SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

5
votes
2answers
1k views

Why is NIST removing & not updating TLS guidance? What is the replacement?

The document NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations was retired without superseding it with a newer document. In ...
1
vote
1answer
1k views

Can I use any ssl certificate to sign and encrypt AS2 message?

I'm absolutely new to this topic of ssl certificates, so please be patient with me. My task is to install an AS2 communication with some business partner. Therefore we need message signing and ...
3
votes
1answer
7k views

How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?

I read a lot of issue [1] currently stating that RC4 is broken and is at risk. I just checked my web server (nginx) and it is using the default settings, which is DHE-RSA-AES256-SHA How does this ...
4
votes
5answers
511 views

Does using ssl matter if I am connected using a VPN?

Say I have an internal server that I am using for source control. If I only access that server through a VPN connection, do I still need to have SSL setup on the source control server to ensure that ...
0
votes
1answer
149 views

Setting up two way SSL

I am trying to setup two way SSL to communicate with partner web service. I understand I have to provide server certificate on client side. However, questions are: Is self signed certificate okay? ...
2
votes
1answer
2k views

Certificate Chains When Importing Signed CSR Response

I'm interfacing with a secure web service, and authenticating using a client certificate. I'm confused about step #3 in the client configuration: Generate a private key into keystore Generate a CSR ...
14
votes
4answers
16k views

Why don't major browsers currently support TLS above version 1.0?

TLS 1.0 seem to be vulnerable to Beast, Lucky13 and maybe other attacks and is simply outdated. Common workaround used e.g. by Google was to use RC4 which was also recently broken, but none of the ...
0
votes
2answers
725 views

Two-way SSL Performance

We are planning to use 2 way ssl instead of username/password token for authentication. Does anyone know what is the performance penalty for using 2 way SSL?
2
votes
5answers
1k views

Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?

I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"? Furthermore, are there any practical ...
0
votes
2answers
385 views

Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
0
votes
1answer
110 views

Implementing secure login for an API

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
0
votes
1answer
141 views

Is this a secure method for authenticating clients?

I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy. Client sends a ...
2
votes
1answer
159 views

SSL certificates published in Mandiant's APT1 report

You probably heard about excellent report "APT1: Exposing One of China's Cyber Espionage Units" published by the Mandiant company (you can download it here). Report is great and I recommend it to ...
1
vote
2answers
247 views

What threats are posed by SSL connections?

I'm working on implementing an Exchange 2010 solutions which includes Outlook Web Access, Exchange ActiveSync and Outlook Anywhere. These services use SSL and would be presented on the Internet so our ...
5
votes
2answers
481 views

RC4 bias protection with padding in TLS

On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said: One way to "fix" RC4, which has been suggested many times, is to drop ...
21
votes
1answer
4k views

TLS: RC4 or not RC4?

I was reading another interesting article by Matthew Green today, saying that if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop As far as I'm aware ...
3
votes
2answers
152 views

Should I use SSL on my database server?

Say I have a website and a database, both hosted on rackspace. Since all communication with the database is from the web server and not the internet, is it safe to assume that I do not need SSL ...
1
vote
1answer
4k views

Web Applications (http): Don't get how token based authentication is secure

See something like this: http://stackoverflow.com/questions/10826293/restful-authentication-via-spring/10864088#comment21706215_10864088 Or more specific: Token-based authentication - Securing the ...
84
votes
2answers
47k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
3
votes
4answers
228 views

Secure single page in a site if site is hacked?

I've been tasked with trying to find a way to secure a single page in our site if somehow, a hacker gets access to our files. This "single page" will be run on a different server. Requirements: ...
5
votes
5answers
543 views

How risky is it not to install ssl?

I would like to have more insight about when a server should install ssl, in particular when it is worth the money to pay for a valid certificate. As my clients often have little understanding of why ...
5
votes
1answer
2k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
2
votes
1answer
277 views

What is the cost of SSL encryption?

So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an ...
4
votes
3answers
552 views

Why are SSL certificates valid only from a certain date?

Each SSL certificate is valid starting from a specific date and up to the expiration date. What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific ...
4
votes
1answer
4k views

Use client SSL certificates as web application authentication

I'm working on a web application with simple API needing authentication. For my application nature, users have two RSA keys, for signing and encrypting messages. My protocol works based on it. The ...
1
vote
1answer
195 views

Key authentication with ssl

Can i authenticate myself in SSL with a key, just like in SSH?
6
votes
1answer
803 views

Choosing an SSL certificate provider

Does it make any difference which provider I get my SSL/TLS certificate from? In particular, what are the pros and cons getting an SSL certificate from Verisign vs getting one from Thawte? Which one ...
2
votes
1answer
748 views

Windows Update - Interception

I'm trying to monitor the HTTP requests/responses made when performing a Windows Update. I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp: netsh ...
5
votes
2answers
998 views

Entering sensitive information into non-SSL site that uses secure iFrame

There is a website that tenants can use to pay their rent. That website uses an http address but apparently uses a third-party product, which embeds an iframe into the page. The source of that iframe ...
2
votes
1answer
2k views

What elliptic curves are supported by browsers?

Wireshark'ed Firefox 3 request. Their names are nowhere documented. Elliptic curve: secp256r1 (0x0017) Elliptic curve: secp384r1 (0x0018) Elliptic curve: secp521r1 (0x0019) What are the supported ...
3
votes
1answer
278 views

What are those nul bytes doing in Certificate Subject CN?

While doing some research with SSL certificates, I found some weird certificates containing nul bytes in their Subject field. One example is www.refah - bank.ir (did the Iranian government fake this ...
4
votes
1answer
150 views

How powerful are top Verisign executives?

I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a ...
0
votes
1answer
868 views

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange? Can the server be configured to use weak key sizes for ...
6
votes
2answers
2k views

How to set “Not Before” value to past when creating certificate request

We have lots of embedded TLS clients on the field. TLS Servers must be authenticated. Because long power cuts may reset clock of those devices, we have requirement to use certificates with validity ...
1
vote
1answer
243 views

How effective is Activesync Certificate revocation using CRL or OCSP

We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords. One way to remedy an account lockout issue is to issue and deploy certificates ...
8
votes
5answers
306 views

Threat model for huge warnings on untrusted SSL certificates and no warnings for plain HTTP connections?

Why do untrusted/expired SSL certificates get such a huge warning in modern browsers even with "DO NOT VISIT THIS SITE!" messages, whereas a regular HTTP connection, which is more prone to ...
50
votes
10answers
7k views

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
1
vote
3answers
564 views

SMTP and SSL/TLS

If I understand correctly, communication between SMTP servers may be encrypted but is not required. Because it is optional, does it really have benefits? When server A connects to server B, both of ...
1
vote
2answers
100 views

How can I set up signed downloads?

Scenario I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
5
votes
1answer
385 views

Certification authority only for certain domains

Is it possible to make a certification authority certificate (even unsigned), which only allow to sign certificates for specific domain(s)?
2
votes
2answers
4k views

HTTPS verification failed - get certificate information iPad/iPhone

I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
6
votes
2answers
336 views

Is IP restriction enough or should I SSL my web authentication?

I want to connect to my home install of phpmyadmin. I restricted the connection for this to my 2 IPs. But I don't really understand this whole OSI layering. I do know that the IP is saved in the ...
2
votes
2answers
98 views

Actual issue? Phone switches from 3G to router makes session switch from https to http

I heard that a security issue exists in some cases when a mobile phone has: Connected to a website via https via 3G Connects to a router I'm told that that in this particular scenario the router ...
0
votes
1answer
643 views

How configure tomcat 7 SSL to use AES-NI?

My server has AES-NI and I would like tomcat 7 to make use of this but I am not really sure how to make that happen or where to even start looking. I am quite familiar with tomcat administration, and ...
2
votes
3answers
119 views

Is password authentication worse that signed messaging if done over SSL?

Let there is a public API: HTTP-based via SSL there are no browsers, just connections between custom written programs The first authentication scheme that came to my mind was... client signs their ...
3
votes
1answer
190 views

Exporting data beyond a cryptographic boundary

Scenario We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
-1
votes
2answers
442 views

What is ASN.1 usage in SSL protocl and What's the risk of using it?

I heard that ASN.1, which is part of browser SSL libraries, introduces the potential risk of compromise our system even if we use no-script. but what is ASN.1 exactly doing? Why do we need to use ...
9
votes
4answers
2k views

Can URLs be sniffed when using SSL? [duplicate]

I know that http requests can be sniffed, so sniffer can see the requested URL from the victim. So 2 days ago I my bank made me a web-account to see, send money etc... The thing I saw is my session ...
1
vote
1answer
397 views

How to troubleshoot why Thunderbird rejects a PKCS#12 certificate with “Could not verify this certificate for unknown reasons”?

After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a ...
3
votes
3answers
163 views

Is it safe to mix authentication methods?

Is it a good idea to "combine" authentication methods? Example we can use username/password method to authenticate a user from a server. What if we used this as a first authentication step to get ...