We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [certificates]

A certificate consists of a public key and information about the owner (e. g. the name of a person or server).

Filter by
Sorted by
Tagged with
0
votes
1answer
5k views

where should private and public keys be stored? [closed]

I am kind of confused whether should a newly generated key pair be stored in a keystore or in just a normal plain text file? From what I read from online source, there are serveral explainations ...
0
votes
1answer
66 views

Understanding hybrid cryptography's concepts: signing and CA

After learning about symmetric encryption, public-key encryption, one-way hash, digital signature and digital certificate, I was tasked to think of an imaginary hybrid cryptosystem. I was thinking ...
0
votes
1answer
43 views

Why CA does not have to be online?

I'm learning publick key infrastructure and certificate authority. But I cannot understand below conecepts. Unlike KDC or public key authority, CA does not have to be online to provide keys to ...
0
votes
1answer
640 views

Which algorithm should be used to replace SHA512withRSA? [closed]

We are working on the web application that is basically generating a self-signed certificate during the installation. It's a Java based app and for generation of the certificate we are using ...
0
votes
1answer
1k views

how to validate cert when signed cert has authority key id but signing cert doesn't?

Say I have the following signing cert: ...
0
votes
2answers
512 views

Why is a certificate needed at client side

I was wondering why you need a certificate of the server at client side. Can't you just fetch it from the CA itself? I am using mbedtls to program some small client, and in all the client examples ...
0
votes
1answer
564 views

How can I verify a client's identity by requesting a digital certificate?

So I am registering users and I need to know they really are who they say they are. More importantly that they represent the company they say they represent. I was told I can ask them to send me a ...
0
votes
1answer
101 views

Is there a way to inercept encrypted https connections by mimicking a cert authority?

In this video, it is shown how encryption can be theoretically intercepted without the client noticing it. In short something in between the connection could make a handshake with the requested ...
0
votes
2answers
77 views

Self signed certificate for mobile app and backend from same company

My company's product is Android and iOS mobile app which connects to our own backend. All interactions of the mobile app are with backend developed by our own company. In such a situation, can the ...
0
votes
1answer
98 views

Certificate revocation

When someone claims that the private key corresponding to the public key has been stolen, and sends to the CA a statement of this fact signed with respect to public key pk. Why doesn't the CA need ...
0
votes
2answers
126 views

Certificate Path Verification of X509 Certificate

I have the trusted root certificate which I am validating using the self signed key. I also have the intermediate certificate, which i am validating using the root certificate. Now when i am ...
0
votes
1answer
34 views

Create self signed certificate from modulus, private and public exponents of RSA

I have the values of RSA public exponent $e$, the secret exponent $d$ and the modulus $n$. How can I create (for example using openssl) a self-signed certificate using the RSA key $(n,d), (n,e)$? Is ...
0
votes
1answer
56 views

Observing cipher suites and certificate algorithms without man-in-the-middle

I manage a proxy server. Is it technically possible to observe and determine which cipher suite is selected between end points (client and server) without changing their SSL certificate, without ...
0
votes
1answer
172 views

Windows certreq full response file [closed]

I'm using the Windows certreq command line tool to submit a CSR for signing to a Windows Server CA. ...
0
votes
1answer
39 views

When a program using openssl library is using a certificate, does the server check if the issuer(s) are still valid

If I have a program acting as TLS server with a certificate signed by a CA, if one of the issuers in the chain becomes invalidated or the date expires, then how does the program using the certificate ...
0
votes
1answer
97 views

Link between openssl 'req' command and 'unable to get local issuer certificate'?

I was using the following command to build a self-signed certificate after creating a private key: ...
0
votes
2answers
65 views

Should Bob trust a certificate issued by delegated party?

Consider this scenario: Alice sends a message signed under her public key to Bob. Bob has never exchanged a keys with Alice. Alice's key is signed by a certain X. X's key is signed by Y, an entity ...
0
votes
1answer
190 views

Digital certificate issuing man-in-the-middle attack

While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key). To certify a domain ...
0
votes
1answer
121 views

Changing the public key in an MD5 certificate

Given a valid, signed X.509 certificate using the MD5 digest algorithm and an RSA public key, how feasible would it be to generate a public key which would, all other parts of the certificate being ...
0
votes
1answer
171 views

How can i verify a certificate to root? [closed]

I write some certificate Authority that has it's own private/public cert keys . This CA signs public keys of user. If for example i have user that has a public cert that signed by the CA. How I can ...
0
votes
1answer
59 views

Encrypted cerficiate signature for server certificate and intermediate certificate in packet capture

If we view the certificate chain using Firefox, we can see the certificate signature of "server certificate" and its "intermediate-CA" right after the "certificate signature algorithm" in the ...
0
votes
1answer
104 views

Questions about the certificate authority procedures

I am beginner in cryptography and now I try to understand certificate process. I read this answer and have some questions about the enrollment process: The general procedure to issue certificates ...
0
votes
1answer
118 views

signature reconstruction in X.509 certificate with root private key

I created a root CA, let's say A. I created the Certificate Signing Request (CSR) for B, and get the certificate signed by A. I would like to know of what exact content the signature is made. This ...
0
votes
1answer
90 views

How to change the policy value of a CA identity in apple keychain?

According to this guide, I made an intermediate CA, and successfully used it to sign app in Windows. However, after converted it into a Apple keychain (by this guide), this CA become having an "iChat" ...
0
votes
1answer
6k views

What is the correct format for a CRLF in a SSL certificate's pem

Currently I am working with SSL certificates inside a Ruby on Rails application. I am storing the certificates in a database along with the corresponding dhparam, and chain. At some point I want to ...
0
votes
1answer
68 views

Method to verify a signed archive's X.509 CoT

I am trying to understand the key high level details behind verifying trust when downloading an archive. This is my understanding of how it could be done: On the Software Developer side: Obtain a ...
0
votes
1answer
62 views

Same certificate for server authentication and authorizatoin in other system

I have a program which acts as a node in a larger system. Those nodes can be connected to form a tree. TLS with mutual authentication is required, which means that each node has it's own certificate. ...
0
votes
1answer
181 views

X509 Cert exploit CA check

Assumptions Let's theoretically assume that a browser skips the check that a certificate it receives belongs to the stated CA (that's an exercise). How could I exploit this in order to impersonate ...
0
votes
1answer
100 views

Workaround to implementing Forward Secrecy

In the case where I am self-signing my digital certificates, if I just change my certificate (generate a new one) every week or month, will this have (sort of similar to) the same effect as ...
0
votes
0answers
29 views

How does DHE-RSA work and why is PFS guaranteed?

How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.
0
votes
0answers
32 views

How to validate the authenticity and integrity of an XML document?

I am working on a C++ desktop application that reads an XML (also created by my org) from a public server (does not require authentication). I would like to make sure that the downloaded XML has not ...
0
votes
0answers
31 views

what is the difference between self issued and an intermediate certificate

Hashicorp vault has an API they call Sign Self-Issued. The use case is for rotating root CAs. A user creates a new root self signed CA and then passes it to this API and what is returned is roughly ...
0
votes
0answers
29 views

Pitfalls of wildcard certificates with unique key pairs?

I am having difficulty finding information regarding using wildcard certificates with unique key pairs. I understand if you duplicate key pairs across multiple servers and one becomes compromised, an ...
0
votes
1answer
130 views

How can I verify certificate signature algorithm in TLS 1.3 using PSS?

I've read this post but I'm still unable to understand some things. I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's ...
0
votes
0answers
57 views

Understanding TLS certificate

I'm newbie in the word of TLS, and need some verification about my picture. I can use TLS with 3 or 2 participants: 3 participants: Client, server, CA (certification authority). The CA is where the ...
0
votes
1answer
115 views

Understanding certificates for public keys with subkey

I have a openpgp key with 3 subkeys: ...
0
votes
0answers
47 views

Derive anonymous dsa key-pair from two certificate authorities

Is it possible to derive a dsa key-pair based on two private keys from different/independent "Certificate Authorities" (ca1 and ca2) to sign s.th. which then verifies only that the signature is a ...
0
votes
3answers
131 views

How to encrypt a message such when a certain condition is met it can be decrypted?

Assume, there is a certificate authority whose public key: $pk$, is known. Also, the certificate $c$ is known, but not the signed certificate. I want to encrypt a message: $m$, such that whoever has ...
0
votes
0answers
56 views

Should a certificate be validated every time it is used?

In contrast to private keys, public keys don't need to be stored on a secure place. But what if somebody changes a certificate with a public key to just another one? To ensure certificate authenticity,...
0
votes
2answers
81 views

How to configure a client browser cert to be authenticated by a server?

I currently am being asked to partake in a strange authentication format while working with a client, and was hoping for clarification. The client is using HTTPS with client certificate ...
0
votes
0answers
53 views

Verification of Certificates in a Chain

The question is not about mathematical cryptography but about the practical usage of certificates and their chained verification. Please let me know, if this is the wrong place to post the question. ...
0
votes
1answer
136 views

Where x509 signature validation is concerned, what does the error “x509 certificate chain incomplete of leaf TP not found” mean? [closed]

I'm validating the x509 signature of an XML document and I encounter the following error: "x509 certificate chain incomplete of leaf TP not found" Any thoughts on what the impact is for a TLS ...
0
votes
1answer
26 views

What will browser show when a user access website and website present certificate of some other domain with same top level domain [closed]

For example, User tries to access a.example.com and server presents abc.example.com with a.example.com not in SANs list. Will it be just a warning or an error?
-1
votes
2answers
2k views

Where is Signaturevalue in Certificate?

Where is the Digital Signature value in my certificate? I can find Signature Algorithm and Signature Hash algorithm. Also why there are two fields specifying the Signature's Hash? With Signature ...
-1
votes
1answer
53 views

I am new to digital certificate 509V3 concept. can some one please clarify the below points [closed]

I am using RSA 2048 with SHA 256 primitive in certificate: How to verify the user certificate n + 1 with Root certificate n? why it is required to perform Certificate chain verification? How to ...
-2
votes
1answer
69 views

Why do we need HMAC?

AFAIK, HMAC solves the collision problem of hash algorithms by mixing in a pre shared secret. Can't we just use the pre shared secret to symmetrically encrypt data and leave out the hashing?
-2
votes
1answer
114 views

Can two different CA's/End Entities in different PKI's have the same asymmetric key pair?

Example: $X$ and $Y$ have the same asymmetric key pair. $X$ communicates with $A$ and gives it's PubKey to $A$. So, $A$ has the PubKey of $X$ which also happens to be the PubKey/PrivKey of $Y$. ...
-3
votes
1answer
88 views

Are there stenography benefits to a “n-prime”?

As mentioned in this StackOverflow CodeGolf question, prime numbers can be redefined: One of my favorite definitions of the prime numbers goes as follows: 2 is the smallest prime. ...