Tag Info

Hot answers tagged

44

Keeping the same private key on your root CA allows for all certificates to continue to validate successfully against the new root; all that's required of you is to trust the new root. The certificate signing relationship is based on a signature from the private key; keeping the same private key (and, implicitly, the same public key) while generating a new ...


25

I worked at a company where the security of the CA key was critical to the continued success of the business. To this end the key was encrypted using a custom protocol that required at least 2 people to be present with physical tokens plugged into terminals to decrypt it(there were at least 5 of these tokens, any 2 combined would work). The terminals were ...


20

Curl is using the system-default CA bundle is stored in /etc/pki/tls/certs/ca-bundle.crt . Before you change it, make a copy of that file so that you can restore the system default if you need to. You can simply append new CA certificates to that file, or you can replace the entire bundle. Are you also wondering where to get the certificates? I (and ...


16

One big gain is to keep the private CA key on a dedicated computer completely cut off from the network. You would then sign, and possibly also generate, new certificates on this machine, and then use an physical media to transfer the new certificates off the CA machine. Such as setup would of course also include considerations regarding the physical ...


14

I have upvoted the other two answers, and commented thereon, because I think they're both excellent. If you decide to go for both of them, and that might well be appropriate, I strongly advise care in the initial generation of the key, since the best time to compromise a key is not in use (where many standard, repeatable precautions can be applied) but at ...


13

Unless extremely accurate timekeeping is mission-critical for you there should be no discernible effect for your users, aside from their clocks changing by 2 minutes. The possible exception is if they declare your NTP server to be "insane" as a result of the large change (which would require you to restart the NTP service on the affected systems to force ...


13

The expiry was set in 2037 to avoid the possibility of running into the Unix year 2038 date problem. Basically in early 2038 Unix dates will no longer fit in a signed 32bit integer so using a date just before then avoids triggering any code not yet updated to fix the problem. Root certificates take all chained certificates with them when they expire so from ...


12

Yup, it works just fine; a Windows certificate authority has no qualms about running as a subordinate to a non-Windows root. Tested with an OpenSSL root and a Windows 2008 R2 subordinate in Enterprise mode. A couple things to play nice with what the MS CA expects in the OpenSSL config: Valid AIA and CDP locations should apply to the root certificate, ...


11

Yeah, it sucks that Apple Mail does not support GPG. :-( I wish it did because I prefer GPG encrypted e-mail too. I also agree that information surrounding S/MIME and generating your own e-mail certificates is hard to come by. I found Paul Bramscher's webpage has a good description of how to create your own Certificate Authority certificate. I don't ...


10

If you host your own CA, it will only be valid in sites/computers that have your CA's root certificate installed. In other words, just because you have your own CA does not mean that your certificates will be trusted by strangers. If all your servers are in-house and accessed by in-house software, then your own CA is the way to go. You can deploy the CA's ...


10

Its generally considered good practice to have at least 2 Tiers. The root ca and the subordinate issuing CAs. The issuing CAs issue all the certificates to your machines or users and the root issues the subordinate CA certificates. This means you can turn off the root, when not commissioning a new subordinate CA, and protect that root by detatching it from ...


9

At the time of this writing I believe that with respect to deciding where to purchase a wildcard SSL certificate, the only factors that matter are the first year's cost of an SSL certificate, and the pleasantness of the seller's website (i.e. user experience) for the purchase and setup of the certificate. I am aware of the following: Claims about ...


9

You need to be joined to a domain to be an Enterprise CA, but you do not need to be domain joined in order to be a standalone CA. An Enterprise CA adds features that come along with being integrated with Active Directory, but the downside is that you cannot take it offline as you would do with a high-security root CA. Yes it is possible to install AD CS on ...


8

SSLCACertificateFile /var/cosign/certs/CA/publickey.pem Unless that PEM file actually contains the CA certificate for the client certificates you wish to grant access, this is incorrect; to provide apache with a certificate chain, use SSLCertificateChainFile instead. Apache must have the actual certificate and any intermediate certificates used to ...


8

I haven't tried this, but there is a PKI PowerShell provider from https://pspki.codeplex.com/ that has a lot of interesting looking functions like Revoke-Certificate followed by Remove-Request: Deletes specified certificate request row from Certification Authority (CA) Database. This command can be used to reduce CA database size, by deleting ...


8

Domain defaults for Windows allow the time to be off +/- 300 seconds before authentication stops working, so you'll be fine. Here's a fairly exhaustive article on the subject, which even mentions how to change your tolerance for time skew with a domain-level GPO. It's at Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account ...


8

Solved. You need to add "ssl" to the end of the listen. listen 443 ssl;


8

You can't do this, but there is no reason to. Unless you, for some strange reason, also used the CA certificate and key as an actual service-authorising certificate, on a machine exposed to the internet, on a service that supported TLS, it is not likely to have been compromised. You will notice that, in the mad flurry of updates post-heartbleed, one thing ...


8

Your assumptions are wrong - no public CA will issue you a certificate to use as your root certificate. You generate your own, self signed certificate authority and distribute it to clients to make them trust you. Then you use that to sign your certificates. All public CAs are self signed - they are included in your OS or browser because the OS vendor ...


8

In my experience most mail servers don't verify the certificate. I've used self signed certificates on my mail servers for TLS for years and haven't seen any problems with delivery. So I'd give that a try first and see if the systems you are having trouble communicating with still don't work. Postfix has a guide about different security levels for TLS ...


7

Depending on how serious you are, you should consider using FIPS 140-2 (http://en.wikipedia.org/wiki/FIPS_140#Security_levels) hardware to store CA keys and back-ups of those keys. You should have one root CA and one intermediate CA so you can keep your root CA offline and physically secured. The root is only needed to renew or sign new intermediate CAs, ...


7

If I understand your question, replacement root certificates would need to be redeployed to the clients. So odds are, their lifetime is set far enough out where there is little or no chance of the root cert expiring.


7

By default ADCS is set to issue certs for a maximum of 2 years (regardless of template or request). To change that just run the following two commands (modify as desired): certutil -setreg CA\ValidityPeriod "Years" certutil -setreg CA\ValidityPeriodUnits 10 Then restart certificate services: net stop certsvc net start certsvc


7

You can only have one AD CS certificate server at a time on a single instance of Windows Server OS. Edit: Also if you want to get serious about the physical security of the root CA, don't make it a VM. A VM can be booted up from the VM management console and then compromised. Make it a physical machine, use it to set up your policy CAs and issuing CAs, then ...


6

Because some software finds the correct keys by looking in the configured directory for a file with a given certificate hash. Hashing creates symlinks from the key id to the files with the human readable names.


6

Since this question's been rudely resurrected, something that hasn't been mentioned is the reissue of certificates. I didn't really understand what this meant until heartbleed came along. I'd assumed that meant they'd give you a second copy of your original certificate, and I wondered how disorganised one had to be to need that service. But it transpires ...


6

A ".pfx" file is a PKCS#12 archive: an archive file format for storing many cryptography objects as a single file. It is commonly used to [snip] bundle a X.509 certificate and all the members of a chain of trust. You imported the intermediate certificate together with SSL certificate.


6

If you mean applications using OpenSSL library for SSL, each application can either specify the (concatenated) file and/or (hash-linked) directory to be used for trusted certs, or it can invoke OpenSSL's defaults, or it could offer the choice. In the first case, you need to (be able and) configure the app what to specify. For example, in curl use --cacert ...


6

Free and signed by a CA: http://www.instantssl.com/ssl-certificate-products/free-email-certificate.html


6

Having dealt with the same scenario, here's an overview of the approach that I took: Get the new environment up and running, but don't give it any ability to issue certificates - use LoadDefaultTemplates=False in your capolicy.inf. While the devices are still set to not issue any templates, get everything squared away with the new environment, AIA ...



Only top voted, non community-wiki answers of a minimum length are eligible