Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

learn more… | top users | synonyms

2
votes
2answers
229 views

X509 PKI Managment Appliance

Can anybody recommend a X509 managment appliance? The needs are rather basic, it should provide secured storage of private keys and the certificates for users and hosts, offer an overview of ...
0
votes
1answer
664 views

How to create a proxy certificate?

I have created an ssl-based server that I need to now create a proxy certificate for. (the second part of the school project). I have found these lines on the OpenSSL Project: openssl req -new ...
0
votes
1answer
130 views

Use Certificate Autoenrolment with third-party Certificate Authority

Is it possible to setup Windows Domain to use Certificate Autoenrolment and third-party Certificate Authority? We think that it can be done in Windows Server 2008 only but don`t know exactly, please ...
7
votes
4answers
7k views

How does SSO using Active Directory works where user is transparently logged in. (intranet webapp)

I'm told that it's possible to make a web application not require a login. The user logs in to Windows, which authenticates via an Active Directory (LDAP) Lookup. Then, they should be able to go to ...
5
votes
3answers
291 views

how to prevent a user using private key after leaving organization?

In the enterprise environment, each user was issue a key pair for using to encrypting/signing. Since they have the private key, that mean they can decrypt any file that encrypt for them, even after ...
2
votes
2answers
683 views

How to set a passphrase for an AWS X.509 private key?

I was rotating my AWS X.509 certificate and private key (not to be confused with ssh private / public key pair) today and decided I wanted to set a pass-phrase on my private key to better protect it. ...
0
votes
1answer
181 views

Does IIS 6.0 Log CRL Checks?

I am adding a 3rd party OCSP responder(Tumbleweed) plugin to IIS 6.0/Windows. I have the 3rd party tool configured to check the revocation status and would like to assert that IIS is not making a ...
8
votes
2answers
1k views

Smart card authentication to a Cisco switch?

We have our Cisco network devices configured to authenticate network administrators using their domain accounts via RADIUS running on a Windows 2008R2 server with the network protection role. This ...
1
vote
1answer
135 views

Hierarchical certification authorities and CRLs

If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or ...
0
votes
1answer
107 views

Who uses OpenXPKI?

I'm evaluating PKI solutions for my client, and among other more technical attributes I'd like to be able to report a few marquis users of each solution. Many projects list well-known users or link ...
1
vote
1answer
247 views

What should be the CRL publishing period for corporate environments?

I am trying to suggest a CRL publishing period for a Microsoft CA, the user certificates are going to be used for digital signature.There can be cases that a user certificate may be revoked. ...
2
votes
1answer
351 views

PKI Issuing CA on Domain Controllers

I am setting up a PKI which will initially be used internally. As we may grow our use of this I have opted for a three tier hierarchy - Offline Root and Policy CAs (one Policy CA at the moment for ...
0
votes
1answer
163 views

Shorten CA Certificate lifetime with Certificate Services?

I recently setup Windows 2003 Certificate Services and installed a five year certificate. I'm now working with a vendor that requires our public CA key so that they can trust all certificates ...
2
votes
3answers
1k views

What books will help me learn everything I can about SSL/PKI?

Since SSL is the backbone of the internet, (now technically called TLS), what are some good books I should read up on to understand all aspects of it. I suppose I'll need to learn some math, some PKI ...
1
vote
1answer
916 views

Import Root CA into Trusted Root Certificate Store from a script

We're looking into the possibility of deploying our enterprise CA to users at their homes, and we're looking for a method to programmatically install a root CA. I noticed certutil isn't included on ...
2
votes
2answers
285 views

PKI infrastructure and usage question

I work in a small software solutions company (50 employees) and I was recently tasked with experimenting with web services. Since we mainly offer solutions for Windows, I started toying around with ...
2
votes
2answers
2k views

OpenVPN with a Windows Certificate Services PKI

has anyone tried using OpenVPN with certificates generated by Windows Certificate Services? In theory this should work. The provided easy-rsa PKI is not very comfortable to manage for many users. I ...
2
votes
2answers
11k views

How secure is SFTP? Is there any benefit in encrypting traffic with PKI as well?

I am working with a client that requires the use of secureFTP for file transfer and is also advocating the use of sLift EZ Classic (command-line file encryption using PKI) on top of SFTP. Is this ...
5
votes
3answers
294 views

PKI keys per service or per server?

We all have a lot of internal services that need encryption and authentication to be provided by some sort of PKI. Do the security gains of using a different private/public key pair for each service ...
261
votes
3answers
255k views

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

I'm pretty much a n00b at system administration and I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I google for tutorials and beat ...