How to generate a x509 certificate using phpseclib 3? - x509

I'm really new to this certificates world. Is it possible to generate a x509 v2 certificate using phpseclib 3?

Related

Not able to import client certificate in Swift XMPP client

I tried to use client certificate for authentication using swift XMPP client but not able to select certificate, although I already import certificate in Window client certificate.
Got below message from the client, click ok to continue exit the window certificate dialog.

You need to install certificate first in the OS then the list will show installed certificate in the system.
To install certificate create pfx certificate formate and double click to install the certificate.
To create PFX
openssl pkcs12 -export -out my_certs.pfx -inkey example.com.key -in example.bundle.pem -certfile ca.pem

Updating public cert with the signed cert

I have a CA pairkey and I need to sign a client pairkey for client authentication. I am using keytool for this. Based on this I have created a .p12 pairkey for my client. Then I create a CSR and then I sign it to have a .cer file.
My problem is that I want to "update" the cert in the p12 with this signed certificate. Basically, I need to import the keypair into the Personal Certificates for client authentication, but Windows will accept the p12 (which is not signed) and not the .cer (since it has no private key).
How can I update the p12 with the new signed public cert? Thanks.
NOTE: I prefer not to have any intermediate cert and I don't want to use OpenSSL, I need to use keytool
EDIT - By the way, when I try to import the signed certificate into the .p12 I get a keytool error: java.lang.Exception: Failed to establish chain from reply
EDIT - This link and this link seem to address my problem, but it is using OpenSSL and other tools, not keytool.

For Server validation using a trusted CA, will the ca-public key that was used to sign the server certificate be provided back to the server?

I was working on a sample TLS client/server program to perform certificate validation.
For a self signed certificate validation, these are the steps i followed.
#server side:
Generated a server key file serverkey.key
Generated a CSR certificate servercert.csr from the key file.
Digitally signed(using openssl x509 utility) the servercert.csr using a
generated rootCA.key and rootCA.cert. server certificate file servercert.cert
is generated.
Loaded the certificate file(servercert.cert) and key file(serverkey.key) using
SSL_CTX_use_certificate_file and SSL_CTX_use_PrivateKey openssl apis.
#client side:
Loaded the server ca-file --> rootCA.cert (which was manually copied to the
client) using the SSL_CTX_load_verify_locations api.
Using the SSL_get_verify_result() api validated the certificate that server
sends in the Certificate message.
The question that i have is that if i use a trusted CA(like godaddy) to sign a server CSR certificate, will the CA be providing its public key file (something similar to rootCA.cert) as well which was used for signing ?
By which i can load the same to the trusted list at client side using SSL_CTX_load_verify_locations api.
My intention is to keep the code unchanged regardless of being a self signed certificate or a valid CA provided certificate.

When (any) x509 certificate is generated, these things happen:
Private key is generated
Public key (associated with the private key mentioned above) is embedded in the new certificate (becomes an integral part of it)
The new certificate is signed using private key of the issuer (read: CA)
In order to verify the certificate integrity (to check if nobody tampered with it) - you need to verify the signature (created using issuer's private key - see 3)). To be able to do it you need to obtain (somehow) the issuer's public key. This key is embedded in the issuer's certificate (see 2)). Usually the trusted CAs' certificates are stored in so called trusted certificate store. In case of OpenSSL you specify this "store" by using SSL_CTX_load_verify_locations function (and a few other simmilar functions - consult OpenSSL documentation).
To summarize:
In your case the location pointed by SSL_CTX_load_verify_locations should contain your CA's certificate(s) - all of them - the whole certificate chain up to the self-signed root certificate. You can obtain all of the certificates in the chain from your CA (in your case GoDaddy).
I hope that helps.
If I can clarify anything more please ask.

Which one certificate to buy for SAML encryption and signing

Is it enough good to buy SSL X509 certificate for SAML 2.0 SP encryption and signing or I have to look for other certificate type such as Code Signing Certificate ?

You do not need a code signing cert.
Depending on how you've set up trust/which bindings you use/federation rules you could get away with a self signed cert. The answer is it depends, but a standard CA issued cert should be fine for the majority of use cases.

New certificate on Squid reverse proxy

I need to create a New certificate on Squid reverse proxy to replace an expired one.
Does anyone know how?

You can use OpenSSL, see especially HOWTO certificates, and note paragraph 4, Creating a self-signed test certificate.
The squid doc OpenSSL Configuration for CA and Certificate Generation
provides full details on using OpenSSL for generating a certificate and using it with Squid.