2
votes
1answer
31 views

OpenVPN: Storage location and creation of keys/certificates?

I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance. It's noted that the best security policy is to keep the Certificate Authority (CA) offline ...
0
votes
1answer
64 views

Create https session between server and client

I'm doing a project about security transactions and i'm wondering if to establish a connection based on https both client and server need to have a ssl implementation installed to preform the ...
0
votes
1answer
89 views

Transmission of messages

I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am ...
2
votes
2answers
266 views

Web Service Security Checklist - Tracing and Debugging

I have been reading this security checklist about web service design: http://msdn.microsoft.com/en-us/library/ff648304.aspx One of the suggestions is that you should disable the following in ...
2
votes
2answers
434 views

SSL: How to send generated client certificate from server to avoid MITM?

The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
6
votes
1answer
4k views

SSL Cert Types and Key Usage

I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
1
vote
1answer
143 views

Client vs Server security for business critical application (crossplatform)

We have the option to develop a software either based on Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...