SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
2answers
34 views

Is TLS v1 really secure for VOIP and video calling?

Many applications are still using TLS v1 for video conferencing and VOIP calls. Is TLS v1 really secure for video and voice & video calling? or can some one can easily snoop your sessions with ...
1
vote
1answer
24 views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
2
votes
1answer
34 views

Is it safe to enable SSLv2 ClientHello support?

In the wake of the POODLE attack, many web sites have dropped support for SSLv3. But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello ...
1
vote
1answer
43 views

How to filter secure (HTTPS) websites by URL with regular expression?

I need to block access to certain pages on a website using regular expression and/or wildcard. The site uses https and therefore cannot be blocked using regular parental control filters (this is ...
3
votes
3answers
62 views

Why does Windows have a place to store intermediate SSL certificates?

As I understand the process of verifying a remote computer's SSL certificate, the remote system sends its 'leaf' certificate and any intermediate certificates, but not the root certificate. Executing ...
0
votes
2answers
41 views

Preventing SSL strip attack

Is it possible to detect a ssl strip attack by checking whether the page deliverd is https or http using javascript?I am assuming that the response page is https page instead of http?
-1
votes
0answers
10 views

TLS 1.1 android 4 support [on hold]

Before Android 4.1 we couldn't add TLS 1.1 or more precisely tls pinning. IS there anyway to make android use TLS 1.1 for version before android 4.1
5
votes
3answers
119 views

Does TLS_FALLBACK_SCSV provide blanket protection against downgrade attacks?

The TLS_FALLBACK_SCSV flag was touted as a way to prevent POODLE, which abused the potential to downgrade to SSLv3 from TLS. Does the implementation of this flag prevent similar downgrade attacks ...
3
votes
1answer
49 views

Different SSL cert behavior with Chrome on desktop vs. Chrome on iOS

We have a website, https://uk.care.com, that has a GeoTrust multi-SAN cert on it. The cert is up-to-date, using SHA-256, TLS 1.2, etc. When we view the site in Chrome on various desktop systems it ...
1
vote
1answer
26 views

HTTPS in captive portals and the Apple Captive Network Assistant

Suppose I connect to the Wi-Fi of a company I trust enough to give them my credit card number (say, my local airport). When I connect to their Wi-Fi network, my web browser gets redirected from any ...
10
votes
2answers
1k views

How to Check if a server is not vulnerable to logjam?

In response to Logjam I want to prove I hardend my services. I know that the DH param has to be 2048 bits atleast and self generated. but I am unable to find a way to actually check this for something ...
5
votes
3answers
310 views

Does the recommended course of action for preventing Logjam on Tomcat servers really eliminate all risks of weak DH keys?

Can anyone verify this fix secures against the Logjam vulnerability for Apache Tomcat? I'm sceptical about it's effectiveness, since it doesn't mention how to implement the user defined 2048 bit DH ...
0
votes
2answers
79 views

Website using http and https

Is there any method to know whether a website is https only or uses http webpages as well?Can it be done without using browsers cache?
1
vote
2answers
45 views

SSL/TLS client authentication - practical client cert validation

How do real HTTPS servers validate client certificates? My context is business-to-business rather than regular human clients. I understand basic chain validation to a trusted root CA cert. But do ...
13
votes
1answer
2k views

PayPal encrypted with obsolete cryptography

My Chrome just complained from PayPal's security, similarly to this issue: Google Chrome "Your connection to website is encrypted with obsolete cryptography" The identity is verified, but ...
57
votes
3answers
6k views

What is Logjam and how do I prevent it?

I heard there is a "new" TLS vulnerability named Logjam, what does it do and how do I prevent it?
-1
votes
1answer
28 views

SSL certificate [closed]

I am in the process of renewing my Domain SSL certificate, but I get this error message about a key duplicate error when I enter my CSR? I think it might have something to do with the fact I generated ...
1
vote
0answers
42 views

PCI DSS Vulnerability Scan failed [closed]

I'm having some problems fixing two Vulnerability's that keep failing the PCI scan. The scan is failing on BEAST attack ports 443 and 25. I've followed a few articles and over the past week got the ...
2
votes
3answers
94 views

How do I deal with browsers complaining that my MediaWiki website has unsecure resources? [closed]

I recently bought a subscription to a NameCheap shared hosting plan, and I plan to primarily run MediaWiki on it. I've managed to setup everything fine except for the SSL encryption. When I visit my ...
2
votes
2answers
61 views

Is there a Cipher Suite which is only “good” when used with HTTPS, but not “good” with other protocols?

Some attacks (e.g. BEAST, CRIME) are only effective against HTTPS. Are there any cipher suites which are only "good" when in use over HTTPS? Is there any "good" HTTPS cipher suites (i.e. ...
1
vote
2answers
68 views

two factor authentication without TLS/SSL

It seems silly to ask about using two-factor authentication without TLS/SSL but, I have a vendor that is using public IP without TLS and asking for login creds. Would the login be more secure if ...
0
votes
3answers
86 views

Disadvantages of disabling RC4 in SSL/TLS [closed]

Other than requiring more server resources, are there any disadvantages of disabling RC4 from being using by an Apache webserver? My primary concern is preventing access from older browsers.
2
votes
1answer
39 views

Why does SSL/TLS MAC the Master Secret?

At the end of the SSL handshake both the client and server send a MAC over all previous messages and the master secret. However, why do we need to MAC the master secret? The master secret is computed ...
1
vote
1answer
20 views

SSL connection between MySQL, Apache and the User's device

I set up SSL connection on my apache web server and I just would like to find out is it enough to secure my connection between the MySQL server, the apache web server and the user's device. Because I ...
1
vote
0answers
34 views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
6
votes
3answers
189 views

Why does the SSL/TLS handshake have a client and server random?

In the SSL handshake both the client and server generate their respective randoms. The client then generates a pre master secret and encrypts it with the server's public key. However, why can't the ...
12
votes
5answers
652 views

Creating my own CA for an intranet

I need to create my own CA for an intranet and unfortunately it seems there's no good answer about this on Security.SE. There are many resources online about this, but all of them are different and ...
1
vote
1answer
39 views

Using a minimal set of certificate authoraties

It been known for quite a while now that SSL is more of a security-illusion than a real one. As it's not completely useless, and there's no real alternative at moment (though convergence looks ...
1
vote
1answer
58 views

Intercept https traffic [duplicate]

Is it possible for a packet sniffer such as wireshark to be able to decrypt the traffic generated by a https connection from a browser ? I do not have control of the server, but I have control of the ...
1
vote
1answer
37 views

Does a TLS-connection to a proxy-server encrypt the destination url's?

If I use a browser through a proxy-server over a secure connection (i.e. the proxy is HTTPS) - does that mean that everything is encrypted, or just the page returned from the site? And who does the ...
2
votes
1answer
55 views

SSL Decryption why is the root CA certificate required on clients?

Maybe a quick question. We have Palo Alto's that perform SSL Decryption using a sub CA certificate issued by our internal Root CA. This is working for our internal windows domain computers as the root ...
1
vote
0answers
22 views

How to correctly secure Reverse Proxy communication with actual server in LAN [migrated]

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
0
votes
0answers
59 views

Apache server chooses TLS1.2 for all request even when TLS1.2 is disabled in IE9 / Windows7 [migrated]

Following is my apache ssl protocol and cipher configuration SSLEngine on SSLProtocol all -SSLv2 SSLCipherSuite HIGH:MEDIUM:-SSLv2:!ADH When tested on IE9 with TLS1.2 checkbox checked in ...
3
votes
1answer
69 views

IoT Devices and 39 Month TLS Certificate Life

I develop IoT (Internet of Things) devices on small embedded systems, where it is very difficult to update the local certificate once they have been deployed. It really needs to be avoid if it can. ...
0
votes
1answer
44 views

HSTS implementation [closed]

I have a little doubt on using HSTS, as per this video, once HSTS is implemented , all the URLs will be going in HTTPS, but as we all know in using SSL we need pre-specified encryption algorithms and ...
10
votes
2answers
904 views

How are digital certificates compared?

I have read about SSL and TLS; I know how RSA works and why digital certificates are necessary (more or less), but I am curious about how we prevent a fake digital certificate. The operating system ...
0
votes
1answer
62 views

SSL certificate appending

On my Linux server I have a keystore which contains SSL certificates and these certs are going to expire in 20 days. Before expiry of old certs, I have installed new SSL certificates to avoid any ...
1
vote
1answer
47 views

PKCS7 vs TLS 1.2 padding

Can anyone explain why there is a difference between padding claimed in PKCS7 https://tools.ietf.org/html/rfc2315 Page 22 - which is 01 02 02 03 03 03 ... and padding used in TLS 1.2 ...
5
votes
1answer
69 views

Sites are signed with an incorrect VeriSign Class 3 G5 CA

Previously today, I encountered a SSL error trying to access twitter.com in Chrome. Investigating the issue, I encountered the same error accessing discussions.apple.com. Most other HTTPS sites were ...
3
votes
1answer
45 views

Does mutual authentication have any impact on MiTM possibilities?

When doing a Man-in-the-middle attack against a classic one-way authentication server, the attacker just have to: Use a certificate credible enough to be trusted by the victim, Act as a standard ...
0
votes
1answer
56 views

HTTPS - Can server see details of client side certificate?

I am using mitmproxy to intercept HTTPS connections from my client device to a third party server. In order for mitmproxy to intercept SSL requests, I need to install a trusted root certificate on my ...
0
votes
0answers
24 views

How to force a server to use a specific elliptic curve at the beginning of the handshake via openssl? [migrated]

Is there a possibility or command in openssl to force a server to use a specific elliptic curve that I am requesting with a certificate or key? Can I "ask" the process the curves it is able to use?
0
votes
2answers
51 views

How much of a certificate is actually covered by the CA's signature?

One of my devs recently had an issue with the compatability of a certificate, and we rooted around for a bit until we came across a a similar problem on SO. Once I understood the developer's initial ...
1
vote
1answer
51 views

Possible to use custom SSL or TCP/IP packets to detect VPN use?

What custom TCP/IP packets or other statistics can I use to detect VPN usage? I understand that this may generate a number of false positives, but my goal is to focus analysis on certain types of ...
3
votes
1answer
42 views

How to detect whether a CA used EV for a certificate using openssl

I want to download the certificate of a particular hostname and detect whether the CA used EV (extended validation) when issuing it. So far I was not able to find anything that identifies certificates ...
0
votes
1answer
26 views

Tomcat Client authentication

I want to make sure that my webapp is secured: I have a tomcat server - and defined the connector to use clientAuth="true". In my trust store there is only the certificate of my CA (self signed). ...
15
votes
9answers
551 views

How does SSL/TLS PKI work?

We have lots of questions that address portions of SSL/TLS as it relates to PKI, but none of them seem to bring everything together. A canonical answer that we can point people to I think would be ...
1
vote
1answer
76 views

How is the username and password captured on this mobile device?

I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html The poster says: For both of these ...
1
vote
1answer
53 views

Private CA and client server authentication

I have a private application - that has one server and many clients and I want to use two way authentication(AKA client auth) I use Tomcat server and java keytool to create TLS certificates. If I ...
0
votes
0answers
29 views

Can Web Proxy Autodiscovery leak HTTPS URLs?

The WPAD protocol can in some circumstances allow an attacker to get clients to use a malicious PAC script. It appears to be well documented, that this can be used to perform MITM-attacks on HTTP ...