ISLAB Logs

Username/password, then one-time passwords, then challenge-response, then certificate/verify: each step stops sending a reusable secret over the wire. Username/password. The user sends a name and password; the server compares it with a stored (ideally hashed) value. Weak points:...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

It creates a key pair and a CSR, the root signs that CSR into a CA certificate, and the subordinate installs the returned certificate chain before it can start. Generate a key pair on the subordinate CA (here RSA 4096 bit, SHA-256) and give the CA a meaningful name ("CKTECK CA")...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

They make Apache demand a client certificate in the TLS handshake and accept it only if it chains to the given CA certificates within two levels; Apache reads CA certificates as PEM, not PKCS#7. SSLCACertificateFile /etc/ssl/certs/ckteck-ca.pem: the CA certificates Apache trusts...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

Replay: the client puts a fresh random number in its request and the responder must sign it into the response, so an attacker cannot resend an old "good" answer. OCSP responses are signed, so they cannot be forged, but a genuine one can be recorded and replayed. An attacker who c...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

It no longer runs under AllSigned: the hash of the current content no longer matches the signed hash, so PowerShell reports the signature as invalid (HashMismatch). The signature covers a hash of the script content. Any change, a comment, a space, a different line ending, changes...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

DigiNotar was hacked and issued over 500 fraudulent certificates for Google and others; Trustwave sold a sub-CA certificate to a company for TLS interception. Both show that any trusted CA can vouch for any domain. DigiNotar (Netherlands, 2011). Attackers broke into the CA and i...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

Version, serial number, signature algorithm, issuer, validity, subject, the subject's public key and v3 extensions, all sealed by the issuer's signature. Field Meaning Version Today always v3 (the version that added extensions) Serial number Unique per issuer, so (issuer...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

The CA copies the AIA URLs into every certificate it issues, so clients learn where to ask from the certificate itself; a wrong URL is baked into all certificates and cannot be fixed afterwards. A verifier that holds a certificate needs to know where to check its status. The only...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

Both sides present certificates and each verifies the other's against a CA it trusts; the client also signs the handshake to prove it holds its private key. Client requests a protected resource (opens the TLS connection). Server presents its certificate, and asks for a client ce...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

Apache asks the responder, gets "revoked", aborts the TLS handshake, and the browser can no longer open the site; the error log records a certificate-revoked verification error. Apache is told to check with SSLOCSPEnable on SSLOCSPDefaultResponder http://ws-XXX.gXXX.c...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026