#x509 — Public Fediverse posts

#DigiCert customer support compromised with .scr ZIP attachment 🤷

During our investigation between 2026-04-14 and 2026-04-17, as DigiCert identified certificates potentially affected by the threat actor’s actions, we revoked them. DigiCert revoked 60 certificates issued from the following CAs:

• DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1
• DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
• GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1
• Verokey High Assurance Secure Code EV

https://bugzilla.mozilla.org/show_bug.cgi?id=2033170

#x509 #infosec

Weekend Reads

* DDoS scrubbing in BGP
https://labs.ripe.net/author/shyam-krishna-khadka/understanding-ddos-scrubbing-in-bgp-five-leading-scrubbers/
* Revocation of X.509 certs
https://blog.apnic.net/2026/04/24/revocation-of-x-509-certificates/
* Mobile telecom surveillance actors
https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/
* Signalgate socio-technical analysis
https://arxiv.org/abs/2604.19711
* Inside a fake shops bulletproof host
https://www.netcraft.com/blog/fibergrid-inside-the-bulletproof-host

#BGP #DDoS #X509 #Cellular #Signal #Infosec

The Internet Last Week

* DigiCert CA bundle expiry
https://help.duo.com/s/article/9451
* Various US DoD route updates
https://www.cidr-report.org/cgi-bin/as-report?as=AS306
https://stat.ripe.net/widget/routing-history#resource=306&starttime=2026-03-29
https://www.cidr-report.org/cgi-bin/as-report?as=AS721
https://stat.ripe.net/widget/routing-history#resource=721&starttime=2026-03-29
https://www.cidr-report.org/cgi-bin/as-report?as=AS27064
https://stat.ripe.net/widget/routing-history#resource=27064&starttime=2026-03-29
https://www.cidr-report.org/cgi-bin/as-report?as=AS27065
https://stat.ripe.net/widget/routing-history#resource=27065&starttime=2026-03-29
* Quad9 enables DoH3 and DoQ
https://quad9.net/news/blog/quad9-enables-dns-over-http-3-and-dns-over-quic/

#DigiCert #X509 #BGP #USDoD #Quad9 #DNS

The Internet Last Week

* IETF 125
https://www.ietf.org/meeting/125/
* Cuba power outage effects
https://noc.social/@cloudflareradar/116240190351546459
https://mastodon.social/@IODA/116246041272623316
https://infosec.exchange/@dougmadory/116240466331483809
https://mastodon.social/@netblocks/116240861464667713
* IoT DDoS botnets disrupted
https://www.justice.gov/usao-ak/pr/authorities-disrupt-worlds-largest-iot-ddos-botnets-responsible-record-breaking-attacks
* Unallocated IP4 /13 announced
https://infosec.exchange/@spamhaus/116250561577999852
https://bgp.he.net/net/102.224.0.0/13
https://stat.ripe.net/widget/routing-history#resource=102.224.0.0/13&starttime=2026-03-15
* CAs must perform DNSSEC validation
https://cabforum.org/2025/06/18/ballot-sc-085v2-require-validation-of-dnssec-when-present-for-caa-and-dcv-lookups/
https://infosec.exchange/@mnordhoff/116240122433847371

#IETF125 #Cuba #Botnets #Bogons #DNSSEC #X509

RE: https://infosec.exchange/@paulehoffman/115889970411988081

Side note: this is why things like "multi-perapective corroboration" for domain validation do not work.

When every single packet to .ir nameservers and servers inside Iran pass through two (yes, 2!) gateways, then those controlling the gateways can acquire a valid domain validation certificate for any .ir domain or any server located in Iran.

#x509 #dns #dnssec #certificate

RE: https://abyssdomain.expert/@filippo/115674985400164090

An archive of all CT-logged certificates with all the tools needed for an analysis! No more scraping.

#ctlog #x509 #certificate

So @letsencrypt have put out a new blog post about shorter lives for certs moving forward (45days by 2028), but I've still not seen any movement on deploying the "shortlived" profile (and as a result IP address certs) from their post back in July. It's all been up on the test Staging servers since then.

Does anybody have any idea when this will finally go live?

It's in the docs, but no mention that it is restricted to invited users only still

https://letsencrypt.org/docs/profiles/#shortlived

#x509 #LetsEncrypt #ip

% openssl x509 -in /Applications/zoom.us.app/Contents/Resources/BBMMRoot.crt -text
…
Validity
Not Before: Feb 8 00:00:00 2010 GMT
Not After : Feb 7 23:59:59 2020 GMT
Subject: C=US, O=Thawte, Inc., CN=Thawte SSL CA
…

🧐

#Zoom #x509

It's been over half a year and the Internet still seems to be working.

Here's your regular reminder that #cname in #x509 is almost always irrelevant for the validation. If someone is using it, they are doing it wrong.

@petarov

Fortunately the #python #cryptography library has good code examples on how to actually get a #pki to work.

Roughly, #x509 provides one way trust and I need mutual trust in a distributed group.

So I find myself working on x509 certificates for #wireguard. Wireguard works with a key pair at each tunnel end. Adding certs to that sounds conceptually easy, but for me it's a struggle.

One of the most simultaneously useful and painful things you can ever learn in your IT/programming career is the X.509 standard.

#programming #x509 #pki

Refrescar el certificado X.509 de una entidad de certificación para OpenVPN, manteniendo sus firmas previas como válidas

https://blog.jcea.es/posts/20240521-refrescar_CA.html

#OpenVPN #x509 #hack

@letsencrypt any more news on when the short lived profile (and IP address SAN entries) will go live on production?

Or if I can get added to the test group?

#X509 #LetsEncrypt #certificates

Certbot only got a PR to enable IP address support with LetsEncrypt today.

Does anybody know of a ACME client that has support?

I want to test some things (both with LetsEncrypt and my local SmallStep CA)

https://github.com/certbot/certbot/pull/10468

#ACME #certificates #CertBot #X509

I was told that I'm too dumb to understand the threat of putting IP addresses in #x509 #cname, and after two months, the Internet seems to be working just fine.

RIP #Volksverschlüsselung, du wirst nicht vermisst werden! https://www.heise.de/news/Bald-ist-Schluss-Volksverschluesselung-wird-eingestellt-10637044.html

Warum wählen eigentlich Projekte, die verschlüsselte Kommunikation massentauglich machen wollen, regelmäßig so beknackte Nerd-Namen und -Akronyme? 🙄 Siehe auch p≡p.

#Security #Encryption #SMIME #X509 #Fraunhofer

We have just released the first version of voa-core, a #RustLang library for access to verifiers in #VOA structures. 🎁 🦀

https://crates.io/crates/voa-core/0.1.0

VOA, short for "File Hierarchy for the Verification of OS Artifacts", is a way of providing and using verifiers for digital signatures in a stateless manner, for various cryptographic technologies:
https://uapi-group.org/specifications/specs/file_hierarchy_for_the_verification_of_os_artifacts/

Thanks to @hko for his work on this and an upcoming #OpenPGP backend! 🥳

#UAPIGroup #ArchLinux #DigitalSignature #SSH #X509 #STF

Обзор нововведений Kubernetes 1.34: новая YAML-конфигурация и отслеживание здоровья устройств при DRA

Сегодня официально выпустили новую версию Kubernetes — 1.34. Собрали обзор со всеми изменениями. Среди главных нововведений — отслеживание здоровья устройств при DRA, тонкая настройка рестарта контейнеров в подах, асинхронная обработка API-вызовов, нативная доставка сертификатов X.509 в поды и новая разновидность YAML для описания конфигураций.

https://habr.com/ru/companies/flant/articles/940394/

#kubernetes #dra #kyaml #x509 #device_health #container_restart_rules #emptydir #Asynchronous_API_calls #планирование_подов #NominatedNodeName

One year after it's acquisition by the dutch company Total Specific Solutions (#TSS), #Buypass terminates it's free #X509 certificate service. Another European alternative to #LetsEncrypt bites the dust. So much for the #EU #sovereignty.

https://community.buypass.com/t/y4y130p

OK. Now that I understand how to create working S/MIME certificates for signed and/or encrypted eMail with my own Certificate Authority (CA), I can take it to the next level. Federated CAs. Decentralised trust relationships between CAs. https://smallstep.com/blog/step-v0.8.3-federation-root-rotation/

#SelfHost #CA #x509 #nerdcert

Happily sending around signed and encrypted emails that use S/MIME certificates that I created myself on my own CA. And as my mail server (that I also run myself) has DKIM, DMARC, SPF set up correctly, that also works. Nice!

#SelfHost #CA #SMIME #x509 #eMail

So now that I have my own s/mime certificate generated and installed, here's the SHA256 fingerprint:

19dae1a388af5c91e3dc53d89e3efdaef3f24878b9d37f809463ee801f3eae25

Should you get an email from me, it will be signed and with this fingerprint you can verify that indeed it was me who sent it.

I know almost no one will ever actually do this verification, but it is reassuring to me that you can :)

#SelfHost #email #SMIME #CA #x509

I have brain dumped the process at https://codeberg.org/jwildeboer/gists/src/branch/main/2025/20250803SmimeCertStepCA.md and will work on an extended version as blog post in the next few days. Big shoutout to @ben again for getting the process up and running in the first place!

If you want to get a signed email from me to see what happens in your mail client, DM me an email address and I will send a s/mime signed email to you :)

6/6

#SelfHost #eMail #SMIME #CA #x509

If I understand the whole s/mime stuff correctly, I can send you a signed email and your mail client should be able to extract my public key from that. You reply with a signed mail, I can extract your public key. Now we can send encrypted emails :) Your mail client/operating system won't trust my certificate as it is signed by my CA (Certificate Authority), but it should still work.

5/6

#SelfHost #eMail #SMIME #CA #x509

KEKS кодек и криптографические сообщения

Данная статья напоминает о проблемах X.509 PKI и реализаций ASN.1. Предлагает компактный, быстрый, детерминированный, потоковый и простой формат кодирования данных KEKS, а также криптографические сообщения для подписи и шифрования данных с поддержкой пост-квантовых алгоритмов.

https://habr.com/ru/articles/923810/

#c #go #python #keks #asn1 #x509 #openssl #криптография #pqc #hpke #pgp #cms

KEKS кодек и криптографические сообщения

Данная статья напоминает о проблемах X.509 PKI и реализаций ASN.1. Предлагает компактный, быстрый, детерминированный, потоковый и простой формат кодирования данных KEKS, а также криптографические сообщения для подписи и шифрования данных с поддержкой пост-квантовых алгоритмов.

https://habr.com/ru/articles/923810/

#c #go #python #keks #asn1 #x509 #openssl #криптография #pqc #hpke #pgp #cms

KEKS кодек и криптографические сообщения

Данная статья напоминает о проблемах X.509 PKI и реализаций ASN.1. Предлагает компактный, быстрый, детерминированный, потоковый и простой формат кодирования данных KEKS, а также криптографические сообщения для подписи и шифрования данных с поддержкой пост-квантовых алгоритмов.

https://habr.com/ru/articles/923810/

#c #go #python #keks #asn1 #x509 #openssl #криптография #pqc #hpke #pgp #cms

KEKS кодек и криптографические сообщения

Данная статья напоминает о проблемах X.509 PKI и реализаций ASN.1. Предлагает компактный, быстрый, детерминированный, потоковый и простой формат кодирования данных KEKS, а также криптографические сообщения для подписи и шифрования данных с поддержкой пост-квантовых алгоритмов.

https://habr.com/ru/articles/923810/

#c #go #python #keks #asn1 #x509 #openssl #криптография #pqc #hpke #pgp #cms