2013
- What's in a certificate chain and why?
Have you ever wondered why your web server certificate has a “chain” of other certificates associated with it?
- How to generate and send a timestamp request for Authenticode
When code is signed with a digital certificate the signature can not be relied upon past the validity of the certificate that was used because you don't know when the signature was applied. If you trusted it beyond that…
- How to generate and send an RFC3161 timestamp with OpenSSL and curl
For me the blog is this odd mix of diary and technical notes, this time I guess the post is more of a technical note -- here is a quick guide on how to generate RFC 3161 time-stamps using OpenSSL and curl.
- The weaknesses of fingerprint based authentication
I love security people, were paranoid, were fun, we think outside of the box but we are also human and often times get distracted by dogma and shiny objects. I think this happens a lot when talking about stuff like…
- Thoughts on Apple and fingerprint based biometrics
Yesterday Apple finally confirmed what their acquisition of Authentec was all about, integrating fingerprint based biometrics in the iPhone. This was not exactly a surprise but its one thing to know they were going to do…
- The origin of the Windows Biometric Framework
One of the projects I was responsible for when I was at Microsoft was the design and delivery of the Windows Biometric Framework. This was actually one of my favorite projects during my entire tenure at the company.
- The (soon to be) not-so Common Name
If you are reading this post you are probably familiar with the use of digital certificates in SSL even if you are you may not be familiar with their history. Before we go there though we should start with what, at its…
- Strategies for Deploying 2FA
Two Factor Authentication (2FA) enables applications and services to tie the usage of a two things (typically something you know and something you have) to user accounts so that both factors must be proven prior to the…
- Windows Certificate Enrollment Protocols
Windows has two sets of certificate enrollment protocols; these protocols are used to enable a client to acquire and maintain certificates with little to no manual interaction.
- DCOM and your Firewall
DCOM (Distributed Component Object Model) is a framework used by Windows to allow COM components to work over the network.
- Enterprise logon with challenge response (OTP) tokens
So from time to time I am asked about how to add support for a new authentication method for Windows Logon, the answer to that question is buried in what authentication methods Windows natively supports.
- How to redirect POST’s based on their Content-Type in Nginx
Time, it gives everything context especially in Public Key Infrastructure (PKI).
- Deploying forward secrecy on RedHat, Centos or Fedora based systems
If you want to deploy perfect forward secrecy and you use a RedHat, Centos or Fedora based system you likely won't be able to do so without building your own OpenSSL. This is because by default the OpenSSL packages for…
- How to Build Your Own OpenSSL
So you have been reading all the press on forward secrecy and want to deploy it? But does your OpenSSL support it? Thankfully it is easy to tell, just run this command:
- Example IIS SSL / TLS configuration
Configuring your web server for SSL can be a little overwhelming. In the case of IIS (In this post I am assuming you are running 2008 R2 or later) it often requires navigating a myriad of screens and sometimes may…
- Deploying SSL – Beyond the certificate and cipher suites
If you were to go do a search on the internet for “configuring SSL” you would find a ton of references on configuring your favorite web server to do SSL some of it good and some of it not so good. But what you don’t see…
- Deploying SSL – How to get your server configuration right
They say the most complicated skill is to be simple; despite SSL and HTTPS having been around for a long time, they still are not as simple as they could be.
- How to do a quick and dirty benchmark on a smart card
So you have to make a decision on which smart card or crypto token you’re going to use on a given project, there are lots of things to consider including price, platform support, certifications, build and software…
- How to get the latest stable OpenSSL, Apache and Nginx
Unfortunately many distributions are slow to pick up the most recent distributions of these core software packages. I see many arguments why this not a problem, the most common being the enterprise distributions backport…
- Example Nginx SSL / TLS configuration
Configuring your server for SSL can be a little overwhelming. To help with this I am writing three posts (one for Nginx, Apache and IIS) with example configurations that (to the extent possible) result in the same…
- Average CRL size and download time
The other day I had a great conversation with Robert Duncan over at Netcraft, he showed me some reports they have made public about CRL and OCSP performance and uptime.
- How not to collect sensitive information
So I was chatting with a friend today about the recent Register article about TeliaSonera’s application to add a new root into into the Mozilla root program.
- A look at revocation repository uptime
It is no secret that in the last two months GlobalSign was affected by outages at relating to our use of CloudFlare. I won’t go into the specifics behind those outages because the CloudFlare team does a great job of…
- Why we built the Revocation Report
For over a year I have been monitoring the industry’s largest OCSP and CRL repositories for performance and uptime. I started this project for a few reasons but to understand them I think it’s appropriate to start with…
- Certificate-based Mozilla Persona IdP
My name is David Margrave, I am a guest author on unmitigatedrisk.com. I have worked in the security sphere for 20 years at various U.S. federal agencies, financial institutions, and retailers. My interests include…
- Microsoft Root Program and Excel
The other day I was was studying up on my Excel so I could help someone with a project, today I met with a friend where we were discussing the composition of root programs.
- Advanced Troubleshooting of Certificate Validation Related Problems on Windows Part 2
One of the most complicated things to troubleshoot in X.509 is failures related to Name Constraints handling, there are a few ways to approach this but one of the easiest is to use the Extended Error Information in the…
- Advanced Troubleshooting of Certificate Validation Related Problems on Windows Part 1
The Windows platform for validating X.509 certificates has a feature I don’t see many discuss -- its robust logging subsystem.
- Abstract: Using least privileged design principals to improve trust in the online marketplace
Weekends, they are overrated :)
- Abstract: Revocation reality and the path to becoming effective
Just submitted my first abstract for the NIST workshop on "Workshop on Improving Trust in the Online Marketplace" in April, the title of the talk is "Revocation reality and the path to becoming effective", the abstract…
- Is SSL Broken?
\ This is a re-post of a article I wrote for the GlobalSign corporate blog, you can find it [here\]