I want to try LPS, but I cannot verify the certificate of their https site, I already knew the reason, now how can I get the correct certificate information(especially the fingerprint) to compare it to the one I get in the browser?

Edit: I found a site that seems provide DOD certificate in https, is that site legit?

  • You can’t. Why would anyone publish that? The chain of trust means they don’t have to. You need the CA certificate. – Daniel B Jun 13 '17 at 19:14
  • So it will be impossible for a normal civilian to obtain the CA securely? – Sam Jun 14 '17 at 14:10
  • The site is unofficial but legit as far as I know, although not sure how carefully they check where they've obtained the files... @DanielB, the question is about obtaining the roots as DoD has their own independent from WebPKI, and of course they publish the public root certificates... – user1686 Jun 15 '17 at 15:59

From Wikipedia:

The web site for distribution of LPS-Public is served over HTTPS, but uses a TLS certificate that is signed by a certificate authority managed directly by the Department of Defense. This CA is not trusted by most non-DoD operating systems and browsers. Because of this, visiting the site or downloading the ISO will generate a browser security warning indicating that the certificate is not trusted. Military-issued devices already include this certificate authority in their list of trusted CAs, and so will not see these errors.

You'll have to get the CA from DOD.

|improve this answer|||||
  • 1
    Apparently, they’re available here: iase.disa.mil/pki-pke/Pages/tools.aspx (tab “Trust Store“). – Daniel B Jun 13 '17 at 19:15
  • Nice. Thanks. I like the toll-free number to verify the fingerprint of the signature. – quadruplebucky Jun 13 '17 at 20:09
  • @quadruplebucky - What makes you think there is a number you can call to verify the fingerprint of the certificate? The thumbprint of the certificate is ‎b8 48 bd a3 10 8c 3e b2 42 b2 51 0c 47 9e e0 ab 53 66 2f ed by the way. The certificate is valid from 8/22/2016 to 8/23/2018. Of course if you download from iase.disa.mil, which itself is a secure connection, I don't understand the concern. – Ramhound Jun 13 '17 at 20:50
  • I think the author was being sarcastic, sarcasm escapes me, I am a very literal person :$ – Ramhound Jun 14 '17 at 1:46
  • @Ramhound apparently you're not too literal, because the site for the CAs does indeed have a phone number. – Xavier J Jun 14 '17 at 2:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.