SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

5
votes
3answers
187 views

Risk in buying an SSL cert from a not well-known party

Let's say I know a guy is selling an SSL cert at a very low price, assume they will generate a real and valid cert for me, since I need to submit my CSR to them and they pass to the CA, are there any ...
12
votes
3answers
1k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
1
vote
1answer
29 views

How often should the DHE p and g factors be recycled?

I've been asked to enable DHE in our SMTP product. I'm stuck on this question: How often should the product regenerate its DHE p and g parameters? I've seen some implementations that use a cron job ...
0
votes
0answers
8 views

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file?

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file? Scenario: We have a few legacy certificates based on some legacy templates (2012 R2). ...
51
votes
10answers
11k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
3
votes
2answers
64 views

What role do hashes play in TLS/SSL certificate validation?

After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
1
vote
1answer
270 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
7
votes
0answers
300 views

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? ...
32
votes
5answers
21k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
47
votes
4answers
12k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
1
vote
4answers
310 views

Achieving End to End encryption with TLS

The scenario is that a client browser (eg: a user trying to log in to a bank website) needs to be able to view certain sensitive information that resides in a mainframe sitting in the Internal network ...
16
votes
3answers
2k views

Is SHA1 weak for SSL?

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
0
votes
0answers
8 views

How should a captive portal handle SSL requests, that are expired, or not authenticated?

What is the best course of action for a user that uses HTTPS anywhere, or tries to access a secure URL (from an phone based App, or from a browser)? Ideally, I'd like to get the phone to "prompt" via ...
0
votes
0answers
17 views

Can I terminate an SSL Tunnel at the Load Balancer in Amazon VPC? [migrated]

In other words, can the Amazon VPC load balancer be configured as an SSL Host? As a proof of concept, we've created this setup: Heroku Appserver <---> VPC Load Balancer <---> Ubuntu SSL ...
3
votes
4answers
20k views

how safe is the 256 bit encryption used in bank transactions

Most of the banks use a 128 bit or 256 bit encryption. What does this mean? Does it mean that the keys used in ssl are 128 bit long or what? If they are the ssl key lengths then 128 bit rsa keys are ...
0
votes
0answers
36 views

HTTPWebRequest over SSL gives intermittent error “The request was aborted: Could not create SSL/TLS secure channel”

I am using HTTPWebRequest to connect to Java rest services hosted in Tomcat Apache server. The endpoints are configured for HTTP as well as HTTPS. There are no issues connecting to HTTP endpoints, but ...
0
votes
1answer
265 views

Does an HTTPS proxy encrypt traffic between proxy client and server for HTTP requests?

To bypass censorship in a DIY fashion, I plan to set up private proxies for my personal use. One of the possible methods I would try is to use an HTTPS proxy (not a web proxy, to be explicit) hosted ...
12
votes
4answers
1k views

Downsides to using HTTPS [duplicate]

Recently Google has indicated that a HTTPS certificate will be used as a positive signal in it's search rankings. This has caused some discussion within our company as to if we should apply a HTTPS ...
0
votes
1answer
31 views

Does the SSL/TLS client certificate “hash over all previous messages” step hash the entire TCP packets or just data?

We have which uses TLS client certificates as it's authentication mechanism between client and server. There is an IT department which wants to run this app through a firewall/proxy device of some ...
1
vote
2answers
83 views

Does where I put my PKI certificates matter?

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were ...
1
vote
1answer
104 views

Apply SSL for domain that I do not own

As part of a project that my company is doing, we need to setup a development server. Let's say our company's main domain is example.com We need to be able to access the dev server through ...
1
vote
1answer
72 views

Authentication between two internal servers

I have two internal servers that are going to communicate with each other; they speak HTTP/TLS. Is there a best practice for authenticating communications between internal servers? Short of a best ...
1
vote
0answers
32 views

Android support for TLS 1.1

Do anybody know from what version of Android did TLS 1.1 started to be supported directly by the OpenSSL version preinstalled in the system?
0
votes
2answers
62 views

PKI certificate validation graphs, trees and cross signing

I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it ...
3
votes
2answers
252 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
2
votes
1answer
67 views

Does mixing different types of encryption make the connection more secure?

Like when I browse a website using SSL from my laptop that is connected to my router using WPA2. My router talks to my ISP using IPSec. Is that more secure or these types of encryption have nothing ...
5
votes
1answer
92 views

Are certificate authorities required to obey to the signature algorithm (hashing) specified in the CSR?

I was playing a little bit with signature algorithms, trying to determine which CAs among the ones I use are currently issuing SHA2 certificates. I generated a CSR specifying the SHA256 hash (either ...
1
vote
0answers
33 views

Is it fair to say that lack of client-authentication in TLS implies no requirement of non-repudiation?

In an https context, if a server does not send a CertificateRequest message, is there any other way it can require non-repudiation from the client?
1
vote
0answers
64 views

How do I force Firefox or any other browser to check for CRLs [migrated]

I am trying to see if I can watch the traffic that is sent and received when a browser checks for CRLs. All I can see with the latest version of Firefox is setting for OCSP. I dont see anything where ...
0
votes
1answer
161 views

Why is stackoverflow not using HTTPS for all it's page?

Most webpage from stackoverflow use http even if you are logged in. Isn't it a security issue? Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent ...
1
vote
1answer
41 views

Dump SSL traffic from a Java applet

I have a smartcard that can be read by websites using a Java applet (see http://www.springcard.com/online/applet_pcsc/). I would like to monitor and is to replay packets going from this java applet to ...
0
votes
1answer
47 views

HTTPS enable for proxy server or web server

Say I have 2 separated servers which are one web server (apache) and one proxy server (nginx), I want to use HTTPS for the website running on the Apache. Do I enable SSL on apache or nginx or both? ...
35
votes
7answers
3k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
1
vote
1answer
51 views

Entering payment information in Android Apps

I'm concerned how android apps that integrate payment processing deal with secure financial information.When purchasing through these apps the apps show the Webpage of the bank asking for credentials. ...
16
votes
3answers
2k views

Why can SSL certificates not be free of charge?

I am a newbie in this field. I am confused with why SSL certificates cannot be free of charge. In my understanding the certificate is just a text file consisting of cryptic numbers installed on a ...
2
votes
1answer
34 views

Is distinguished subject name at normal SSL Certificate issuance must same as generated Certificate Signing Request (CSR)?

For example: from Issued SSL Certificate: CN = abc.com.my, OU = Room, O = House, c= MY from generated CSR: CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY Questions: 1. Is it ...
1
vote
3answers
86 views

Not replacing SSL cert on a rebuilt, formerly rooted Unix Server

If a server was rooted, to the point that we know a Perl script which creates a remote shell was placed on the filesystem remotely, and the server was rebuilt entirely, patching the original Apache ...
1
vote
1answer
120 views

What is stopping me from replaying an SSL certificate?

Say I have the SSL certificate for google.com. I intercept it, edit the certificate with my own domain name and public key and use it to intercept all traffic to google.com. What mechanisms exist in ...
0
votes
1answer
52 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
2
votes
2answers
70 views

Will using a self-signed SSL certificate on a mail server hinder communication?

According to this ArsTechnica article, using a self-signed certificate on a mail server is a bad idea: When we set up a Web server in our previous series, getting SSL/TLS working was a ...
3
votes
1answer
668 views

Preventing spoofing of remote server with PHP & cURL

I'm writing a PHP script that is requesting confidential data from a remote server. I'm using cURL to get the remote server's certificate information (for its output, please see below). Which array ...
0
votes
2answers
89 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
3
votes
1answer
162 views

What is “Multi-Protocol Unified Hello” and what are the impacts of disabling/enabling it?

This article describes how to disable old versions of TLS, but in addition to doing so, "Multi-Protocol Unified Hello" is also disabled. # Disable Multi-Protocol Unified Hello md ...
2
votes
2answers
126 views

How to avoid session fixation (Login CSRF) by MitM attack without HSTS?

I'm writing a web app that already uses TLS encrypted connections (HTTPS), Secure; HttpOnly session cookie, HMAC-SHA1 CSRF token, requires correct Referer header to avoid Login CSRF and changes ...
1
vote
2answers
52 views

If TLS compression is not supported is a site still vulnerable to attacks such as BREACH?

I have read that BREACH was a side channel compression attack against TLS however focuses on HTTP response compression. If a site has disabled support for TLS compression does that still mean it can ...
2
votes
2answers
68 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
1
vote
1answer
46 views

BREACH attack and content length

I've been researching BREACH, and while I can understand how it might work if you have access to the the browser (to send crafted requests) and the wire (to capture compressed response length), I ...
20
votes
1answer
850 views

What is 'TLS version intolerance'

I'm trying to fully understand the report of the SSL Labs server test. Can someone explain the term 'TLS version intolerance'? I cannot find any documentation of this term, even not on the forums of ...
0
votes
1answer
47 views

Secure way to pass client certificate to the client2

Our product is comprised of two servers. We would like to authenticate one server to the main server by means of client certificate. I assume that we should ask the customers (who purchase the ...
-1
votes
0answers
48 views

Secure way to pass client certificate to the client [duplicate]

Our product is comprised of two servers. We would like to authenticate one server to the main server by means of client certificate. I assume that we should ask the customers (who purchase the ...