SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

0
votes
1answer
968 views

Java SSL factory connection to SSL server (with just public-key and certificate)

I am trying to connect to a SSL web server. We currently have a pkcs12 file and connect, that is our private-key and certificate. Is it possible to connect using Java code with a public-key and ...
0
votes
2answers
106 views

Does CRIME also compromise basic access authentication?

CRIME mitigation involves disabling TLS compression. My server offers services only via XML-RPC and does not make use of Cookies, which is what CRIME exploits. Does this mean that I can turn on TLS ...
0
votes
1answer
233 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
0
votes
2answers
127 views

Subdomain-only SSL security/availability

CAcert and StartSSL both only validate domains whose TLD is owned by the requester. I have a few subdomains that come from places like freeDNS that I would like to run an SSL-secured server on. Are ...
9
votes
2answers
238 views

Why do some certificates specifically identify a corporation and most don't?

Looking at a handful of websites that allow for/require HTTPS, I realized that the certificate for a few of them specifically identifies the owning corporation, but some (most) don't. What's the ...
1
vote
1answer
62 views

Transport Layer Security for multiple persons

I know that TLS protocol is used to authenticate two persons and when a secure channel is established we can perform a key exchange. My question is if TLS can be used to establish a secure channel ...
-2
votes
2answers
113 views

the possibility of man in the middle attack [closed]

when was the possibilty to perform man in the middle attack on ssl? is it possible to perform with out session between client and server? can you explain MITM?
0
votes
1answer
228 views

SSL what's the client write key used in application layer?

I've used wireshark to watch serveral SSL3.0 traffic and decrypt the messages transfered between client & server. And what I've just found is very strange : AFAIK, the encryption-key, MAC and ...
0
votes
2answers
213 views

Does a simple mobile REST API need HTTPS?

Let's say I have a really simple mobile app with a server API. For example some kind of Q&A app, where users answer questions to win some points ('Who wants to be a Millionaire' kind of game). ...
13
votes
3answers
1k views

Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?

Perhaps I'm being overly paranoid, but after reading recent news regarding network security I'm starting to believe that SSL isn't quite enough anymore for sensitive data transmissions. Ref: ...
0
votes
3answers
177 views

What are the MitM implications of a stolen client-side private key?

Many VoIP handsets support client-side SSL authentication for auto-provisioning. Unfortunately, some devices must be programmed with their client-side keys. (Keys generated on low-entropy devices are ...
0
votes
2answers
244 views

Difference between free ssl and non-free ssl? [duplicate]

I am making a choice between StartSSL and positiveSSL($4.99/yr). I want to know the difference between them. As I know, SSL is used to encrypted the connection between client and server so that data ...
1
vote
3answers
430 views

Can my customer's ISP trace who visited my business website?

I own a private business and a web site with a domain name hosted with Godaddy US. I live in Europe. I want to know if the various ISP of my customers in my country can find out who visited my web ...
2
votes
2answers
210 views

For DHE_RSA_.. Cipher Suites what is RSA used for?

In addition to achieving PFS with DHE, we want as little as possible to be revealed when the server's private key is revealed. So, what is RSA used for in DHE_RSA cipher suites? What does the server ...
0
votes
1answer
187 views

Installing SSL on load balancer and the internal IP

I have a server which has an internal IP (Used to access from local) and an external IP (accessed from Internet and placed in the load balancer). And both will use the same URL ...
0
votes
1answer
707 views

OpenSSL get key length of all certs [closed]

I am trying to ensure that all certificates in a chain for a host have a key length of 2048 bits. Using openssl s_client, only the key length for that host's cert is given, is there a simple way to ...
1
vote
1answer
3k views

Force a specific SSL cipher

Is there a tool or browser addon that will allow you to connect to a HTTPS website using a specific SSL cipher, and view the output? This would be useful when doing a vulnerability analysis and ...
0
votes
1answer
214 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
1
vote
1answer
2k views

Sending Client Certificate to Server

I have a simple question. Is a web browser sends client certificate to the web server on demand(means web server is configured for client authentication and demand the client certificate) or just ...
-3
votes
1answer
122 views

What are the risks if a weak ciphers are accepted by a technology that uses SSL

The TLSSLed tool found that the host that I use has SSL connection that accepts 8 different TLSv1 and SSLv3 ciphers that are weak by their length (40 bits). How can an attacker exploit this fact?
0
votes
2answers
749 views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
1
vote
1answer
5k views

Speaking Plain HTTP over an SSL enabled Server port [closed]

atm I'm facing a problem with IE and Firefox because they don't redirect my Links correctly. I'm requesting my application via: https://myapp.example.de/context In my webapplication I have links ...
2
votes
2answers
249 views

How common is Perfect Forward Secrecy in HTTPS clients?

We are hosting an SaaS website and API with the https protocol, both of which are accessed by numerous users with a lot of different browsers and client-side apps. What would happen if I made PFS ...
1
vote
1answer
2k views

SSLv3 or SSL Certificate Version 2?

Below is the SSLScan output, what does it mean with SSL Cerficate Version 2? Aren't SSLv3 and SSL Certificate Version 2 the same? ...
0
votes
1answer
157 views

How does ssl prevent MITM attacks [duplicate]

My understanding of how it works : A victim asks for the public key of a server. The attacker just forwards this request. The server now responds with a certificate which contains the Public key. The ...
0
votes
3answers
121 views

Does semi-sensitive information demand encryption / security? [closed]

Since it's been requested that this question be rewritten: Is SSL (or some other encryption equivalent) required in the below case? From a small local business website, is there any damage that an ...
0
votes
1answer
427 views

How to MiTM SSL on a device with no proxy settings

I'm trying to MiTM a device on my network and having some problems. SSLstrip doesn't work because the URL is https://, and I can't use something like Fiddler because the device has no configurable ...
1
vote
1answer
357 views

Camellia and ECDHE_ECDSA -ECDSA in TLS1.2

I am setting up a server using nginx. I have it working with a self signed ecc certificate and if I connect it reports ECDHE-ECDSA which is what I wanted. But I was also wondering if I could use ...
0
votes
2answers
303 views

Is HTTPS based on a private key on the user side? [duplicate]

Is HTTPS it based on private key on user side? Where does the user get the private key in the first place? Suppose the user gets the private key by downloading a browser (Chrome, Firefox), then ...
3
votes
1answer
250 views

Safe way of accepting customer-supplied private keys?

We run a software as a service application that is used by medium to large companies. One part of our application is a messaging service that integrates into the customers own infrastructure. At the ...
2
votes
3answers
154 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
0
votes
1answer
86 views

how does IE or chrome verifies certificate? [duplicate]

If the HTTPS webserver uses self signed certificate, the web browser warns the user as follow. http://www.sslshopper.com/assets/images/iis7/iis7-self-signed-certificate-8-certificate-not-trusted.png ...
5
votes
3answers
727 views

How to Man in the Middle Internal AD Traffic

A coworker asked me why I thought encrypting internal AD Bind communication was important. I said because I follow a standard security practice, but couldn't actually articulate how an attacker would ...
2
votes
1answer
185 views

Fundamental differences between digital ID and SSL security certificates

I was reading http://www.symantec.com/verisign/digital-id and http://technet.microsoft.com/en-us/library/dd351044(v=exchg.150).aspx. The articles are treating ssl cert and 'digital id' as if they are ...
1
vote
2answers
227 views

Choosing the right X.509 certificate infrastructure for securing LAN communications between a PC and a device

Edit: seems like I was quite hasty when typing in my question at first, so here is an updated version of it. I am developing an application that runs on PCs which are on the same LAN as other ...
2
votes
0answers
62 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
5
votes
2answers
403 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
17
votes
3answers
2k views

Why can SSL certificates not be free of charge?

I am a newbie in this field. I am confused with why SSL certificates cannot be free of charge. In my understanding the certificate is just a text file consisting of cryptic numbers installed on a ...
10
votes
2answers
655 views

Why are we still using HTTP? [duplicate]

I've been reading a lot of online articles and blogs about advantages of using HTTPS (HTTP over SSL/TLS) and the performance issues involved in deploying a website over HTTPS. What I understood is ...
1
vote
0answers
194 views

Should I tunnel multiple TCP connections through a TLS/SSL tunnel or use TLS/SSL for each connection?

I am developing an application that runs on Windows PCs. The application is able to connect to some kind of devices within a LAN. It can create multiple TCP-connections to the device it is connected ...
2
votes
3answers
876 views

How to mitigate SSL based DDoS attacks?

as you probably know the problem with SSL based DDoS attacks is, that the traffic cannot be analysed and filtered by a DDoS mitigation service provider such as Prolexic, Akamai, Radware, etc. without ...
1
vote
2answers
187 views

Securing multiple connections with different protocols all together

I need to secure the communication between an application (runs on any PC and has been designed for Windows) and an external device (runs on UNIX). The application is running on Windows while the ...
1
vote
4answers
335 views

Achieving End to End encryption with TLS

The scenario is that a client browser (eg: a user trying to log in to a bank website) needs to be able to view certain sensitive information that resides in a mainframe sitting in the Internal network ...
1
vote
3answers
467 views

TLS 1.2 Server certificate and signature_algorithms

In the specification for TLS 1.2, it says the following: If the client provided a "signature_algorithms" extension, then all certificates provided by the server MUST be signed by a hash/signature ...
0
votes
1answer
169 views

Can I use a CDN for static content without sacrificing SSL keys?

I would like to use a CDN for the static content of a website. But obviously I do not wish to share my SSL key with any external service. What are my options? An ideal solution would be to link to ...
0
votes
1answer
242 views

Are web sites with non-https login pages secure? [closed]

I was looking at weibo.com (chinese equivalent of twitter). I was surprised to see that their login page (http://www.weibo.com/) or forgot password ...
0
votes
2answers
107 views

SSL/TLS Question [closed]

I am currently working on my SSL/TLS assignment and I got a question to ask. What is the use of a login password since it is not needed for establishing secret communication between your computer and ...
0
votes
1answer
106 views

vsftp encryption algorithm

I want to configure VSFTP for ftps protocol and it has some choices to select the encryption type: tlsv1, sslv2, sslv3. I read that tls version 1 has some security issues but in the man page it says ...
1
vote
2answers
66 views

Using SSL for a single request

I want to use distributed cluster configured like: xx.resource.server.com. xx - can be anything from aa to zz, most of the requests will be one time. I need the connection to be secure between client ...
1
vote
1answer
199 views

Long-lived SSL connections to dynamic IP addresses

I'm seeing some odd behaviour on my proxy server logs since I started blocking direct outbound connections to port 443 (thus forcing applications to use the proxy server for HTTPS connections). I'm ...