SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

11
votes
4answers
992 views

Downsides to using HTTPS [duplicate]

Recently Google has indicated that a HTTPS certificate will be used as a positive signal in it's search rankings. This has caused some discussion within our company as to if we should apply a HTTPS ...
1
vote
1answer
174 views

cURL cert validation with curlopt_cainfo not working

I want to validate my SSL certificate each time I run API calls. I've been following this guide: http://artur.ejsmont.org/blog/content/how-to-properly-secure-remote-api-calls-from-php-application ...
1
vote
2answers
200 views

Online Shopping password keylogger risk

Suppose I do an online shopping they are asking me to enter my card details like four digit number(whatever related to that) and they are asking me to enter the PIN number too. If I enter all this ...
0
votes
2answers
62 views

Printer SSL certificates [on hold]

Is a printer SSL cert really necessary if you just print? I don't use https for any administration; just http. I got a vulnerability saying that my cert was out of date.
2
votes
2answers
166 views

It is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place?

I have the following question regarding the decryption of SSL traffic. The topology that I have in mind is like this: User-------MitM Proxy--------WebServer In the environment described earlier there ...
24
votes
4answers
13k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
0
votes
2answers
40 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
1
vote
2answers
71 views

Are input fields that don’t have name=“” sent via the browser [on hold]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
-5
votes
1answer
77 views

How to decrypt the encrypted data, in SHA256, of mysql database? [on hold]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
0
votes
2answers
70 views

What would cause a server to only send over 1 SSL certificate to a client?

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
2
votes
3answers
120 views

Free second-level domain SSL certificate [on hold]

With CAcert.org losing trust in browsers and OSs and StartSSL providing only top-level domain certificates, are there any free SSL certificates providers for second-level domains?
5
votes
3answers
328 views

What exactly determines what version of SSL/TLS is used when accessing a site?

If I click on the little lock icon in Chrome it says that the site in question is using TLS v1. I also checked using openssl and was able to hit the site using TLS1, SSL2 and SSL3. From what I ...
2
votes
1answer
48 views

API request modification

I am building an API that returns data about companies Multiple applications will access the API, some of these applications will have access to one company, some to multiple companies. When a request ...
1
vote
1answer
106 views

Behavior of trusting a self signed SSL certificate

I have just deployed a Turnkey appliance which comes configured with a self signed certificate. This is a server that only I will be using, so I don't want to pay for a certificate. If I add this ...
5
votes
6answers
1k views

Should the bit-strength selection of a child certificate be influenced by the CA or the chain?

All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
1
vote
2answers
31 views

Can I change the CSR of my SSL certificate?

I have 2 SSL certificates that are generated and being used for our staging and development server. However, we wish to change the roles of these two servers. currently the staging server is using ...
-1
votes
0answers
29 views

Burp clone certificates [on hold]

Basically what I need is a HTTPS proxy, that will get the certificate from the target host, and create a new self-signed certificate based on the metadata of the original certificate. Ideally there ...
1
vote
2answers
50 views

Client-server encryption technique explanation (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 128 bit keys)

I opened a web page using https. When I looked at the page info provided by my browser (Firefox) I saw following: Connection encrypted: High-grade Encryption ...
1
vote
1answer
255 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
3
votes
2answers
502 views

What is the difference between EV-SSL certificates and Normal SSL certificates? [duplicate]

Recently while looking at several banking URLs I can see the domain name with security certificate at address bar and normal locker security certificate at address bar. Have a look at the screenshots: ...
0
votes
1answer
75 views

This certificate has an invalid digital signature

I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. ...
0
votes
0answers
26 views

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or ...
1
vote
1answer
44 views

Drawbacks to only using TLS 1.2 ciphers in OpenSSL

I understand you would not want to do this as it would limit compatibility for older devices and platforms. However if someone were in an all TLS1.2 environment, say a very well managed internal ...
0
votes
1answer
171 views

Does an HTTPS proxy encrypt traffic between proxy client and server for HTTP requests?

To bypass censorship in a DIY fashion, I plan to set up private proxies for my personal use. One of the possible methods I would try is to use an HTTPS proxy (not a web proxy, to be explicit) hosted ...
1
vote
1answer
293 views

Camellia and ECDHE_ECDSA -ECDSA in TLS1.2

I am setting up a server using nginx. I have it working with a self signed ecc certificate and if I connect it reports ECDHE-ECDSA which is what I wanted. But I was also wondering if I could use ...
0
votes
1answer
64 views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
1
vote
2answers
72 views

Can you use https only for cookies and not the html?

I have a few questions, all relating to the title. 1) Is it possible to configure a server to receive the cookies using https but then serve all the content with http? 2) Does SE do this / do many ...
0
votes
0answers
36 views

I Need Wireshark Confirmation on Full Implementation of SSL for YouTube

I've just noticed today that YouTube have implemented SSL over the entire service (including video transfer). I've analyzed the partial SSL YouTube had before and it encrypted the video request but ...
4
votes
2answers
199 views

Safety of using web based proxy?

Lets say for example I have to use a public online proxy like https://www.zend2.com to load a PHP webpage controlled by me containing sensitive data over HTTPS. How would I make sure that the proxy ...
0
votes
1answer
23 views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
4
votes
2answers
684 views

What Ubuntu packages are still affected by gnutls bug CVE-2014-0092?

Right now the internet is abuzz with news about a severe breach in GnuTLS. An update to the relevant GnuTLS packages has already been released. But I am worried whether some packages might have had ...
1
vote
2answers
59 views

Does where I put my PKI certificates matter?

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were ...
3
votes
2answers
43 views

Standard practice for distributing server certificate for users

I have a Winforms app that users have to download and install on their machines. It connects to a WCF service(using SSL), hence requires the server certificate to be installed on users' Trusted ...
3
votes
2answers
81 views

What is the point of secure email gateways?

We run Exchange 2010. Our edge servers run "passive opportunistic TLS" for 99% of the domains we communicate with. For a handful of domains, we have forced TLS on both our end and the other domain's ...
-1
votes
0answers
41 views

Implementing simple authencation based on random number generated [closed]

I have an application in which, i want make some admin options to be controlled by super Admin's permission. Currently , i have framed a simple flow/expectation how this is to be done. But, for this ...
2
votes
1answer
102 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
2
votes
4answers
129 views

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
1
vote
0answers
25 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
1
vote
0answers
23 views

Is there a way to restrict hls key file served by cloudfront (over https) to only authorized users

I have a video file which is distributed after hls packaging and encrypted using aes 128. Since HLS key url is part of the m3u8 file I have to restrict the delivery of key file only to authorized ...
0
votes
2answers
50 views

PKI certificate validation graphs, trees and cross signing

I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it ...
3
votes
2answers
1k views

Forcing IE11 to use perfect forward secrey on AWS ELB

I can connect to my server in practically every browser except for Internet Explorer and I cannot figure out why. I am resolving SSL on AWS Elastic Load Balancer (ELB), which is configured to use the ...
2
votes
4answers
6k views

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. ...
1
vote
1answer
49 views

Would it be possible to use cookie to store SSL Client Certificate?

Lately, I was reading that article about SSL client certificate. Why is nobody using SSL Client Certificate? The answer was to that question was : In the current state, this excellent idea is ...
2
votes
1answer
93 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
1
vote
1answer
55 views

Self-signing client certificates and distributing them, is the following a sound procedure?

I have a case at hand as follows: There is a number of clients in Internet (i.e. untrusted channel), initially in hundreds but growing in numbers. There is a server doing processing related to these ...
0
votes
1answer
131 views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
1answer
48 views

Browser and SSL support

According to http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers most browsers support SSL 3.0. And with my understanding (please correct me if I am wrong), when a browser just ...
1
vote
1answer
27 views

TLS 1.2 Older Browser Compatibility

We are in the process of upgrading our webservers to support TLS 1.2 but I have heard rumor of very old browsers, such as those used as kiosks will fall over when trying to connect to a server that ...
1
vote
2answers
50 views

Is it Possible to use one commercial SSL Certificate to issue end user certs?

My organization is preparing to purchase some 50 "units" from Symantec, with which we can purchase Verisign SSL certificates of varying authentication levels. Our organization does not have--but ...
2
votes
4answers
142 views

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...