SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

2
votes
1answer
13 views

What is the difference between a “Thumbprint Algorithm” “Signature Algorithm” and “Signature Hash Algorithm” for a certificates?

I'm a bit confused on the differences between Signature Algorithm, Signature Hash Algorithm, and Thumbprint Algorithm that are present in SSL/TLS certificates. Can someone please elaborate?
4
votes
4answers
2k views

Checking client hello for https classification

I need to detect https packets in network traffic . Until now I were marking all "443" as https but I don't want to use port information for these any more . Will it be enough to check client hello ...
0
votes
2answers
628 views

Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?

I'm not sure where to post this, so I figured I'd just post it here. CloudFlare is now offering free SSL to all sites. There are two different types of SSL connections, however. There's "Flexible ...
7
votes
2answers
242 views

Why is TLS_FALLBACK_SCSV secure against a MITM attack?

It is recommended, to mitigate POODLE, if SSLv3 cannot be disabled entirely, to make use of TLS_FALLBACK_SCSV, a signaling cipher suite value that indicates that fallback has occurred. The draft ...
2
votes
6answers
3k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...
6
votes
2answers
2k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
98
votes
3answers
68k views

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
1
vote
0answers
38 views

Mobile, WebServices and SSL

So I just started dipping my feet into Security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now. But most deal with it taking the ...
3
votes
4answers
2k views

How to get an “A” on Qualys SSL Labs with Apache 2.2?

I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers. On their blog, they suggest a configuration for Apache 2.4 that should get an "A" ...
-4
votes
1answer
24 views

Question regarding Oauth and https [on hold]

Whats the difference between Oauth protocol and https protocol?
1
vote
2answers
48 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
0
votes
0answers
15 views

IIS 8.5 TLS 1.2 not working [migrated]

I have Windows 8.1 with IIS 8.5 and have run the script from http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12 to enable TLS 1.2, but Qualys SSLLabs says my server ...
1
vote
0answers
26 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
0
votes
1answer
115 views

What would cause a server to only send over 1 SSL certificate to a client? [on hold]

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
0
votes
0answers
20 views

some Concerns about security in online merchants sites [on hold]

I want clarification regarding some concerns about online merchants : is there some standard classification for online merchants ? how can you recognize if the site is real or fake ? through using ...
171
votes
4answers
37k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What ...
3
votes
1answer
55 views

Is it any more secure to use a HTML form instead of a javascript popup?

Assuming both use session authentication, token validation and forced https: Is there any difference in security between submitting data via a JS popup <> ajax endpoint, and a standard web page ...
1
vote
2answers
169 views

POODLE vulnerability in major social networking

Social networking is a corner stone for a majority of our daily lives, be it communicating with friends, sharing photos or even using social networking for advertising and business promotion. Whilst ...
1
vote
2answers
89 views

Why do browsers probe and fallback (or, why SSL_MODE_SEND_FALLBACK_SCSV)?

I've been following POODLE and the SSL_MODE_SEND_FALLBACK_SCSV TLS extension. I never really paid much attention to it, but it appears SSL_MODE_SEND_FALLBACK_SCSV is needed for clients like browsers ...
-4
votes
1answer
137 views

If NSA can't decrypt TLS why don't we use it to encrypt phone calls [on hold]

If an individual can convert his voice into Internet traffic using a simple combination of hardware and software what stop governments from using it and avoid NSA spying on them? To clarify: Since ...
0
votes
1answer
333 views

Poodle - possible to protocol downgrade if SSLv3 is disabled but still have SSLv3 ciphers enabled?

My title pretty much sums it up. If I have: A server with the SSLv3 protocol disabled BUT still have SSLv3 ciphers enabled. Would that mean that a protocol downgrade attack can still occur?
1
vote
2answers
208 views

SSLv3 cannot be disabled, can I use weak cipher as a workaround?

We're using lighttpd 1.5.0-2349 which unfortunately doesn't support the option to disable SSLv3. I think a potential workaround would be to only allow it to use some cipher which has already been ...
2
votes
1answer
119 views

Performing POODLE attack

I trying to perform POODLE attack on a hosted server that I've configured to support only SSLv3. The scenario is I logged on my server and it sends the cookie in response that will be stored by the ...
3
votes
2answers
70 views

Could SSL-like encryption be used for not password-protected wireless access points?

I'm looking at ways an outsider (i.e. someone without a possible password) of the network could sniff the communication within the network, specifically focusing on WLAN. This is what I understand ...
1
vote
2answers
301 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
5
votes
2answers
445 views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
1
vote
1answer
114 views

SSLStrip vs HSTS

I've heard about the new SSLStrip and how it is able to bypass HSTS. Where can I find an article that talks about this? How does this work? Where can I download it? Moxie's website has not been ...
14
votes
3answers
995 views

How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?

How many hostnames can be supported by a wildcard ssl certificate? Is there any limit ?
0
votes
2answers
34 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
1
vote
2answers
67 views

Is 'correct' TLS Configuration dependant mainly on the Server?

Here is a link to a screen grab of SSL Configuration Checker by GlobalSign for my domain: SSL Configuration Checker: http://i.imgur.com/CbVjVee.png. Following recent discussions with the host, they ...
13
votes
3answers
2k views

Why doesn't the TLS protocol work without the SSLv3 ciphersuites?

While disabling SSLv3 from our ssl.conf files to overcome the Poodle vulnerability, I also disabled the SSLv3 ciphers using !SSLv3. With the ciphers disabled, we were not able to access the website ...
1
vote
1answer
63 views

Is having a GUID in a https url secure enough? [duplicate]

Is having a GUID in a https url secure enough? Are there any security risks of using this way of authenticating users? https://mywebsite.com/......?Guid=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Also what ...
11
votes
2answers
4k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
-1
votes
1answer
24 views

How do server know the CSR sender is approved client?

Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The prblem is anyone can POST a CSR to the server and then ...
-1
votes
1answer
20 views

Does DH parameter file need to be unique per private key?

There is scant information available online on the DH parameters used in DHE ciphers (and the kind that's available is aimed at cryptographers, not systems administrators). Basically, as a sysadmin, I ...
3
votes
0answers
201 views

POODLE: Disabling SSLv3 in Apache [migrated]

Everybody seems to be talking about the POODLE vulnerability today. And everybody recommends disabling SSLv3 in Apache using the following configuration directive: SSLProtocol All -SSLv2 -SSLv3 ...
1
vote
1answer
44 views

Can Cipher Suites defined in TLSv1.2 be negotiated by clients that only support TLSv1.0?

If my server has only the cipher suites enabled which are defined by TLSv1.2 does that force a client to also use TLSv1.2 or else not be able to connect or can the connection fallback to TLSv1.1 or ...
14
votes
2answers
5k views

How do I use “openssl s_client” to test for (absence of) SSLv3 support?

In order to mitigate the "Poodle" vulnerability, I'd like to disable SSLv3 support in my (in this case, TLS, rather than HTTPS) server. How can I use openssl s_client to verify that I've done this?
1
vote
3answers
790 views

Any alternative available for RSA? Is the web still visible to NSA?

After the Snowden revelations, is there any mass change being carried out to HTTPS protocol? As far as I understood, any HTTPS communication is still visible to NSA as they can compromise the RSA ...
2
votes
2answers
431 views

Disable SSLv3 system-wide for all clients?

After reading about Poodle secutrity bug, I have disabled SSLv3 on my servers and browsers. But there are several clients that do not expose settings detailed enough via their own means of ...
2
votes
0answers
72 views

Does Firefox support TLS on non-standard ports? [migrated]

My presumption was that TLS 1.0+ is supported by Firefox on ports other than 443. However, a tweet crossed my path that seems to debunk this. Turns out that Firefox does not support TLS on any ...
375
votes
3answers
158k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
0
votes
0answers
34 views

What's the impact of POODLE to the Internet? [duplicate]

POODLE can be exploited on SSL 3.0 and TLS 1.0, as the latter falls back to SSL 3 after multiple connection errors. I wonder how many use these protocols for encrypted data transfer, will it be a ...
0
votes
1answer
39 views

Creating secure communication line for mobile payment

Is SSL the most efficient way for creating a encrypted communication between the user's mobile to the backend server? I understand that there is a flaw in SSL, so I was wondering is there other ...
10
votes
4answers
646 views

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? ...
1
vote
1answer
112 views

Android support for TLS 1.1

Do anybody know from what version of Android did TLS 1.1 started to be supported directly by the OpenSSL version preinstalled in the system?
3
votes
2answers
98 views

What role do hashes play in TLS/SSL certificate validation?

After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
1
vote
2answers
67 views

Why would Comodo SSL certs have two intermediate CAs (chain length 4)?

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs. What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a ...
4
votes
0answers
21 views

What information do EAP-TLS certificates contain?

I recently read a couple of topics on stackoverflow, concerning the verification of Wi-Fi access points: How Are Wi-Fi access points verified? Why is a CA certificate required for EAP-TLS clients? ...
4
votes
3answers
112 views

SSL Certificate - is passphrase necessary and how does apache know it?

I want to generate a Certificate Signing Request for my server and in order to do so, I first need a secure private key. When I create a private key by using openssl genrsa -des3 -out server.key 2048, ...