-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi
On Sunday 20 October 2019 at 3:20:41 PM, in <mid:87a79vsdl2....@mat.ucm.es>, Uwe Brauer via Gnupg-users wrote:- > I just found that > https://extrassl.actalis.it/portal/uapub/doProcess > Provides a free smime certificate. [...] > does somebody know whether there is a security > breach, the way this > certificate was generated? I'm no expert but their Certificate Policy reads to me that the private key is compromised right from the start. I think usually the keys are generated on the subscriber's device and only the public key goes to the CA to be certified. https://www.actalis.it/documenti-it/caact-free-s-mime-certificates-policy.aspx 3.2.2 Proving possession of private key The private cryptographic key corresponding to the public key within the certificate is generated by the CA (with a suitable algorithm, size, etc.) and subsequently sent to the subscriberin PKCS#12 for-mat[PFX], via email, thereby insuring that the subscriber does possess the private key.The password needed to import the PKCS#12 file isprovided to the subscriber out-of-band (via web), therefore protecting it from unwanted disclosure to third parties. The CA does not retain such pass-word, so that the legitimate subscriber –assuming that he/she keeps such password confidential –remains the only person able to import the PKCS#12. And 4.1Certificate Application, Processing and Issuance To apply for a certificate pursuant to this CP, after accepting the quote, the requestor shall fill in and submit aweb-basedrequest formto be found on the CA web site.Before the requestor can actually submit the certificate request form to the CA, he/she must read and accept this Certificate Policy and the Terms & Conditions; both documents are made available for download in the same web form. The requestor’s acceptance is expressed by “point & click”, as allowed by Italian and European legislation on distance contracts. Furthermore, before the certificate request is accepted, the CA shall perform I&A according to §3.2.Upon submission of the certificate request form, the CA shall issue the certificateand send this latter to the Subscriber via email.The certificate is sent to the Subscriber requestor together with the corresponding private key, both bundled into a PKCS#12 file[PFX]. The password needed to decipher the PKCS#12 file is shown to the requestor in the browser, at the end of the certificate request procedure. It is up to the Subscriber to keep that password confidential and protect it from unwanted loss - -- Best regards MFPA <mailto:2017-r3sgs86x8e-lists-gro...@riseup.net> The cure for anything is salt water - sweat, tears, or the sea. -----BEGIN PGP SIGNATURE----- iNUEARYKAH0WIQSWDIYo1ZL/jN6LsL/g4t7h1sju+gUCXa5CFl8UgAAAAAAuAChp c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0OTYw Qzg2MjhENTkyRkY4Q0RFOEJCMEJGRTBFMkRFRTFENkM4RUVGQQAKCRDg4t7h1sju +v+iAQCE1htzI++iZGPw3aWSdvYOtStbg/+RCOq/55iUo4AkXwD+Mpeawj+TjNNK Kj7Bp9ciiGgtlsxqPeVtls8tMSNFDgaJApMEAQEKAH0WIQRSX6konxd5jbM7JygT DfUWES/A/wUCXa5CFl8UgAAAAAAuAChpc3N1ZXItZnByQG5vdGF0aW9ucy5vcGVu cGdwLmZpZnRoaG9yc2VtYW4ubmV0NTI1RkE5Mjg5RjE3Nzk4REIzM0IyNzI4MTMw REY1MTYxMTJGQzBGRgAKCRATDfUWES/A/+xoD/9rTd1kVPIlVjk9Worhv07MxsJ1 jLfWWifiLApgVG08JhOdjOSY8T3W4Ew/HbuvfS4/Xc1keGja7ZgEw7cSQf6LZxSz GWH55I3y6zzh5B0JYqu+DWnsRjU3oxQhwWW2rwJFXEiEDBraerA28/8XO3CXBctm 0jjOAAA0VEfwJEJda7W32PqcSqfL+iRcoZc1vC3o6YjOdvpK/tHDNPL4KzAqt+rV N4IraP1N/3oGKGT303G1U6eAR6Pvmsd7YSb0yLFKUVIsYzYW7GuhTiX65QvHC3ov ss1vVDjTPxV8a7+0B1QuNlFRBpdrDAdG9t2ecblG5FcIeDrEaigabdN9QQG7RWtr KPKv2E47bMUGgC3wqgeCO7qiCf6gSIdrI3aEi7Jvfpdu0vq4myf8ysuRL1yywaWJ OD/taEJ50SNTwT38qWq2KWDEWo4jupPqqHfcWNLFG8ARa0mVu84GwkM7bB1bDsaF DQKKukXsywq2EhE4CHgjWq/0jUbr6oDjxu7PIwxTdo7f/NWdOxqk9GPDMkIIsut/ fej/L6Rm0NgJfXmvWJAQ9ghCwGE3A+MoOoCWS30Czqz5+P3GpKpLyv54QEc1LrRz CF8VNvEhMyRPlmlnns6QLvZmoYspXkygRho8xAYIqWQ/fS/ZufkS6FS82TY58fvf rBJ7qMIUewF91bEIEQ== =uB21 -----END PGP SIGNATURE----- _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
