SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

0
votes
0answers
1 views

it is possible to decrypt HTTPS with the (private, public) pair if it uses DHE?

Assuming you have a PCAP file with HTTPS traffic and having the key pair (private & public), it is possible to decrypt the traffic if it uses Diffie Hellman Ephemeral? Using openSSL lib for ...
1
vote
1answer
57 views

Mobile, WebServices and SSL

I just started dipping my feet into security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now, but most of them deal with it taking the ...
0
votes
0answers
23 views

Encryption algorithm keySize restriction in JSSE 7

I have an application which uses SSL (JSSE Implementation). Currently from my client side, the "Client Hello" message suggests a list of cipher suites that consists of both 128 & 256 bits key ...
2
votes
0answers
28 views

CRL check for TLS client certificate on Linux?

I run a web service. Clients authenticate using a TLS Client Certificate issued by a 3rd party CA. All certificates include the CRL distribution point, but do not support OCSP. How do I configure a ...
2
votes
2answers
418 views

Can Poodle be fixed in SSLv3 or will it go the way of TLS compression?

Is TLS_FALLBACK_SCSV going to be the fix for servers that wish to keep SSLv3 enabled? If not what actions are being taken, if any, that address the vulnerability besides disabling SSLv3?
0
votes
0answers
35 views

How do I set up SSL on my NearlyFreeSpeech site via StartSSL? [on hold]

When it comes to infosec and managing a website, I know next to nothing. What I do know is that I'd like to set up SSL on my personal website, which is hosted on NearlyFreeSpeech. My primary ...
1
vote
3answers
55 views

Can any website secured using TLS can be impersonated using a rogue certificate issued by a rogue CA?

Any website secured using TLS can be impersonated using a rogue certificate issued by a rogue CA. This is irrespective of which CA issued the website’s true certificate and of any property of that ...
2
votes
1answer
34 views

What is the difference between a “Thumbprint Algorithm” “Signature Algorithm” and “Signature Hash Algorithm” for a certificates?

I'm a bit confused on the differences between Signature Algorithm, Signature Hash Algorithm, and Thumbprint Algorithm that are present in SSL/TLS certificates. Can someone please elaborate?
4
votes
3answers
2k views

Checking client hello for https classification

I need to detect https packets in network traffic . Until now I were marking all "443" as https but I don't want to use port information for these any more . Will it be enough to check client hello ...
0
votes
2answers
654 views

Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?

I'm not sure where to post this, so I figured I'd just post it here. CloudFlare is now offering free SSL to all sites. There are two different types of SSL connections, however. There's "Flexible ...
7
votes
2answers
543 views

Why is TLS_FALLBACK_SCSV secure against a MITM attack?

It is recommended, to mitigate POODLE, if SSLv3 cannot be disabled entirely, to make use of TLS_FALLBACK_SCSV, a signaling cipher suite value that indicates that fallback has occurred. The draft ...
2
votes
6answers
3k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...
6
votes
2answers
2k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
98
votes
3answers
68k views

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
3
votes
4answers
2k views

How to get an “A” on Qualys SSL Labs with Apache 2.2?

I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers. On their blog, they suggest a configuration for Apache 2.4 that should get an "A" ...
-4
votes
1answer
28 views

Question regarding Oauth and https [on hold]

Whats the difference between Oauth protocol and https protocol?
1
vote
2answers
54 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
0
votes
0answers
15 views

IIS 8.5 TLS 1.2 not working [migrated]

I have Windows 8.1 with IIS 8.5 and have run the script from http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12 to enable TLS 1.2, but Qualys SSLLabs says my server ...
1
vote
0answers
27 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
0
votes
1answer
115 views

What would cause a server to only send over 1 SSL certificate to a client? [on hold]

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
0
votes
0answers
20 views

some Concerns about security in online merchants sites [on hold]

I want clarification regarding some concerns about online merchants : is there some standard classification for online merchants ? how can you recognize if the site is real or fake ? through using ...
174
votes
4answers
40k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What ...
3
votes
1answer
55 views

Is it any more secure to use a HTML form instead of a javascript popup?

Assuming both use session authentication, token validation and forced https: Is there any difference in security between submitting data via a JS popup <> ajax endpoint, and a standard web page ...
1
vote
2answers
178 views

POODLE vulnerability in major social networking

Social networking is a corner stone for a majority of our daily lives, be it communicating with friends, sharing photos or even using social networking for advertising and business promotion. Whilst ...
1
vote
2answers
100 views

Why do browsers probe and fallback (or, why SSL_MODE_SEND_FALLBACK_SCSV)?

I've been following POODLE and the SSL_MODE_SEND_FALLBACK_SCSV TLS extension. I never really paid much attention to it, but it appears SSL_MODE_SEND_FALLBACK_SCSV is needed for clients like browsers ...
-4
votes
1answer
140 views

If NSA can't decrypt TLS why don't we use it to encrypt phone calls [on hold]

If an individual can convert his voice into Internet traffic using a simple combination of hardware and software what stop governments from using it and avoid NSA spying on them? To clarify: Since ...
0
votes
1answer
344 views

Poodle - possible to protocol downgrade if SSLv3 is disabled but still have SSLv3 ciphers enabled?

My title pretty much sums it up. If I have: A server with the SSLv3 protocol disabled BUT still have SSLv3 ciphers enabled. Would that mean that a protocol downgrade attack can still occur?
1
vote
2answers
229 views

SSLv3 cannot be disabled, can I use weak cipher as a workaround?

We're using lighttpd 1.5.0-2349 which unfortunately doesn't support the option to disable SSLv3. I think a potential workaround would be to only allow it to use some cipher which has already been ...
3
votes
1answer
130 views

Performing POODLE attack

I trying to perform POODLE attack on a hosted server that I've configured to support only SSLv3. The scenario is I logged on my server and it sends the cookie in response that will be stored by the ...
3
votes
2answers
70 views

Could SSL-like encryption be used for not password-protected wireless access points?

I'm looking at ways an outsider (i.e. someone without a possible password) of the network could sniff the communication within the network, specifically focusing on WLAN. This is what I understand ...
1
vote
2answers
301 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
5
votes
2answers
633 views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
1
vote
1answer
117 views

SSLStrip vs HSTS

I've heard about the new SSLStrip and how it is able to bypass HSTS. Where can I find an article that talks about this? How does this work? Where can I download it? Moxie's website has not been ...
14
votes
3answers
1k views

How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?

How many hostnames can be supported by a wildcard ssl certificate? Is there any limit ?
0
votes
2answers
36 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
1
vote
2answers
69 views

Is 'correct' TLS Configuration dependant mainly on the Server?

Here is a link to a screen grab of SSL Configuration Checker by GlobalSign for my domain: SSL Configuration Checker: http://i.imgur.com/CbVjVee.png. Following recent discussions with the host, they ...
14
votes
3answers
2k views

Why doesn't the TLS protocol work without the SSLv3 ciphersuites?

While disabling SSLv3 from our ssl.conf files to overcome the Poodle vulnerability, I also disabled the SSLv3 ciphers using !SSLv3. With the ciphers disabled, we were not able to access the website ...
1
vote
1answer
63 views

Is having a GUID in a https url secure enough? [duplicate]

Is having a GUID in a https url secure enough? Are there any security risks of using this way of authenticating users? https://mywebsite.com/......?Guid=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Also what ...
11
votes
2answers
4k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
-1
votes
1answer
25 views

How do server know the CSR sender is approved client?

Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The prblem is anyone can POST a CSR to the server and then ...
-1
votes
1answer
20 views

Does DH parameter file need to be unique per private key?

There is scant information available online on the DH parameters used in DHE ciphers (and the kind that's available is aimed at cryptographers, not systems administrators). Basically, as a sysadmin, I ...
3
votes
0answers
201 views

POODLE: Disabling SSLv3 in Apache [migrated]

Everybody seems to be talking about the POODLE vulnerability today. And everybody recommends disabling SSLv3 in Apache using the following configuration directive: SSLProtocol All -SSLv2 -SSLv3 ...
1
vote
1answer
52 views

Can Cipher Suites defined in TLSv1.2 be negotiated by clients that only support TLSv1.0?

If my server has only the cipher suites enabled which are defined by TLSv1.2 does that force a client to also use TLSv1.2 or else not be able to connect or can the connection fallback to TLSv1.1 or ...
15
votes
2answers
5k views

How do I use “openssl s_client” to test for (absence of) SSLv3 support?

In order to mitigate the "Poodle" vulnerability, I'd like to disable SSLv3 support in my (in this case, TLS, rather than HTTPS) server. How can I use openssl s_client to verify that I've done this?
1
vote
3answers
802 views

Any alternative available for RSA? Is the web still visible to NSA?

After the Snowden revelations, is there any mass change being carried out to HTTPS protocol? As far as I understood, any HTTPS communication is still visible to NSA as they can compromise the RSA ...
2
votes
2answers
491 views

Disable SSLv3 system-wide for all clients?

After reading about Poodle secutrity bug, I have disabled SSLv3 on my servers and browsers. But there are several clients that do not expose settings detailed enough via their own means of ...
2
votes
0answers
72 views

Does Firefox support TLS on non-standard ports? [migrated]

My presumption was that TLS 1.0+ is supported by Firefox on ports other than 443. However, a tweet crossed my path that seems to debunk this. Turns out that Firefox does not support TLS on any ...
375
votes
3answers
158k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
0
votes
0answers
34 views

What's the impact of POODLE to the Internet? [duplicate]

POODLE can be exploited on SSL 3.0 and TLS 1.0, as the latter falls back to SSL 3 after multiple connection errors. I wonder how many use these protocols for encrypted data transfer, will it be a ...
0
votes
1answer
39 views

Creating secure communication line for mobile payment

Is SSL the most efficient way for creating a encrypted communication between the user's mobile to the backend server? I understand that there is a flaw in SSL, so I was wondering is there other ...