New answers tagged public-key-infrastructure
1
My guess would be that you are trying to use an ECC key (or subkey). The version of gnupg that comes with Amazon Linux is too old to support ECC cryptography. If you look at the output of gpg --list-key 40BXFE61, you can check for any pub or sub entries that have cv25519 or nistp256 in them, e.g.:
pub rsa4096/E63EDCA9329DD07E 2011-11-07 [SC]
...
33
CA A revokes CA B, does certificate C become invalid?
Yes, revocation cascades down to the tree. If CA certificate is revoked, all certificates below (regardless of how many levels are below CA) are implicitly considered untrusted. Keep in mind that they become *untrusted*, not revoked.
CA A gets revoked (somehow), does its revocation cascade all the way ...
9
"It depends".
The most secure answer is "yes, it revokes the subtree", because once the "B" certificate has been revoked there's no reason to trust any certificate it claims to have issued (or any CRL it has signed, et cetera).
But it really depends on what inputs are given to the chain builder (which means it won't be consistent from application to ...
2
For RSA and 'dss' hostkey pkalgs yes the server uses whatever key size it has; in general a client can fail the handshake if it considers the hostkey too small or otherwise cryptographically unsatisfactory, although I don't know any that does. (Whereas of course most do reject a hostkey that mismatches the pre-configured or previously-accepted one.) For ...
15
No, HSTS does not protect against certificate misissuance. HSTS simply tells the browser to only allow connecting to that site over HTTPS, it doesn't have anything to do with checking whether the certificate should be trusted.
There are two things that can help with misissuance to some extent, Certificate Transparency (CT) and Certificate Authority ...
1
You query the certificate store where the private CA's cert would be stored. CA certs are stored in a collection of trusted certificates, often managed by the operating system but optionally separate from it (as Mozilla does) or even specific to a particular application. You'd need to know what store your private CA cert would be installed in, and check to ...
Top 50 recent answers are included
