SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
1answer
61 views

How to convert SSL Certificate for mobile app?

I am in the current process of renewing my SSL cert for my website. I also have a mobile app for my site. I want to use the same cert from my website in my mobile app. How can I do this? Thanks - I ...
10
votes
4answers
957 views

Can ISP block HTTPS selectively? [duplicate]

Can ISP block HTTPS selectively i.e. certain websites cannot be accessed using HTTPS while others can be ?
0
votes
1answer
40 views

Forward Secrecy not supported with referenced browsers?

I am running a scan against one of our servers from the Qualys SSL tester site and it says that my server "does not support forward secrecy with the referenced browsers". What exactly does that mean? ...
-5
votes
2answers
41 views

how do vpns secure the encyption key? [closed]

VPNs are accessed by the user with credentials so that the information is encrypted. There are credentials that you download to allow this. Since you don't physically, in person get the credentials ...
10
votes
4answers
654 views

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? ...
1
vote
2answers
68 views

Relying on openssl's certificate authority list or provide my own

My apologies if this is too subjective, but I am looking for advice on best practices. We maintain a small program written in Python that runs on our customers' servers and communicates back with our ...
0
votes
2answers
87 views

https login iframe 2014

Per current security recommendations & browser support, is it okay to have an https iframe in an otherwise http-only set of pages? Is this not a dupe? It is, but I want current trends because ...
0
votes
1answer
58 views

Why do certificate authorities often require/use multiple intermediates?

I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway. Why do most modern certificate authorities (e.g. ...
0
votes
0answers
35 views

securing my API: concept of accesstokens

first of all I want to excuse for the bad spelling and grammar. English is not my mothertongue. I have built a JSON communication between frontend(website) and my NodeJS webserver. I want to keep in ...
2
votes
2answers
127 views

How can I secure my api to avoid copying?

Im building an app which should receive data from my server. The Api should be a PHP based script which provides the data as JSON. However I want to keep the data private and it should only be ...
22
votes
3answers
7k views

Why is “www.” considered unsafe in this HTTPS URL?

I was doing some cross-origin requests to Soundcloud's oEmbed and I noticed some strange behaviour. When doing a request from my localhost, which is on a regular HTTP connection, everything worked ...
12
votes
4answers
1k views

Downsides to using HTTPS [duplicate]

Recently Google has indicated that a HTTPS certificate will be used as a positive signal in it's search rankings. This has caused some discussion within our company as to if we should apply a HTTPS ...
0
votes
2answers
80 views

Printer SSL certificates [closed]

Is a printer SSL cert really necessary if you just print? I don't use https for any administration; just http. I got a vulnerability saying that my cert was out of date.
0
votes
2answers
79 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
2
votes
2answers
252 views

It is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place?

I have the following question regarding the decryption of SSL traffic. The topology that I have in mind is like this: User-------MitM Proxy--------WebServer In the environment described earlier there ...
-5
votes
1answer
398 views

How to decrypt the encrypted data, in SHA256, of mysql database? [closed]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
1
vote
2answers
89 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
2
votes
3answers
229 views

Free second-level domain SSL certificate [closed]

With CAcert.org losing trust in browsers and OSs and StartSSL providing only top-level domain certificates, are there any free SSL certificates providers for second-level domains?
0
votes
1answer
117 views

What would cause a server to only send over 1 SSL certificate to a client? [on hold]

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
2
votes
1answer
52 views

API request modification

I am building an API that returns data about companies Multiple applications will access the API, some of these applications will have access to one company, some to multiple companies. When a request ...
1
vote
2answers
53 views

Can I change the CSR of my SSL certificate?

I have 2 SSL certificates that are generated and being used for our staging and development server. However, we wish to change the roles of these two servers. currently the staging server is using ...
3
votes
2answers
527 views

What is the difference between EV-SSL certificates and Normal SSL certificates? [duplicate]

Recently while looking at several banking URLs I can see the domain name with security certificate at address bar and normal locker security certificate at address bar. Have a look at the screenshots: ...
1
vote
2answers
217 views

Client-server encryption technique explanation (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 128 bit keys)

I opened a web page using https. When I looked at the page info provided by my browser (Firefox) I saw following: Connection encrypted: High-grade Encryption ...
0
votes
1answer
812 views

This certificate has an invalid digital signature

I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. ...
2
votes
1answer
80 views

Drawbacks to only using TLS 1.2 ciphers in OpenSSL

I understand you would not want to do this as it would limit compatibility for older devices and platforms. However if someone were in an all TLS1.2 environment, say a very well managed internal ...
1
vote
2answers
78 views

Can you use https only for cookies and not the html?

I have a few questions, all relating to the title. 1) Is it possible to configure a server to receive the cookies using https but then serve all the content with http? 2) Does SE do this / do many ...
0
votes
0answers
58 views

I Need Wireshark Confirmation on Full Implementation of SSL for YouTube

I've just noticed today that YouTube have implemented SSL over the entire service (including video transfer). I've analyzed the partial SSL YouTube had before and it encrypted the video request but ...
0
votes
1answer
225 views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
0
votes
0answers
71 views

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or ...
0
votes
1answer
123 views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
3
votes
2answers
52 views

Standard practice for distributing server certificate for users

I have a Winforms app that users have to download and install on their machines. It connects to a WCF service(using SSL), hence requires the server certificate to be installed on users' Trusted ...
3
votes
2answers
88 views

What is the point of secure email gateways?

We run Exchange 2010. Our edge servers run "passive opportunistic TLS" for 99% of the domains we communicate with. For a handful of domains, we have forced TLS on both our end and the other domain's ...
2
votes
1answer
188 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
1
vote
2answers
95 views

Does where I put my PKI certificates matter?

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were ...
1
vote
0answers
27 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
2
votes
4answers
518 views

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
1
vote
0answers
44 views

Is there a way to restrict hls key file served by cloudfront (over https) to only authorized users

I have a video file which is distributed after hls packaging and encrypted using aes 128. Since HLS key url is part of the m3u8 file I have to restrict the delivery of key file only to authorized ...
1
vote
1answer
66 views

Would it be possible to use cookie to store SSL Client Certificate?

Lately, I was reading that article about SSL client certificate. Why is nobody using SSL Client Certificate? The answer was to that question was : In the current state, this excellent idea is ...
3
votes
2answers
460 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
0
votes
1answer
789 views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
1answer
205 views

Browser and SSL support

According to http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers most browsers support SSL 3.0. And with my understanding (please correct me if I am wrong), when a browser just ...
2
votes
1answer
53 views

TLS 1.2 Older Browser Compatibility

We are in the process of upgrading our webservers to support TLS 1.2 but I have heard rumor of very old browsers, such as those used as kiosks will fall over when trying to connect to a server that ...
1
vote
2answers
60 views

Is it Possible to use one commercial SSL Certificate to issue end user certs?

My organization is preparing to purchase some 50 "units" from Symantec, with which we can purchase Verisign SSL certificates of varying authentication levels. Our organization does not have--but ...
0
votes
0answers
44 views

What are the risks of submiting from iframe to a SSL site?

I have a SSL site where a user can select items to purchase, register and pay. For payment, the user is redirected to a payment gateway. Once the payment is completed, the user is redirected to our ...
1
vote
1answer
146 views

Is the limited elliptic curve support in rhel/centos/redhat openssl robust enough?

Redhat finally gave in after insisting for years that elliptic curves had patents and disabling them, recently enabling a whopping three algorithms: CentOS 6.5 openssl ecparam -list_curves ...
1
vote
1answer
55 views

Entering payment information in Android Apps

I'm concerned how android apps that integrate payment processing deal with secure financial information.When purchasing through these apps the apps show the Webpage of the bank asking for credentials. ...
8
votes
1answer
687 views

How to convert http site to full https? [closed]

I have a site running only with http. I have decided I want to go full https, but I have no idea how to do this. Do I have to buy that certificate somewhere? Where, how much does it cost? Does it ...
4
votes
4answers
346 views

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
1
vote
1answer
83 views

Self-signing client certificates and distributing them, is the following a sound procedure?

I have a case at hand as follows: There is a number of clients in Internet (i.e. untrusted channel), initially in hundreds but growing in numbers. There is a server doing processing related to these ...
0
votes
2answers
92 views

Installing self-made cert as trusted CA on windows?

I'm looking into using mitm-proxy, but part of the process of filtering/snooping SSL is that you must generate and install a root cert as a trusted CA, so that mitm-proxy can generate and throw out ...