SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

1
vote
2answers
731 views

Best way to set up SSL certificates for consuming web service from Azure

I need to purchase and install the correct Verisgin SSL certificate(s) (X.509) on Azure. I have never done this before and would really appreciate some advice on how to go about it and what is ...
0
votes
1answer
602 views

Private Key and Public Key Serial Number and Thumbprints

Are the private key Serial numbers and thumbprints the same as the corresponding public key Serial numbers and thumbprints for certificates (X509Certificates, Base64-encoded X.509), and are these good ...
34
votes
3answers
20k views

“Optimal” Web Server SSL Cipher Suite Configuration

Over the last couple of years there have been a number of changes in what would be considered an optimal SSL cipher suite configuration (e.g. the BEAST and CRIME attacks, the weaknesses in RC4) My ...
1
vote
1answer
125 views

Use TLS certificate as both server and client?

For a federated server-to-server protocol with domain-based identities, I am thinking of using TLS client certificates as authentication mechanism. I figured that re-using each peer's TLS server ...
0
votes
1answer
227 views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
2
votes
4answers
384 views

What's the best way to secure inter-server communication for cloud servers?

I'm looking for best-practices or suggestions to secure inter-server communications between VPSs. Should I just run all traffic through SSH? What about HTTP Traffic via something like mongo? ...
2
votes
1answer
1k views

Do the BEAST and CRIME attacks apply to an IMAP service?

While setting up the Dovecot IMAP service, I noticed that the default parameters are not optimal, it allows SSLv3 for example. Using Thomas Pournin's TestSSLServer.java program, I saw the following: ...
5
votes
1answer
2k views

What is a Certification Path in SSL certificate?

I've been trying to learn more about Digital certificates for the past few days and I'm struggling in order to understand how actually this concept is applied in the real world. Anyways, as I visited ...
0
votes
1answer
91 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...
1
vote
3answers
286 views

Why can't someone break email or https encryption by somehow getting access to the encryption key?

To repeat, "Why can't someone break email or https encryption by somehow getting access to the encryption key?" In other words, why can't someone intercept the key, or the algorithm to create the ...
1
vote
1answer
62 views

Home banking site request, it possible for a small web agency?

I'm working in a web agency, i have a request to made an home banking system for a little bank. I'm searching in internet for some information about security and a good pattern to start, but naturally ...
0
votes
2answers
109 views

Corporate IT monitoring and access to user private data (keylogging? https data transmission?) [closed]

I work at a large company that requires employees to sign a digital certification saying that we recognize the right of the said company to monitor all data and communication on our work laptops, and ...
3
votes
2answers
276 views

How is HTTPS Everywhere leaking my Twitter session from an incognito window?

I manage a couple of twitter accounts for businesses/websites that are separate from my personal account. For simplicity, I prefer to log in from an incognito window so that I don't need to log out of ...
1
vote
0answers
142 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
1answer
101 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
1
vote
1answer
321 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
2
votes
2answers
171 views

Does the .net mvc/iis stack support whitelists for bidirectional authentication for SSL/TLS connections?

I'd like to limit access to some of my REST api, such that only bidirectional SSL/TLS connections are accepted, where the "other side" matches a detailed, restricted, whitelist. Is this something ...
1
vote
2answers
2k views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
3
votes
1answer
163 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
2
votes
3answers
206 views

Does the principle of the CRIME & BEAST attack affect VPNs?

I was recently reading about the attacks on SSL/TLS that CRIME and BEAST were able to exploit by attacking the compression in the secure session. Upon reading this I remembered that OpenVPN has ...
1
vote
3answers
172 views

Using public/private key without signed certificate

I am working on a java program and I am now working on its network security. I want to use a secure connection since it transfers a lot of sensitive information. On all security guides it is mentioned ...
-1
votes
4answers
497 views

Secure communication between server and client [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
0
votes
2answers
16k views

SSL Handshake failed

I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
0
votes
0answers
20 views

Protecting client's data over the wire [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
5
votes
3answers
811 views

Does checking the fingerprint of a self signed certificate improve security?

I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
1
vote
1answer
97 views

Is it dangerous to sync my data with my personal server through unencrypted http?

Since Apple force iPhone users to use iCloud to sync contacts & calendar, I moved to a local ownCloud instance that works well. However, it would be more convenient if I could sync everywhere and ...
1
vote
2answers
141 views

Why do client certificates not protected against improper server certificate validation

I understand the question of client certs and MITM attacks has been asked several times, but I don't believe this specific scenario has been answered. It was my (seemingly incorrect) assumption, that ...
1
vote
2answers
2k views

iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)

As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2. ...
0
votes
1answer
151 views

Why not use client certificates for premaster key generation

The question is about a very specific SSL handshake scenario. I understand that some servers may request client certificates in order to authenticate connecting clients. However, as far as I can ...
1
vote
2answers
764 views

Actually, isn't it bad to redirect http to https? [duplicate]

I have a two-part question about question #570288 over on ServerFault. Question: Is it bad to redirect http to https? Accepted answer (185 up-votes): [...] Hell no. It's very good. Part 1 ...
0
votes
2answers
58 views

DHE Verification

I'm just struggling to get my head around this. In certificate signing with static Diffie Hellman the public key and certificate information is sent to the CA who verifies the certificate ...
0
votes
1answer
165 views

HTTPS Proxy Everwhere?

I am configuring a HTTPS proxy, which I want to use for my laptop wherever I go. The idea is that since its encrypted, I should be safe from eavesdroppers, even on open wireless networks. Think of it ...
1
vote
3answers
2k views

Does a TLS interception proxy present the user's browser with the end server's certificate?

I know that TLS (commonly but mistakenly called SSL) interception works by establishing two encrypted tunnels between a client and server, with the interception device (proxy) terminating both tunnels ...
2
votes
1answer
230 views

In Same Origin Policy, why are different protocols considered a security violation?

I can understand why content from different domains is considered to be unstrusted for the same origin policy. But, how can be content from diferent protocols from the same site/domain be dangerous? ...
1
vote
1answer
96 views

How does a CA add www and raw domain names to my cert when my CSR doesn't have them?

I'm in the process of buying an SSL cert, and I'm confused by this part: Many CAs say they'll add www. to your domain, so that e.g. if you buy a single-domain cert app.example.com, they'll also add ...
3
votes
2answers
677 views

Should login pages be cacheable?

I'm considering the relative benefits/disadvantages of making a login page cacheable. Note that here I'm referring to the page containing the form into which the user enters their username and ...
0
votes
2answers
127 views

understanding the point of VPNs

I can't really understand the concept of VPNs, since we already have various secure transmission protocols. Isn't the point of VPNs that people using its 'channels' can send encrypted data to each ...
2
votes
1answer
724 views

HTTP Reverse Proxy: Correct way to do SSL to backend

If I have a HTTP reverse proxy that communicates with it's backends in an untrusted datacenter, or across datacenters, I would want to use HTTPS in the backend, as talked about here: Reverse Proxy ...
15
votes
1answer
573 views

Does Gibson's fingerprinting service add much additional security?

I just read this post and it proposes a method of storing SSL fingerprints online so that you can double check that your certificates have not been tampered with. But is it really relevant or useful? ...
0
votes
1answer
26 views

3rd party SSL security and having an extra layer of SSL

I did a search and didn't quite find an answer to my question. I have website that is integrating with a 3rd party for eCommerce and CRM. On my side I am collecting no data. I don't collect any login ...
4
votes
2answers
85 views

Internet and Email privacy in an “internet-enemy” country [closed]

Here where I live, it is believed that all the internet traffic goes through the hands of government agencies, and the telecommunication office is actually owned by the government. Given the ...
3
votes
3answers
260 views

Should I install an SSL certificate for a website that uses a third party payment gateway?

I understand what an SSL certificate does but I need help evaluating if I need one for my client's website. His website sells holiday packages online but does so without asking for any credit card ...
0
votes
2answers
190 views

Modifying SSL Certificate once created, Multi domain

We're developing an application that has the ability to run across multiple top level domains, each with its own sub domain. (www.foo.com, www.bar.com, would each point to the same application on the ...
3
votes
2answers
806 views

Form submissions over HTTPS are not encrypted?

My question is regarding HTTPS form submission. One of our website is using HTTPS, we display the login page to the user via HTTPS protocol. When the form is submitted, if we try to intercept the ...
2
votes
1answer
383 views

How can a trusted intranet certificate be issued if they are being phased out?

I've just seen this article regarding the phasing out of intranet names on SSL certificates. However, CAs such as this one claim to still issue them and it will be "Trusted by all popular browsers" ...
-1
votes
1answer
79 views

Installing a custom SSL Certificate For Local Proxy. Safe?

I've been writing some software for over a year that is a sort of browsing security/privacy application. One of the features of this software is that it uses a local HTTP proxy for some content ...
1
vote
1answer
207 views

Why are OSX users of my TLS-only site being asked to supply a client certificate?

I purchased a Comodo SSL certificate (OV), and set up the Apache vhost config so that all traffic is forwarded to 443. Intermittently some users are being prompted to supply a client certificate; ...
0
votes
1answer
276 views

Is there a benefit to having SSL connections on localhost?

I have a mail server with a MySQL database back-end. The mail server and MySQL DB are both installed on the same Windows machine. Is there any benefit to using SSL connections between the two ...
0
votes
2answers
1k views

Is using an SSL Session ID along with a cookie based session verification more secure or not really?

I am using Django which is a web framework for Python. I love it but the session handling is cookie-based. Now over SSL I'm sure it's reasonably "secure" but I don't think there is any kind of fail ...
2
votes
1answer
299 views

HMAC needed with SSL/AccessToken in place?

Is using an HMAC in web service messages overkill if you are already using SSL and Access Tokens? I’m thinking of further ways to secure a service, and HMAC message signing is one. But it comes with ...