Tagged Questions
3
votes
1answer
73 views
Has a HTTP server access to SSL session ID?
I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
0
votes
2answers
92 views
Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]
I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
2
votes
1answer
125 views
How to secure or (Ensuring Integrity) of Web Data in transit and in store?
Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data.
If talking about security, we need it for:
...
1
vote
2answers
130 views
HTTPS Certificate mismatch alert before redirection
Let's analyze the following situation:
A server is hosting 10 websites: site1.com - site10.com.
Only one of these websites uses SSL -site1.com.
If you try to access site2 - site10 over https the ...
5
votes
1answer
186 views
How should I store SSL keys on the server?
I have a Node.JS HTTPS webserver instantiated as follows:
var privateKey = fs.readFileSync('./../ssl/localhost.key').toString();
var certificate = ...
7
votes
2answers
85 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
4
votes
2answers
466 views
Test website for SSL 2.0
I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled?
The website is still in development so not visible outside our ...
3
votes
3answers
344 views
What is the actual security of this login page?
Please visit https://devforums.apple.com
If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show.
Does this ...
0
votes
1answer
266 views
What security concerns exist in running a glassfish app directly on port 443
I have installed Apache http server in front of glassfish based on recommendations i had in this question.
I have been told that i will run into performance problems along with security issues. I was ...
1
vote
4answers
188 views
Should i use SSL for local access?
I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip).
Should i use SSL for the communications between the sites and the service, or would that ...
8
votes
2answers
584 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
4
votes
3answers
1k views
When is it appropriate to SSL Encrypt Database connections?
Let's say I have a web server I setup, and then a database server.
However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right?
The only time to use ...
3
votes
2answers
113 views
Does site need SSL to resend info to a site that does use SSL?
Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
4
votes
4answers
2k views
Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
6
votes
1answer
383 views
Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.
...
15
votes
3answers
612 views
What are the risks of using a CDN to speed up my website? How do I avoid them?
Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN.
What ...
11
votes
4answers
6k views
What ciphers should I use in my web server after I configure my SSL certificate?
There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list.
...
9
votes
2answers
2k views
Are there any statistics about webservers and browsers TLS support?
From Hackers break SSL encryption used by millions of sites:
The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
9
votes
1answer
1k views
enable browser caching with HTTPS
I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
1
vote
3answers
487 views
Reverse Proxy Secure Configuration
I have a Forefront TMG 2010 acting as a reverse proxy:
I can force HTTP*S* between internet clients and TMG.
I can force HTTP*S* between TMG and my web servers.
From a security point of view, it ...
5
votes
5answers
446 views
Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
13
votes
4answers
918 views
How to detect “forged” SSL certificates from the webserver end
The company I work for sometimes intercepts employees ssl connections to https websites by making the ssl connection on their behalf from a proxy, and then using the own generated certificate to send ...
4
votes
3answers
246 views
Locking down web-based admin areas with personal SSL certificates
I've been tasked to setup a secure platform, where I've been asked to assign personal SSL certificates to administrators, and have the server only allow persons into the administration areas that have ...
4
votes
1answer
2k views
How to convert IBM Domino SSL keys (private key) to the OpenSSL format?
I have a customer with an IBM Domino server. They offer a way to export SSL keys but in a weird proprietary format. Any idea on how to convert those to OpenSSL?
Basically I need to upload this key to ...
38
votes
11answers
4k views
What are the pros and cons of site wide SSL (https)?
What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
8
votes
2answers
189 views
What is the best way to verify the SSL configuration of my web server?
How do I ensure I have my SSL configuration setup securely?
13
votes
5answers
342 views
What is the best option for setting up a several sites supporting SSL on the same IP?
If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?
