SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

17
votes
9answers
3k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
1
vote
1answer
44 views

How to convert SSL Certificate for mobile app?

I am in the current process of renewing my SSL cert for my website. I also have a mobile app for my site. I want to use the same cert from my website in my mobile app. How can I do this? Thanks - I ...
1
vote
2answers
32 views

How secure are SSL client certificate authentications?

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
1
vote
1answer
123 views

Is keystore file(server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I did to generate .p7b file. I generated jks(java keystore) file using below ...
0
votes
1answer
34 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
2
votes
4answers
3k views

How do I diagnose client-side SSL errors?

Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
1
vote
2answers
30 views

How to Secure Exchange 2010 cookie?

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
9
votes
4answers
877 views

Can ISP block HTTPS selectively? [duplicate]

Can ISP block HTTPS selectively i.e. certain websites cannot be accessed using HTTPS while others can be ?
4
votes
1answer
107 views

How safe can connecting to VPN really be?

I would like to make this story as short as possible since my question is not that long, I have worked with journalists previously in war zone where we investigated the involvement of EU IT companies ...
1
vote
1answer
38 views

Early ChangeCipherSpec Attack

For the early ChangeCipherSpec attack, the attack would affect client with all version of OpenSSL and server with OpenSSL version 1.0.1 and above. My question: If two mail servers are communicating ...
3
votes
2answers
178 views

Why do the banks all use weaker TLS suites? [on hold]

I've been checking out various TLS certificates lately and noticed that most of the banks seem to have the following two issues: 1) They do not offer perfect forward secrecy 2) They are still using ...
0
votes
0answers
40 views

CA Flag in SSL certificate [migrated]

I have an web portal running as a POC purpose, and then i have a mobile apps to access this web portal. Since it's a POC, I just generate a self-signed SSL cert and load it inside the Web and my ...
2
votes
1answer
59 views

DTLS Session Keys life time

I have a UDP client application that is long-lived: Ideally, it keeps streaming to a server forever. I'm using Datagram Transport Layer Security (DTLS) to secure the UDP communication. How often ...
-5
votes
2answers
30 views

how do vpns secure the encyption key? [on hold]

VPNs are accessed by the user with credentials so that the information is encrypted. There are credentials that you download to allow this. Since you don't physically, in person get the credentials ...
0
votes
0answers
18 views

SSL Mismatched Address Certificate Error on IIS 7 [migrated]

We have a local application server (trisha0002), and on this server we have an application (FlexibleBenefits). When we install SSL for this application, it gives Mismatched Address. What can be the ...
0
votes
1answer
31 views

Forward Secrecy not supported with referenced browsers?

I am running a scan against one of our servers from the Qualys SSL tester site and it says that my server "does not support forward secrecy with the referenced browsers". What exactly does that mean? ...
3
votes
0answers
143 views

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? ...
1
vote
2answers
45 views

Relying on openssl's certificate authority list or provide my own

My apologies if this is too subjective, but I am looking for advice on best practices. We maintain a small program written in Python that runs on our customers' servers and communicates back with our ...
22
votes
3answers
7k views

Why is “www.” considered unsafe in this HTTPS URL?

I was doing some cross-origin requests to Soundcloud's oEmbed and I noticed some strange behaviour. When doing a request from my localhost, which is on a regular HTTP connection, everything worked ...
-1
votes
1answer
57 views

An indian government website is not secure [on hold]

We know the news about fake SSL certificates issued by Indian government agency. This site http://www.passport.gov.in/nri/Online.do does gather confidential information as you can see. The site ...
0
votes
2answers
61 views

https login iframe 2014

Per current security recommendations & browser support, is it okay to have an https iframe in an otherwise http-only set of pages? Is this not a dupe? It is, but I want current trends because ...
0
votes
1answer
49 views

Why do certificate authorities often require/use multiple intermediates?

I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway. Why do most modern certificate authorities (e.g. ...
1
vote
1answer
197 views

Can HSTS be defeated?

As I know HSTS is mainly implemented to mitigate famous sslstrip attack in which browser is forced to use ssl when connecting to particular site. And I think it also prevents user to proceed to site ...
2
votes
1answer
458 views

HTTP Reverse Proxy: Correct way to do SSL to backend

If I have a HTTP reverse proxy that communicates with it's backends in an untrusted datacenter, or across datacenters, I would want to use HTTPS in the backend, as talked about here: Reverse Proxy ...
0
votes
0answers
29 views

securing my API: concept of accesstokens

first of all I want to excuse for the bad spelling and grammar. English is not my mothertongue. I have built a JSON communication between frontend(website) and my NodeJS webserver. I want to keep in ...
1
vote
2answers
225 views

Online Shopping password keylogger risk

Suppose I do an online shopping they are asking me to enter my card details like four digit number(whatever related to that) and they are asking me to enter the PIN number too. If I enter all this ...
358
votes
3answers
144k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
2
votes
2answers
113 views

How can I secure my api to avoid copying?

Im building an app which should receive data from my server. The Api should be a PHP based script which provides the data as JSON. However I want to keep the data private and it should only be ...
7
votes
2answers
320 views

How can we revoke all ssl certificates issued for our domain?

After having the hostmaster@domain.com email compromised, we found that someone issued a Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked. Is there ...
0
votes
1answer
195 views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...
8
votes
2answers
602 views

Can custom elliptic curves be used in common TLS implementations?

Recent developments have cast some doubt on the elliptic curves specified by NIST and used in many standards like TLS (for signatures with ECDSA and key agreement with ECDHE). It seems like the ...
0
votes
3answers
2k views

Hardened SSL ciphers for Nginx as AWS/Cloudfront Custom Origin

Based on recommendations, we recently attempted to harden our Nginx SSL configuration against BEAST/CRIME/BREACH attacks with the following stanza: ssl_prefer_server_ciphers on; ssl_ciphers ...
12
votes
4answers
1k views

Downsides to using HTTPS [duplicate]

Recently Google has indicated that a HTTPS certificate will be used as a positive signal in it's search rankings. This has caused some discussion within our company as to if we should apply a HTTPS ...
1
vote
1answer
209 views

cURL cert validation with curlopt_cainfo not working

I want to validate my SSL certificate each time I run API calls. I've been following this guide: http://artur.ejsmont.org/blog/content/how-to-properly-secure-remote-api-calls-from-php-application ...
0
votes
2answers
66 views

Printer SSL certificates [closed]

Is a printer SSL cert really necessary if you just print? I don't use https for any administration; just http. I got a vulnerability saying that my cert was out of date.
2
votes
2answers
189 views

It is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place?

I have the following question regarding the decryption of SSL traffic. The topology that I have in mind is like this: User-------MitM Proxy--------WebServer In the environment described earlier there ...
24
votes
4answers
13k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
0
votes
2answers
49 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
1
vote
2answers
73 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
-5
votes
1answer
93 views

How to decrypt the encrypted data, in SHA256, of mysql database? [closed]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
0
votes
2answers
79 views

What would cause a server to only send over 1 SSL certificate to a client?

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
2
votes
3answers
144 views

Free second-level domain SSL certificate [closed]

With CAcert.org losing trust in browsers and OSs and StartSSL providing only top-level domain certificates, are there any free SSL certificates providers for second-level domains?
5
votes
3answers
350 views

What exactly determines what version of SSL/TLS is used when accessing a site?

If I click on the little lock icon in Chrome it says that the site in question is using TLS v1. I also checked using openssl and was able to hit the site using TLS1, SSL2 and SSL3. From what I ...
2
votes
1answer
49 views

API request modification

I am building an API that returns data about companies Multiple applications will access the API, some of these applications will have access to one company, some to multiple companies. When a request ...
1
vote
1answer
107 views

Behavior of trusting a self signed SSL certificate

I have just deployed a Turnkey appliance which comes configured with a self signed certificate. This is a server that only I will be using, so I don't want to pay for a certificate. If I add this ...
5
votes
6answers
1k views

Should the bit-strength selection of a child certificate be influenced by the CA or the chain?

All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
1
vote
2answers
33 views

Can I change the CSR of my SSL certificate?

I have 2 SSL certificates that are generated and being used for our staging and development server. However, we wish to change the roles of these two servers. currently the staging server is using ...
1
vote
2answers
62 views

Client-server encryption technique explanation (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 128 bit keys)

I opened a web page using https. When I looked at the page info provided by my browser (Firefox) I saw following: Connection encrypted: High-grade Encryption ...
1
vote
1answer
256 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
3
votes
2answers
508 views

What is the difference between EV-SSL certificates and Normal SSL certificates? [duplicate]

Recently while looking at several banking URLs I can see the domain name with security certificate at address bar and normal locker security certificate at address bar. Have a look at the screenshots: ...