#certificateauthority — Public Fediverse posts

RE: https://mastodon.wolkenheim.eu/@Wolkensteine/116795057265112295

I'm now also working on a way to reliably integrate git-pages into my Home Lab. I am just missing an automated way of getting wildcard certificates from my local CA!

Since I don't know much of the technical details of ACME I decided that I wouldn't search for a ready-made tool to solve this problem, but build one myself, fully according to RFC3555.
I am not yet sold on making that open, since I will surely make some huge mistakes, but if others are interested in a tool to have DNS-01 challenges solved with a PiHole DNS provider I might open source the project when I am done with the basics and feel comfortable with it.

#coding #programming #rust #forgejo #gitpages #selfhosting #dns #acme #homelab #selfsignedcerts #certificateauthority

RE: https://mastodon.wolkenheim.eu/@Wolkensteine/116795057265112295

I'm now also working on a way to reliably integrate git-pages into my Home Lab. I am just missing an automated way of getting wildcard certificates from my local CA!

Since I don't know much of the technical details of ACME I decided that I wouldn't search for a ready-made tool to solve this problem, but build one myself, fully according to RFC3555.
I am not yet sold on making that open, since I will surely make some huge mistakes, but if others are interested in a tool to have DNS-01 challenges solved with a PiHole DNS provider I might open source the project when I am done with the basics and feel comfortable with it.

#coding #programming #rust #forgejo #gitpages #selfhosting #dns #acme #homelab #selfsignedcerts #certificateauthority

NTLM relay attacks are back from the dead https://www.helpnetsecurity.com/2025/07/04/ntlm-relay-attacks/ #certificateauthority #Expertanalysis #authentication #cybersecurity #Expertcorner #SpecterOps #Don'tmiss #Microsoft #Hotstuff #attacks #opinion #servers #News

NTLM relay attacks are back from the dead https://www.helpnetsecurity.com/2025/07/04/ntlm-relay-attacks/ #certificateauthority #Expertanalysis #authentication #cybersecurity #Expertcorner #SpecterOps #Don'tmiss #Microsoft #Hotstuff #attacks #opinion #servers #News

Let's #Encrypt rolls out free IP address #certificates • The Register

Let's Encrypt, a #CertificateAuthority (CA) known for its free TLS/SSL certificates, has begun issuing digital certificates for IP addresses.

It's not the first CA to do so. #PositiveSSL , #Sectigo, and #GeoTrust all offer TLS/SSL certificates for use with IP addresses, at prices ranging from $40 to $90 or so annually. But Let's Encrypt does so at no cost.
#security #tls #ssl #privacy

https://www.theregister.com/2025/07/03/lets_encrypt_rolls_out_free/

Let's #Encrypt rolls out free IP address #certificates • The Register

Let's Encrypt, a #CertificateAuthority (CA) known for its free TLS/SSL certificates, has begun issuing digital certificates for IP addresses.

It's not the first CA to do so. #PositiveSSL , #Sectigo, and #GeoTrust all offer TLS/SSL certificates for use with IP addresses, at prices ranging from $40 to $90 or so annually. But Let's Encrypt does so at no cost.
#security #tls #ssl #privacy

https://www.theregister.com/2025/07/03/lets_encrypt_rolls_out_free/

Hm, do Firefox and Vivaldi really not accept my system-wide custom CA(s)? On Windows, at least Firefox works fine if you set “security.enterprise_roots.enabled” to true, but on Linux it doesn't seem to make any difference. While in Firefox I can at least import a custom CA, I can't find anything similar in Vivaldi. 🤔

#firefox #vivaldi #ca #linux #certificateAuthority

Hm, do Firefox and Vivaldi really not accept my system-wide custom CA(s)? On Windows, at least Firefox works fine if you set “security.enterprise_roots.enabled” to true, but on Linux it doesn't seem to make any difference. While in Firefox I can at least import a custom CA, I can't find anything similar in Vivaldi. 🤔

#firefox #vivaldi #ca #linux #certificateAuthority

Google is shaking up web security by ditching certificates from Chunghwa Telecom and Netlock after repeated slip-ups. Could your website be at risk? Dive into the details!

https://thedefendopsdiaries.com/googles-strategic-move-to-enhance-web-security-by-distrusting-chunghwa-telecom-and-netlock-certificates/

#google
#websecurity
#certificateauthority
#chunghwatelecom
#netlock

Best talk I've seen on #Peergos so far https://www.youtube.com/watch?v=yDU4GHsEo34 #E2EE, no #DNS, no #CertificateAuthority, #privacy #security

The Importance of Code Signing Best Practices in the Software Development Lifecycle – Source: securityboulevard.com https://ciso2ciso.com/the-importance-of-code-signing-best-practices-in-the-software-development-lifecycle-source-securityboulevard-com/ #HardwareSecurityModules(HSMs) #CertificateAuthority(CA) #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CertificateManagement #CyberSecurityNews #SecureCodeSigning #SecurityBoulevard #codesigning #CA/BForum #ISO27001 #NIST #SOC2

The Importance of Code Signing Best Practices in the Software Development Lifecycle – Source: securityboulevard.com https://ciso2ciso.com/the-importance-of-code-signing-best-practices-in-the-software-development-lifecycle-source-securityboulevard-com/ #HardwareSecurityModules(HSMs) #CertificateAuthority(CA) #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CertificateManagement #CyberSecurityNews #SecureCodeSigning #SecurityBoulevard #codesigning #CA/BForum #ISO27001 #NIST #SOC2

Got the notification by #LetsEncrypt that they will sunset the #email #certificate expiration warning. Albeit, I am a fan of it, since I have not automated all of my certificates, I can understand their argument of complexity of a system.

Albeit, I don't get, how this service costs an organization tens of thousands of dollars a year, but I do understand that operating #mail servers yourself is something the modern #Internet discourages increasingly.

More on it, in their latest blog post.

#TLS #CertificateAuthority

Got the notification by #LetsEncrypt that they will sunset the #email #certificate expiration warning. Albeit, I am a fan of it, since I have not automated all of my certificates, I can understand their argument of complexity of a system.

Albeit, I don't get, how this service costs an organization tens of thousands of dollars a year, but I do understand that operating #mail servers yourself is something the modern #Internet discourages increasingly.

More on it, in their latest blog post.

#TLS #CertificateAuthority

Shorter TLS certificate lifespans expected to complicate management efforts https://www.helpnetsecurity.com/2024/08/09/certificate-lifespans/ #certificateauthority #quantumcomputing #cybersecurity #certificates #report #Venafi #News

Shorter TLS certificate lifespans expected to complicate management efforts https://www.helpnetsecurity.com/2024/08/09/certificate-lifespans/ #certificateauthority #quantumcomputing #cybersecurity #certificates #report #Venafi #News

DigiCert Revokes Thousands of SSL Certificates Over Validation Error https://thecyberexpress.com/digicert-ssl-certificates-validation-error/ #CertificateAuthority #TheCyberExpressNews #CybersecurityNews #DomainValidation #CA/BrowserForum #SSLCertificates #TheCyberExpress #Websitesecurity #CyberSecurity? #OnlineSecurity #TechnicalError #FirewallDaily #DataSecurity #DigiCert

DigiCert Revokes Thousands of SSL Certificates Over Validation Error https://thecyberexpress.com/digicert-ssl-certificates-validation-error/ #CertificateAuthority #TheCyberExpressNews #CybersecurityNews #DomainValidation #CA/BrowserForum #SSLCertificates #TheCyberExpress #Websitesecurity #CyberSecurity? #OnlineSecurity #TechnicalError #FirewallDaily #DataSecurity #DigiCert

Google Chrome putting Entrust root CAs in the not-trustworthy bucket

https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html

#Entrust #CertificateAuthority

Google Chrome putting Entrust root CAs in the not-trustworthy bucket

https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html

#Entrust #CertificateAuthority

SSH vs. SSL/TLS: What’s The Difference? – Source: securityboulevard.com https://ciso2ciso.com/ssh-vs-ssl-tls-whats-the-difference-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #certificateauthority #CyberSecurityNews #SecurityBoulevard #NetworkSecurity #ssh

SSH vs. SSL/TLS: What’s The Difference? – Source: securityboulevard.com https://ciso2ciso.com/ssh-vs-ssl-tls-whats-the-difference-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #certificateauthority #CyberSecurityNews #SecurityBoulevard #NetworkSecurity #ssh

EJBCA: Open-source public key infrastructure (PKI), certificate authority (CA) https://www.helpnetsecurity.com/2024/04/09/ejbca-open-source-pki-ca/ #certificateauthority #authentication #opensource #Don'tmiss #Hotstuff #software #GitHub #News #PKI

EJBCA: Open-source public key infrastructure (PKI), certificate authority (CA) https://www.helpnetsecurity.com/2024/04/09/ejbca-open-source-pki-ca/ #certificateauthority #authentication #opensource #Don'tmiss #Hotstuff #software #GitHub #News #PKI

New #blog posted! Check out how you can run your own private #StepCA #CertificateAuthority with #ACME and #Certbot totally private, disconnected from the internet. Run your own #LetsEncrypt at home!
#HomeLab #Security
https://mteixeira.wordpress.com/2024/03/03/running-your-private-certificate-authority-with-acme-support/

New #blog posted! Check out how you can run your own private #StepCA #CertificateAuthority with #ACME and #Certbot totally private, disconnected from the internet. Run your own #LetsEncrypt at home!
#HomeLab #Security
https://mteixeira.wordpress.com/2024/03/03/running-your-private-certificate-authority-with-acme-support/

And, after some hard work, and a few struggles with #Docker, #DNS and #Firewall rules, I finally have been able to install #StepCA from #SmallStep on my #HomeLab, so now I have a nice private #CertificateAuthority with which I can use #Certbot to manage my service certificates in a #LetsEncrypt style. Took a lot of notes. Blog post will come eventually! (too tired right now)
https://smallstep.com/docs/step-ca/

And, after some hard work, and a few struggles with #Docker, #DNS and #Firewall rules, I finally have been able to install #StepCA from #SmallStep on my #HomeLab, so now I have a nice private #CertificateAuthority with which I can use #Certbot to manage my service certificates in a #LetsEncrypt style. Took a lot of notes. Blog post will come eventually! (too tired right now)
https://smallstep.com/docs/step-ca/

Well, there goes that idea... I had no idea that Kubes had so many certificates/CA roles. Let's Encrypt won't sign sub CA (which makes sense), so I'll have to rely on my CA stack in Vault.

Now I have a new problem... do I split my dns/certs into lab.fqdn.dev and fqdn.local (where the .dev DNS uses Lets Encrypt and the .local uses Vault?)

If so, I'll need to add a new layer to my DNS automation and create a new fqdn.local domain in PowerDNS...

What a fun way to spend Christmas Eve Eve.

#kubernetes #hashicorpvault #certificateauthority #letsencrypt #homelab

Well, there goes that idea... I had no idea that Kubes had so many certificates/CA roles. Let's Encrypt won't sign sub CA (which makes sense), so I'll have to rely on my CA stack in Vault.

Now I have a new problem... do I split my dns/certs into lab.fqdn.dev and fqdn.local (where the .dev DNS uses Lets Encrypt and the .local uses Vault?)

If so, I'll need to add a new layer to my DNS automation and create a new fqdn.local domain in PowerDNS...

What a fun way to spend Christmas Eve Eve.

#kubernetes #hashicorpvault #certificateauthority #letsencrypt #homelab

eIDAS: EU Enforcing Gov Approved HTTPS Certs Presents MITM Threat

#News #Tech #infosec #Europe #eIDAS #mitm #cybersecurity #governance #https #TLS #certificateAuthority #Peertube #privacy #surveillance #www #web #internet

https://tube.tchncs.de/w/ssskMM6dNG8hM1FUzP4xfA

eIDAS: EU Enforcing Gov Approved HTTPS Certs Presents MITM Threat

#News #Tech #infosec #Europe #eIDAS #mitm #cybersecurity #governance #https #TLS #certificateAuthority #Peertube #privacy #surveillance #www #web #internet

https://tube.tchncs.de/w/ssskMM6dNG8hM1FUzP4xfA

Let's Encrypt is apparently the Certificate Authority competitor Cloudflare trusts the most.

#CloudFlare #LetsEncrypt #SSL #CertificateAuthority

Let's Encrypt is apparently the Certificate Authority competitor Cloudflare trusts the most.

#CloudFlare #LetsEncrypt #SSL #CertificateAuthority

Today, I stumbled upon my first find of a #domain squatting. Without going into details, who it was, I would still like to share the giveaways, how I spotted it:

Firstly, the original domain was a .com, whereas the imposter had the same name, but on a #ngTLD which provides a fairly cheap first-year pricing model.

Secondly, resolving the original domain name returned two A records, which is not uncommon for redundancy reasons. Both IPs were hosted in the same large #cloud provider. In contrast, the squatter had only a single A record, in a different ASN.

Let's stay in #DNS: The NS records of the squatter also pointed to different nameservers than the victim.

Additionally, the original website forwarded any http request to the #https endpoints and also had a nice little chat popping up, when visiting the website. The squatter website looked exactly the same, however had no forwarding to HTTPS, neither the dynamic elements of the website such as the chat.

Another give-away was the #certificateauthority. The original website used a commercial CA, whereas the imposter used the non-profit certificate authority #LetsEncrypt. Nothing wrong with LetsEncrypt, but it is a logical choice for adversaries since it signs domain names free of charge.

And last but not least, the #whois lookups for both domains point to different registries and different abuse contacts.

What I try to share in this post: There are many indicators for domain squatting or #phishing sites. One has to pay attention to details, and there are multiple indicators for a malicious website. Just from the looks, the imposter was indistinguishable from the original. Yet, the details gave it away. The right people were informed, and it will be taken care of. Have a good rest of the weekend, everyone!

Today, I stumbled upon my first find of a #domain squatting. Without going into details, who it was, I would still like to share the giveaways, how I spotted it:

Firstly, the original domain was a .com, whereas the imposter had the same name, but on a #ngTLD which provides a fairly cheap first-year pricing model.

Secondly, resolving the original domain name returned two A records, which is not uncommon for redundancy reasons. Both IPs were hosted in the same large #cloud provider. In contrast, the squatter had only a single A record, in a different ASN.

Let's stay in #DNS: The NS records of the squatter also pointed to different nameservers than the victim.

Additionally, the original website forwarded any http request to the #https endpoints and also had a nice little chat popping up, when visiting the website. The squatter website looked exactly the same, however had no forwarding to HTTPS, neither the dynamic elements of the website such as the chat.

Another give-away was the #certificateauthority. The original website used a commercial CA, whereas the imposter used the non-profit certificate authority #LetsEncrypt. Nothing wrong with LetsEncrypt, but it is a logical choice for adversaries since it signs domain names free of charge.

And last but not least, the #whois lookups for both domains point to different registries and different abuse contacts.

What I try to share in this post: There are many indicators for domain squatting or #phishing sites. One has to pay attention to details, and there are multiple indicators for a malicious website. Just from the looks, the imposter was indistinguishable from the original. Yet, the details gave it away. The right people were informed, and it will be taken care of. Have a good rest of the weekend, everyone!

I'm out of practice on all things web tech, it's been just over two years since I got fired, but I did get compatible versions of #PHP, #MySQL, and #WordPress installed and running on my laptop (2016 #MacBookPro running #Monterey/ #MacOS 13) today, most of it from the command line.

It was a struggle at some points, particularly troubleshooting the MySQL WordPress connection and learning how to generate my own local #CertificateAuthority and signing PHP.

Next: configure #SSL, another new task

I'm out of practice on all things web tech, it's been just over two years since I got fired, but I did get compatible versions of #PHP, #MySQL, and #WordPress installed and running on my laptop (2016 #MacBookPro running #Monterey/ #MacOS 13) today, most of it from the command line.

It was a struggle at some points, particularly troubleshooting the MySQL WordPress connection and learning how to generate my own local #CertificateAuthority and signing PHP.

Next: configure #SSL, another new task

PGPainless meets the Web-of-Trust

We are very proud to announce the release of PGPainless-WOT, an implementation of the OpenPGP Web of Trust specification using PGPainless.

Big thanks to Heiko for his valuable contributions and the great boost in motivation working together gave me 🙂
Also big thanks to NLnet for sponsoring this project in such a flexible way.
Lastly, thanks to Wiktor for his talent to connect people 😀

https://blog.jabberhead.tk/2023/07/25/pgpainless-meets-the-web-of-trust/

#certificateauthority #gpg #openpgp #pgp #pgpainless #pgpki #sequoia #weboftrust #wot

@arichtman as far as understand:

1) Go to a commercial #certificateAuthority and get an #email signing #certificate.
2) Download the certificate to an „Offline storage (e.g. usb in safe)“
3) Add this cert to a #Fido2 #key (if paranoia level is medium to high) otherwise to your local installed email clients. (Attention not every key has the capability… see https://docs.google.com/spreadsheets/d/1o_l6ieNRgf4IDYFcTNuw2st96VjrB-djtT2BMRhRDbI/edit?usp=sharing)
4) Send a signed mail to your contacts (they have to save the pub keys)
5) Send the encrypted mails to your contacts

Problem I see: many clients e.g. outlook are crappy in handling pgp. Is there good ones as well?

I am also interested in a good guide!

@arichtman as far as understand:

1) Go to a commercial #certificateAuthority and get an #email signing #certificate.
2) Download the certificate to an „Offline storage (e.g. usb in safe)“
3) Add this cert to a #Fido2 #key (if paranoia level is medium to high) otherwise to your local installed email clients. (Attention not every key has the capability… see https://docs.google.com/spreadsheets/d/1o_l6ieNRgf4IDYFcTNuw2st96VjrB-djtT2BMRhRDbI/edit?usp=sharing)
4) Send a signed mail to your contacts (they have to save the pub keys)
5) Send the encrypted mails to your contacts

Problem I see: many clients e.g. outlook are crappy in handling pgp. Is there good ones as well?

I am also interested in a good guide!

Weekend Reads:

* Internet Protocol Journal 2023-06 https://ipj.dreamhosters.com/wp-content/uploads/2023/05/261-ipj.pdf
* Aggressive net scanners impact https://arxiv.org/abs/2305.07193
* Cert-based DNS censor detection https://arxiv.org/abs/2305.08189
* CA diversity https://www.netmeister.org/blog/caa-diversity.html
* CA trustworthiness https://www.splunk.com/en_us/blog/security/trust-unearned-evaluating-ca-trustworthiness-across-5-billion-certificates.html

#IPJ #Scanning #DNS #CertificateAuthority

Weekend Reads:

* Internet Protocol Journal 2023-06 https://ipj.dreamhosters.com/wp-content/uploads/2023/05/261-ipj.pdf
* Aggressive net scanners impact https://arxiv.org/abs/2305.07193
* Cert-based DNS censor detection https://arxiv.org/abs/2305.08189
* CA diversity https://www.netmeister.org/blog/caa-diversity.html
* CA trustworthiness https://www.splunk.com/en_us/blog/security/trust-unearned-evaluating-ca-trustworthiness-across-5-billion-certificates.html

#IPJ #Scanning #DNS #CertificateAuthority

Of course, now that I’ve laboriously set up my #homelab #StepCA #CertificateAuthority, I am finding that #Pfsense and the #TrueNASScale #TrueCharts apps for #Traefik and #CertManager don’t integrate easily via #ACME custom servers or otherwise. 🤦‍♂️

Of course, now that I’ve laboriously set up my #homelab #StepCA #CertificateAuthority, I am finding that #Pfsense and the #TrueNASScale #TrueCharts apps for #Traefik and #CertManager don’t integrate easily via #ACME custom servers or otherwise. 🤦‍♂️

Happy that I’ve successfully set up my own local #homelab #x509 and #SSH #CertificateAuthority with #StepCA. I imported a root #CA chain that I generated on my own separately.

From this, I learned that StepCA did not like the human-readable headings — above the “BEGIN CERTIFICATE” statements — in .crt/.pem files that #OpenSSL generated. I don’t know they are called or any CLI option that added them to the #PEM files. However, when I removed the headers, the StepCA server started without error.

What is the difference between a signed CSR and a leaf certificate?

https://security.stackexchange.com/questions/269270/what-is-the-difference-between-a-signed-csr-and-a-leaf-certificate

#certificateauthority #certification #tls

Does a certificate revocation list (CRL) keep it's entries at least as long as the certificate would have been valid?

https://security.stackexchange.com/questions/269076/does-a-certificate-revocation-list-crl-keep-its-entries-at-least-as-long-as-t

#certificaterevocation #certificateauthority #certificates

Over what fields is the X509 hash computed over? [duplicate]

https://security.stackexchange.com/questions/268498/over-what-fields-is-the-x509-hash-computed-over

#publickeyinfrastructure #certificateauthority #digitalsignature #certificates #tls