Tagged Questions

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

4
votes
1answer
368 views

How secure is MongoDB wire protocol?

I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
3
votes
1answer
5k views

Openssl generate different type of self signed certificate

Does anyone know how to use openssl to generate certificate for the following public key type: 1) DSA - For DHE_DSS key exchange. 2) Diffie-Hellman - For DH_DSS and DH_RSA key exchange. 3) ECDH - For ...
1
vote
3answers
468 views

Asking for an SSL Certificate from the Client

I have created a web application for a client and I'm hosting it on my own server behind a domain I own. I have purchased an SSL certificate for this domain and the web application runs nicely over ...
3
votes
1answer
327 views

Is TLS 1.0 sufficiently secure for a bank?

I disabled SSL2 and SSL3 in my Firefox browser, version 24. I only enabled TLS 1.1 and 1.2. Unfortunately when I went to my bank's website, I found that it didn't work until I re-enabled TLS 1.0. ...
3
votes
3answers
579 views

What type of SSL certificate do I need for communications between an Android app and a web service?

I am developing a game for Android. The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database. I would ...
0
votes
1answer
1k views

“Must have” and “Preferred Cipher” suites terminology

I have received the following advise to set cipher suites to suitably mitigate Beast attack on a newly setup Apache HTTPD server. Preferred ciphers: RC4-SHA, RC4-MD5 Must Have Ciphers: ...
1
vote
1answer
499 views

Additional security for WebRTC/DTLS-SRTP with PGP?

I am having a thought experiment. Can you help me? Two clients who both use PGP. They initiate a WebRTC call using DTLS-SRTP via a 3rd party server. Is there any benefit of encrypting, via their ...
0
votes
2answers
759 views

mutual authentication between two clients

I understand how mutual authentication works between a client and a server, however I am unsure how I would be able to get mutual authentication between two clients A and B? What would be the best ...
0
votes
1answer
2k views

Problems with intermediate ssl certificates and ssl proxy

I'm currently implementing a SSL-proxy, and have run into some problems regarding certificates. We have a offline "Company Root CA", and an online "Company intermediate CA". On the proxy I have ...
2
votes
3answers
216 views

Do on-demand SSL certificates exist?

A few days ago, I visited an SSL protected website. Since Safari complained about the SSL-certificate, I did a short inspection: The certificate was issued by GoDaddy in just the minute I ...
2
votes
1answer
595 views

Different SSL states as seen by Safari, Chrome and Firefox

Today, I visited some sites of the German DHL group. While Chrome and Safari complain about an invalid certificate of Firefox accepts it. Which one is right, which one is wrong? Which decision ...
1
vote
1answer
95 views

Certificate Mapping in IIS

When pasting the certificate blob in the configuration editor in IIS 7.5 for one on one authentication, is this the server certificate or the client certificate?
0
votes
1answer
240 views

SSL (TLS v1.2) - Can i offer fallback CAs when upgrading Certificates? (Java)

I am currently developing a product that involves two network situations. At the client side, multiple computers form a P2P network (multiple locations, multiple p2p networks), and a subset of nodes ...
0
votes
1answer
113 views

Increasing website data security level

Could it be more secured using the "HTTPS" protocol for website data security and at the same time using another encryption algorithm (Elgamal) as well? I know "HTTPS" could be used alone, but I ...
3
votes
1answer
535 views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
0
votes
1answer
1k views

Configuring SSL certificate on OS X 10.8.5 produces “Chain issues Contains anchor” error

I'm trying to install a Thawte SSL123 certificate on OS X 10.8.5, but having a difficulty. While the certificate and intermediates appear to be installed without any errors, running the Qualys SSL ...
3
votes
1answer
143 views

FIPS compliant application based on OpenSSL

Let's say I need to write a simple application for signing/checking some data. The hard part is, that it must be FIPS 140-2 compliant. I was thinking to do it using OpenSSL FIPS Object Module 2.0 but ...
3
votes
3answers
1k views

Revoke a certificate without index.txt

I generate self-signed client certificates for a little Apache server hosted under my stairs. The script below was hacked together for this purpose - note it uses the 'mini-CA' x509 method, therefore ...
-2
votes
1answer
54 views

Website data security using HTTPS / ELGAMAL [duplicate]

Is using the "HTTPS" protocol is enough for website data security, or should I use another encryption algorithm (Elgamal, RSA or something else) as well? Does the BREACH attack described here affect ...
15
votes
2answers
743 views

Twitter's HTTP response vs Google's HTTP response

I was looking at the HTTP responses form https://twitter.com and https://encrypted.google.com. These two responses have interesting similarities and differences in their security definitions. Both ...
4
votes
4answers
698 views

Is it possible to detect SSL private key changes?

I wonder if it would be possible to detect a change of an SSL private key? If you change the key, then I think one must issue a new certificate, but new certificates could be issued without changing ...
1
vote
2answers
121 views

Force https, complex implementation

I have a website running on a dedicated server (single IP) on apache. Multiple domains are pointed to the website . For ex: sub.abc.com, sub.bcdaf.com I have now purchased a single SSL certificate ...
4
votes
1answer
514 views

Is possible that a TLS server send more than one certificate to the client for the same site?

What I'm trying to archive is enable ECDSA and DSS ciphers in my site, but at the same time not depend just of self signed certificates, so I could sent to my client more than one certificate and them ...
2
votes
1answer
355 views

What are the implications of using the same DH parameters in a TLS server?

For a DHE cipher, nginx hard-codes the Diffie-Hellman parameters to use base 2 and a fixed 1024-bit prime (modulus) if no custom DH parameters are configured. These parameters are public (sent in ...
3
votes
1answer
1k views

What could be the order of these ciphers following as first criteria the security and just then the performance?

I need some guide to decide in which order I must put the following ciphers if I want prioritize security and in cases of tied, consider performance to decide. ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 ...
0
votes
1answer
1k views

Why Qualys SSL Server Test is giving me 80 and not 100 in Key Exchange?

My openssl ciphers -v 'CIPHER' output is the following: ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA ...
1
vote
3answers
10k views

How force that all connections to my Apache use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...
1
vote
1answer
149 views

SSL on domain will affect un-secured sub-domain

I have a plan to buy a SSL certificate for my domain. I don't have much budget so I decided to buy standard SSL with no support for sub-domains. I have a WCF web-service that works on sub-domain. This ...
2
votes
5answers
2k views

How can a non-technical user verify a message was sent “securely”? …or over TLS?

I have a situation where B2B and B2C communication needs to be sent securely and not visible to most SMTP hijackers. I don't care about conspiracy theories or NSA style attacks, but want to provide ...
3
votes
2answers
259 views

Is it true, that using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret?

I am a newbie in the security field, so sorry for the naive question. In my understanding, using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can ...
2
votes
1answer
324 views

Communicate between two sites both with SSL

I now have two websites - site A and B, both with SSL-certificate, and they have exact same users. So when a user log into site A and click the link to site B, I want to make him auto log in to site ...
1
vote
2answers
98 views

non-MiTM Reverse SSL

Do non-MiTM Reverse SSL Proxies exist? Or do all proxies that do SSL-SSL mappings decode and then re-encode HTTPS traffic? If this is the case and I want to map https://mypublicdomain.com -> ...
3
votes
2answers
354 views

Plausibly deniable SSH - does it make sense?

My colleague just told me he can't make outbound SSH connections in his corporate networks, so I advised him to set up a server on 443 port and it worked. I then started thinking that the ...
2
votes
1answer
943 views

Evaluate the signature of an X509 certificate in .NET

This is my scenario: A CA signs a certificate with its private key and sends it to a client via https response. From this response the client creates a X509Certificate2 class, that represents the ...
3
votes
2answers
771 views

Is there a problem with issuing a HSTS header in PHP?

I want to trial a HSTS policy on my blog without enabling it site wide initially. As a HSTS policy is just a HTTP response header would there be any problem with sending the header in PHP like so: ...
5
votes
3answers
854 views

Does Google's SSL encryption for searches thwart NSA spying?

Given everything that is suspected about NSA (and GCHQ, DGSE, etc.) access to user data: Avoiding speculation, can and do we know whether Google's recent action to make all searches use SSL ...
0
votes
3answers
998 views

On a public wifi I just tried to access google over HTTPS and was forced on to HTTP, how?

I'm on a coffee shop wifi. I just typed https://google.com in to my browser and noticed that I got redirected to http://google.com. I tried other google domains (google.ie) and these work fine, so ...
6
votes
2answers
1k views

Is SSL terminated at a load balancer PCI compliant?

I've read this nice question: Should SSL be terminated at a load balancer? And I have the same question, but with PCI-DSS compliance in mind. Is SSL terminated at the load balancer, with clear ...
11
votes
1answer
362 views

Is using a CA more secure if I'm self-signing anyway?

We have a web application that we run for clients at their booth on fairs. The communication between clients and the server was done over HTTP until recently. We're currently working on improving ...
1
vote
1answer
519 views

Force browser to use higher security connection

How can I force my Chrome broswer (or even Firefox) to always use a higher security encryption?, for example 256bit (or more) encryption when using https. I guess it should be some flag to force the ...
1
vote
1answer
395 views

ReverseProxy and PCI Compliance

My company has a PCI compliant billing gateway and they expose a service for submitting credit card payment details. I am writing a (Single Page Application/end-to-end javascript) website for them ...
5
votes
2answers
3k views

Which is better for server-to-server-communication: IPSec or TLS?

Maybe you could help me with a small problem. Would you recommend IPSec or TLS for a Server-to-Server-Connection? I need two or three arguments for reasoning a decision within my final paper, but ...
1
vote
3answers
246 views

What information can be seen from HTTPS to HTTP?

Assuming a secured page https://google.com/redirect.php?keyword=apple which redirects the visitor to a non-secured website http://apple.com, would an eavesdropper (anyone watching over the network) be ...
4
votes
2answers
488 views

Is cookie information hackable by “Man in middle” Attack over HTTPS?

Just I want to know, is it possible to extract header data by 'Man in middle attack' in HTTPS connection and is there any other way or hack to achieve same thing? If there is way to hack, is it ...
6
votes
2answers
2k views

1024-bit DHE vs 2048-bit RSA

Currently with apache/mod_ssl, if DHE is enabled then a 1024-bit ephemeral key will be used. I found the following quote in Adam Langley's blog: Ideally the DH group would match or exceed the RSA ...
1
vote
2answers
276 views

Could a user never store a password if a username/email hash was used instead?

So I was just thinking about token_authenticatable setup from devise (rails gem), and this thought occurred to me: Could we strengthen web security by hashing username/password with javascript before ...
5
votes
3answers
2k views

SSL VPN Detection and possible to block

Is it possible to determine the difference between a VPN on port 443 compared to standard SSL traffic? In order to access SSL websites you need port 443 open but if you setup a VPN Service on port ...
0
votes
1answer
143 views

Can the random keys generated during handshake be guessed

During the handshaking of an SSL connection, the server sends its public key, the client generates a random password, encrypts it with the pk, and sends it back, then the server decrypts it and all is ...
1
vote
3answers
492 views

How does SSL protect against network level attacks on integity?

I would like to know if there is any way to demonstrate how an attacker may attack the integrity of a website due to an unencrypted connection and how SSL will avoid this. For the aspect of ...
5
votes
2answers
841 views

Website: Pre-Shared-Key Authentication

We have this web-application with high valuable (business) data. All communication is encrypted through TLS/SSL. While I consider this a really safe protocol, it can still be compromised if someone ...