Skip to main content
The 2026 Annual Developer Survey is live— take the Survey today!

All Questions

Ask Question
Tagged with or
1,934 questions
Newest Active Bountied Unanswered

Question list filters

Filter by
Sorted by
Tagged with
Filter by Employee ID
Best practices
0 votes
2 replies
59 views

Context I'm operating a PKI based on step-ca (Smallstep), version 0.30.2, to issue short-lived certificates: SSH (user and host) TLS/X.509 (internal services) The CA sits behind its own ...
Score of 1
1 answer
68 views

I have a custom SBL I wrote for a SoC. When I do my release builds I want to put the name of the release as a human readable string in the X.509 certificate that is attached to the release binary. I ...
Score of 0
0 answers
90 views

In Go 1.24.0 there is an additional parameter in x509.VerifyOptions to be included when verifying X.509 certificate. The problem is that if my X.509 ceritificate doesn't contain any policies or ...
Score of 0
1 answer
89 views

SubjectAlternativeNameBuilder doesn't provide a method to add _Registered Id_ attribute, so, I'm trying to use reflection to achieve my goal: var assembly = typeof(SubjectAlternativeNameBuilder)....
Advice
0 votes
0 replies
94 views

The X509_get_signature_info() function allows the public/private key nid (pknid) to be returned for an X509 certificate, with examples like "RSA". To be nice to people, we want to offer ...
Advice
0 votes
2 replies
445 views

I am getting the below SSL error when my Java (Java 21, Spring Boot 3/4) application makes a REST call to a gateway: Internal server error: (certificate_unknown) PKIX path building failed: sun....
Score of 0
0 answers
109 views

I'm building a Flutter app that uses Android TV Remote Protocol v2. The app requires client certificates for authentication. When I use a manually created certificate (placed in assets), everything ...
Score of 0
0 answers
404 views

We're configuring a Keycloak (v26) authentication flow and are trying to gather some information from the UPN in the client certificate. Here's what that client certificate contains on the OtherName (...
Score of 0
1 answer
177 views

HOW TO EXTRACT NONCE FROM APPLE ATTEST CMS RECEIPT? I'm working on a server implementation to validate Apple's iOS device App Attest protocol, specifically validating the attestation (receipt) on the ...
Score of 4
1 answer
456 views

I'm trying to connect my .NET (8.0) application to IBM MQ over TLS using X.509 certificate-based authentication, but running into issues during the SSL handshake. Using Python + pymqi, I was able to ...
Score of 0
0 answers
230 views

I read that a machine certificate can be created without a subject name if it has a subject alternative name. My use case is to generate such a certificate and use it for certificate chain ...
Score of 1
0 answers
243 views

We are communicating to an external server through HttpClient using mutual TLS. They provided us the following OpenSSL command to create the private key and the CSR: openssl genrsa -aes256 -out ...
Score of 0
0 answers
332 views

Is there any way to connect to SQL Server 2022 using Client Certificate Authentication using an X.509 cert? From everything I can see it looks like this is not possible but where I am confused is it ...
Score of 0
1 answer
152 views

Using X.509 certificate stored in a hardware security module (HSM), how can my IoT device establish a secure connection with IoT hub doing proof of possession challenge? All samples I have seen assume ...
Score of 4
2 answers
173 views

Im trying to implement this in C: openssl req -new -config client.config -key ./my-key.pem -out certreq.csr client.config has this ... [ req_attributes ] challengePassword = password ... so ...
Score of 0
0 answers
82 views

I am running a part of the open-source fleet code from: https://github.com/fleetdm/fleet/blob/7fd9d8a3e9de47ab325882dd5e46035a81d26617/tools/mdm/windows/poc-mdm-server/mde_enrollment.go When I use ...
Score of 0
1 answer
81 views

I am trying to load a private key and a certificate bundled in a PKCS12 file using Java's Keystore#load. The PKCS12 file uses no password and is intended for two-way TLS connections (TLS client-...
Score of 1
1 answer
144 views

I'm trying to generate a Certificate Signing Request (CSR) using Bouncy Castle in CFML/Lucee. The CSR needs to include Subject Alternative Names (SANs) for both DNS names and IP addresses. However, I'...
Score of 2
1 answer
294 views

I am setting up a PKI for local test environment. It's based on SmallStep and Traefik in Docker and I am trying to use name constraints to just the domains I use. Template for root CA: { "...
Score of 0
0 answers
213 views

I am trying to use client certificate in my C# web APIs in order to sign generated PDF document(s). I managed to allow client certificate in Startup.cs using the following code: services.Configure<...
Score of 1
1 answer
580 views

From a third party I'm receiving an ecdsa public key in uncompressed format I wrote a basic parser (without any checks) that works for the specific key I am getting: func HexToPublicKey(data []byte) *...
Score of 0
1 answer
134 views

I ran into an issue of a segfault when calling X509_STORE_CTX_init. gdb showed it was calling X509_STORE_CTX_free on the 1st arg X509_STORE_CTX. This link https://linux.die.net/man/3/...
Score of 2
0 answers
277 views

I'm trying to validate a peer cert on a server using a crl in tls but I'm getting "invalid certificate verification context" when calling X509_verify_cert. I've set up my TLS server as below....
Score of 0
1 answer
249 views

I'm using Windows 11, i created a selft signed certificate in pfx format with appropriate keyUsage, basicConstraints and SubjectKeyIdentifier in order to make a CA Certificate. I added this ...
Score of 1
1 answer
595 views

Information I am trying to connect to MongoDB Atlas cluster using Datagrip as a DB client and authenticating by an Atlas managed x.509 certificate which I got when setting up a user in MongoDB Atlas ...
Score of 1
1 answer
330 views

I am unsuccessfully trying to use Go to parse a TPM2.0 public key. The error that I receive seems to indicate that the parsing fail due to some sort of 'structure error'. The full error is shown below....
Score of 0
1 answer
187 views

I would like to ask if this is possible. I kept on having problem with my certificate because i set x509_get_notBefore to 0. I received Certificate Unknown error from time to time my assumption is ...
Score of 0
1 answer
542 views

Description Greetings, I'm trying to authenticate to a client (myclient_mTLS) with mTLS (x509) authentication and I'm getting 401 unauthorized. I'm deploying keycloak on AWS on an EC2 instanced served ...
Score of 0
0 answers
576 views

I’m setting up mTLS to secure communication between my application’s components, specifically Service A and Service B. I’ve issued server certificates for both Service A and Service B, and they trust ...
Score of 3
1 answer
296 views

I am trying to write C code to verify a certificate, including checking the CRL to check if it is revoked. Certificate chain Here is the chain of certs, edited for privacy and brevity: mycert.pem ...
Score of 0
1 answer
102 views

I have a vague idea between REQUIRE SSL and REQUIRE X509, I just don't understand how the client and server relationship works in terms of securing the connection. With REQUIRE SSL, the connection ...
Score of -1
1 answer
53 views

I create a Certificate Path with Java. It is presented as an object CertPath and then as a Base64 string for output. // certificates that build a chain: rootcert -> intermediatecert -> mycert ...
Score of 0
1 answer
282 views

I'm trying to import a private key to sign an XML file in NodeJS. To sign the XML, I'm using xmldsigjs which requires the key to be passed in a CryptoKey object that is obtained by crypto.subtle....
Score of 0
0 answers
148 views

The X.509 certificate created through self programming cannot display the certificate hierarchy properly in the certificate viewer of Chrome browser. Is there any missing information? 1.in browser 2....
Score of 0
1 answer
615 views

I want to generate a v3 certificate which contains the PrivateKeyUsagePeriod extension. I have created an opnessl.cnf configuration file which contains the privateKeyUsagePeriod under [v3_req] but the ...
Score of 0
0 answers
204 views

I am trying to set up a simple client and server using python-mbedtls, where only the server shall be certificated via one intermediate certificate. I was able to make it work without an intermediate ...
Score of 2
2 answers
507 views

I am trying to create subscriptions in the Graph API, and I'm looking at trying to include the resource data. I've been reading through this Microsoft documentation to try and create the keys in code, ...
Score of 1
1 answer
1338 views

I'm trying to connect an external IdP to Keycloak, so that I have "Login with [X, an external system]" feature. I managed to configure it so that the IdP returns a response with the ...
Score of 0
1 answer
392 views

I have created a self-signed certificate and stored it in the personal certificates store. When I double-click on the certificate in mmc, it indicates 'You have a private key that corresponds to this ...
Score of 1
3 answers
285 views

I am trying to import a certificate to the device keychain, which I am getting my API. I have used these references to save received data in certificate format. references: (SecPKCS12Import returns ...
Score of 0
0 answers
173 views

I want to to print the CN,issuer and dates of a certificate chain containing one certificate and the intermediate certificate : $ grep -c BEGIN.CERTIFICATE myCert.pem 2 $ So I tried this : $ openssl ...
Score of 7
0 answers
691 views

My C++ application (WinSCP) connects to my server to check for new versions. The HTTPS code uses neon and OpenSSL libraries. I'm verifying the TLS certificate using CertVerifyCertificateChainPolicy ...
Score of 0
1 answer
186 views

I am doing an assignment where I have a CA (server) and a client that requests a certificate from the CA, this function works. The certificate is sent via tcp as bytes. The idea is that clients will ...
Score of 2
0 answers
130 views

I'm encountering issues with validating the signature of a decoded SAML response in Python using its corresponding public key. Despite implementing the verification process, I consistently receive a &...
Score of 0
1 answer
480 views

I have created a https CRL in both DER and PEM format, but it looks like openssl isn't even attempting to reach out to my distribution point to get the CRL. Both the int and root ca issuers are ...
Score of 1
0 answers
332 views

I have an ED25519 key inside an HSM and I want to use it to produce a self-signed X509 certificate. I'm using OpenSSL version 3.3.0 to construct/produce the self-signed certificate. As far as I can ...
Score of 0
0 answers
1593 views

Pulling from Docker Hub I get: error pulling image configuration: download failed after attempts=6: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time ...
Score of 0
1 answer
142 views

I'm currently in the process of upgrading several Mongodb servers that don't use authentication at all to use x509 certificates for authentication. During this process, I'd like the client to be able ...
Score of 0
0 answers
321 views

We've generated a Key Pair/Certificate using Keystore Explorer. This is self-signed by following these steps: generate csr from the generated cert; sign the csr using the generated cert; import the ...
Score of 0
0 answers
490 views

I was using module cryptography.x509 sign certificate,when I want to verify the server cert,I got this error:Certificate is missing required extension,what extension I miss? I'm new to this sign and ...

1
2 3 4 5
…
39