SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

0
votes
0answers
15 views

Indication of RSS SSL news feed source [closed]

I manage a website which is under HTTS (SSL). The issue is that I need to add a RSS news feed ticker in this website. I could not find any HTTPS news feed source, and as result depending on the ...
0
votes
0answers
17 views

Key differences between IPSec and HAIPE?

HAIPE is derived off IPSec but can someone draw up the differences between using IPSec with Suite B crypto and HAIPE with Suite B? We can drop Suite A or classified info for this question; staying ...
0
votes
0answers
30 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
0
votes
3answers
45 views

Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why?

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement? This is between non browser client ...
0
votes
1answer
27 views

Diffie-Hellman certificate verify message

On the RFC 6101, about "Certificate Verify", I read that: "This message is used to provide explicit verification of a client certificate. This message is only sent following any client ...
0
votes
1answer
100 views

Does an HTTPS proxy encrypt traffic between proxy client and server for HTTP requests?

To bypass censorship in a DIY fashion, I plan to set up private proxies for my personal use. One of the possible methods I would try is to use an HTTPS proxy (not a web proxy, to be explicit) hosted ...
0
votes
0answers
52 views

Socket.IO & WebSocket security - query certifcate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
0
votes
0answers
16 views

How to install SSL certificate in the Trusted Root Certification Authorities Store? [migrated]

Apologies in advance, I do not have an IT background and have never done this before, yet I am being asked to figure this out and to do so as soon as possible. Our organization is trying to update ...
0
votes
0answers
33 views

Errors from httperf [migrated]

I use httperf for performance testing. I start many threads of httperf at the same time, but after running for a while I receive errors like this: "httperf: failed to connect to SSL server ...
0
votes
1answer
58 views

Server SSLv2 enabled on non-webservers

Using Nessus I'm scanning our internal network for vulnerabilities and exploits. I've found a large number of instances where SSLv2 is enabled and is as a result, being flagged as a vulnerability. I ...
0
votes
1answer
63 views

Why middleman cannot capture the encryption key of https/tor traffic? [duplicate]

When we use Tor or https traffic , the encryption- decryption key has to be exchanged between the browser and the website server. Why somebody who can capture entire traffic , say ISP or somebody who ...
0
votes
0answers
24 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
0
votes
0answers
78 views

cURL cert validation with curlopt_cainfo not working

I want to validate my SSL certificate each time I run API calls. I've been following this guide: http://artur.ejsmont.org/blog/content/how-to-properly-secure-remote-api-calls-from-php-application ...
0
votes
1answer
66 views

SSL decryption without installing a certificate on each client

Given a proxy performing MITM SSL decryption and inspection, is it possible to install a wildcard certificate (*.domain.com) on the proxy signed by a root CA (such as VeriSign or GoDaddy) such that ...
0
votes
2answers
82 views

SSL Finished message contents

Hi everyone I'm little bit confused about contents of Finished Message used during Handshake Protocol.In particular this message (client/side) contains the connection-id originally sent from the ...
0
votes
0answers
31 views

ARR Server and SSL Offloading

we want to implement ARR server in our WAN. the SSL offloading feature is enabled on ARR server. Since SSL offloading terminates encryption , we want to secure connection between ARR server and data ...
0
votes
1answer
61 views

Is session-passing safe?

I have a php and nodejs server. User logs in on the php backend, and, when entering nodejs, the php SID cookie is being passed through a websocket. I further take the session ID, find the session file ...
0
votes
2answers
35 views

PKI certificate validation graphs, trees and cross signing

I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it ...
0
votes
0answers
38 views

Strange Finished Message in TLS

I've tried to understand the content of the Finished Message of TLS. I'm using wireshark to capture the traffic between my browser and the internet. I noticed a "stangeness" when the chosen ...
0
votes
0answers
45 views

Central Authentication Server

I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication ...
0
votes
0answers
23 views

DTLS CertificateVerify doubt

In DTLS 1.2 RFC 6347, section 4.2.6: CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: ...
0
votes
0answers
187 views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...
0
votes
1answer
86 views

TLS sequence number

Watching at TLS 1.2 traffic using Wireshark, I figured out that in the Application Data record, the 64-bit sequence number in some connessions is sent and in others not. Does it depend on the Cipher ...
0
votes
2answers
109 views

Are SSL encrypted communications through a company network safe?

If I'm using Skype, Facebook, or another type of communication at my work, can the network administrator see my Skype and Facebook conversations, although its encrypted with SSL? I found this text: ...
0
votes
2answers
465 views

Why do I need a certificate to pin an SSL connection with AF Networking 2?

I am using the AF Networking 2 library and read that I need to include the server's certificate here. The client should be able to tell that the certificate is valid when it connects to the server, ...
0
votes
1answer
64 views

How does the Subterfuge toolkit bypass SSL? [closed]

As the title says, does anybody know how Subterfuge bypasses the SSL layer?
0
votes
3answers
400 views

Any alternative available for RSA? Is the web still visible to NSA?

After the Snowden revelations, is there any mass change being carried out to HTTPS protocol? As far as I understood, any HTTPS communication is still visible to NSA as they can compromise the RSA ...
0
votes
1answer
72 views

Secure Communication Between .Net Application and Website

Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our ...
0
votes
0answers
20 views

What SSL/TLS ciphers do each version of Android support? [duplicate]

What ciphers do each Android device support? Update: More specific not SSL or TLS versions but the actual ciphers such as ECDHE-ECDSA-AES128-GCM-SHA256, etc. Android 2.3? Android 3.x? Android ...
0
votes
0answers
20 views

Protecting client's data over the wire [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
0
votes
1answer
567 views

OpenSSL get key length of all certs [closed]

I am trying to ensure that all certificates in a chain for a host have a key length of 2048 bits. Using openssl s_client, only the key length for that host's cert is given, is there a simple way to ...
0
votes
1answer
74 views

how does IE or chrome verifies certificate? [duplicate]

If the HTTPS webserver uses self signed certificate, the web browser warns the user as follow. http://www.sslshopper.com/assets/images/iis7/iis7-self-signed-certificate-8-certificate-not-trusted.png ...
0
votes
2answers
706 views

Do i need SSL certificate signed by a CA for hybrid mobile apps?

I have just stepped into ssl domain and started exploring how to implement ssl. My question is i understand ssl certificates signed by CA actually allow the client or browser to validate that the ...
0
votes
0answers
85 views

SSL is cracked. What is the alternative? [duplicate]

According to Der Spiegel: SSL should be cracked Exactly how much the two intelligence agencies can actually read along from the encrypted traffic in the network, is not entirely clear. But ...
0
votes
0answers
21 views

Minimum protocol versions for SSL setup [duplicate]

What are the suggested minimum version of SSL/TLS supported by the major browsers (IE 8+, Chrome, Firefox, Safari, Opera,...)? Can I get rid of SSL3.0 and TLS1.0 or is there still a major user base ...
0
votes
1answer
417 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
0
votes
1answer
46 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
-1
votes
4answers
164 views

How secure is this login page? [closed]

Unfortunately I cant link to the page (it internal). But I can describe it! This is a lightspeed systems policy enforcement login page (content filter). The page is http and there is no iframe with ...
-1
votes
3answers
91 views

MiTM attacks SSL to SSL

I was wondering what ways there are to MiTM a client link to the server where I would give them a public key that they would then send their data via https://example.com using my key. Then without ...
-1
votes
3answers
116 views

Secure transmission for desktop applications

Suppose I have a desktop application that does password hashing for login authentication. Is the password normally hashed before it travels to the wires or does it travel to the wires first in plain ...
-1
votes
2answers
345 views

Generate openSSL certificates from within C code using commands?

This is an openSSL command for generating a private key and a certificate, openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key The question I have is whether there is some ...
-1
votes
2answers
399 views

What is ASN.1 usage in SSL protocl and What's the risk of using it?

I heard that ASN.1, which is part of browser SSL libraries, introduces the potential risk of compromise our system even if we use no-script. but what is ASN.1 exactly doing? Why do we need to use ...
-1
votes
1answer
367 views

Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited?

I am making a presentation to the class about "SSL 2.0 deprecated protocol" and I really have no idea how this exploit is used or how the attacker can use this vul. I understand the impact of this ...
-1
votes
4answers
299 views

Secure communication between server and client [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
-1
votes
1answer
194 views

How secure are the new TLDs ( .us, .io, …) and do they compare to .com? [closed]

The introduction of the new top level domains (TLDs) such as .music, .books, etc. will increase the number of people and organisations adding and removing entries into the root DNS servers (.) for ...
-1
votes
2answers
87 views

What happens when and attacker changes the installed public keys in browser

I was reading about SSL. I understood that each browser comes with a predefined set of known public keys,which is then used to authenticate the messages. I was wondering what will happen when a virus ...
-1
votes
2answers
327 views

Is SSL needed for connecting to my DVR System?

I was wondering if SSL is necessary to connect to my DVR System, by default, which can't be changed, I can connect to my DVR System with the help of dyndns.com. But going to the domain doesn't show ...
-1
votes
1answer
180 views

RC4-MD5 vs DES-CBC3-SHA [closed]

We moved to RC4-MD5 as a mitigation to BEAST attack. But our other teams are saying to use DES-CBC3-SHA I want to know if DES-CBC3-SHA is also equivalent secure and mitigates BEAST as well ? Also ...
-1
votes
1answer
2k views

Why IE/Windows forces you to install self-signed certificates as root CA to make them work?

In old versions of IE/Windows you could install a self-signed certificate for a web site and it just worked: the warnings disappeared. In more recent versions (and with Chrome) this just didn't work. ...
-1
votes
1answer
110 views

XER encoded X.509 certs [closed]

Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it? Thanks!