SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

7
votes
2answers
229 views

How can we revoke all ssl certificates issued for our domain?

After having the hostmaster@domain.com email compromised, we found that someone issued a Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked. Is there ...
2
votes
1answer
100 views

TLS WG Charter and Security Goals

I was looking at the TLS Working Group Charter. I noticed that confidentiality and integrity of messages for those who desire it are not goals for the group. Naively, I believe confidentiality and ...
0
votes
2answers
34 views

client SSL authentication .pem file and .crt files

So I have minimal knowledge of security really but I'm a primary developer on an application which handles some sensitive data that we want to be secure. The application communicates with one other ...
1
vote
0answers
29 views

Self signed certificate on application server behind web front end

I have a Tomcat application which is front ended by an Apache web server - end users connect to the Apache web server (never directly to Tomcat) and Apache has a valid, externally issued SSL etc The ...
0
votes
2answers
66 views

Encryption mechanism

I want to send data over the Internet securely. For that, I am using an public key of the receiver to encrypt the data. In this case, if an intruder in the network modifies the data, like placing the ...
0
votes
1answer
22 views

How is the Premaster secret used in TLS generated?

I believe that it uses some combination of the random values sent in the hello messages. From RFC 2246: (TLSv1.0) RSA encrypted premaster secret message Meaning of this message: If RSA is ...
0
votes
1answer
20 views

EAP-TLS fragmentation implementation

I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a ...
3
votes
1answer
52 views

How to force browsers to accepte all further SSL certificates

I am using the last versions of IE, Firefox and Google Chrome web browsers on Windows 8. How can force these browsers to accept automatically the SSL certificates of any website I will visit ? I know ...
2
votes
2answers
106 views

When visiting an HTTPS page for the first time, why isn't there a prompt for the certificate?

I installed a fresh Windows 7. I wonder why when I visit website using HTTPS, I do not get asked to accept their certificate like shown on this picture:
12
votes
5answers
2k views

Can sites which check your password as you type pose a security risk?

Some sites that I use check my password as I type it into the login (not registration) form. So, for example, to begin with I might have: Username: sapi ✓ Password: passw × and by the time I've ...
0
votes
1answer
35 views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...
2
votes
1answer
37 views

Inconsistant browser warnings for SSL

I am doing a penetration test at the moment, where the client has deep packet inspection for SSL enabled (my guess), as every SSL connection seems to being MITMed. Now, some HTTPS sites, like Gmail, ...
4
votes
2answers
113 views

Safety of using online proxy?

Lets say for example I have to use a public online proxy like https://www.zend2.com to load a php webpage controlled by me containing sensitive data over https. How would i make sure that the proxy ...
2
votes
3answers
71 views

“Web of trust” for self-signed SSL certificates?

SSL certificates, generally speaking, use a "chain of trust" model - a trusted certificate authority (CA) gets proof that a company such as Amazon owns amazon.com and issues an SSL certificate. ...
0
votes
0answers
70 views

Can not open my yahoo email. The connection was interrupted [closed]

Since yesterday, I can not open my yahoo mail. I get connection interrupted message (see pic). Or, some times I get another similar message saying the connection was reset. I tried another PC, same ...
0
votes
1answer
48 views

how can i bypass close_notify in ssl in firefox? [closed]

i am trying to login to my yahoo mail, but no avail. i recently discovered after monitoring some traffic that the dumb yahoo server doesn't send a close_notify response but just acts ignorantly and ...
3
votes
0answers
38 views

What's stopping DANE? [closed]

As I understand it, DANE (RFC 6698) is a promising candidate for addressing issues with current TLS Trust Anchors (i.e. Trust Anchors). My attempt at explaining the issue: Currently, CAs are ...
2
votes
5answers
402 views

Does the SSL termination happen with the ISP or a mobile service provider? [duplicate]

Is it true that when I connect to a site over HTTPS , my mobile service provider or the ISP gets to snoop in the communication? Can they play MITM?
1
vote
2answers
74 views

Identifying suspicious encrypted traffic [duplicate]

Firstly, I welcome a better title for this question. I admit I'm a security novice. I'm trying to determine whether I have malware and what that malware may be doing. Using Wireshark, I see several ...
5
votes
2answers
118 views

Security sanity check

A company whose services I'm trying to integrate uses this protocol: An AES key is embedded in an Android library. To authenticate itself, the library sends a SHA1 hash of the key over plain HTTP. ...
0
votes
1answer
22 views

In TLS1.2 AES-GCM mode, what happened when input is not exactly the multiple of its block size?

I know that AES-GCM mode does not need padding, and its output are exactly the length of input data plus the tagging. But I am a little bit lost, as AES itself is block cipher, it could only operate ...
0
votes
2answers
53 views

HTTPS - ssl error bad cert domain

When I try to visit some websites with HTTPS , I get the error that the SSL is self-signed and that the SSL is only valid for another domain, and that SSL is actually invalid. If the SSL is valid only ...
2
votes
1answer
71 views

Proper way to ask for parameters renegotiation with SSL

Given a specific SSL/TLS connection, I would like to know what is the proper way to launch a parameter renegotiation, asked from client side. 1) Are they any requirements from the previous handshake ...
0
votes
2answers
120 views

Online Shopping password keylogger risk

Suppose I do an online shopping they are asking me to enter my card details like four digit number(whatever related to that) and they are asking me to enter the PIN number too. If I enter all this ...
1
vote
1answer
31 views

series of SSL errors across multiple sites — reason for concern? [closed]

Rebooted my rMBP late 2013 recently, and saw a set of SSL errors (unable to verify certificate) across a wide range of sites (google, gmail, mubi, medium) and also in the Calendar app as it tried to ...
1
vote
1answer
51 views

Questions about self-signed Certificates' Fingerprints and Client-Server Interaction through SSL

I have some questions about how the fingerprint function is performed. First of all, I have some knowledge about cryptography. However it seems to do not be good enough to understand hundreds of ...
0
votes
3answers
46 views

Using client certificate to authenticate an app

I'm building a backend for the mobile app with a public-facing HTTP API endpoint. Despite being publicly visible, this endpoint is only meant to be used by my app, i.e. I don't want people to send ...
1
vote
3answers
92 views

I see a warning notification “site not verified”

Utill yesterday I never saw any warnings on secure sites like twitter and many others but currently I am getting an exclamation in my chrome saying identity not verified but https is indeed used, ...
1
vote
1answer
105 views

Help removing my domain from blacklists

I bought a domain few days before. but it came to my attention that my domain has been blacklisted by many antivirus programs and search engines as the domain for previously purchased by somebody and ...
1
vote
4answers
120 views

Are there any reasons for using SSL over IPSec?

is it recommended to use both protocols together? In which situation?
65
votes
5answers
6k views

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
1
vote
0answers
15 views

PBKDF2 hashing over TLS for encrptig password [closed]

i wanna use PBKDF2 hashing over TLS for encrypting password and session and that way stop hackers from breaking into my connection. How to do it in java.
6
votes
1answer
117 views

Why does Firefox split HTTPS request?

I am using Firefox browser version 28.0. To access https://www.yahoo.com, I put a proxy with a self-signed certificate in between and my client PC can access the HTTPS site. I then sniffed traffic in ...
3
votes
3answers
81 views

Trusting SSL and the Trust Chain

As we all know, when an SSL Certificate is assigned, there is a trust chain that is created for verify everyone from the Certificate Authority to the actual website's SSL Certificate. Thanks to a ...
0
votes
0answers
21 views

Parsing an X509 Certificate [migrated]

I currently need to parse the CommonName from a packet. I have code that works up to a point, however am having trouble skipping over the "issuer" member of a Certificate record for TLSv1.2. I have ...
1
vote
0answers
68 views

What are the benefits of IP Whitelisting? [closed]

While IP Whitelisting can be usefull in certain circumstances, it can also be a great annoyance that kind of secures through obscurity. It doesn't really restrict unauthorized requests as IP spoofing ...
2
votes
1answer
61 views

What should a client verify after getting a client certificate?

I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String. the String is then decoded to a x509Certificate (using Bouncycastle's ...
0
votes
1answer
61 views

learning SSL/TLS [closed]

I am looking forward to learn more on implementing SSL/TLS, can anyone of you suggest me a good source to learn about it? For now I only have basic knowledge about it such as what is SSL and how it ...
0
votes
1answer
35 views

MITM protection, key distribution

I want to make sure each of my apps users only get their own data, and that nobody tampers with it or sniffs it in a MITM fashion. Encryption of everything should be the solution, right? But how do I ...
8
votes
3answers
998 views

Why enable SMTP STARTTLS if OpenSSL is dangerous?

There are a bunch of people in the anti-surveillance movement who are virtually demanding that I enable SMTP STARTTLS support in my environment, in order to enable opportunistic MTA-to-MTA encryption. ...
-1
votes
0answers
23 views

Port forwarding does not work for http sites [migrated]

I am connecting to office network through VPN. I have two servers A and B. I have ssh tomcat access to A through VPN but not to B. When I ssh into A, from there I can ssh into B. Also, B is running ...
0
votes
1answer
61 views

Any example where client certification is required? [closed]

There are some optional cases in SSL/TLS where server can demand the certificate of the client. Can anyone give me any example regarding this? Thank you.
2
votes
1answer
60 views

Do SSL / X.509 certs cover all ports for a host?

Or are certs both host- and port-specific (excepting wildcard certs)? I would assume they aren't, because they're supposed to verify a domain, but at the same time I've never seen anyone run HTTPS on ...
3
votes
1answer
78 views

Why shouldn't I sign my email newsletter using an s/mime email certificate?

I currently offer email subscriptions on my blog, something I coded myself in PHP. People sign up on the blog using their email address. I send them an email with a link to verify their email address ...
1
vote
2answers
97 views

My certificate seems fine but my TLS fails (Cert not validated)

I set up my certificate for my mail server at https://mail.travelstreamer.com/ I exported my certificate as described in my mail servers documentation and pointed to it in the server settings. The ...
11
votes
6answers
2k views

Can I use a single SSL cert on two different servers?

I have a master server installed on AWS and the slave server installed on GoDaddy. How many SSL certificates do I need to buy? Can I use a single certificate for both?
0
votes
0answers
20 views

How can I export private key from a certificate chain? [migrated]

I create a keystore and from that keysore I generate a CSR file and when I receive Signed Certificate from CA, I imported root and intermediate certificates to my keystore and finally my signed ...
0
votes
0answers
23 views

Key differences between IPSec and HAIPE?

HAIPE is derived off IPSec but can someone draw up the differences between using IPSec with Suite B crypto and HAIPE with Suite B? We can drop Suite A or classified info for this question; staying ...
0
votes
1answer
51 views

Apache redirecting to unsecure port

I have setup a test website in order to play around setting up SSL. The website is setup on a Windows host with Apache 2.2.20 with OpenSSL 0.9.8r, MySQL 5.5.37, PHP 5.3.28. The URL to the home page ...
-1
votes
1answer
57 views

Protocols equivalent to TLS? [closed]

Are there any protocols equivalent to TLS that are widely used, or the TLS is the most, worldwide used protocol to secure almost all the traffic available in the network?