SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

0
votes
2answers
185 views

SSL handshake: what makes it unforgeable?

I understand the ssl handshake flow, but still need few verifications: If I'm trying to forge another handshake the client will fail because, and only because the certificate I'll send him back is ...
0
votes
3answers
405 views

Trust a non-root CA in OpenSSL

Is it possible to have OpenSSL trust a non-root CA such that a certificate signed by that non-root CA can be properly verified? I've noticed that the default behavior for OpenSSL is to only verify ...
0
votes
1answer
220 views

Sniff HTTP(S) from PPTP VPN server

I've setup an PPTP VPN server on my Debian 7 server. I'm using this VPN in combination with my Android phone to ensure a secure connection. However, i'm getting curious of what my phone is sending ...
0
votes
1answer
916 views

Java SSL factory connection to SSL server (with just public-key and certificate)

I am trying to connect to a SSL web server. We currently have a pkcs12 file and connect, that is our private-key and certificate. Is it possible to connect using Java code with a public-key and ...
0
votes
1answer
204 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
0
votes
3answers
170 views

What are the MitM implications of a stolen client-side private key?

Many VoIP handsets support client-side SSL authentication for auto-provisioning. Unfortunately, some devices must be programmed with their client-side keys. (Keys generated on low-entropy devices are ...
0
votes
1answer
178 views

Installing SSL on load balancer and the internal IP

I have a server which has an internal IP (Used to access from local) and an external IP (accessed from Internet and placed in the load balancer). And both will use the same URL ...
0
votes
2answers
674 views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
0
votes
1answer
161 views

Can I use a CDN for static content without sacrificing SSL keys?

I would like to use a CDN for the static content of a website. But obviously I do not wish to share my SSL key with any external service. What are my options? An ideal solution would be to link to ...
0
votes
1answer
229 views

Are web sites with non-https login pages secure? [closed]

I was looking at weibo.com (chinese equivalent of twitter). I was surprised to see that their login page (http://www.weibo.com/) or forgot password ...
0
votes
1answer
98 views

vsftp encryption algorithm

I want to configure VSFTP for ftps protocol and it has some choices to select the encryption type: tlsv1, sslv2, sslv3. I read that tls version 1 has some security issues but in the man page it says ...
0
votes
1answer
106 views

SSL and Strategy to prevent destination URL from being revealed

Googling the subject "sniffing out / spying on SSL secured communications" one finds many references to being able to make some good guesses about the "target destination" once the path length is ...
0
votes
1answer
89 views

Protected Client Server communication advice

I am hoping for a better understanding about SSL/TLS by setting up two devices, running two different applications, allowing communications to go over SSL/TLS. With OpenSSL I have created a ...
0
votes
2answers
200 views

Man-in-the-middle SSL generation on request possible

I am doing some research on man-in-the-middle focusing on SSL in particular. I have been looking into generating a certificate on request when a client connects and requests a secured page. ...
0
votes
1answer
48 views

How to properly implement TLS on an ejabbered server

The official ejabbered documentation instructs the user to generate a self-signed certificate like this: openssl req -new -x509 -newkey rsa:1024 -days 3650 -keyout privkey.pem -out server.pem openssl ...
0
votes
1answer
112 views

TLS_RSA type ciphersuite and PFS

Today while I'm reading about the RSA factoring challenge. I thought to myself that if whoever depends on RSA-512 (By using TLS_RSA_xxxx) to secure their TLS connection years ago, the info they wish ...
0
votes
1answer
2k views

Problems with intermediate ssl certificates and ssl proxy

I'm currently implementing a SSL-proxy, and have run into some problems regarding certificates. We have a offline "Company Root CA", and an online "Company intermediate CA". On the proxy I have ...
0
votes
1answer
199 views

SSL (TLS v1.2) - Can i offer fallback CAs when upgrading Certificates? (Java)

I am currently developing a product that involves two network situations. At the client side, multiple computers form a P2P network (multiple locations, multiple p2p networks), and a subset of nodes ...
0
votes
1answer
112 views

Increasing website data security level

Could it be more secured using the "HTTPS" protocol for website data security and at the same time using another encryption algorithm (Elgamal) as well? I know "HTTPS" could be used alone, but I ...
0
votes
2answers
115 views

Force https, complex implementation

I have a website running on a dedicated server (single IP) on apache. Multiple domains are pointed to the website . For ex: sub.abc.com, sub.bcdaf.com I have now purchased a single SSL certificate ...
0
votes
3answers
6k views

How force that all connections to my Apache use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...
0
votes
1answer
746 views

OpenSSL: Enable cipher suites per protocol version

Is there a way to explicitly configure OpenSSL to allow AES (or in general, block ciphers) only for clients that use a TLS version >= 1.1? This would protect against the BEAST attack, while still ...
0
votes
1answer
141 views

Does the VPN provider will have access to my content? [duplicate]

I am planning to buy a VPN service just to circumvent the filtering applied by the government. However as I am planning to use OpenVPN on my dd-wrt router, all of my data will pass through this ...
0
votes
1answer
149 views

Setting up two way SSL

I am trying to setup two way SSL to communicate with partner web service. I understand I have to provide server certificate on client side. However, questions are: Is self signed certificate okay? ...
0
votes
1answer
890 views

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange? Can the server be configured to use weak key sizes for ...
0
votes
1answer
653 views

How configure tomcat 7 SSL to use AES-NI?

My server has AES-NI and I would like tomcat 7 to make use of this but I am not really sure how to make that happen or where to even start looking. I am quite familiar with tomcat administration, and ...
0
votes
1answer
305 views

Configuring IIS SSL for PCI

Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning? Preferably something for both IIS 6 and IIS 7 I'm currently running into BEAST issues but ...
0
votes
1answer
550 views

Why do we need to use HTTP CONNECT? [closed]

If we are writing a custom http client which connects with an https server. Should the custom client when deployed on machines which are behind web proxy need to send a HTTP CONNECT Request so as to ...
0
votes
2answers
933 views

Protecting yourself against DNS spoofing?

Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot ...
0
votes
0answers
8 views

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file?

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file? Scenario: We have a few legacy certificates based on some legacy templates (2012 R2). ...
0
votes
0answers
8 views

How should a captive portal handle SSL requests, that are expired, or not authenticated?

What is the best course of action for a user that uses HTTPS anywhere, or tries to access a secure URL (from an phone based App, or from a browser)? Ideally, I'd like to get the phone to "prompt" via ...
0
votes
0answers
17 views

Can I terminate an SSL Tunnel at the Load Balancer in Amazon VPC? [migrated]

In other words, can the Amazon VPC load balancer be configured as an SSL Host? As a proof of concept, we've created this setup: Heroku Appserver <---> VPC Load Balancer <---> Ubuntu SSL ...
0
votes
0answers
36 views

HTTPWebRequest over SSL gives intermittent error “The request was aborted: Could not create SSL/TLS secure channel”

I am using HTTPWebRequest to connect to Java rest services hosted in Tomcat Apache server. The endpoints are configured for HTTP as well as HTTPS. There are no issues connecting to HTTP endpoints, but ...
0
votes
1answer
47 views

HTTPS enable for proxy server or web server

Say I have 2 separated servers which are one web server (apache) and one proxy server (nginx), I want to use HTTPS for the website running on the Apache. Do I enable SSL on apache or nginx or both? ...
0
votes
0answers
9 views

How to create .pfx file containing only one of private/public key [migrated]

As far as I know .pfx files are not required to contain both public and private key. However, I could not find a way how to create a file that contains only one of them. I need this because I am ...
0
votes
1answer
38 views

SSL question TLS response in TCP

After some careful looking at one .pcap of my network i would like to undestand why a request appears on the communication like IP [TLS Application Data] Application Data Protocol: http Version ...
0
votes
1answer
37 views

Is it possible to inject information into a clients TLS session cache?

Hypothetically speaking, could an attacker run a targeted attack on a network that would inject information into a victim's cache of recent TLS connections? Specifically, the master-key and sessionID ...
0
votes
2answers
89 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
0
votes
0answers
40 views

CA Flag in SSL certificate [migrated]

I have an web portal running as a POC purpose, and then i have a mobile apps to access this web portal. Since it's a POC, I just generate a self-signed SSL cert and load it inside the Web and my ...
0
votes
0answers
18 views

SSL Mismatched Address Certificate Error on IIS 7 [migrated]

We have a local application server (trisha0002), and on this server we have an application (FlexibleBenefits). When we install SSL for this application, it gives Mismatched Address. What can be the ...
0
votes
0answers
31 views

securing my API: concept of accesstokens

first of all I want to excuse for the bad spelling and grammar. English is not my mothertongue. I have built a JSON communication between frontend(website) and my NodeJS webserver. I want to keep in ...
0
votes
2answers
88 views

What would cause a server to only send over 1 SSL certificate to a client?

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
0
votes
0answers
36 views

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or ...
0
votes
0answers
43 views

I Need Wireshark Confirmation on Full Implementation of SSL for YouTube

I've just noticed today that YouTube have implemented SSL over the entire service (including video transfer). I've analyzed the partial SSL YouTube had before and it encrypted the video request but ...
0
votes
0answers
39 views

What are the risks of submiting from iframe to a SSL site?

I have a SSL site where a user can select items to purchase, register and pay. For payment, the user is redirected to a payment gateway. Once the payment is completed, the user is redirected to our ...
0
votes
1answer
52 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
0
votes
1answer
55 views

How does Matrix SSL perform certificate validation?

We use a custom app which uses Matrix SSL (client side) to perform certificate validation on MAC and Linux systems. My question is, does Matrix SSL keep a cert store cache of intermediate and trusted ...
0
votes
1answer
58 views

How is the Premaster secret used in TLS generated?

I believe that it uses some combination of the random values sent in the hello messages. From RFC 2246: (TLSv1.0) RSA encrypted premaster secret message Meaning of this message: If RSA is ...
0
votes
1answer
29 views

EAP-TLS fragmentation implementation

I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a ...
0
votes
1answer
309 views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...