworthy the operators of that Root CA are. You rely on Verisign abiding by its Certificate Practice Statement (CPS) and only issuing certificates to authorised users of the represented resource.
In this case you are installing a ...
1
The certificate is one part of the whole system. The other part is the school router which should be CyberHound Appliance.
When your browser connects with a site with https, the flow goes roughly like this:
Browser initiates connection with the server
Server returns its own certificate and a chain of certificates reaching up to a well known Certificate ...
5
Is it dangerous to add a custom cert authority to a browser?
It is pretty dangerous. The owner of this CA can use it for man in the middle attacks or to impersonate arbitrary web sites since your browser will trust the CA to create certificates for arbitrary sites. Using such attacks he can then intercept your passwords and other sensitive data.
For ...
1
As long as you control DNS, it's trivial, even with Let's encrypt. Simply use DNS validation with LE, and they will happily issue a certificate. The point of this process isn't to ensure that anyone can use your site (that's your problem), but to ensure that noone will get a certificate for sites they don't know.
With many paid certificates, you can ...
3
The certificate and DNS record for IP public are irrelevant, you can buy any certificates without publish your sites. All you have to do is to prove you are the owner of that domain by clicking the approval link which send to your domain registration email or a DNS TXT record only.
76
How does that work?
They seem use an In-the-middle SSL Bump proxy.
First, it works as a transparent proxy, meaning it will silently redirect all HTTPS traffic to SSL Bump proxy servers.
You have to install and accept the proxy's Certificate Authority cert to make this work.
Once done, each SSL connection is made from your host to the SSL Bump Proxy with ...
Top 50 recent answers are included
