Questions tagged [certificates]

A piece of data used in public key cryptography (specifically public key infrastructures) that contains identifying information (i.e. email address or web address), a hash of a public key, and a digital signature that authenticates the data in the certificate. For questions specifically about [x509], [certificate-authority], or [public-key-infrastructure], please use those tags.

Also commonly known as a digital certificate, a certificate is a piece of data issued by a Certificate Authority for the purpose of associating a public key with a person, account, organization, or machine.

Most certificates are in the X.509 format, defined in RFC2459, though there are other less-used formats, such as the EAC Certificate format for Electronic Travel Documents (aka "ePassports").

Certificates are most commonly used for server authentication during the TLS handshake by allowing the server to issue trusted signatures, though certificates are also commonly used in corporate and governmental settings for signing and encrypting email and other documents, as well as in embedded chips in smartcards and ID badges for providing physical and logical access to computer systems and restricted locations.

2866 questions
66
votes
7 answers

Why would a school need to install certificates on student laptops?

This question indicates parents are to buy laptops for a school to install software and certificates. I am seeking to understand reasons for site certificates installation: Why would site certificates be installed? What is the potential for…
gatorback
  • 1,541
  • 2
  • 14
  • 17
43
votes
2 answers

What is the difference between a certificate and a private key?

What is the difference between a certificate and a private key? In answering another question on this site, I wanted to point to a canonical answer to this question, but to my surprise I don't see one. Users can be forgiven for getting these terms…
Mike Ounsworth
  • 59,005
  • 21
  • 158
  • 212
27
votes
5 answers

Is it safe to send a CSR via email?

I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?
joshu
  • 587
  • 2
  • 9
  • 13
19
votes
5 answers

Does Google use extended validation certificates?

I just changed a password on a Google account while using the Chrome browser. After doing so, I noticed that the https connection to Google was not highlighted in green signifying that it was an "Extended Validation Certificate". Does Google not use…
Solx
  • 291
  • 2
  • 3
19
votes
2 answers

Is Certificate validation done completely local?

Am I right in my conclusion that validation of a certificate by a client that wishes to communicate with a server that offers said certificate, is done completely local? As in, the client is supposed to have all information (eg. CA's public key,…
JdeHaan
  • 293
  • 2
  • 8
15
votes
5 answers

Why is this certificate valid for so many domains?

If you look at the (invalid) certificate for https://i.imgur.com/ it says only valid for the following names: The certificate is only valid for the following names and then a list of about 100 names. Isn't it a danger to have one certificate for…
jdoe
  • 337
  • 2
  • 9
13
votes
1 answer

Does an existing SSL connection outlast the certificate's expiration

I have two servers A and B that connect via SSL to a third server X. X had a new certificate installed recently. Server A could not establish SSL with X, while server B is still working. Server B is a production site and I am unsure why it still…
Jonku
  • 131
  • 3
12
votes
4 answers

Adding self signed certificate to trusted store

I have been reading about certificates and often is said that self signed certificate should not be added to the trusted authority store and even if you did, remove it after usage immediately. MSDN How to: Create Temporary Certificates for Use…
Chandan
  • 223
  • 1
  • 2
  • 5
11
votes
1 answer

How should I store and secure self-signed certificates?

I'm fairly certain I shouldn't commit certificates into source control. Even if the repository is private and only authenticated coworkers (for example) have access to it. That would allow for accidental exposure (thumb drives, leaked credentials,…
11
votes
2 answers

Can we always remove WWW from a host name?

When I'm opening https://india.gov.in, it's opening all right. But for https://www.india.gov.in, the browser is throwing a certificate error. Why is that happening?
Arka
  • 571
  • 2
  • 7
  • 12
11
votes
2 answers

Prevent and/or detect installation of root certificates on Windows?

I noticed that some applications installed root certificates on my computer. Is it possible to prevent this? Or is there a firewall or such that notifies me?
Rápli András
  • 2,154
  • 1
  • 12
  • 26
10
votes
1 answer

"Manually" verify a certificate

I want to 'manually' verify a certificate and the first step in doing so, I accessed paypal.com and obtained the following RSA modulus and signature value. modulus =…
Radu Titiu
  • 203
  • 1
  • 4
10
votes
4 answers

HTTPS self signed certficiate for personal website

I want to make my Synology NAS accessible over the internet. When I create my own certificate and import this on all my devices (PC, Laptop, Smartphone, Tablet, etc.) is this as secure as buying a certificate? If not, what is the most secure thing I…
my_username
  • 103
  • 1
  • 6
8
votes
1 answer

Are EV certificates still useful?

Years ago (~2010-2019) the Extended Validation (EV) Certificates made a lot of sense. The user in their browser would see a clear difference between a "grey" (http/not secured) website a "green lock" (https normal certificate) website and a "green…
Niels Basjes
  • 263
  • 1
  • 6
8
votes
2 answers

How can I verify that a root certificate is authentic?

I have found that my home PC (Windows 10) currently has 39 root certificates installed. While scrolling though the list I have noticed: Names that look familiar (e.g. Thawte / VeriSign) Names that are unfamiliar to me (e.g. Startcom /…
Kelly Thomas
  • 182
  • 1
  • 6
1
2 3
8 9