New answers tagged certificates
0
Are User Credentials on Android such as "user key", "user certificate", and "CA certificate" only used to connect to a single specific network?
A user certificate is used to authenticate a user against an HTTPS website and is totally agnostic of the network used to access this website.
A CA Certificate is used to ensure that the certificate provided by an ...
2
Cross-certification in Windows is done via certreq.exe tool:
certreq -policy <policy.inf> <certtocrosssign.cer> <outreq.csr>
where <policy.inf> is INF file that defines cross-certificate contents and constratints. <certtocrosssign.cer> is a path to a certificate file you are cross-signing. And the last parameter <outreq.csr&...
0
Yes you can. But they will be completely pointless if you don't pin their thumbprint to a specific application.
Imagine for a second what you want to use the certificate for: The certificate should provide authenticity, i.e. you want to verify that an entity that claims to be entity X is actually entity X.
Consider the following example: When you get a CA-...
0
This has been answered, but if anyone's still looking for a no-prompt, cli-only method to create a self-signed root cert (without CAs or CSRs) and don't mind using Java keytool, here's an alternative:
Generate a PKCS12 keystore with keytool
keytool -genkeypair \
-keyalg RSA \
-keysize 3072 \
-alias titan \
-dname "CN=titan,OU=Engineering,O=Titan Corp.,...
2
TL;DR: It's not permitted; it's not technically impossible.
Assuming you're not talking about a certificate that's been held, it would be against the rules for a certificate, once revoked, to be unrevoked.
If you ask a CA to unrevoke a revoked certificate, they should refuse, and they'll probably tell you it's impossible.
However, if you websearch, you ...
0
Combining two of the answers above, to create a PFX without a password for Azure Front Door from an existing PFX with a password, I did:
openssl pkcs12 -in input.pfx
-nodes | openssl pkcs12
-export -keypbe NONE
-certpbe NONE
-out output.pfx
4
Using CAA DNS records for internal networks doesn't really make sense, especially when you're using a .local domain.
Simply put: The way CAA records work is that an issuing CA will check the CAA records of a domain through public DNS records but only if the issuing CA is told to do so.
Public CAS are required to do that. But a public certificate authority ...
3
There are a few different ways:
You can cross check with Common CA DB. Mozilla operates this site, but all of the major Root certificates stores vendors (Mozilla, Microsoft, Google, Cisco, and Apple) contributes data to the common database.
All the major root certificate store maintainers publishes all the root certificate that they have in their root store ...
7
Is it possible to create a pfx file without import password?
Yes, it is possible:
openssl req -x509 -newkey rsa:4096 -keyout PrivateKey.pem -out Cert.pem -days 365 -nodes
openssl pkcs12 -export -out keyStore.p12 -inkey PrivateKey.pem -in Cert.pem
Or is it possible to remove the import password from pfx file that
I've already created?
Yes, it is ...
3
In most browsers, you should be able to view the certificate for a site, and follow the chain up to the root certificate. For example, in Firefox for security.stackexchange.com, you can follow the following steps, and see that the root certificate of the chain is DST Root X3.
1) Navigate to security.stackexchange.com, and click the green padlock in the ...
2
Mitigating Effects of Malicious/Compromised Certificate Authorities
There aren't very many things you can do yourself as the client, but I will outline several solutions available anyway.
Remove Untrusted Certificates
If there are CAs that are trusted by your browser and/or operating system that you do not personally trust, you should remove them. This is ...
-2
So the owners or your router that you've connected to, it shows all ip's that has been connected to on the main router and someone or you didn't know has it on blocked to unaccess to the web pages.
If it's your router then fix it to where you can make that ip on the router gain access to the YouTube, gmail, or other websites again. It has been you or ...
1
The aim of certificate pinning is to protect against malicious man in the middle attacks and not against legal content inspection as done in companies and also desktop antivirus for protection, where the certificates are issued by an explicitly trusted local CA. it does not matter here that legal protection methods might also be used to invade the privacy - ...
1
Is it even possible to "recycle" my valid personal certificate to be used in the RADIUS server?
A certificate is valid only for the domains listed in the certificate. Since your private domain is likely not the domain of the radius server you cannot reuse your certificate there. Apart from that it is a bad idea to give your secret key to the school, since ...
0
According to page 9 of the product spec sheet this router does have a built in firewall that can filter URLs.
You are probably going to want to:
Disable the URL filtering
Or update the router firmware which may result in a updated certificate.
0
While it is the typical case of https eavesdropping, most likely there is no malicious intent in the background.
For example, the router can provide some web filtering or other defense for you with it.
Furthermore, it is impossible to be done without your consent: the manufacturer can't create such SSL certificates to the domains you visit, what are ...
Top 50 recent answers are included
