SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
5
votes
2answers
161 views
What kind of certificate do I need to be able to sign my own subdomain certificates?
We are making a web-based application that will be installed in intranets as a virtual machine image (we send the user a CD with the virtual machine image, user runs it in a VMWare/VirtualBox/...).
...
10
votes
1answer
489 views
Is Nokia's “institutional MITM” of SSL traffic vulnerable to CRIME attack?
It's recently been in the news that some Nokia phones proxy all traffic, including SSL connections, through a Nokia proxy. This is effectively an "institutional MITM" attack on users those phones.
...
1
vote
3answers
222 views
Monitoring and filtering of arbitrary outgoing data
I would like to be able to not just centrally monitor but also filter any organizational data moving out our edge routers, regardless of the sender application and regardless of the protocol/port used ...
1
vote
2answers
144 views
Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?
From a security point of view, is it okay to read foreign (untrusted) cookies (from 3rd parties on the Internet) on your internal (trusted) network, or should you only read them within the DMZ areas ...
20
votes
7answers
1k views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
3
votes
3answers
251 views
How do a VPNs route SSL traffic and do they compromise security?
If my understanding of how VPNs operate is correct, all traffic between me and the Internet at-large is routed through the VPN's servers. So an attacker would only be able to see encrypted traffic ...
7
votes
2answers
3k views
What is ECDHE-RSA?
What is the difference between ECDHE-RSA and DHE-RSA?
I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
2
votes
2answers
173 views
'SSL Session Resumption using Cached Session IDs'
Is supporting 'SSL Session Resumption using Cached Session IDs' by SSL Servers secure ? Is Session Hijacking possible in any way if this feature used ?
8
votes
4answers
389 views
Can real end-to-end SSL encryption be made?
I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate.
I've got a very precise question but first I need to give some background.
Basically I'm very ...
4
votes
2answers
169 views
How to verify certificate with very little information
Lets assume there is a server and a client and you want to connect those two.
Server has a self-signed certificate, and prior to establishing the connection for the first time (enrollment) the server ...
1
vote
2answers
103 views
BrowserID and HTTPS conflict?
My flask-webapp was utilizing BrowserId. When I tried to extend my app further by redirecting all incoming requests to HTTPS. The HTTPS redirect worked fine but now the login feature results in a:
...
4
votes
2answers
215 views
Extensions for SSL server certificate
I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
7
votes
2answers
86 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
4
votes
3answers
149 views
Is using encryption the only viable option to thwart password sniffing?
I'm using HTTPS Everywhere on my browser to chose SSL versions of websites when available, but many sites don't offer a secure version. Is SSL the only viable option to thwart password/clear text ...
16
votes
9answers
582 views
Does hashing a file from an unsigned website give a false sense of security?
Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
3
votes
4answers
203 views
User-to-user encryption in addition to SSL for mobile phones?
I have learned that SSL is a protocol to implement machine-to-machine encryption and that there are protocols, like PGP, which implement user-to-user encryption (end-to-end encryption).
There are ...
5
votes
3answers
685 views
Securing a multi-tenant architecture
I'm a computer science student looking to expand an already developed web application into using multi-tenant architecture. Considering I'm far from being a security expert, which precautions can I ...
1
vote
2answers
106 views
Does Convergence solve the problem of hacked CAs?
My question is about the Firefox AddOn Convergence.
So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
2
votes
3answers
98 views
Whether certificates can be used for regulating access
I am thinking of a mechanism where I need to authenticate the client and control the access. I am thinking of using SSL for this purpose. I want to know whether using SSL solves my purpose.
My ...
4
votes
4answers
507 views
Why would someone want to encrypt RSS feeds?
I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
4
votes
3answers
565 views
How is an X509 certificate signer verified?
Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is,
...
7
votes
2answers
282 views
X.509 certificate policies question
I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies.
To quote from the X.509 RFC:
In an end entity certificate, these ...
10
votes
4answers
1k views
Are there technical disadvantages in using free ssl certificates?
Note this question is related, except this one is about free SSL certs.
There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
7
votes
1answer
237 views
Why is there no Domain CA?
I was asked to deliver a signed SSL certificate for an IIS server for a client.
I have previously done this for the same client/domain before, so it start to seem like
an unnecessary expense to hold ...
11
votes
3answers
9k views
Expired SSL Certificate Implications
What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
2
votes
3answers
319 views
Is OpenSSL secure enough?
We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries.
It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
1
vote
1answer
221 views
IE on Windows 2012 doesn't show certificate or lock icon despite using HTTPS
Can anyone explain why IE on Windows 2012 doesn't show the lock icon despite using HTTPS when visiting the following site?
https://www.microsoft.com/en-us/default.aspx
I am able to see the lock ...
0
votes
1answer
139 views
In SSL/TLS, how is the authenticity of a server's certificate verified?
Quote from an article on computerworld.com:
"The private key is used to sign the server's TLS public key, which
is currently used by browsers to validate SSL certificates."
My understanding ...
2
votes
4answers
312 views
Clients trust my custom CA
I'm sorry if this is a dumb question. I'm new to all this.
I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
2
votes
3answers
329 views
SSL inspection detection
an interesting question was recently asked about SSL inspection, and that got me wondering if it is actually possible, from the end user (or even server side), to detect if the SSL link is being ...
3
votes
2answers
133 views
In practice, does crypto software accept a *.com or or even a *. certificate?
Assuming this will be done with your own PKI, and not a public trusted CA.
Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
6
votes
2answers
678 views
How is certificate forgery with cheap CA's prevented?
In order to perform a successful man in the middle attack on HTTPS, one needs to either strip SSL layer and convert it to HTTP completely or needs to have a valid certificate from a CA for the same ...
2
votes
4answers
212 views
Should links to images contained in emails be secure?
We are generating emails which contain links to images: our client's branding, images showing other products offered by the client etc...
What are the security pitfalls if these links in the emails ...
2
votes
2answers
125 views
SSL Bit Length History
Sometimes I see web pages advertising a site's support for SSL with a given bit length (commonly 128), and saying that visitors need certain browsers that support this. Is 128-bit SSL common now, or ...
1
vote
1answer
114 views
Implementing Secure Remote Password with Remote Desktop Application
I had read the Secure Remote Password Protocol paper written by Tom Wu. This protocol is resistant to dictionary attacks. I have also go through some papers regarding to VNC attacks due to weak ...
1
vote
1answer
190 views
Is one CSRF token per session is adequate with HTTPS?
Ours is a Ajax heavy application with concurrent Ajax requests. Generating unique tokens with each request or expire and creation of new tokens after a certain interval could get tricky with multiple ...
2
votes
2answers
132 views
Attacks in SSL and SSH
I have a question
Assume that we have two end-host A and B connected by two routers R1 and R2. A wants to send a large file to B.
1) A decides to establish ssh connection with host B using public ...
5
votes
6answers
708 views
Should the bit-strength selection of a child certificate be influenced by the CA or the chain?
All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
0
votes
1answer
111 views
Anonymous access over SSL
I am using a paid VPN service and I just realized IP privacy does not exist at all when the connection is made over SSL.
If I Google "what is my ip" using the HTTP version of Google, it will give me ...
1
vote
5answers
718 views
how to import a private key in windows
Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys?
Is the only way I can do that by converting both ...
1
vote
3answers
318 views
Do client certificates provide protection against MITM?
I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
21
votes
8answers
2k views
Is anybody using client browser certificates?
Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
3
votes
1answer
52 views
Signing CertificateRequest with special privileges
Well, I am not sure if I specified the question correctly.
While I was browsing web, I checked several SSL certificates and noticed that even Root Certificate doesn't have set all attributes of ...
3
votes
3answers
2k views
BEAST: IIS6: Failing PCI scan - are these ciphers OK?
Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers:
Cipher Suite: SSLv3 : DES-CBC3-SHA
Cipher Suite: SSLv3 : RC4-SHA
Cipher Suite: ...
4
votes
3answers
273 views
What issues arise from sharing a SSL certificate's private key?
Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website.
I have ...
3
votes
2answers
164 views
What did the certificate authority do with my CSR?
I needed to reach a web service which is not mine.
The IT department of that web service has asked me to send them a CSR (certificate signing request).
Then, he will send me back a signed certificate ...
1
vote
2answers
461 views
KDC(Key Distribution Center) vs Asymmetric Key Exchange
Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network.
1st Method :
Make use of ...
2
votes
1answer
77 views
how does OpenSSL create X.509 certs from SPKACs?
The SPKAC ASN.1 description:
PublicKeyAndChallenge ::= SEQUENCE {
spki SubjectPublicKeyInfo,
challenge IA5STRING
}
SignedPublicKeyAndChallenge ::= SEQUENCE {
publicKeyAndChallenge ...
0
votes
3answers
263 views
help understanding client certificate verification
I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
0
votes
2answers
162 views
How valid is this statement “SSL sit between application layer and network layer”
taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer
The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
