SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
1answer
13 views

How to add basicConstraints extention to a self signed certificate

Using openssl to create a self signed certificate. The certificate needs to have the Basic Constraints value defined and showing in the cert but I can't seem to be finding the right location to modify ...
0
votes
1answer
17 views

SSL/TLS Session Resumption with Session Tickets

We already have SSL session resumption enabled using a session cache. Based on an in-house performance report, enabling Session Resumption using Session Tickets is recommended. Is the performance ...
2
votes
3answers
129 views

With HTTPS, what information would a MitM attacker be able to glean?

Consider a user accessing a site that is using HTTPS for all its traffic. A hacker is trying to use a man-in-the-middle to snoop on the user. What information can he glean? Obviously the content is ...
2
votes
3answers
10k views

How force that all connections to my Apache use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...
0
votes
1answer
46 views

Mixed content - stylesheet being blocked because of a querystring parameter?

I've just run into a scenario where a stylesheet was being blocked on a secure payment page. The stylesheet was loaded like so: <link href="/CSS/all.min.css?v=2" rel="stylesheet" type="text/css" ...
0
votes
2answers
27 views

cross-signed end-entity certificates: usage in apache/openssl/gnutls

A previous question, What is the use of cross signing certificates in X.509? described cross-signed certificates well. I have a situation where the clients trust CA1 xor CA2, and both need to reach a ...
0
votes
0answers
38 views

SSL certificate expired on laptop what does that mean? [on hold]

SSL certificate says it is expired on my laptop. What are the implications.
1
vote
1answer
41 views

What happens if a page with an invalid SSL cert responds with a 302 redirect to a page with a valid cert? Do you still get the warning?

Alice navigates to https://example.com. https://example.com delivers an invalid certificate. https://example.com 302 redirects to https://www.example.com https://www.example.com delivers a valid ...
1
vote
1answer
41 views

Why does firefox still display website ssl to be 128 bit encrypted after changing to 256

I recently renewed an ssl certificate to use SHA-2 but on firefox the website still shows to be SHA-1 and 128 bit encrypted, on all other browsers it show SHA-2 , 256 bit. Can anybody help me with ...
1
vote
3answers
121 views

{Secure} Telnet connect to a console server from webbrowser

I've got a terminal server set up in a data center that also serves as a console server. This console server only accepts regular telnet requests. To this server are a bunch of routers and switches ...
2
votes
3answers
178 views

Company decrypting SSL, is it common?

We've just implemented a proxy that decrypts all SSL traffic in order to classify and scan it. Naturally a lot of our users feel concerned. We're a small company (100 users) owned by a big company ...
3
votes
1answer
54 views

Does SNI have any benefit when doing fingerprint validation instead of using the common name?

Does using SNI have any benefit whatsoever (whether security, scalability, or otherwise) if the TLS certificate validation is performed exclusively using the certificate fingerprint and without regard ...
1
vote
1answer
75 views

How will SHA1 deprecation affect SHA1 roots in OS/Browser trust stores.

I understand the SHA1 deprecation policy applies to CA's issuing SHA2 end-entity certs and intermediates starting Jan 2017 but how will this policy affect the actual root certificates in OS/Browser ...
0
votes
0answers
15 views

OCSP stapling: Staple just my domain/root CRT, or Combine/Concatenate including Intermediates?

I cant seem to find a specific well documented resource on this question. Should I staple just my domain/root CRT, or staple my combined crt (Combine/Concatenate file which includes my root cert plus ...
3
votes
3answers
179 views

TLS library problem when connecting to Dovecot

I have a Comodo PositiveSSL certificate issued for mail.btcontract.com and I've set up Postfix and Dovecot to work with it in the following way: Postfix main.cf: smtpd_tls_cert_file = ...
3
votes
2answers
74 views

Choosing TLS / SSL cipher suites - What considerations are there?

Most of the advice on choosing cipher suites I find tends to be one of these forms: Here's a string to paste into your application, or Here's a list of 30,000-foot generic criteria to use ("favor ...
0
votes
2answers
73 views

Effective Free and Anonymous Web Form Encryption

I've got a website and I would like the users to be able to login securely but I don't want to spend any money on SSL / certificates and I would like to stay anonymous i.e. not give the certificates ...
0
votes
1answer
36 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
0
votes
1answer
80 views

Why does my TLS configuration not work with IE 8 / XP? [on hold]

After all the last news about TLS/SSL faults and problems, I'm working on strengthening our TLS config — yes, I dropped SSL; at least, that's something. The main effort is to enforce, as much as ...
0
votes
1answer
71 views

Poodle vulnerability and eCommerce

Our client has recently stopped getting new orders placed on their Magento eCommerce site. Could this be related with the Poodle vulnerability, as their server is still on SSLv3. Is there any ...
0
votes
0answers
21 views

Encrypted alert with code 21 for connection [on hold]

I've got a device that connected to the server and successfully did the handshake and received application data, however later when client sends keep-alive requests server sends back encrypted alert ...
1
vote
2answers
66 views

MITM on program with no proxy settings

I'm trying to inspect the traffic of a program (which is running on my computer) that uses SSL over TCP to a non-standard port. The traffic may or may not be HTTP traffic, likely isn't. Neither ...
0
votes
1answer
27 views

Add certificate authority to one browser only

For testing purposes, I'd like to add a "CA" to the list of trusted-CA's of one browser - and use it only for testing. I want to make sure that it won't get added to the computer's trusted CA list. ...
2
votes
1answer
723 views

HTTP Reverse Proxy: Correct way to do SSL to backend

If I have a HTTP reverse proxy that communicates with it's backends in an untrusted datacenter, or across datacenters, I would want to use HTTPS in the backend, as talked about here: Reverse Proxy ...
0
votes
1answer
205 views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
0
votes
1answer
50 views

TLS Authentication/OpenVPN/MITM Attacks on Public Wifi [duplicate]

My question is about how an SSL VPN connection such as OpenVPN is protected against MITM/Spoofing attacks on a public Wifi. For example, if somebody has a 'pineapple' or router setup as a honeypot ...
1
vote
1answer
36 views

What are the compatibility implications of generating a new TLS key?

The guide I'm following says to use openssl genrsa to generate a TLS key, which I did. I've changed the CSR generation command to use SHA256 instead of SHA1, but I'm still not sure if this is the ...
0
votes
0answers
22 views

TLS authentication on Openvpn server

I'm not sure if this question can be applied elsewhere and that's why posting it here. The matter is that I want to setup hardened(as far as possible) VPN server. No the issue is that tls handshake ...
2
votes
1answer
53 views

Must the distinguished subject name of an issued SSL Certificate match that of the generated Certificate Signing Request?

For example: from Issued SSL Certificate: CN = abc.com.my, OU = Room, O = House, C = MY from generated CSR: CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY Is it legal for a ...
0
votes
2answers
52 views

Sign SSL certificate with root certificate using openssl

I have created a root certificate, My Root Certificate, with a private key, RSA Private Key 1, using the openssl terminal command. I would like to make a certificate chain such as the following: My ...
0
votes
4answers
83 views

How and why does not having https allow people to trace my browsing habits if at home? [closed]

How can my browsing habits be traced when I am at home on my own local network? Technically how is it done ?
2
votes
2answers
165 views

What's the difference between X.509 and PKCS#7 Certificate?

Am I correct calling file with .p7b file extension saved as 'Cryptographic Message Syntax Standard - PKCS#7 Certificates (.P7B)' in Windows - a 'PKCS#7 certificate'? Or is it better called 'X.509 ...
12
votes
6answers
11k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
1
vote
1answer
86 views

Mobile, WebServices and SSL

I just started dipping my feet into security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now, but most of them deal with it taking the ...
2
votes
1answer
77 views

Do payload sizes reveal URLs when HTTPS is deployed on news, blogs, etc?

Even though HTTPS keeps HTTP paths private, is it not the case that the generally-unique payload sizes for particular URLs (on news articles, blogs, etc) provides a mechanism to reveal the URL anyhow ...
4
votes
4answers
375 views

How widely deployed is TLS with cipher ECDHE?

Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers. Cipher suite Exchange Encryption Hash TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
1
vote
0answers
47 views

How does SELinux effect the Linux Kernel networking stack?

I'm interested in how SELinux effects the processing of packets through the networking stack. I've found the following questions and answers: Network policies under AppArmor/SELinux Filtering ...
1
vote
0answers
545 views

GnuTLS ServerHello exploit (CVE-2014-3466) - how to verify?

So pretty much all of the GNUTLS world is worrying about CVE-2014-3466. I checked my Kali and it responds with this - # apt-cache rdepends libgnutls26 | grep -v lib Reverse Depends: ...
2
votes
5answers
169 views

Can we have https without certificates?

I apologize in advance if I am fundamentally misunderstanding something, but is it possible to have encrypted communication protocols (https, I suppose) without resorting to a certificate system? ...
7
votes
5answers
1k views

Understanding SSL certificate signing

I am trying to understand how SSL certificate and signing and the chain of trust works. I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are ...
0
votes
0answers
63 views

sniff https traffic and grab credentials with ettercap [closed]

how to access a website with the session id ? thanks very much!! I have the session id but I don't know how to use it
1
vote
2answers
48 views

Invalid OCSP signing certificate in OCSP response

I want to open the following page in Firefox, and get an error. https://www.acm.nl/nl/ Secure Connection Failed An error occurred during a connection to www.acm.nl. Invalid OCSP signing ...
1
vote
2answers
99 views

Will CA's still validate internal IP's in SSL certs?

Just wondering what Certificate Authority (CA) policy is nowadays on validating someone's internal IP address in a certificate? I have heard that some CA's used to do this but won't anymore.
0
votes
2answers
36 views

Why does IP address need to be listed as a DNS name in SAN/UCC certs?

I have heard that when creating a CSR that if you want to validate an IP address that you should list the IP as a "DNS" name and not "IP Address". I have actually had to re-create CSR's like this to ...
1
vote
1answer
77 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
0
votes
2answers
54 views

Storing CardHolder Data using RC2 encryption

I would like to know if storing credit cardholder data using RC2 encryption requires to be compliant with PCI DSS. Currently the 16 digit PAN number and expiry date is stored in the database. The PAN ...
1
vote
4answers
74 views

employing SSL even on non critical web server [duplicate]

I know that SSL should be used on web servers that need to gather credit card information etc..however, is it industry best practice to also turn on SSL even for non critical web servers? eg those ...
0
votes
0answers
36 views

Question regarding SSL / TLS / Certificates in general [duplicate]

for the last two days I played around a bit with nginx's SSL configuration. A question came up: I created asymmetric key using $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:4096 -keyout ...
0
votes
1answer
38 views

How to change the expiration time for the pkcs certificate?

I have an application (which I'm testing), in which I create some services. These services are accessible via libraries i.e java and python apis. In order to authenticate the api calls, the ...
2
votes
1answer
223 views

Are Java applications vulnerable to CVE-2014-6321 (WinShock)?

CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows. My Java application uses SSL (JSSE ...