SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

0
votes
1answer
39 views

Python SSH vs SSL?

I read the What is the difference between SSL vs SSH? Which is more secure? , and it mentions there is the possibility they can be affected by similar attacks. Now that the heartbleed thing is out, ...
0
votes
1answer
34 views

Outbound Port 443 Open but Not Allowing SSH

My college wireless network has a firewall blocking all outbound ports except 443 and 80. The wired network, however, has none of these restrictions. I can connect to HTTPS sites (obviously). On my ...
1
vote
1answer
82 views

How do I allow websites to call my desktop app over HTTPS?

I'm building a desktop app. I'd like websites to be able to communicate with the app over HTTPS. The general idea is that a website could run a JSONP call to https://127.0.0.1:8844 and send data to ...
54
votes
3answers
5k views

Heartbleed: Why does the client supply the length of the message at all?

"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
-1
votes
0answers
26 views

Secure connection failed (OCSP)

I've been getting a lot of failed connections lately, namely from Facebook and now Google (German site works, French does not). This happened to other sites as well but these two are the kind you do ...
4
votes
2answers
297 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
2
votes
3answers
91 views

Risk in buying SSL cert from non well-know party

Let say I knew a guy is selling SSL cert in a very cheap price, assume they will generate a real and valid cert for me, since I need to submit my CSR to them and they pass to th CA, are there any ...
1
vote
1answer
156 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
0
votes
2answers
107 views

SSL can stop MiTMs … but on the long run, can it really? [duplicate]

SSL uses CAs which sign certificates for the domains after they validate that the person requesting is truly the owner and by a public/private key pair a encrypted connection is achieved which cant be ...
1
vote
1answer
107 views

Best way to set up SSL certificates for consuming web service from Azure

I need to purchase and install the correct Verisgin SSL certificate(s) (X.509) on Azure. I have never done this before and would really appreciate some advice on how to go about it and what is ...
4
votes
1answer
130 views

What are the OpenSSL standard Diffie Hellmann parameters (primes)?

I recently generated some custom Diffie Hellmann parameters which are basically just long (in the below case 4096 bit) primes. Those are then used in the key exchange process. I used the following ...
4
votes
2answers
109 views

Can Heartbleed expose a TOR user's IP address?

It is interesting to observe, that TOR exit nodes with out-of-date OpenSSL implementations can themselves be affected by the Heartbleed bug. Can Heartbleed expose a TOR user's IP address merely by ...
0
votes
1answer
24 views

Apache 2.2 mod_ssl configuration Forward Secrecy/BREACH/BEAST/CRIME

I am looking for mod_ssl configuration which protects against common attacks like Breach, Beast and Crime. I already disabled gzip to avoid Crime but I'm unsure about the others. RC4 should only be ...
2
votes
7answers
102 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
0
votes
1answer
27 views

Downloading list of pinned certificates

I'm thinking about implementing certificate pinning in a mobile app. The app will need to connect to several secure sites. Rather than having to update the app every time one of their certificates ...
1
vote
1answer
29 views

Is it bad to put a certificate as CA in Firefox?

I know I can add a self-signed certificate from a website to Firefox, but only in the CA list of it. Question: does this mean I have to ultimately trust that self-signed certificate? Can someone ...
0
votes
1answer
112 views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
2
votes
2answers
89 views

What prevents me from using ARP poisoning to force a client to use HTTP?

So I was just thinking about how ARP poisoning can be used to intercept a clients request, forge an SSL cert, and send it back, with the caveat of not meeting certificate validation, but what if I ...
1
vote
1answer
61 views

Are there any “offline” open source software with I can check my HTTPS site? [on hold]

There are many sites that can rank the HTTPS quality of a website. But are there any that is open-source and can be used "offline"? So example in an intranet environment. The tool needs to check for ...
1
vote
2answers
58 views

How to prevent attacks before HSTS is established for the first time? [on hold]

What is the best way to accomplish this and prevent attacks like SSL Strip?
2
votes
1answer
128 views

Why is the SSL handshake not shown in Wireshark?

I am trying to figure out if some Android applications with login functions are vulnerable to man in the middle attacks or not. I have set up a MITM proxy (as an attacker) on my lubuntu machine and ...
1
vote
2answers
17 views

Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?

Put simply, CSRF tokens can be sniffed out of responses from the server unless the request/response are transmitted using encryption. Is this enough of a concern to worry about, or is it reasonable ...
0
votes
0answers
17 views

error in net excess [on hold]

Incorrect certificate for host. The server presented a certificate that doesn't match built-in expectations. These expectations are included for certain, high-security websites in order to protect ...
0
votes
3answers
3k views

How force that all connections to my Apache use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...
0
votes
0answers
54 views

Squid upgrade HTTP to HTTPS [migrated]

I want to use Squid to upgrade HTTP request to HTTPS using my own certificate, in order to make clients handshake with a server (a reverse proxy) that requires mutual authentication. How can I ...
4
votes
1answer
557 views

What Ubuntu packages are still affected by gnutls bug CVE-2014-0092?

Right now the internet is abuzz with news about a severe breach in GnuTLS. An update to the relevant GnuTLS packages has already been released. But I am worried whether some packages might have had ...
1
vote
1answer
46 views

IE11 on windows 8.1 and ssl fallback

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 ...
7
votes
1answer
75 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
0
votes
1answer
39 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
2
votes
1answer
45 views

TestSSLServer Results

I ran TestSSLServer.exe (from http://www.bolet.org/TestSSLServer/) against a web server in my organization. The results seemed self explanatory save for one section I'm not sure how to interpret. ...
55
votes
4answers
20k views

Does Heartbleed mean new certificates for every SSL server?

If you haven't heard of the Heartbleed Bug, it's something to take a look at immediately. It essentially means that an attacker can exploit a vulnerability in many versions of OpenSSL to be able to ...
0
votes
0answers
32 views

How do I renew an SSL certificate correctly? [closed]

I have an SSL certificate which is about to expire under GoDaddy. So what I did after I renewed was Generate a Keystore and CSR in Tomcat Install SSL in Tomcat The above is based on the steps ...
1
vote
3answers
288 views

TLS 1.2 Server certificate and signature_algorithms

In the specification for TLS 1.2, it says the following: If the client provided a "signature_algorithms" extension, then all certificates provided by the server MUST be signed by a hash/signature ...
3
votes
3answers
808 views

Heartbleed - Read only the next 64k and hyping the threat

My understanding of the Heartbleed vulnerability is that there is no bounds check on the payload length/buffer size so the server can read into memory outside of its process space. But can the start ...
3
votes
2answers
712 views

Forcing IE11 to use perfect forward secrey on AWS ELB

I can connect to my server in practically every browser except for Internet Explorer and I cannot figure out why. I am resolving SSL on AWS Elastic Load Balancer (ELB), which is configured to use the ...
0
votes
0answers
25 views

nginx - How to prevent processing requests with undefined server names with HTTPS

How do I avoid nginx processing a request with an undefined server name using the https protocol. The following configuration makes this work for http requests: server { listen 80; ...
-4
votes
0answers
67 views

Heartbleed and Client Certificates [closed]

I would like to know if there is the possibility that a server that REQUIRES some client certificate is able to respond to any type of heartbeat request. Would it would be: Hello server ...
1
vote
0answers
53 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
2answers
294 views

Self-signed SSL certificate on chromebook (and android)

I am having the following problem on both my android phone and on my chromebook. I'm running a website on an internal server (10.3.3.3) using nginx with a self-signed ssl certificate. Since it is just ...
1
vote
4answers
223 views

Advantages of one time pad

I always hear that one time pad'ing something is so great because you won't know if you've successfully decrypted the data. I understand the idea that you can XOR any bits just the same as any other ...
1
vote
2answers
74 views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
4
votes
1answer
155 views

Defending against private key leaks such as those enabled by Heartbleed

More and more evidence seems to be surfacing that the Heartbleed vulnerability leaks the private key portion of the SSL certificate in use. As such this can actually mean that if an attacker was also ...
1
vote
1answer
46 views

Client authentication flaw in old Netscape SSL protocol

Below is a screenshot from the paper "Prudent Engineering Practice for Cryptographic Protocols" by Martin Abadi and Roger Needham. I can't see what's wrong with the protocol and what the fix achieves. ...
1
vote
4answers
485 views

nginx recommended ssl_ciphers for security, compatibility - with PFS

I'm currently using nginx with the following ciphers: ssl_ciphers HIGH:!aNULL:!eNULL:!LOW:!ADH:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS; I would like to maintain compatibility to older ...
2
votes
1answer
121 views

How widely is Perfect Forward Secrecy in HTTPS clients?

We are hosting an SaaS website and API with the https protocol, both of which are accessed by numerous users with a lot of different browsers and client-side apps. What would happen if I made PFS ...
4
votes
1answer
352 views

PFS on nginx: only RC4 gets used (TLS_ECDHE_RSA_WITH_RC4_128_SHA)

I'm trying to configure my webserver for perfect forward secrecy. I'm using ssl_ciphers ...
1
vote
1answer
328 views

Heartbleed detection [duplicate]

It is fairly easy to detect the heartbleed exploit if it all happens over cleartext, which it seems most things are doing for the time being. However, I believe that there are some heartbleed ...
24
votes
10answers
823 views

Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
0
votes
1answer
46 views

TLS sequence number

Watching at TLS 1.2 traffic using Wireshark, I figured out that in the Application Data record, the 64-bit sequence number in some connessions is sent and in others not. Does it depend on the Cipher ...
-2
votes
0answers
72 views

How does a hacker use the heartbleed bug? [duplicate]

So I was, reading about the new heartbleed bug, and I was really curious about how hackers actually use it. Basically, I'm wonder how someone would go about using this exploit to get information, like ...