Tagged Questions

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
1answer
42 views

SSL certificate expired on the embedded device (a client)

I need some inputs for the scenario when the certificate expires which is stored on the embedded device on the network which is a client. Following is the explaination of the setup. The setup ...
4
votes
1answer
63 views

Is it true that certificates requested with a specific CSR can only be used on the machine where the CSR was generated?

Assume that I have created a CSR and I am going to buy an SSL certificate with it. Would I be able to use the SSL certificate on another machine than where the CSR was created? Someone I know ...
2
votes
1answer
50 views

Does client certificate do any encryption in https connection? [duplicate]

In Https connection asymmetric encryption (with Server certificate) is used during handshake and to create symmetric keys. Am I right that in this case client certificate does no encryption? The ...
23
votes
2answers
3k views

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" ...
1
vote
2answers
69 views

Burp configuration to allow SSL connection

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This ...
0
votes
0answers
24 views

How does a browser know if a site supports https [migrated]

A lot of sites now default to https. Where beforehand i would have had to asked for https specifically (ie: typing out https://www.google.com) now even if I type out just www.google.com or even ...
0
votes
2answers
691 views

Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?

I'm not sure where to post this, so I figured I'd just post it here. CloudFlare is now offering free SSL to all sites. There are two different types of SSL connections, however. There's "Flexible ...
0
votes
2answers
93 views

Self-signed certificates and internal cURL requests

I'm using an internal API for some commercial software we purchased and it recommends using SSL when utilizing the API; it uses cURL to achieve this and hence the user, pass and key will all be passed ...
0
votes
1answer
45 views

Can I sign a new certificate with a previously paid for certificate [duplicate]

For the last few months, I have been using self signed certificates to provide ssl for a system that I have been building. We are now getting ready to start getting external users on the system, but ...
6
votes
2answers
452 views

Storing SSL certificates in DNS records

Why not get rid of all certificate authorities and all the special kind of SSL certificates there are (extended validation etc. etc.) and instead just require anyone who wanted SSL to write their own ...
1
vote
1answer
54 views

Recommended Key Usage for a client certificate

My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicate with the server to a path that requires a ...
2
votes
1answer
65 views

Search for user credentials within a packet capture of a gmail session over SPDY

I was reading this paper on SSL/TLS from the SANS Reading Room on how to capture and decrypt your own SSL traffic with Wireshark. I wanted to capture the credentials used to login to gmail. When the ...
3
votes
1answer
142 views

How to disable cipher RC4 in ubuntu 12.04

I have been doing Network Scan for our box and Ncircle reported SSL Server support RC4 ciphers for SSLv3. Based on that I did a search and I plan to add to /etc/apache/conf.d/security the following: ...
0
votes
1answer
102 views

Can anyone with access to root CA private key decrypt HTTPS traffic?

Can anyone with access to root CA private key decrypt HTTPS traffic of sites using certificate signed by that CA ? and if yes do he need to be man-in-the-middle or just monitoring traffic is ...
1
vote
1answer
60 views

SSL heartbeat design [duplicate]

So, about Heartbleed again, why does SSL/TLS allow the client to specify the message and its length in the heartbeat requests, rather than sending a simple ping?
0
votes
1answer
82 views

Why are CA's now signing root certs with SHA2?

I see that CA's are now giving the option of having the root CA cert signed with SHA2. I have been told that the hashing function in a root has no security value, and is irrelevant as far as a ...
3
votes
1answer
58 views

Forward Secrecy in TLS-PSK

I'm reading RFC4279 (Pre-Shared Key Ciphersuites for Transport Layer Security), Section 7.1, which is about Perfect Forward Secrecy. In that section, it's said that PSK/RSA_PSK ciphersuites don't ...
1
vote
1answer
103 views

Can't I forge an SSL certificate? [duplicate]

I read What's keeping a malicious man in the middle server from forging a valid certificate?, but when the client goes to verify the certificate, can't an attacker intercept that connection and say ...
0
votes
1answer
49 views

How could SSL certificate affect the symmetric key length?

This article in GoDaddy support knowledge base says All of our SSL certificates support high-grade 256-bit encryption How would they not support it? The SSL certificate contains keys for ...
0
votes
2answers
57 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
0
votes
0answers
42 views

SSL Certificate and IDS\IPS

I'm currently drafting an infrastructure design to provide web (internet) access to a number of users to an internal web server in our perimeter DMZ, we have no direct internet access but we do have a ...
10
votes
5answers
2k views

Why can't I decrypt SSL traffic with the client's private key only?

I have found that I can decrypt SSL traffic in Wireshark with the server's private key. Why isn't the client's private key enough to decrypt SSL traffic?
0
votes
2answers
184 views

What does 2^77.1 calls presented in a SHA1 attack mean?

Regarding the SHA 1 deprecation, I found this information here: http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx I know ...
0
votes
1answer
59 views

SSL cipher suite: what does “export” mean?

I saw a cipher suite EXP-EDH-RSA-DES-CBC-SHA, EXP stands for export, How do I explain the "export"? What is the different between "EXP-EDH-RSA-DES-CBC-SHA" and "EDH-RSA-DES-CBC-SHA"?
1
vote
0answers
33 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
0
votes
0answers
29 views

What certificate attributes can I check to verify if an issuer is correct?

Apologies if this is a duplicate question. I thought I saw this discussed earlier but couldn't find the thread when searching. What attribute can I check to verify if I have the correct ...
3
votes
1answer
127 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
0
votes
1answer
154 views

Password stolen on public wifi even though https was used [duplicate]

I saw this video where news reporter is in public place, and some security expert demonstrates to her that even though she logged in at page which was using https that guy got password in his ...
-2
votes
1answer
78 views

A future heartbleed bug? [closed]

Checking out IBM.com and Google.com: https://www.ssllabs.com/ssltest/analyze.html?d=ibm.com&s=172.230.109.66 Valid from Tue Sep 09 14:00:34 UTC 2014 ...
1
vote
2answers
61 views

Why the Websense blocks same site when used with http & not when used https? [closed]

I have been working in a IT firm. I have access to some social sites. When I try to open site Links in mail (that are having http://), the websense prompts me that the access is blocked. However, when ...
0
votes
0answers
51 views

Security considerations for RESTlike HTTP API of an embedded system

I'm designing a HTTP service for an embedded device and wondering if the following security concept is good enough: SSL(Up to Version 3) is enabled by default, TLS is not by limitations of the ...
1
vote
1answer
44 views

How often should the DHE p and g factors be recycled?

I've been asked to enable DHE in our SMTP product. I'm stuck on this question: How often should the product regenerate its DHE p and g parameters? I've seen some implementations that use a cron job ...
13
votes
3answers
1k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
3
votes
2answers
125 views

What role do hashes play in TLS/SSL certificate validation?

After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
0
votes
0answers
17 views

How should a captive portal handle SSL requests, that are expired, or not authenticated?

What is the best course of action for a user that uses HTTPS anywhere, or tries to access a secure URL (from an phone based App, or from a browser)? Ideally, I'd like to get the phone to "prompt" via ...
0
votes
0answers
373 views

HTTPWebRequest over SSL gives intermittent error “The request was aborted: Could not create SSL/TLS secure channel”

I am using HTTPWebRequest to connect to Java rest services hosted in Tomcat Apache server. The endpoints are configured for HTTP as well as HTTPS. There are no issues connecting to HTTP endpoints, but ...
17
votes
3answers
2k views

Is SHA1 weak for SSL?

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
1
vote
1answer
42 views

Does the SSL/TLS client certificate “hash over all previous messages” step hash the entire TCP packets or just data?

We have which uses TLS client certificates as it's authentication mechanism between client and server. There is an IT department which wants to run this app through a firewall/proxy device of some ...
1
vote
1answer
159 views

Android support for TLS 1.1

Do anybody know from what version of Android did TLS 1.1 started to be supported directly by the OpenSSL version preinstalled in the system?
2
votes
1answer
106 views

Apply SSL for domain that I do not own

As part of a project that my company is doing, we need to setup a development server. Let's say our company's main domain is example.com We need to be able to access the dev server through ...
1
vote
1answer
100 views

Authentication between two internal servers

I have two internal servers that are going to communicate with each other; they speak HTTP/TLS. Is there a best practice for authenticating communications between internal servers? Short of a best ...
2
votes
1answer
72 views

Does mixing different types of encryption make the connection more secure?

Like when I browse a website using SSL from my laptop that is connected to my router using WPA2. My router talks to my ISP using IPSec. Is that more secure or these types of encryption have nothing ...
1
vote
0answers
36 views

Is it fair to say that lack of client-authentication in TLS implies no requirement of non-repudiation?

In an https context, if a server does not send a CertificateRequest message, is there any other way it can require non-repudiation from the client?
5
votes
1answer
297 views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...
0
votes
1answer
198 views

Why is stackoverflow not using HTTPS for all it's page?

Most webpage from stackoverflow use http even if you are logged in. Isn't it a security issue? Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent ...
1
vote
1answer
60 views

Dump SSL traffic from a Java applet

I have a smartcard that can be read by websites using a Java applet (see http://www.springcard.com/online/applet_pcsc/). I would like to monitor and is to replay packets going from this java applet to ...
0
votes
1answer
54 views

HTTPS enable for proxy server or web server

Say I have 2 separated servers which are one web server (apache) and one proxy server (nginx), I want to use HTTPS for the website running on the Apache. Do I enable SSL on apache or nginx or both? ...
2
votes
1answer
42 views

Is distinguished subject name at normal SSL Certificate issuance must same as generated Certificate Signing Request (CSR)?

For example: from Issued SSL Certificate: CN = abc.com.my, OU = Room, O = House, c= MY from generated CSR: CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY Questions: 1. Is it ...
1
vote
1answer
125 views

What is stopping me from replaying an SSL certificate?

Say I have the SSL certificate for google.com. I intercept it, edit the certificate with my own domain name and public key and use it to intercept all traffic to google.com. What mechanisms exist in ...
1
vote
3answers
111 views

Not replacing SSL cert on a rebuilt, formerly rooted Unix Server

If a server was rooted, to the point that we know a Perl script which creates a remote shell was placed on the filesystem remotely, and the server was rebuilt entirely, patching the original Apache ...