Tag Info

Hot answers tagged

394

SSL has been around for long enough you'd think that there would be agreed upon container formats. And you're right, there are. Too many standards as it happens. So this is what I know, and I'm sure others will chime in. .csr This is a Certificate Signing Request. Some applications can generate these for submission to certificate-authorities. The actual ...


46

PEM on it's own isn't a certificate, it's just a way of encoding data. X.509 certificates are one type of data that is commonly encoded using PEM. PEM is a X.509 certificate (whose structure is defined using ASN.1), encoded using the ASN.1 DER (distinguished encoding rules), then run through Base64 encoding and stuck between plain-text anchor lines (BEGIN ...


13

Sometimes a .crt file is already a .pem. See: http://stackoverflow.com/questions/991758/openssl-pem-key


12

You can register a private enterprise and then an OID will be allocated for your use as you see fit. There is no fee. It will be under iso.org.dod.internet.private.enterprise (1.3.6.1.4.1). For example, my company can use: 1.3.6.1.4.1.17992 for any internal and published applications that we develop. As voretaq7 points out, you need to internally organize ...


7

First of all - and in case other users happen to visit this page - there are only certain authentication methods that allow you to do promptless SSO. These are NTLM and Kerberos. LDAP - on the other hand - will never give you promptless SSO. NTLM is actually NTLMv1 and NTLMv2. These are very different and NTLMv1 is deprecated because of serious security ...


7

In direct response to "how secure is SFTP", the latest version of OpenSSH supports up to AES-256, 3DES and Blowfish. As to whether you need to encrypt the document before transferring it, it depends on what you're trying to achieve. Barring some breakthrough in quantum computing, the time it will take to brute-force a stolen SFTP data stream is not within ...


7

These are the settings for the certificate (certificate is a public key + (this) info signed by a Certificate authority). So in your case, these are you country (where you live, where your company is), province (same), city (same), organization name, email, common name (unique for this CA), name, and organizational unit - in this order. The last two lines ...


7

You can only have one AD CS certificate server at a time on a single instance of Windows Server OS. Edit: Also if you want to get serious about the physical security of the root CA, don't make it a VM. A VM can be booted up from the VM management console and then compromised. Make it a physical machine, use it to set up your policy CAs and issuing CAs, then ...


5

wikipedia there are excellent pages on SSL/TLS and most other crypto topics. as the tech changes, these pages will change with them.


5

re-use whatever cert I buy to chain trust back to Comodo for a local thatcompany.com Windows AD local root CA, which is yet to be built... ... Is there any other reason that we couldn't reuse this Comodo UC Wildcard Certificate to build a Windows local root CA? That's not possible - an end entity certificate issued to you will contain "Basic ...


4

No, the certificate signing request does not need to be encrypted, the certificate itself doesn't need to be encrypted. Only the private key associated with the CSR/CERT needs to be protected, and that should never be transmitted to another host.


4

You will need to modify your CA's CRL locations via the Certification Authority snap-in. Right-click on the CA, select 'Properties', then the Extensions tab. Select the 'CRL Distribution Point' extension and add the needed locations. Full instructions are located on Technet: http://technet.microsoft.com/en-us/library/ee649168(WS.10).aspx Unfortunately, ...


4

My answer is for the "Is there a smarter/simpler way to do this?" part of your question. This script was successful in removing a go daddy cert for me $Path = 'Cert:\LocalMachine\AuthRoot\' $CertList = @() $CertList = Get-ChildItem -Path $Path | Where-Object {$_.Issuer -like "CN=GO*"} foreach($Cert in $CertList){ remove-item ...


4

Yes, you can deploy the root and intermediate CAs into Windows trust stores from AD. At least IE and Chrome browsers will pick it up from there as they use whatever comes with Windows. In Firefox you will need to have the users import the certs themselves or find a way to script it. Thanks to @Aceth, here's a completion for the answer: I edit the default ...


4

No, PKIView.msc do not provide any automation means/capabilities. You have to write your own scripts. What I would suggest (sorry, no actual code, but a way to do this) is to consider the following plan and possible tools (assuming, you will use Windows PowerShell): enumerate all Enterprise Certification Authorities (by using ICertConfig interface) loop ...


3

Each CA will need to publish its own CA. The reason that it's not possible from a technical perspective to combine multiple CRLs is that each CRL needs to be cryptographically signed by the CA that generated it, so it's a 1-CA-to-1-CRL relationship.


3

You can give employees usb tokens/smartcards. You store the key on the card and it will never ever leave the token. When the someone leaves the organization you can get back the token as company property.


3

I've been doing the same due diligence and I too am concerned that all of the client tools and documentation seems to promote bad security best practices. I response to the question "do you really want to be reentering a pass phrase for every single command you enter?" -- yes, or at least I'm happy to have a tool like ssh-agent enter it for me. I don't ever ...


3

You could deploy your own PKI. You primary limitation will be getting all your customers to install your CA Cert as a Trusted Root certificate. That is, getting all of them to trust when you say a server is secure, it is (that's a very broad statement, and most IT depts will object). Otherwise what you propose would work. I might suggest looking into using ...


3

A bit late but anyways. Its generally not recommended to deploy CA role on a DC. It makes it hard to upgrade the AD as you have to inplace upgrade the DC for newer OS releases. This is awkard if moving from a 32-bit OS based DC to 64-bit OS's like Windows Server 2008 R2. Additionally as the preference is to promote clean built new DCs as opposed to inplace ...


3

Is the user a member of a security group that has Read and Enroll permission on the certificate template? That is required. Administering Certificate Templates http://technet.microsoft.com/en-us/library/cc725621%28v=ws.10%29 When you install certificates into the computer store and use auto-enrollment or manually request the certificate using the ...


3

When you see that particular error message, it means that the workstation you're logging on to cannot access the CRL for the CA that issued the DC's certificate. You need to make sure that the CRL published for the DC's certificate is both accessible and valid. I'm looking for some links to send you that further flesh out the issue and will edit the answer ...


3

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I correct? Correct. Your offline root CA will be a workgroup computer. You will only turn it on for the purposes of renewing the issuing CA certificates ...


3

Microsoft pushed an update in October of 2012 that made SSL certificates under 1024-bits not validate as secure. That particular update also removed weak-key validation for any certificates in the chain, which would include older Authorities signed with weak keys. The question is, will they do so again for 2048-bit certificates, and if so how soon? They ...


3

When using 802.1x certificate-based authentication on Windows machines, should I use different certificate for each machine? Yes, otherwise you may as well be using a shared passkey. Having a different certificate for each machine (or user) is how you prevent clients from being able to decrypt each others' traffic. If I should, how do I distribute ...


3

If the cert provider and the signing certificate are the same in both the old and the new certificates, then you can use the CRL link in the new certificate. This will list all of the certificates revoked under the signing certificate.


3

No, you cannot set an empty PIN on a Windows 8 Virtual Smart Card. At first I said "having a smart card with no PIN defeats the purpose." But that was too flippant of me. I have Bitlocker enabled on my laptop with a TPM, and I don't need to enter a PIN manually every time I boot up to unlock it. But the fact remains that you can't set an empty PIN on a ...


3

An Enterprise Certificate Trust List (CTL) gives you more granularity and control over exactly what types of certificates and for what purposes those certificates can be trusted. Simply distributing certificates via Group Policy doesn't give you much control over exactly how and under what circumstances those certificates are trusted on your clients. From ...


2

Yes, but you'll have to reissue your CA certificate and deal with all the knock-on effects of that. Short of invalidating it, there is no way to reduce the validity period of a certificate, it's encoded at create time.


2

How have you structured your CAs, a single CA, or many CAs? How quickly do you need certificates to be revoked? How are you using the certificates? If you are using the certificate for AD authentication, in the case of a serious emergency, you can temporarily disable the account if you believe a certificate for that account has been compromised. If you ...



Only top voted, non community-wiki answers of a minimum length are eligible