The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
16 views

Changing strong protection passwords of private key in the Windows certificate store

When importing a x509 certificate with a private key into the Windows certificat store, there is an option to set a password for that key (It is called “strong protection” in the Certificate Import ...
3
votes
4answers
4k views

OpenSSL: How to create a certificate with an empty subject DN?

Is it possible to create a PKCS#10 certificate request / X.509 certificate with the identifying information only in the subject alternate name attribute/extension? According to X.509 4.1.2.6 Subject, ...
1
vote
1answer
51 views

ASN1 Structure Admission Syntax

I want to add the Admission Extension to my Certificate. Therefor i use the Tool XCA, which uses OpenSSL to create the certificates. This is my structre i wrote with some dummy Data: ...
0
votes
2answers
33 views

Windows can't find the issuer of a client certificate

Hello and sorry about my bad english. I have a problem about a PKI which I did on Ubuntu using OpenSSL: when I installed the root certificate on Windows (it's a simple hierarchy: ROOT -> Intermediate ...
0
votes
0answers
34 views

X509 extensions in openssl

With "openssl" I want to sign a "csr" including several X509.v3 extensions. I do not known how to configure the following three ones: a) "X509v3 Private Key Usage Period", "not before/after than". ...
1
vote
3answers
34 views

How can I cryptographically verify that someone owns the website they claim to?

More specifically, can I get them to sign a string of text with their x509 private certificate and then I can verify it using the public cert used by the website in question? Perhaps I could supply ...
0
votes
0answers
18 views

X509 certificate that can only be installed on a particular machine

Is it possible to create a certificate that will not install on a machine other than its intended one? (Using some hardware fingerprint embedded into the cert?) Or alternatively, is there a way to ...
0
votes
1answer
38 views

UTF8 and T61 strings, how do I see what my SSL cert uses?

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
1
vote
3answers
152 views

How do you get an SNI certificate for internal host-names?

I have a Synology NAS at home, which has a web-based user-interface which I expose to the public Internet. Inside my LAN my NAS has the hostname nas.domain.local. and on the public Internet I have the ...
3
votes
1answer
2k views

logstash-forwarder failed to tls handshake cannot validate cert because it doesnt contain any IP SANS

I have a logstash / elastic search / kibana server on ubuntu 14.x 64bit. I have a few other servers with the same spec using logstash-forwarder, and everything is working as expected. However, when ...
4
votes
4answers
2k views

X.509 certificates - expiration and key reuse

I have set up a small X.509 certificate authority for internal use in my network. Now I want to renew a certificate, and I want to know how should I do it. Can the new certificate reuse the same key ...
0
votes
1answer
36 views

How to sign a CSR on windows

I've got a custom certificate that I'm using as a local root authority. This certifcate has a private key on my machine and is stored in the "Personal" certificates store of the "Local Machine" ...
1
vote
2answers
974 views

s_client not failing on revoked certifcate?

I'm running Firefox with with the EFF's HTTPS Everywhere. I recently visited Lavabit's site to see if its accepting donations: The revocation is expected considering the history.... However, I'm ...
1
vote
1answer
2k views

Can't S/MIME sign using OpenSSL even if “verify” suceeds

I have a client certificate in Chrome, that I used for logging into StartSSL. I exported it using pk12util to certfile.p12. Now I want to use it for signing with S/MIME. I converted the p12 file to ...
1
vote
0answers
6k views

Firefox, “Secure Connection Failed” and client certificate

I have a client certificate for Satrtcom. I'm trying to authenticate to their service, but I'm receiving a "Secure Connection Failed" error with error code ssl_error_handshake_failure_alert: The ...
2
votes
1answer
1k views

Incorrect Authority Key Identifier on openssl end cert

I'm getting interesting results when signing an end-server certificate using an intermediate CA using openssl. I have a Root CA which looks like this: Serial Number: 14296918985177649921 ...
2
votes
1answer
673 views

Alternatives to SSH x509 logon

I have a Windows 7 machine which is not part of domain, and a Linux machine. I want to login to Linux from Windows using an x509 certificate stored in windows certificate store. Is it possible? ...
2
votes
2answers
310 views

Primary 'common name' in subjectAltName?

I have my own X.509 CA. When issuing certificates for hosts, if I have Subject: .../CN=foobox.grawity.tld and subjectAltName: DNS:foobox.local, do I still have to put DNS:foobox.grawity.tld as a ...
2
votes
0answers
87 views

SSL cert owner != localhost after creating SSH tunnel

I use an SSH tunnel to connect to my work's mail server, then tell my mail client to connect to server "localhost" on port "1993" (the port I chose for the tunnel). I have two different Ubuntu Precise ...
2
votes
1answer
336 views

What's a good database-backed X.509 certificate authority on Linux

I've been using OpenSSL as an X.509 certificate authority. Because multiple machines will need to create certificates, I've exported the certificate authority folder on a distributed filesystem. When ...
0
votes
1answer
2k views

How to make an x.509 certificate from a PEM one?

I'm trying to test a script, locally, which involves uploading a file using a Java-based program to a FileZilla FTPES server. For the real thing, there is a real certificate on the FZ server, and the ...