SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

3
votes
2answers
40 views

How to secure communications between a web front-end and the web server when/where the HTTPS protocol is compromised?

A country in the Central Asia has issued a law enforcing all the ISPs to decrypt the transit HTTPS traffic and encrypt it with a special certificate issued by the government. Every client is to ...
1
vote
1answer
24 views

How to implement the fix for Forward Secrecy on Debian Apache OpenSSL?

My SSL test result was an A- due to forward secrecy. I want to know how to implement the fix mentioned on this page here: https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy ...
0
votes
0answers
19 views

How TLS exchange key to prevent Man In Middle Attack and sniffing? [duplicate]

I am using an SSL socket in my Qt program and implemented all requirments such as (public-key and private-key files), related libraries, and so on. Now I want to use of TLS protocol to transfer ...
1
vote
1answer
21 views

Dealing with a misconfigured corporate SSL certificate

I work at an organization that inspects all HTTPS traffic by injecting its own SSL certificates. It wasn't configured properly though, so Firefox always shows a "Your connection is not secure" error ...
1
vote
1answer
21 views

Login to social Media using Facebook Connect

I came here with a struggle issue. We run a social media website, where people can register by classical login (might be his email or his username) and password form but also using a Facebook Connect. ...
1
vote
3answers
38 views

Is EV green extended validation slower than a regular SSL?

How does EV green extended validation SSL certificate affects the speed of my web site (if at all) comparing to a regular SSL? Also, my provider only allow the EV green certificates to be on the root ...
1
vote
2answers
49 views

How important is it to use a large encryption key for SSL certificate?

I'm trying to figure out which size of encryption key should I use for my SSL certificates (2k, 4k?) Is a 2k key "sufficient"? is it crackable...? and if so, is a 4k key not crackable? Also, how ...
2
votes
2answers
45 views

Is it possible to use more than one certificate on the same server at the same time? [duplicate]

Is it possible to use more than one certificate on the same sever at the same time, on the same connection? If I have a certificate from Alice Keys CA and another from Bob Security CA, is it possible ...
17
votes
5answers
2k views

Who is responsible for revoking a certificate?

The CA issues certificates to clients/servers. Whenever a request is made by the client/server, the certificate is used to verify the identity. Now, if a certificate needs to be revoked then who does ...
1
vote
1answer
72 views

What website accepts only TLS 1.2 so I can verify client capability?

Is there a publicly accessible website which will only accept TLS 1.2 connections so that I can test to see if my application can successfully, securely connect to it? Background: I have an old VB....
1
vote
0answers
38 views

Certificate based Access Control for Pub Sub messaging

I'm extending an existing p2p/master Pub Sub framework to support additional security measures, via over the wire encryption and topic based access control. I'd like to use the x.509 certificates that ...
0
votes
1answer
76 views

Is SSL not enough for a secure chat?

I was going through SSL/TLS article on wikipedia. It turns out that it provides key setup, encryption as well as authentication. The question is "isn't this enough to make a secure messaging/chat ...
3
votes
2answers
148 views

Verify my own self signed SSL certificate

I have generated my own SSL certificate for a web server on the internet, however this was for three reasons: Fun Not wanting to buy an SSL certificate Trying to get an A rating (excluding trust ...
0
votes
0answers
28 views

Generating a cert for use to digitally sign an email

I am having some issues generating certs, past a certain point. So far, I have done the following to generate a CSR, and have obtained an intermediate cert from the provider, and another CRT file. I ...
0
votes
1answer
32 views

Downloading a new SSL pinned certificate insecure?

I want to make a mobile app secured with SSL pinned. The problem I know I will have is if the certificate expires. My possible solution would be downloading a certificate from my server from time to ...
0
votes
0answers
12 views

Mutual authentication between devices [on hold]

I have clear understanding of mutual authentication and I'm now trying to implement it just for testing purposes. Here is my scenario: I have a Linux machine A which acts as a self-signed CA. Now ...
1
vote
0answers
61 views

Risks of using UUID to identify user in mobile app

I've got an existing customer base. A customer has appointments. Currently they cannot access or change their appointments without contacting me directly. I want to offer them a way to access and ...
28
votes
2answers
3k views

Why do web sites show my iPhone using different IP addresses for HTTP and HTTPS (cellular only)?

While testing a recent adtech integration I noticed something I can't explain. The iPhone uses two IP addresses. Seemingly one for HTTP and one for HTTPS. To further confuse things it only happens ...
3
votes
1answer
56 views

Can a .DER be converted to a .PFX / .P12 ?

Burp-Suite's http://burp/cert:8080 web-interface for downloading the CA Certificate only provides a .der encoded certificate, but for a particular use-case scenario I require a PKCS#12 .pfx/.p12. I ...
4
votes
0answers
124 views

HTTPS Cipher selection considerations [closed]

I went through various online docs, e.g. SSL and TLS Deployment Best Practices, regarding the "right" selection of cipher suites for a website. The attached picture shows my selection of cipher suites ...
0
votes
1answer
39 views

Use elliptic curves certificate only if client support them

Is it possible to send an EC certificate to a client if it supports it or send a regular certificate if it doesn't?
3
votes
1answer
48 views

Server closed connection error on several browsers when testing SSL

I have uploaded a SSL Certificate to my site www.walksindorset.co.uk. When I test the SSL rating I receive the error message "Server closed connection" on over 15 browsers which includes Andriod 4.0....
0
votes
0answers
25 views

ldaps on Debian Jessie with let's encrypt certificate [migrated]

I'm already struggling for a while to set up an LDAP-Server on debian Jessie with enabled TLS. I'm new to the topic, so please show me my mistakes. I started by installing an reconfiguring slapd apt-...
0
votes
1answer
71 views

Vicious circle with certificates - how to trust the server cert?

I have a java app on Android that needs to be able to communicate with a web server over ssl using an client x509 certificate (for encryption negotiation) - the private key is in the java keystore ...
5
votes
2answers
82 views

Passive fingerprinting of HTTPS client

Is it possible to passively fingerprint a HTTPS client, based solely on data visible to a network eavesdropper? In other words, consider a network monitoring box that can see all the packets (but ...
0
votes
1answer
46 views

Buy Two sub domain SSL Certificates from different SSL providers for same main domain

I would like to know, is it possible to buy a sub domain SSL cert from different provider if other sub domains SSL are already registered with another provider for example GoDaddy. Forexample I have ...
1
vote
1answer
61 views

What causes the descriptive text in HTTPS lock icons? [duplicate]

Some websites have descriptive text next to their lock icon. While many other websites (like Google) simply display a simple green lock icon. What causes this? And does this text have a special ...
5
votes
1answer
90 views

Why do Chrome and OpenSSL disagree over signature algorithm?

$ openssl version OpenSSL 1.0.2h 3 May 2016 $ openssl s_client -connect winkel.vpro.nl:443 < /dev/null 2>/dev/null | openssl x509 -text -in /dev/stdin | grep -i sha Signature Algorithm: ...
5
votes
1answer
67 views

Accepting Avast Antivirus MITM certificate “securely”

I have a multiplatform client plugin that has its own trust store (ie this client app does not trust the OS trust store) that is used to talk to a webservice over TLS. Clients that have Avast ...
-1
votes
0answers
23 views

Client-initiated renegotiation on Apache httpd.conf

During testing we have found that one of our servers has this vulnerability and can any one of you let me know how to fix this issue. We use Apache 2.X version. Is there any variable which can be set ...
1
vote
1answer
73 views

Does the HTTPS protocol consume a lot of CPU time?

If every TLS message has to be encrypted / decrypted by both hosts involved in the secure connection, is this consuming a lot of CPU time?
2
votes
1answer
32 views

TLS DSA signature inputs

Each TLS1.0 implementation must support the use of the TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA cipher suite. This cipher suite dictates that the server must send a ServerKeyExchange message with the ...
1
vote
1answer
79 views

TLSv1: Reason for client not sending client certificate

Our BizTalk installation consists of two load balanced nodes B1 (10.137.10.1) and B2 (10.137.10.2) which process and route incoming SOAP messages. The processing is nothing more than: sending the ...
1
vote
1answer
67 views

Browsers and SSLv3 End-of-Life

Is there a point in time at which browsers will refuse to connect to web servers that support SSLv3 in addition to TLS 1.0/1.1/1.2? Will they produce warnings? I assume the browser would be content ...
1
vote
1answer
34 views

Is it possible to DNS-spoof Exchange ActiveSync?

My company's SSL Certificate for basically all their websites and Activesync servers have expired long ago. For my upcoming meeting's sake I need to explain how this is very insecure. Unfortunately I ...
6
votes
3answers
2k views

Isn't HTTPS insecure over a hacked router? [duplicate]

I have heard that a hacker can become a proxy using the router your device is connected to and send his own public key to you instead of you getting the server's public key - which the browser will ...
3
votes
1answer
55 views

The use of DES-CBC3 for TLS

When researching some TLS compliant software I found some mentions of DES-CBC3. Further research shows that it is probably simply a name of OpenSSL for 3DES-EDE-CBC (under section "CIPHER SUITE NAMES" ...
3
votes
2answers
125 views

How to tell if a SSL cert is 128 bit or 256 bit?

My cert is: Key Length = 2048 Signature algorithm = SHA256 + RSA So is it a 256 bit SSL cert?
3
votes
2answers
92 views

Should I use websockets (ws) or secure websockets (wss) for my game?

I'm making a game and I'm using websockets for 99% of communication. The only http(s) is on initial page load and when logging in/registering. I'm a complete noob so correct me if I'm wrong, but SSL ...
9
votes
2answers
528 views

Why SSL uses a third party (certificate authority) yet SSH does not [duplicate]

SSL operations require the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client. SSH on the other hand relies on the client having the ...
1
vote
2answers
99 views

Understanding blacklisted ciphers for HTTP2

I've been working on get HTTP2 support running on an Nginx server for some time now. At this point I'm stuck at selecting ciphers to support. Hopefully you can help me understand this. Before I ...
1
vote
0answers
26 views

Does Rabbitmq support Elliptic Curve Encryption? [migrated]

I am using rabbitmq for chat. I have already installed the ssl on machine, which work fine for Android platform, but iOS broker not able to establish connection with machine and always show SSL ...
-2
votes
1answer
63 views

SSL Server-side certificate on client computer? [closed]

There is a server with WCF client, which periodically initiates communications over internet with many WCF services installed on our clients computers. WCF services and WCF clients are hosted in ...
0
votes
0answers
44 views

My school is making everyone install a SSL certificate. Will my VPN still work? [duplicate]

My public highschool is having everyone with a non-school rented device install a SSL certificate provided by Securely. Nothing has taken place yet but they threatened that personal laptops without ...
1
vote
1answer
100 views

Why is CAcert not trusted by my browser?

I am fairly new to encryption and SSL. Today I googled a bit (read some atricles about security) and encountered the site https://cacert.org. I clicked it and was surprised. Chrome showed me a "not ...
2
votes
2answers
62 views

DROWN vulnerability on root domain affect subdomains?

I maintain a departmental server hosted on a subdomain of my organizational network, as in department.example.com. Both example.com and department.example.com use HTTPS, but run on completely ...
1
vote
0answers
44 views

Are there any benefits in using VPN service for application with SSL pinning?

I understand how using a public VPN service can make network connectivity more secure in case of HTTP, or even HTTPS a without certificate pinning in place. Suppose we have a fat client application ...
0
votes
2answers
20 views

Reconcile IMAP4 RFC with No RC4 RFC

RFC 3501 states: IMAP client and server implementations MUST implement the TLS_RSA_WITH_RC4_128_MD5. RFC 7465 states: o TLS clients MUST NOT include RC4 cipher suites in the ClientHello ...