3

No, but. Yes, technically you sign (or decrypt) with the privatekey, not with the certificate itself. And a publickey certificate never contains the privatekey. But a lot of software, and thus documentation, and other description, blurs this distinction. We generally use a privatekey with a certificate (with the exception of SSH, where we attach limited ...


2

What's the best method/solution for protecting the integrity and identity of end-user certs? Install an HSM on their devices and use keys stored within it for VPN. Expensive and difficult to set up. I want to make sure that users only able to use VPN with company provided devices. Then instead of trying to control the keys, which is difficult, use VPN ...


2

Browsers will alert the user if they are presented with a self-signed certificate which they don't trust. The browser user or system administrator should preempts this scenario and add the self-signed certificate to the browser's trust-anchor store beforehand. That way, the user won't see a warning. Done this way, users can be informed that if they ever ...


2

Browsers will only accept an invalid certificate - and self-signed is one form of "invalid" - when the user acknowledges the risk and overrides the browser. The specific steps for doing so vary from browser to browser, but they're usually onerous by design - they want the decision to bypass security to be hard, not easy.


1

You need to add -pubin to your openssl rsa invocation to work with the public key: $ openssl rsa -pubin -in ./oci_api_key_public.pem -noout -modulus


1

I found the following simple method to remove the locally trusted CA certificates not present in the official and current Microsoft Certificate Trust List: First download Sigcheck (https://docs.microsoft.com/en-us/sysinternals/downloads/sigcheck) and then execute: >sigcheck.exe -tuv ... Listing valid certificates not rooted to the Microsoft Certificate ...


Only top voted, non community-wiki answers of a minimum length are eligible