New answers tagged certificates
1
I just used another Comodo's product to scan my PC and find out this warning was a false positive about "microsoft ecc development root certificate authority 2018".
but anyway if you need to scan your installed certificate just like me you can use comodo free antivirus
Update:
Because I wanted to investigate more about this issue, as described in this ...
0
No. When you submit a Certificate Signing Request to a CA, you've already selected which "intermediate" certificates are applicable.
If you send a CSR directly to a Root, there are no intermediates.
If you send a CSR to a Sub CA (signed by a Root), you're getting the CSR signed by an "intermediate" which was already set up.
When designing a certification ...
0
Certificate that CA issue is a, simply said, confirmation that public key that you sent to CA in the Cerfiticate Request, really belongs to you (otherwise everyone could claim that he is the owner of domain google.com or amazon.com). Since the certificate contains your public key, it cannot be prepared in advance. Furthermore, response time depends on the ...
0
The ideal solution would be to use a custom Extended Key Usage (EKU) and to mark the Extended Key Usage as critical. Your application (the TLS client) then needs to validate the Extended Key Usage and make sure that it contains the custom OID you have defined.
TLS clients that do not know or understand your custom EKU OID (e.g. a web browser) will reject ...
1
If attacker gets access to a private key material of the server certificate, your security is compromised. What you can do is to add security to key storage and store the key in HSM (Hardware Security Module).
1
It is perfectly fine to use a cryptographic hash ("fingerprint") of the certificate for comparison instead of the certificate itself. And this is actually often done when implementing certificate pinning.
A man in the middle would not be able to generate a certificate and matching private key where the certificate has exactly the same fingerprint as your ...
0
I needed to do this for creating self-signed certs for local testing, but also wanted to be able to pass multiple parameters for extensions, not just SAN. I discovered that doing multiple -extfile commands, just seemed to overwrite each other, and only the last -extfile value ended up in cert.
The solution was just to add more variables to the printf:
...
1
Unless you specifically configure your web browser to use a client certificate for the site that you're connecting to, your browser does not use a certificate to make the SSL/TLS handshake with the server.
Instead, your browser receives the server's certificate, and verifies that it was signed using a certificate in your browser's or OS's certificate ...
0
You are essentially asking what is stopping a third party from issuing a certificate via a trusted CA.
Cost - CAs charge to issue certificates. It's cost prohibitive to issues thousands this way.
Domain validation - a trusted CA is only trusted because they are trusted to verify domain ownership correctly. Some CAs have failed to do so 100% and have lost ...
3
A Web Server handles certificates and TLS connections
A web site itself is simply an HTML document, possibly including scripts and stylesheets, and references to other resources (external scripts, styles, images, etc.). The document itself is not aware if it is served via HTTP or HTTPS, and if so, which certificate was used for that.
Instead, these things ...
3
No. Possession of the certificate alone is not enough to authenticate a user. The user must also have possession of the private key corresponding with the public key in the certificate, and must complete some cryptographic operation using that private key, to prove that they have possession of the private key. See Could a stolen certificate show as ...
0
I met the same problem, and I find solution now.
You need use the same rsa that you used to generate the signature to generate a public key and provite key for all to use, then use this public Key & private key for all other action: encrypt,decrypt,verify, you will not see this error.
0
The greatest weakness of this scheme is the use of a "simple pin". A simple pin will only give you as much protection as a simple pin can, regardless of whether you are using a KDF to expand it. If you only allow for 4-digit, numerical pins, then your KDF will only be able to produce 10^4 different keys, which is a trivial number to brute-force.
So in this ...
0
This answer is based on the discussion between Schroeder and wtdmn in the comments. Yes, the client's private key (corresponding to the client's public key in the client's certificate) will need to be decrypted in order for the client to establish a TLS connection with the server, using the client's certificate. But, once the client's private key is ...
2
I am not sure to fully understand the question, but I recently encountered a similar situation.
I did not found evidence that it is possible to use TPM persistent handle in OpenSSL command in place of file path for keys. OpenSSL is not made to fully interact with the TPM, it can only use the tpm2 cryptographic calculations through the engine.
To know if an ...
0
Extended Validation (EV) certificates are a bad choice for web performance. They have a much bigger negative impact on website speed and reliability than Domain Validation (DV) certificates.
I researched this extensively in Dec 2019/Jan 2020 and just published the results at https://www.aaronpeters.nl/blog/ev-certificates-make-the-web-slow-and-unreliable/.
...
3
First, this is a pretty broad question already. Please don't add anymore questions to this and ask for further details in new questions instead.
Question 1: Is this observation correct?
No. If you do a openssl x509 -text -in cert.pem you can see the public key and also the type of the public key:
...
Subject Public Key Info:
Public Key ...
6
Great question! I don't know if there's definitive source for this, so I'm going to make educated guesses based on the RFCs.
TL;DR: the following keyUsage bits are supported in TLS 1.2 for end-entity certs:
digitalSignature (0),
keyEncipherment (2),
keyAgreement (4),
Now let's go through the keyUsages one at a time:
...
Top 50 recent answers are included
