Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Also commonly known as a digital certificate, a certificate is a piece of data issued by a Certificate Authority for the purpose of associating a public key with a person, account, organization, or machine.

Most certificates are in the X.509 format, defined in RFC2459, though there are other less-used formats, such as the EAC Certificate format for Electronic Travel Documents (aka "ePassports").

Certificates are most commonly used for server authentication during the TLS handshake by allowing the server to issue trusted signatures, though certificates are also commonly used in corporate and governmental settings for signing and encrypting email and other documents, as well as in embedded chips in smartcards and ID badges for providing physical and logical access to computer systems and restricted locations.

2751 questions
1258
votes
3 answers

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. How the key exchange works. How authenticity,…
Polynomial
  • 132,208
  • 43
  • 298
  • 379
364
votes
6 answers

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate pinning?
259
votes
7 answers

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted certificates and selling them on the black…
258
votes
17 answers

Provide subjectAltName to openssl directly on the command line

Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line? I know it's possible via a openssl.cnf file, but that's not really elegant for batch-creation of CSRs.
Michael Seiwald
  • 2,713
  • 2
  • 11
  • 7
206
votes
7 answers

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the certificate which A previously got from W? If G can get the…
jojo
  • 2,171
  • 3
  • 13
  • 4
163
votes
4 answers

Difference between .pfx and .cert certificates

What is the difference between .pfx and .cert certificate files? Do we distribute .pfx or .cert for client authentication?
Xsecure123
  • 1,753
  • 2
  • 11
  • 8
159
votes
4 answers

What exactly does it mean when Chrome reports 'no certificate transparency information was supplied by the server?'

When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I receive a message 'no certificate transparency information was supplied by the server' (before Chrome 45, the message was displayed as 'the…
Andrew
  • 1,806
  • 2
  • 12
  • 9
143
votes
5 answers

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
Jonas
  • 5,063
  • 7
  • 32
  • 35
142
votes
14 answers

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's identity) for approximately $120 and up. But then I…
Luke Sheppard
  • 2,217
  • 3
  • 15
  • 21
127
votes
7 answers

Let's Encrypt for intranet websites?

Many companies have intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate, which causes a bad habit for the users since they get used to just pressing OK on invalid CERT warnings. Question: How…
LoukiosValentine79
  • 1,531
  • 2
  • 11
  • 13
116
votes
6 answers

I can't access websites that use HTTPS, instead getting the message "your connection is not private"!

I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But something isn't right: installing a certificate…
Tarek
  • 1,063
  • 2
  • 7
  • 9
115
votes
4 answers

What certificates are needed for multi-level subdomains?

I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy. Here's what I need to secure: foo.com www.foo.com Any combination of…
Nathan Long
  • 2,624
  • 4
  • 21
  • 28
107
votes
8 answers

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE I am interested as well in knowing what attacks are…
107
votes
10 answers

Should I change the private key when renewing a certificate?

My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling attempts have failed to verify their claim. What is the…
Commander Keen
  • 1,173
  • 2
  • 7
  • 6
100
votes
4 answers

What is the difference between an X.509 "client certificate" and a normal SSL certificate?

I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with SSL certificates provided by both parties, but…
1
2 3
99 100