About

A CSR is signed by the private key corresponding to the public key in the CSR. This check verifies the signature on the CSR is valid. An invalid signature indicates that the CSR has been modified since it was created or the public key in the CSR doesn't correspond to the private key used to sign it.

This check checks if the CSR's name contains a field with no value. For example, the CSR Decoder would issue a warning about the name given below because the locality field is present, but has no value.

CN=www.acme.com, O=acme, L=, C=gb

The reason for this warning is that some CAs may reject CSRs that contain fields with empty values.

Checks for weak RSA keys generated by Debian-based systems.

In May 2008, the Debian team announced that Luciano Bello had discovered a vulnerabilty in the Debian OpenSSL package. The impact was that all SSL and SSH keys generated on Debian-based systems (including Ubuntu) released between September 2006 and May 13th 2008 may be affected. The Debian Security Team disclosed this vulnerability in Debian Security Advisory 1571. The best resource on this vulnerability is the Debian Wiki. We have also written about this in our CSR FAQ.

NIST recommends a minimum RSA key size of 2048-bits after 31 December 2010.

For a number of years now many prominent voices in the security community have suggested a move away from 1024-bit RSA key lengths by the end of 2010. In Special Publication 800-57 NIST recommends that 1024-bit RSA keys only be used to protect data until 2010. In 2003, RSA Labs published a document that recommended 1024-bit RSA keys should not be used to protect data with a lifetime beyond 2010.This check warns you if the RSA key size is less than 2048 bits

About Cert Logik

What is Cert Logik?

Cert Logik is a collection of PKI and SSL products developed by Red Kestrel Consulting Limited. Our Cert Centre product provides you with a consolidated view of your certificate portfolio. We've combined a CSR Decoder and X.509 Certificate Decoder into a single decoder to make decoding simpler. We've developed an SSL Checker that connects to your website and checks the installation of your SSL certificate. To avoid expired SSL certificates impacting your bottom line in terms of lost sales and reputational damage, we've developed CertAlert. For all the latest news on our tools, follow us on twitter

Is Cert Logik Free?

For nearly all users Cert Logik is totally free. There is a monthly subscription for the most heavy users of the services. The subscription goes towards maintenance costs and improving the service to make it even better.

About CSR and Certificate Decoder

Objects it can Decode

The CSR and Certificate Decoder can decode the following types of objects:

X.509 Certificates
SSL Certificates
PKCS#7 encoded Certificate Chains
CSRs or PKCS#10 Requests
Some CMS objects

Certificate Checks

The Certificate Decoder checks the following:

Certificate does not use a weak key
Certificate has not expired
Key size is at least 2048 bits
The signature algorithm is strong

CSR Checks

The CSR Decoder checks the following:

CSR does not use a weak key
CSR signature is valid
Key size is at least 2048 bits
The Subject field does not contains empty values

About Red Kestrel Consulting

Red Kestrel Consulting Limited is an IT security consultancy based in Staffordshire in the UK. We provide security consultancy and software development services to various clients including banks, governments and software companies. We have experience in many areas of IT security including but not limited to: PKI, cryptography, secure email, smart cards, biometrics and secure application development.