SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
1answer
22 views

SSL/TLS Session Resumption with Session Tickets

We already have SSL session resumption enabled using a session cache. Based on an in-house performance report, enabling Session Resumption using Session Tickets is recommended. Is the performance ...
0
votes
0answers
42 views

SSL certificate expired on laptop what does that mean? [on hold]

SSL certificate says it is expired on my laptop. What are the implications.
0
votes
1answer
19 views

How to add basicConstraints extention to a self signed certificate

Using openssl to create a self signed certificate. The certificate needs to have the Basic Constraints value defined and showing in the cert but I can't seem to be finding the right location to modify ...
1
vote
1answer
45 views

What happens if a page with an invalid SSL cert responds with a 302 redirect to a page with a valid cert? Do you still get the warning?

Alice navigates to https://example.com. https://example.com delivers an invalid certificate. https://example.com 302 redirects to https://www.example.com https://www.example.com delivers a valid ...
0
votes
1answer
55 views

Mixed content - stylesheet being blocked because of a querystring parameter?

I've just run into a scenario where a stylesheet was being blocked on a secure payment page. The stylesheet was loaded like so: <link href="/CSS/all.min.css?v=2" rel="stylesheet" type="text/css" ...
1
vote
1answer
42 views

Why does firefox still display website ssl to be 128 bit encrypted after changing to 256

I recently renewed an ssl certificate to use SHA-2 but on firefox the website still shows to be SHA-1 and 128 bit encrypted, on all other browsers it show SHA-2 , 256 bit. Can anybody help me with ...
0
votes
2answers
30 views

cross-signed end-entity certificates: usage in apache/openssl/gnutls

A previous question, What is the use of cross signing certificates in X.509? described cross-signed certificates well. I have a situation where the clients trust CA1 xor CA2, and both need to reach a ...
3
votes
3answers
142 views

With HTTPS, what information would a MitM attacker be able to glean?

Consider a user accessing a site that is using HTTPS for all its traffic. A hacker is trying to use a man-in-the-middle to snoop on the user. What information can he glean? Obviously the content is ...
2
votes
3answers
178 views

Company decrypting SSL, is it common?

We've just implemented a proxy that decrypts all SSL traffic in order to classify and scan it. Naturally a lot of our users feel concerned. We're a small company (100 users) owned by a big company ...
0
votes
0answers
15 views

OCSP stapling: Staple just my domain/root CRT, or Combine/Concatenate including Intermediates?

I cant seem to find a specific well documented resource on this question. Should I staple just my domain/root CRT, or staple my combined crt (Combine/Concatenate file which includes my root cert plus ...
3
votes
2answers
74 views

Choosing TLS / SSL cipher suites - What considerations are there?

Most of the advice on choosing cipher suites I find tends to be one of these forms: Here's a string to paste into your application, or Here's a list of 30,000-foot generic criteria to use ("favor ...
0
votes
1answer
82 views

Why does my TLS configuration not work with IE 8 / XP? [on hold]

After all the last news about TLS/SSL faults and problems, I'm working on strengthening our TLS config — yes, I dropped SSL; at least, that's something. The main effort is to enforce, as much as ...
0
votes
0answers
21 views

Encrypted alert with code 21 for connection [on hold]

I've got a device that connected to the server and successfully did the handshake and received application data, however later when client sends keep-alive requests server sends back encrypted alert ...
1
vote
2answers
66 views

MITM on program with no proxy settings

I'm trying to inspect the traffic of a program (which is running on my computer) that uses SSL over TCP to a non-standard port. The traffic may or may not be HTTP traffic, likely isn't. Neither ...
0
votes
1answer
28 views

Add certificate authority to one browser only

For testing purposes, I'd like to add a "CA" to the list of trusted-CA's of one browser - and use it only for testing. I want to make sure that it won't get added to the computer's trusted CA list. ...
0
votes
1answer
36 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
1
vote
1answer
75 views

How will SHA1 deprecation affect SHA1 roots in OS/Browser trust stores.

I understand the SHA1 deprecation policy applies to CA's issuing SHA2 end-entity certs and intermediates starting Jan 2017 but how will this policy affect the actual root certificates in OS/Browser ...
0
votes
1answer
216 views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
0
votes
1answer
50 views

TLS Authentication/OpenVPN/MITM Attacks on Public Wifi [duplicate]

My question is about how an SSL VPN connection such as OpenVPN is protected against MITM/Spoofing attacks on a public Wifi. For example, if somebody has a 'pineapple' or router setup as a honeypot ...
0
votes
0answers
24 views

TLS authentication on Openvpn server

I'm not sure if this question can be applied elsewhere and that's why posting it here. The matter is that I want to setup hardened(as far as possible) VPN server. No the issue is that tls handshake ...
0
votes
2answers
73 views

Effective Free and Anonymous Web Form Encryption

I've got a website and I would like the users to be able to login securely but I don't want to spend any money on SSL / certificates and I would like to stay anonymous i.e. not give the certificates ...
0
votes
1answer
71 views

Poodle vulnerability and eCommerce

Our client has recently stopped getting new orders placed on their Magento eCommerce site. Could this be related with the Poodle vulnerability, as their server is still on SSLv3. Is there any ...
2
votes
1answer
77 views

Do payload sizes reveal URLs when HTTPS is deployed on news, blogs, etc?

Even though HTTPS keeps HTTP paths private, is it not the case that the generally-unique payload sizes for particular URLs (on news articles, blogs, etc) provides a mechanism to reveal the URL anyhow ...
0
votes
4answers
83 views

How and why does not having https allow people to trace my browsing habits if at home? [closed]

How can my browsing habits be traced when I am at home on my own local network? Technically how is it done ?
2
votes
5answers
169 views

Can we have https without certificates?

I apologize in advance if I am fundamentally misunderstanding something, but is it possible to have encrypted communication protocols (https, I suppose) without resorting to a certificate system? ...
0
votes
2answers
53 views

Sign SSL certificate with root certificate using openssl

I have created a root certificate, My Root Certificate, with a private key, RSA Private Key 1, using the openssl terminal command. I would like to make a certificate chain such as the following: My ...
1
vote
2answers
48 views

Invalid OCSP signing certificate in OCSP response

I want to open the following page in Firefox, and get an error. https://www.acm.nl/nl/ Secure Connection Failed An error occurred during a connection to www.acm.nl. Invalid OCSP signing ...
0
votes
0answers
64 views

sniff https traffic and grab credentials with ettercap [closed]

how to access a website with the session id ? thanks very much!! I have the session id but I don't know how to use it
1
vote
2answers
99 views

Will CA's still validate internal IP's in SSL certs?

Just wondering what Certificate Authority (CA) policy is nowadays on validating someone's internal IP address in a certificate? I have heard that some CA's used to do this but won't anymore.
0
votes
2answers
36 views

Why does IP address need to be listed as a DNS name in SAN/UCC certs?

I have heard that when creating a CSR that if you want to validate an IP address that you should list the IP as a "DNS" name and not "IP Address". I have actually had to re-create CSR's like this to ...
2
votes
2answers
166 views

What's the difference between X.509 and PKCS#7 Certificate?

Am I correct calling file with .p7b file extension saved as 'Cryptographic Message Syntax Standard - PKCS#7 Certificates (.P7B)' in Windows - a 'PKCS#7 certificate'? Or is it better called 'X.509 ...
1
vote
1answer
77 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
1
vote
4answers
74 views

employing SSL even on non critical web server [duplicate]

I know that SSL should be used on web servers that need to gather credit card information etc..however, is it industry best practice to also turn on SSL even for non critical web servers? eg those ...
0
votes
0answers
36 views

Question regarding SSL / TLS / Certificates in general [duplicate]

for the last two days I played around a bit with nginx's SSL configuration. A question came up: I created asymmetric key using $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:4096 -keyout ...
0
votes
2answers
54 views

Storing CardHolder Data using RC2 encryption

I would like to know if storing credit cardholder data using RC2 encryption requires to be compliant with PCI DSS. Currently the 16 digit PAN number and expiry date is stored in the database. The PAN ...
1
vote
1answer
36 views

What are the compatibility implications of generating a new TLS key?

The guide I'm following says to use openssl genrsa to generate a TLS key, which I did. I've changed the CSR generation command to use SHA256 instead of SHA1, but I'm still not sure if this is the ...
3
votes
3answers
181 views

TLS library problem when connecting to Dovecot

I have a Comodo PositiveSSL certificate issued for mail.btcontract.com and I've set up Postfix and Dovecot to work with it in the following way: Postfix main.cf: smtpd_tls_cert_file = ...
0
votes
1answer
38 views

How to change the expiration time for the pkcs certificate?

I have an application (which I'm testing), in which I create some services. These services are accessible via libraries i.e java and python apis. In order to authenticate the api calls, the ...
2
votes
1answer
223 views

Are Java applications vulnerable to CVE-2014-6321 (WinShock)?

CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows. My Java application uses SSL (JSSE ...
6
votes
2answers
450 views

Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use?

Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use for a TLS 1.2 connection to a Tomcat server? What are potential weaknesses or better alternatives? I am looking for a cipher ...
3
votes
1answer
102 views

Can Fiddler decrypt HTTPS traffic when using elliptic curves + client cert authetication?

Case 1 involves TLS + client certificate authentication with both client and server using secp384 based EC certificates. In this case, when monitoring traffic via fiddler, the tunneling/handshaking as ...
3
votes
2answers
417 views

In a browser web server communication, who decides which encryption protocol to use [duplicate]

My IE browser has SSLv3.0, TLS 1.0,1.1 and 1.2 has enabled in the advanced settings. And (I was informed by my server admin) my web server can encrypt data in SSLv3.0 and TLS 1.0 Now which system ...
10
votes
2answers
592 views

What role does clock synchronization play in SSL communcation

We've recently implemented WS Trust security over SSL for our client / server communications. Our application is used by thousands of our customers, spread out all over the world. One of the ...
1
vote
0answers
18 views

Possible to Mix SNI and Dedicated IP SSL on Apache? [migrated]

I've reached the limit of available IP addresses on my Apache web server but increasingly need sites to run under SSL. I'd be comfortable with some of the sites running under SNI but a few of them ...
-4
votes
1answer
57 views

How to create a secure channel in Java?

I am creating a certification server which takes some required details like name, email etc from clients and issues public and private keys using RSA along with digital certificate. Initially all ...
1
vote
0answers
47 views

How does SELinux effect the Linux Kernel networking stack?

I'm interested in how SELinux effects the processing of packets through the networking stack. I've found the following questions and answers: Network policies under AppArmor/SELinux Filtering ...
1
vote
1answer
82 views

Encrypting sensitive data in a financial form

I'm currently building a B2B E-Commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
0
votes
0answers
23 views

What could be the reason for “SSL: No Application Data included”

I am trying EAP-TLS privacy, upon receiving change_cipher_spec and finish, and the same handshake has another request for client_hello_requset as a encrypted message, and openssl able to decrypt it ...
1
vote
1answer
27 views

Does OpenSSL have stat for read change cipher spec (SSL3_ST_CR_CHANGE_A)

In EAP-TLS method of authentication if a server sends Change Cipher Spec message to the client, I couldn't find references to SSL3_ST_CR_CHANGE_A. The enum is defined for SSL3_ST_CR_CHANGE_A in ...
1
vote
0answers
93 views

Running openssl s_client with an aes encrypted key fails

I'm trying to verify a 2-way SSL connection using the openssl s_client command openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key The openssl s_client fails ...