New answers tagged public-key-infrastructure
2
With OpenSSH it's not possible. As said by @TildalWave you need to use the fork from Roumen Petrov PKIXSSH.
Once you have your X509 certificate you don't need to add the public key on the authorized_keys file.
You need to configure two things in the server side:
Add the certificate for the CA in the directory set by CACertificatePath directive in ...
1
See The First Few Milliseconds of an HTTPS Connection, by Jeff Moser. Scroll down to the section, 'Trading Secrets'. This section describes how the client encrypts the pre-master secret using the server's public key (i.e. the public key contained in the server's leaf certificate), and sends the encrypted public key to the server. The server then has to ...
0
They're probably referring to NISTP256 in the algorithm. The constants for this elliptical curve were created by the NSA, and there is some speculation that the NSA may have been specially chosen these constants to create a backdoor for themselves for this curve. See the links below for more info:
https://crypto.stackexchange.com/questions/52983/why-is-...
1
Lets break down your problem into three parts:
1) Identity provisioning: Ideally you should strive to provide an identity to each of your servicer at the time of deployment. This is generally done using leaf X.509 certificates signed by a CA which is trusted by all entities in your infrastructure. The private key of the CA should not be accessible to anyone....
0
In the past I ran into a similar discussion with one of my friend and thus comment:
You and your friend/colleague both are correct. However, your colleague is closer to the definition of Self Signed Certificate (SSC) and whereas you have looked at one aspect of it.
self-signed certificate to be one that's created by the host that it resides on and has ...
21
RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
The end of section 3.2 states:
This specification covers two classes of certificates: CA certificates
and end entity certificates. CA certificates may be further divided
into three classes: cross-certificates, self-issued certificates, and
...
1
The way the question is worded, there is a root. Therefore, you should have dismissed self-signed because there is no root in self-signed. That's the "obviously wrong" option (using the 4-option model of obviously wrong, 2 almost right, and right/more right).
Online CAs include the idea of redundancies and a distributed chain.
0
The online root cert is in your trusted certificate store.
So if the issuing CA cert is trusted by the root then you trust the issuing CA.
As such, the Root can be offline and the certificate chain is still trusted
Top 50 recent answers are included
