SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
1answer
19 views

Which HTTPS certificate is the content verified by if the content comes from multiple servers?

If a webserver has an HTTPS certificate and a page on the server pulls resources from other webservers - maybe a CDN with a protocoless path, or not, for things like static images, stylesheets, and ...
0
votes
0answers
30 views

How to safely pass password reset token from http get request to html page?

I am working on implementing my own custom password reset that sends an email where the user is taking to a page to reset their password. So far I have generated a unique token that gets put in an ...
1
vote
1answer
31 views

Should I concatenate root certs

I am installing SSL cert and I am in doubt about should I concatenate site cert, intermediate cert and root cert or just site and intermediate cert ?
0
votes
0answers
30 views

HTTPS iFrame embedded in HTTP page - PCI implications?

I'm currently volunteering at a nonprofit. While researching something unrelated, I noticed that a $sisteragency was using an embedded iFrame to accept online donations. While the frame's source uses ...
4
votes
1answer
74 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
-1
votes
1answer
40 views

Same certificate but different private keys on different servers. Does this work?

We have a SAN cert that is used on multiple servers. Is it possible to have the cert re-keyed and only use the new private key on a particular server while keeping all of our other servers using the ...
7
votes
1answer
93 views

Is the order of cipher suites related to the client's preferences ?

I am wondering if the order in which the cipher suites appear (from top to bottom) in the ClientHello message, and the client preference are relevant. So for example in the picture I have attached, is ...
3
votes
2answers
69 views

Best practices to implement HTTPS in embedded devices

Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...
0
votes
1answer
47 views

How to verify the signature of DHE_RSA server parameters (TLS 1.2)?

By reading the TLS 1.2 specs I have been able to manually decrypt/encrypt pretty much all the steps of a TLS connection (DHE_RSA_AES_CBC_128_SHA cipher suite). One of things I am missing is how to ...
0
votes
2answers
72 views

Is open source a good option for cryptography libraries? [on hold]

I am trying to find good cryptography library to use with my project. I found open source options like openSSL and many more and also proprietory options like Intel Integrated Performance Primitives ...
2
votes
0answers
24 views

What are the risks of using an untrusted https connection? [duplicate]

Assuming the user realizes the connection is unsafe and doesn't send any secret data to the server, are there any risks of connecting to a website without a valid certificate using https? Does that ...
2
votes
1answer
83 views
+50

Authenticate tracking device with TCP server

I am building a tracking device and am looking for a secure authentication method to use when the device wants to establish a connection to the server. The server is a TCP server that we open a ...
3
votes
2answers
106 views

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few: https://superuser.com/questions/791015/https-over-private-network ...
0
votes
0answers
10 views

How do I update a verisign SSL certificate for a website running on Apache for windows server? [migrated]

The site has an SSL cert signed by verisign which expires in four days. Webserver is a windows server 2008 running Apache 2.2. There's an Apache2.2/conf/ssl/verisign folder that has all the certs ...
0
votes
2answers
31 views

One SSL Certificate for Client and Server Auth?

If I have a cert that has the usages: Server Authentication (1.3.6.1.5.5.7.3.1) Client Authentication (1.3.6.1.5.5.7.3.2) Is it possible that if a client accesses the server and was sent a copy of ...
3
votes
0answers
56 views

Secure a server on `localhost` such that only the authorized users can connect

Consider an application (such as an IPython notebook) that runs an HTTP server, and that (by design!) allows arbitrary code execution by authenticated users (this is the entire point of IPython, ...
1
vote
1answer
60 views

Why does Safari still support SSL 3?

The "POODLE" attack was made public in October, 2014. Why does Safari still support SSL 3.0 after POODLE showed it to be insecure?
1
vote
0answers
29 views

Client Side Encryption (CSE) across multiple clients

Working on 2 layer security in the cloud (AWS). Have multiple clients pushing files to S3 document storage which are then retrieved by one EC2 instance. Multiple external customers each requiring ...
0
votes
0answers
46 views

Can someone explain “two tries” in the CRIME attack on TLS

Ok, so I understand most of the attack, but when it comes to DEFLATE I'm not sure how two tries helps us get over the constraint that we see bytes where DEFLATE outputs bits. So basically, lets say ...
6
votes
3answers
1k views

Does HTTP Strict Transport Security (HSTS) make any sense in server to server communication?

We occasionally get findings for not having HSTS enabled on our HTTPS interfaces, but since these interfaces are server to server only, would enabling HSTS make any difference security wise?
1
vote
3answers
129 views

What SSL certificate do I need?

I have 2 domains, one where the website is hosted (lets call it www.a.com), and another (lets call it www.b.com) which has a CNAME record pointing to the first one (www.a.com). Which one should have a ...
3
votes
0answers
73 views

SSL certificate and price difference [closed]

After reading this discussion, Why are there very expensive and cheap SSL same type certificates? I surfed over the internet “Symantec Secure Site Pro with EV SSL Certificates”. I found something ...
1
vote
1answer
98 views

Chrome 50: Where can I see the negotiated cipher suite?

This is about Chrome 50. When visiting an https site, where can I find the negotiated cipher suite? I know where to find this info in previous versions of Chrome but I'm not able to find it in the ...
1
vote
1answer
44 views

How does Tor collect addresses of nodes?

My name is Alice and I would like to send a package to my beloved Bob. In order to avoid getting recognized by Bob I decide to send my message through several nodes. At each step, a node decrypts the ...
1
vote
2answers
25 views

Mandadory checks a client should make to verify a ssl/tls certificate [duplicate]

Let's say I have a client, not a browser, that wants to connect with https to a server. It could be a python program, an android app or a library etc. Suppose the client has a list of trusted CAs and ...
3
votes
3answers
90 views

SSL Certificate in my hosting makes me change my java code?

Sorry for my stupid question. But I really want to know what is gonna happen.. I have a webservice hosted over the http protocol. I wanna buy an SSL certificate to have my webservice hosting with ...
3
votes
1answer
39 views

What security impact is caused by a TLS server continuing the handshake when presented with an invalid SNI?

RFC 6066 defines Server Name Indication as an extension, whereby virtualised web servers may be given an SNI extension in order to know which certificate should be presented. It has the following to ...
32
votes
4answers
5k views

Can or should whitelisting replace encryption?

I've noticed that there is a third-party webservice we utilize programmatically at my job to transmit somewhat sensitive information and I was surprised to see that the endpoint was only using http, ...
31
votes
2answers
2k views

Can a SSL certificate have longer validity period than its parent in X.509 chain?

When a X.509 certificate chain is composed of X1, X2 ... Xn and Xn is root CA, Can a certificate in lower level have longer validity period than its parents? I think that lower level should be proper ...
0
votes
0answers
22 views

SSL config on Apache [migrated]

I have an Apache/2.4.18 server with OpenSSL/1.0.1s. I used the Mozilla SSL Configuration Generator to generate the SSL config: SSLProtocol all -SSLv3 SSLCipherSuite ...
2
votes
3answers
302 views

Does HTTPS allow replay attack on authentication request? [duplicate]

If I sent a username and the password to a website over HTTPS, is it possible that someone on the net would save this request and re-send it later to authenticate on the website?
1
vote
0answers
42 views

How to craft Invalid packet to test for TLS Poodle vulnerability?

I need to test if a server is vulnerable to TLS Poodle. To do this I need to send an invalid packet to the server and check if it closes the connection. But I am not sure how I create that packet ...
1
vote
1answer
34 views

OpenSSL certificate revocation check in client program using OCSP stapling 2

Pretty much this is request for additional information for the question: http://stackoverflow.com/questions/9607516/openssl-certificate-revocation-check-in-client-program-using-ocsp-stapling I want ...
6
votes
3answers
81 views

Can a TCP connection be terminated by an attacker if SSL/TLS has been used to protect data in the TCP segment?

I understand that SSL/TLS is built on top of TCP. That is after a TCP connection is established, an SSL handshake can be started. When it is completed, all communication will be encrypted and ...
1
vote
2answers
39 views

Is there a difference in security between an IP address white list and a domain white list with TLS?

It seems to me that an IP address white list relies on easily spoofed information, while a domain white list, if it forces TLS, at least, relies on the validity of the certificate systems. I may be ...
3
votes
3answers
42 views

Is it possible to prove that a TLS server key has changed?

I know of a site that is currently using SSLv2 and I'm refusing to connect to them until they Disable SSLv2 Re-key their servers I'm insisting on #2 because due to DROWN, servers running SSLv2 ...
13
votes
2answers
535 views

What is the difference between DH and DHE?

I have been reading Bulletproof SSL and TLS Diffie Hellman is a key exchange mechanism, in which each of server and client share secret i.e. g^x and g^y respectively with each other where g is ...
-3
votes
0answers
47 views

Can't use bitbucket any more. Your connection is not secure [migrated]

I've been using Bitbucket for 2 years on my Macbook. Today I went to view one of my depots but I am getting the error message, Your connection is not secure. All other sites works, it's only ...
0
votes
1answer
38 views

how to determine the cipher suites supported by a SERVER?

I somehow was not able to find an answer. I can see the ciphersuits supported by the client/browser on the wire, but server does NOT appear to advertise the ciphersuites it supports during the ...
1
vote
2answers
52 views

MITM my own SSL connections with e.g. wireshark - no proxy

I'd like to investigate some SSL (https?) traffic coming from one of my computers. The problem is that I don't know for sure which program it comes from, and I most likely can't make it use a proxy ...
0
votes
0answers
3 views

How to check if the .sig file is correct? [migrated]

I issued the following commands to create a signature for a file (linux kernel) : openssl req -newkey rsa -keyout codesign.key -out codesign.req openssl ca -config ca.cnf -extensions codesigning -in ...
1
vote
1answer
19 views

Extract X509 client certificates from TCPdump files

I have the following question: assuming I have a TCPDump file containing a number of HTTPS connections using TLS mutual authentication, is there a way to extract all client certificates sent to the ...
1
vote
1answer
43 views

Is it possible to utilize an outbound proxy to upgrade to TLS

Given a situation where legacy technology exists from a system and we don't want to do a complete upgrade (.net in this case w/ version that doesn't have any support for TLS 1.1/1.2) as the product ...
1
vote
0answers
26 views

TLS: Are the following considered 'weak' ciphers? [duplicate]

A customer I'm currently working with has reported the following as 'weak' cipher suites in use on a site: Accepted TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Accepted TLSv1.1 256 bits ...
3
votes
2answers
64 views

SSL browser session keys

I am trying to export/write the SSL master secret and keys to a file from the chromium browser. I would appreciate if someone could advice me how to do this. To write the premaster secret we can ...
1
vote
0answers
14 views

Authentication tag lengths of AES-CCM in TLS

I'm catching up on understanding some of the new cipher suites that are appearing in TLSv1.2 and will be making an appearance in 1.3. While looking through AES-CCM, I discovered that it offers a ...
1
vote
0answers
59 views

HTTPS: Same certificate, different public key

I have a web server, Debian, and the site uses a HTTPS cert from Thawte. The root certificate meant to be on top of my verification chain is also on the server, in /etc/ssl/certs, because the APT ...
7
votes
1answer
213 views

Why does Firefox claim that my connection to Google is insecure?

I keep receiving this message whenever I open any site from Google: My Firefox is up-to-date, and so my Windows 8.1. Since I don't know much about HSTS, I don't know what's going on, and obviously, ...
4
votes
1answer
64 views

Should 'openssl verify' recognise an exceeded 'Path Length' constraint on a root/intermediate CA?

Background Following the guides here and here I am setting up a multi-level PKI. I have increased the pathlen config to 3, such that I can generate one root certificate that I can use to sign the ...
4
votes
1answer
46 views

Are there “master keys” that can be used to generate valid SSL keys?

I was in a discussion about SSL, and I was explaining that it's impossible to decrypt data sent over SSL if you don't have the key. Someone responded with the following, that really confused me: ...