SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
0answers
23 views

What could be the reason for “SSL: No Application Data included”

I am trying EAP-TLS privacy, upon receiving change_cipher_spec and finish, and the same handshake has another request for client_hello_requset as a encrypted message, and openssl able to decrypt it ...
1
vote
1answer
27 views

Does OpenSSL have stat for read change cipher spec (SSL3_ST_CR_CHANGE_A)

In EAP-TLS method of authentication if a server sends Change Cipher Spec message to the client, I couldn't find references to SSL3_ST_CR_CHANGE_A. The enum is defined for SSL3_ST_CR_CHANGE_A in ...
1
vote
0answers
93 views

Running openssl s_client with an aes encrypted key fails

I'm trying to verify a 2-way SSL connection using the openssl s_client command openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key The openssl s_client fails ...
0
votes
1answer
44 views

What happens if someone steals one of my additional domain controllers

What happens if someone steals one of my additional domain controllers? What information could an attacker get from my domain controller?
1
vote
5answers
93 views

Using Diffie-Hellman to verify SSL Certificate?

I am fairly new to encryption and I need some help. I have a problem that I'm trying to solve. My problem is the following: I have a Web Server and an (iOS) App that that communicate with each ...
9
votes
2answers
481 views

Is publishing CRLs over HTTP a potential vulnerability?

I noticed that at least one major CA (Comodo) publishes their CRL over HTTP rather than HTTPS. This seems to me to be somewhat of a vulnerability, as an attacker could hijack the HTTP connection that ...
0
votes
2answers
252 views

Avast https scanning

How does Avast's https scanning feature work? Is it basically a MITM attack? This feature was enabled in the 2015 version released a few days back
2
votes
1answer
37 views

What security layers of protection are available over XMPP?

I have been working on an application running over XMPP. I would like to know which all popular security layers are available over the XMPP protocol, similar to SSL over http.
1
vote
0answers
33 views

Force SSL/TLS version for Java RMI server/client [migrated]

Everywhere documented, it says Java RMI can apply SSL/TLS. I have a working sample of a client/server application that does exactly this. But how can i force the used protocol to TLS 1.2? I need to ...
2
votes
2answers
124 views

Security through obscurity - “https requests” are safe?

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text ...
1
vote
1answer
56 views

how to test on which TLS Version has https connection established between server and a mobile application ( Android and iOS )? [closed]

Testing for Poodle attack vulnerability. Also, I could sniff the packet from wireshark and see the TLS version. I want to find if there is any other way available by which I can test this?
1
vote
2answers
59 views

What would HTTP/2 TLS encryption provide?

https://en.wikipedia.org/wiki/HTTP/2 I know that a HTTPS connection provides: Authenticity: a website that I'm visiting is the real website that I intended to visit. Integrity: the data that is ...
6
votes
3answers
751 views

Why wouldn't it be great, if HTTP/2 would only allow communication via TLS? [duplicate]

https://en.wikipedia.org/wiki/HTTP/2 Earlier, encryption method TLS 1.2 or greater was planned to be mandatory as part of the protocol. However, in lieu of consensus for mandatory TLS, an ...
1
vote
1answer
309 views

Minimal HTTPS SSL client in C [closed]

I want to implement an HTTPS client using pure C. I have implemented an HTTP client, and it works just fine. My question is: I know the HTTPS protocol does some kind of negotiation to announce what ...
1
vote
1answer
211 views

SSL interception with Burp Suite using Firefox - Strange behavior when intercepting twitter

I am learning Burp Suite(Free Edition v1.6). I have set it up with the default settings. The proxy listener is listening to 127.0.0.1 on port 8080 and Certificate option is set to 'Generate CA-signed ...
3
votes
4answers
893 views

How to decode traffic on a LAN whose SSL certificates are expired

We have a campus Wi-Fi at my university and we authenticate through a log in page which to me seems like we are using a RADIUS server. Every time the page loads my browser warns me that the ...
-3
votes
0answers
10 views

I want to implement EAP TLS based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol? [migrated]

I want to implement EAP TLS based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?It will be great help for any reference .
1
vote
2answers
174 views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
0
votes
1answer
95 views

Mac OS X : Certificates signed by company trusted CA cannot be verified

I'm trying to setup a keychain on Apache Tomcat that contains a server certificate that was signed by a custom root ca certificate. (not sure if custom is the right word here, but it's a root ...
0
votes
1answer
38 views

Securing connection between redirect from A to B domain

I'm building special extension ( on domain B ) to the present e-commerce hosted on a domain A. The goal is to redirect user from A to B and back. Similar to technique where user leaves e-commerce site ...
1
vote
2answers
95 views

POODLE and REST APIs

Are non-browser applications which do not contain an embedded browser, and merely make REST API calls over HTTPS, vulnerable to POODLE? And if not, is it unnecessary to disable SSL in such ...
1
vote
1answer
42 views

Is using self-signed certificates an option for this m2m scenario

Imagine having a couple of hundred of embedded devices in the field that need to be remotely managed over SSH or HTTPS. These embedded devices are exposed on the internet but are installed at secure ...
3
votes
1answer
162 views

Simplest solution to addressing SSL certificates on internal applications

I am having a discussion with a few coworkers about the best way we can handle SSL certificates within our organization. We have some internal applications that are not using any SSL certificates at ...
1
vote
2answers
118 views

Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?

we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
3
votes
1answer
173 views

Prevent BEAST attack without RC4 cipher suites

It is common practice to prevent the BEAST attack using the following ciphers in Apache SSL configuration: SSLCipherSuite RC4-SHA:HIGH:!ADH Unfortunately, RC4 has been found to be flawed and it is ...
1
vote
1answer
90 views

Forcing eap-TLS 1.2 authentication with FreeRadius and OpenSSL

Been working with TLS DHECE Certificate Based Handshake with a FreeRADIUS Server and wpa_supplicant- both running OpenSSL 1.0.1j FIPS. Afer watching the Wireshark traffic, I notice that the client ...
1
vote
1answer
34 views

Two Phases of Secure Socket Tunneling Protocol (SSTP)

According to http://en.wikipedia.org/wiki/Secure_Socket_Tunneling_Protocol there are two phases, SSL phase and PPP phase. SSL phase establishes a session and PPP also creates a link (which I ...
8
votes
1answer
438 views

How well is the SSL/TLS handshake protected against modifications?

The SSL/TLS handshake is protected against downgrade attempts by the Finished message, a signed and authenticated hash of the master secret and all previous handshake messages. Consider a client that ...
0
votes
2answers
121 views

How much does a GET request over HTTPS reveal to an eavesdropper

Correct me if I am wrong, according to HTTP v1.1 a simple CONNECT request initiates a SSL tunnel between the server and a client. its only after the tunnel is created that the complete GET or POST ...
0
votes
1answer
55 views

How to make a decent Certificate Signing Request (CSR)?

I'd like to know how to make a decent Certificate Signing Request (CSR) to secure my website and e-mail with a wildcard SSL certificate. With recent exploits as POODLE on SSLv3 and such, I'd like to ...
-1
votes
0answers
46 views

Removing CBC ciphers specific to SSLv3 [migrated]

I need to disable SSLv3 specific CBC ciphers as a temporary solution to the POODLE vulnerability as there are legacy applications that need to use SSLv3. After consulting the OPENSSL docs, it seems ...
-4
votes
1answer
86 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
4
votes
2answers
1k views

Disable SSLv3 in Dovecot --> TLS handshaking failed: no shared cipher?

Ubuntu 12.04 OpenSSL 1.0.1-4ubuntu5.20 14 Mar 2012 Dovecot 2.0.19 The situation is I'm trying to disable SSLv3 in Dovecot by adding !SSLv3 to the ssl_cipher_list: ssl_cipher_list = ...
2
votes
2answers
102 views

Decrypting TLS Traffic

Context: I want to reverse engineer a protocol in place for the Nintendo 3DS. The implementation however, uses TLS, which makes it difficult to reverse engineer. I'm currently able to sniff packets ...
1
vote
1answer
79 views

Client Hello message suggests cipher suite which is not in the list specified by setEnabledCipherSuites() method

In my code, I use JSSE6 API to specify a list of enabled cipher suites. I aimed to only allow 168 bits or higher encryption cipher suites, below is a part of my code: /** List of 168 bits encryption ...
-2
votes
0answers
34 views

What happens behind the screens during an HTTPS connection? [duplicate]

How HTTPS(SSL communication) actually works? I have been reading many questions and answers on this topic but some basic question come up to my mind. 1) When I https to any site say ...
1
vote
3answers
121 views

{Secure} Telnet connect to a console server from webbrowser

I've got a terminal server set up in a data center that also serves as a console server. This console server only accepts regular telnet requests. To this server are a bunch of routers and switches ...
3
votes
1answer
138 views

Using Facebook via Tor

I think about using Tor for nearly everthing, including Facebook, because FB often tags the users even on other sites, for example per Like-Button, Cookies etc. Now I think about using the Tor ...
1
vote
1answer
123 views

Need Help with decrypting the “client key exchange” captured in wireshark

I am trying to understand how the SSL handshake happens for HTTPS. I did the Following: Captured the packets for a HTTPS connection using wireshark. examined the Client Hello for cipher suites ...
3
votes
1answer
54 views

Does SNI have any benefit when doing fingerprint validation instead of using the common name?

Does using SNI have any benefit whatsoever (whether security, scalability, or otherwise) if the TLS certificate validation is performed exclusively using the certificate fingerprint and without regard ...
8
votes
4answers
837 views

How bad it is to install another company's root certificate to your server?

Our company uses a web server with a couple of web sites on it (private and public, over HTTP and HTTPS, some low risk and some high risk including online payments or other sensitive data for ...
-1
votes
0answers
28 views

Review of the “Connections Tab” in my browser using secured sites

Can someone help me understand the following information better when looking at a secured site in my browser. For example I'm looking at a site now and it says the following in the connections tab ...
1
vote
1answer
135 views

Email clients and POODLE vulnerabilities

I use a commercial email service that provides IMAP over SSL on port 993 and SMTP over SSL on port 465. I currently connect to their servers with Thunderbird and the Apple's iOS8 email client. Could ...
2
votes
1answer
29 views

SSL Mixed Scripting Vulnerabilities and XOR Attacks

Given that RC4 is a stream cipher (I'm pretty sure the details of its inner workings don't matter for the sake of this argument) and the existence of Mixed Scripting / Mixed Display (web applications ...
3
votes
1answer
81 views

How to best to secure data over HTTPS

My aim is to have an (iOS) app in which the user would login, then on sucsessful login, gain access to additional information over an encrypted webservice (undecided). From research, I understanding ...
2
votes
3answers
701 views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
0
votes
0answers
155 views

How to disable SSLv3 on a Windows 8 phone?

I have a Nokia Lumia phone that runs Windows 8. However, simple test on the browser tells me I'm vulnerable for POODLE attacks. I use the phone for internet and email access a lot and I need it to be ...
0
votes
1answer
94 views

sslv3 is still showing in openssl result even after disabling from sslprotocol [closed]

We are trying to disable sslv3 for poodle vulnerability.so i disabled in ssl.conf SSLProtocol -ALL +TLSv1 -SSLv2 -SSLv3 and tried to connect using tlsv1 using openssl command. openssl s_client ...
1
vote
0answers
42 views

SSL Asymmetric encryption newbie [duplicate]

I am relatively new to the world of cryptography and was wanting to develop a webpage which allows credit card payments. Thus, I looked into the digicert ssl service, hoping that it could do what I ...
0
votes
0answers
22 views

Client side ssl auth by signing with server key [duplicate]

So I followed this for setting up client ssl certs using openssl: http://drumcoder.co.uk/blog/2011/oct/19/client-side-certificates-web-apps/ It basically walks through creating a new CA key, and then ...