SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

0
votes
3answers
345 views

Trust a non-root CA in OpenSSL

Is it possible to have OpenSSL trust a non-root CA such that a certificate signed by that non-root CA can be properly verified? I've noticed that the default behavior for OpenSSL is to only verify ...
0
votes
1answer
207 views

Sniff HTTP(S) from PPTP VPN server

I've setup an PPTP VPN server on my Debian 7 server. I'm using this VPN in combination with my Android phone to ensure a secure connection. However, i'm getting curious of what my phone is sending ...
0
votes
1answer
817 views

Java SSL factory connection to SSL server (with just public-key and certificate)

I am trying to connect to a SSL web server. We currently have a pkcs12 file and connect, that is our private-key and certificate. Is it possible to connect using Java code with a public-key and ...
0
votes
1answer
184 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
0
votes
3answers
161 views

What are the MitM implications of a stolen client-side private key?

Many VoIP handsets support client-side SSL authentication for auto-provisioning. Unfortunately, some devices must be programmed with their client-side keys. (Keys generated on low-entropy devices are ...
0
votes
1answer
165 views

Installing SSL on load balancer and the internal IP

I have a server which has an internal IP (Used to access from local) and an external IP (accessed from Internet and placed in the load balancer). And both will use the same URL ...
0
votes
2answers
575 views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
0
votes
2answers
248 views

Achieving End to End encryption with TLS

The scenario is that a client browser (eg: a user trying to log in to a bank website) needs to be able to view certain sensitive information that resides in a mainframe sitting in the Internal network ...
0
votes
1answer
135 views

Can I use a CDN for static content without sacrificing SSL keys?

I would like to use a CDN for the static content of a website. But obviously I do not wish to share my SSL key with any external service. What are my options? An ideal solution would be to link to ...
0
votes
1answer
209 views

Are web sites with non-https login pages secure? [closed]

I was looking at weibo.com (chinese equivalent of twitter). I was surprised to see that their login page (http://www.weibo.com/) or forgot password ...
0
votes
1answer
90 views

vsftp encryption algorithm

I want to configure VSFTP for ftps protocol and it has some choices to select the encryption type: tlsv1, sslv2, sslv3. I read that tls version 1 has some security issues but in the man page it says ...
0
votes
1answer
102 views

SSL and Strategy to prevent destination URL from being revealed

Googling the subject "sniffing out / spying on SSL secured communications" one finds many references to being able to make some good guesses about the "target destination" once the path length is ...
0
votes
1answer
86 views

Protected Client Server communication advice

I am hoping for a better understanding about SSL/TLS by setting up two devices, running two different applications, allowing communications to go over SSL/TLS. With OpenSSL I have created a ...
0
votes
2answers
196 views

Man-in-the-middle SSL generation on request possible

I am doing some research on man-in-the-middle focusing on SSL in particular. I have been looking into generating a certificate on request when a client connects and requests a secured page. ...
0
votes
1answer
47 views

How to properly implement TLS on an ejabbered server

The official ejabbered documentation instructs the user to generate a self-signed certificate like this: openssl req -new -x509 -newkey rsa:1024 -days 3650 -keyout privkey.pem -out server.pem openssl ...
0
votes
1answer
106 views

TLS_RSA type ciphersuite and PFS

Today while I'm reading about the RSA factoring challenge. I thought to myself that if whoever depends on RSA-512 (By using TLS_RSA_xxxx) to secure their TLS connection years ago, the info they wish ...
0
votes
1answer
1k views

Problems with intermediate ssl certificates and ssl proxy

I'm currently implementing a SSL-proxy, and have run into some problems regarding certificates. We have a offline "Company Root CA", and an online "Company intermediate CA". On the proxy I have ...
0
votes
1answer
191 views

SSL (TLS v1.2) - Can i offer fallback CAs when upgrading Certificates? (Java)

I am currently developing a product that involves two network situations. At the client side, multiple computers form a P2P network (multiple locations, multiple p2p networks), and a subset of nodes ...
0
votes
1answer
111 views

Increasing website data security level

Could it be more secured using the "HTTPS" protocol for website data security and at the same time using another encryption algorithm (Elgamal) as well? I know "HTTPS" could be used alone, but I ...
0
votes
1answer
524 views

Configuring SSL certificate on OS X 10.8.5 produces “Chain issues Contains anchor” error

I'm trying to install a Thawte SSL123 certificate on OS X 10.8.5, but having a difficulty. While the certificate and intermediates appear to be installed without any errors, running the Qualys SSL ...
0
votes
2answers
110 views

Force https, complex implementation

I have a website running on a dedicated server (single IP) on apache. Multiple domains are pointed to the website . For ex: sub.abc.com, sub.bcdaf.com I have now purchased a single SSL certificate ...
0
votes
1answer
837 views

Why Qualys SSL Server Test is giving me 80 and not 100 in Key Exchange?

My openssl ciphers -v 'CIPHER' output is the following: ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA ...
0
votes
3answers
5k views

How force that all connections to my Apache use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...
0
votes
1answer
698 views

OpenSSL: Enable cipher suites per protocol version

Is there a way to explicitly configure OpenSSL to allow AES (or in general, block ciphers) only for clients that use a TLS version >= 1.1? This would protect against the BEAST attack, while still ...
0
votes
1answer
133 views

Does the VPN provider will have access to my content? [duplicate]

I am planning to buy a VPN service just to circumvent the filtering applied by the government. However as I am planning to use OpenVPN on my dd-wrt router, all of my data will pass through this ...
0
votes
1answer
145 views

Setting up two way SSL

I am trying to setup two way SSL to communicate with partner web service. I understand I have to provide server certificate on client side. However, questions are: Is self signed certificate okay? ...
0
votes
1answer
838 views

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange? Can the server be configured to use weak key sizes for ...
0
votes
1answer
616 views

How configure tomcat 7 SSL to use AES-NI?

My server has AES-NI and I would like tomcat 7 to make use of this but I am not really sure how to make that happen or where to even start looking. I am quite familiar with tomcat administration, and ...
0
votes
1answer
294 views

Configuring IIS SSL for PCI

Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning? Preferably something for both IIS 6 and IIS 7 I'm currently running into BEAST issues but ...
0
votes
1answer
526 views

Why do we need to use HTTP CONNECT? [closed]

If we are writing a custom http client which connects with an https server. Should the custom client when deployed on machines which are behind web proxy need to send a HTTP CONNECT Request so as to ...
0
votes
2answers
892 views

Protecting yourself against DNS spoofing?

Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot ...
0
votes
1answer
22 views

How is the Premaster secret used in TLS generated?

I believe that it uses some combination of the random values sent in the hello messages. From RFC 2246: (TLSv1.0) RSA encrypted premaster secret message Meaning of this message: If RSA is ...
0
votes
1answer
20 views

EAP-TLS fragmentation implementation

I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a ...
0
votes
1answer
36 views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...
0
votes
0answers
72 views

Can not open my yahoo email. The connection was interrupted [closed]

Since yesterday, I can not open my yahoo mail. I get connection interrupted message (see pic). Or, some times I get another similar message saying the connection was reset. I tried another PC, same ...
0
votes
0answers
21 views

Parsing an X509 Certificate [migrated]

I currently need to parse the CommonName from a packet. I have code that works up to a point, however am having trouble skipping over the "issuer" member of a Certificate record for TLSv1.2. I have ...
0
votes
0answers
20 views

How can I export private key from a certificate chain? [migrated]

I create a keystore and from that keysore I generate a CSR file and when I receive Signed Certificate from CA, I imported root and intermediate certificates to my keystore and finally my signed ...
0
votes
0answers
23 views

Key differences between IPSec and HAIPE?

HAIPE is derived off IPSec but can someone draw up the differences between using IPSec with Suite B crypto and HAIPE with Suite B? We can drop Suite A or classified info for this question; staying ...
0
votes
0answers
36 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
0
votes
3answers
53 views

Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why?

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement? This is between non browser client ...
0
votes
1answer
35 views

Diffie-Hellman certificate verify message

On the RFC 6101, about "Certificate Verify", I read that: "This message is used to provide explicit verification of a client certificate. This message is only sent following any client ...
0
votes
1answer
128 views

Does an HTTPS proxy encrypt traffic between proxy client and server for HTTP requests?

To bypass censorship in a DIY fashion, I plan to set up private proxies for my personal use. One of the possible methods I would try is to use an HTTPS proxy (not a web proxy, to be explicit) hosted ...
0
votes
0answers
74 views

Socket.IO & WebSocket security - query certifcate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
0
votes
1answer
60 views

Server SSLv2 enabled on non-webservers

Using Nessus I'm scanning our internal network for vulnerabilities and exploits. I've found a large number of instances where SSLv2 is enabled and is as a result, being flagged as a vulnerability. I ...
0
votes
1answer
73 views

Why middleman cannot capture the encryption key of https/tor traffic? [duplicate]

When we use Tor or https traffic , the encryption- decryption key has to be exchanged between the browser and the website server. Why somebody who can capture entire traffic , say ISP or somebody who ...
0
votes
0answers
24 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
0
votes
0answers
107 views

cURL cert validation with curlopt_cainfo not working

I want to validate my SSL certificate each time I run API calls. I've been following this guide: http://artur.ejsmont.org/blog/content/how-to-properly-secure-remote-api-calls-from-php-application ...
0
votes
1answer
70 views

SSL decryption without installing a certificate on each client

Given a proxy performing MITM SSL decryption and inspection, is it possible to install a wildcard certificate (*.domain.com) on the proxy signed by a root CA (such as VeriSign or GoDaddy) such that ...
0
votes
2answers
84 views

SSL Finished message contents

Hi everyone I'm little bit confused about contents of Finished Message used during Handshake Protocol.In particular this message (client/side) contains the connection-id originally sent from the ...
0
votes
0answers
33 views

ARR Server and SSL Offloading

we want to implement ARR server in our WAN. the SSL offloading feature is enabled on ARR server. Since SSL offloading terminates encryption , we want to secure connection between ARR server and data ...