SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
2
votes
2answers
26 views
Change 'Key Usage' of a certificate
Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
5
votes
5answers
68 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
172
votes
3answers
45k views
How does SSL work?
How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering.
I'd like to see details in terms of:
A high level description of the protocol.
...
1
vote
2answers
40 views
Force SSL/TLS client cert authentication even if server does not request it?
Usually the server specifies in the Server Hello message if a client certificate is needed/wanted.
Does anybody know if it is possible to perform an authentication via client cert if the server does ...
2
votes
1answer
27 views
Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA
I would like to ask if it is possible to use different CA for the client certificate and the web certificate?
For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
7
votes
4answers
917 views
What kind of attack was this?
So our website was hacked, and these are the things that were done:
Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
4
votes
2answers
214 views
How do you verify a certificate belongs to a domain?
I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to.
Currently I can verify the certificate is valid using the following code
$resource = fsockopen( ...
-1
votes
1answer
68 views
Wireshark Decode HTTPS Root Certificate
I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
4
votes
2answers
101 views
Multiple SSL connections in a single HTTPS web request
I set up Apache2 with SSL and tried to request the default Apache2 web page ("It works!") using https://[IP_ADDRESS].
The Chrome developer tool shows that only one HTTP connection is established, ...
2
votes
6answers
214 views
Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case.
Is there a way to determine and display the state of HTTPS on a page ...
-5
votes
0answers
50 views
SSL usage and step involved to enable in a web app [closed]
i want to know abt SSL usage and how it improves security link to useful materials will be much appreciated
4
votes
1answer
110 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
23
votes
3answers
14k views
What is the difference between SSL vs SSH? Which is more secure?
What is the difference between SSH and SSL? Which one is more secure, if you can compare them together?
Which has more potential vulnerabilities?
-1
votes
0answers
51 views
TLS Certificate in OSX Mail
My question hasn't been asked before here but when I googled for an answer I arrived at this thread @ macrumors.com. The question is quoted below:
I'm just curious, but in Lion's Mail there is a ...
3
votes
7answers
496 views
Is it compulsory to have https on e-commerce site?
I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data.
I just saw a site that has an e-shop link, if i click it my browser says ...
3
votes
2answers
2k views
Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”
I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain.
...
9
votes
3answers
9k views
How to fix SSL 2.0 and BEAST on IIS
As you can see on this post TeamMentor.net vulnerable to BEAST and SSL 2.0, now what? the app I'm currently development got flagged for SSL 2.0 and BEAST by SSL Labs.
I'm using IIS 7.0 with the ...
5
votes
2answers
639 views
How eavesdropping will be performed how can I prevent from eavesdropping
I believe that eavesdropping in a man in middle attack and the message is passing from the client to server the man sitting at ISP or network hackers can look at what message I am sending. Heard that ...
1
vote
1answer
114 views
Exporting data beyond a cryptographic boundary
Scenario
We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
7
votes
1answer
139 views
Does dnssec protect against malicious registrars?
With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).
This is especially ...
8
votes
1answer
215 views
Why can the validity of an SSL certificate exceed the registration period of a domain?
I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
10
votes
3answers
157 views
Domain name expiration and TLS
If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
3
votes
1answer
52 views
How is the TLS protected against length field of the header being modified?
I know this question looks very silly, but, it has been bothering me for a while and I am unable to come up with an answer by myself. So, here it goes..
Packets in the TLS protocol consist of a 5 ...
31
votes
3answers
3k views
Are all SSL Certificates equal?
After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against.
Are all SSL ...
3
votes
1answer
296 views
Apple Developer Account Hacked?
I just did a fresh install of Snow Leopard on a newly-formatted hard drive.
Logged into the iPhone Developer Page with Google Chrome (latest build) here:
...
5
votes
3answers
83 views
What are the risks of a localhost signed cerificate?
In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections.
Suppose we use this CA to sign a key for "localhost" for use in ...
0
votes
2answers
60 views
Do keyservers keep logs of who adds whom to their keyrings?
Maybe it depends on the keyserver. Does that pose privacy issues?
1
vote
1answer
65 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
6
votes
1answer
213 views
Does HTTPS Encrypt PHP Arguments?
I am working on a web app that will need to have a secret key(s) passed from one server to another - I'll need to do this over PHP. Consider the following URL:
...
8
votes
1answer
169 views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
11
votes
4answers
2k views
What is certificate pinning?
I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
6
votes
1answer
1k views
Is SSL key generation client-side, server-side, or both?
Who generates the session keys for a SSL symmetric encryption? Is it the client for both client and server where client generates part of it while the server generates the other part?
4
votes
2answers
101 views
Checking client hello for https classification
I need to detect https packets in network traffic . Until now I were marking all "443" as https but I don't want to use port information for these any more .
Will it be enough to check client hello ...
3
votes
2answers
960 views
Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection?
What i want to know is whether it is possible to connect to a proxy with an ssl (or otherwise encrypted) connection? (I'm suspecting this is possible because TOR encrypts user connections to it's ...
10
votes
3answers
1k views
Authenticating a Proxy server over HTTPS
When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc. ...
1
vote
3answers
688 views
Why different key exhange techniques for ssl key exchange?
During ssl key exchange, I have read that sending the symmetric key to the server encrypted with the server's public key is an old technique. Now for key echange Diffie hellman and other techniques ...
3
votes
1answer
80 views
Why clients offer handshaking with SSL 2.0 protocol
According to the book, Data Center Fundamentals, page 369, SSLv3 support was added in Netscape 2.x and Internet Explorer 3.x, and TLS was added in Netscape 4.x and Internet Explorer 4.x.
I am ...
4
votes
1answer
135 views
If SSL encrypts urls, then how are https messages routed?
I've googled around and it seems like SSL encrypts URLs. (Correct?) As I understand it, if I go to a site like http://security.stackexchange.com then a DNS server looks at the URL, says hey, he wants ...
3
votes
1answer
70 views
Has a HTTP server access to SSL session ID?
I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
18
votes
8answers
7k views
Can my company see what HTTPS sites I went to?
At work my company uses internet monitoring software (websense). I know if I visit a https ssl-encrypted site (such as https://secure.logmein.com) they can't see what I'm doing on the site since all ...
9
votes
2answers
6k views
Does https prevent man in the middle attacks by proxy server?
There is a desktop client A connecting to website W in a https connection
A --> W
Somehow between A and W, there is a proxy G.
A --> G --> W
In this case, will G be able to get the ...
8
votes
3answers
2k views
What are the risks of self signing a certificate for SSL
Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
2
votes
5answers
657 views
What are practical risks of http (not https) in server-to-server communications
What are some of the practical risks that come with a server-to-server connection over http (not secured with https/SSL)? There are no users involved, just a B2B connection from one company to ...
20
votes
7answers
3k views
Where to get an SSL certificate for personal website?
I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
1
vote
2answers
93 views
Question about HTTPS [duplicate]
I have a question about HTTPS, which I need help understanding.
So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
0
votes
1answer
54 views
Best practice for securing user credentials once they reach the server using Basic Auth + SSL
I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
4
votes
3answers
99 views
What SSL options should not be used?
What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
2
votes
2answers
90 views
BEAST mitigation on a Cisco ACE 4710 load balancer
We are looking to mitigate BEAST (and similar) on our Cisco ACE appliance (running version A4(2.0)), which is the 'endpoint' for a handful of load-balanced services. Some of these service still run ...
43
votes
3answers
16k views
What's the difference between SSL, TLS, and HTTPS?
I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
1
vote
1answer
66 views
For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?
I am observing an issue in which the TLS handshake is failing between a Java Client and a web service hosted under IIS 7. Upon wiresharking the attempt it seems that the problem is the list of ...
