SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
1answer
13 views

Clarifications sought about SSL cert signing process

Currently I have a cert (signed with SHA1) expiring soon and I have extended its expiry incorporating SHA2 signing algorithm. I have done this by creating another CSR using certutil command with the ...
13
votes
4answers
977 views

What layer is TLS?

TLS stands for "transport layer security". And the list of IP protocol numbers includes "TLSP" as "Transport Layer Security Protocol". These two things would leave me to believe that TLS is a ...
1
vote
1answer
34 views

Is it possible to use obtained wildcard certificate on more than one server?

We are using two Debian servers in our company (with apache 2 as httpd) and our services are split between those two of them. One server has the website, the other has some minor sites under ...
3
votes
1answer
37 views

Security of OpenVPN against sophisticated DPI solution

I'm planing to build a device (prototype) that act as a portable security gateway. To make this, I choosed OpenWRT running on Raspberry Pi with OpenVPN for VPN connection. My main purpose of this ...
1
vote
2answers
26 views

Combinations of key exchange and signature algorithm in TLS

Let's say that one does not trust ECC a lot, and values confidentiality over authenticity (perhaps simply for the reason that MitM is more difficult than passive eavesdropping and decryption later ...
2
votes
0answers
54 views

Should Mozilla SSL3/RC4 whitelisted sites be blacklisted by admins/users? [on hold]

As of Firefox 39, Mozilla has dropped support for SSL3 and RC4... and whitelisted 519 (!) non-compliant sites: ...
-1
votes
1answer
59 views

What is the meaning of “www-ssl” in the URL https://www-ssl.intel.com/? [on hold]

While browsing INTEL website I came across the following link ...
4
votes
1answer
61 views

HPKP-based persistent denial-of-service attack on web sites

HTTP Public Key Pinning (HPKP) is a standard that allows a HTTPS website to specify which certificates it trusts, and instruct the browser not to allow any connection to that site that's secured by ...
1
vote
1answer
112 views

Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1

My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean): This site uses a weak security configuration ...
1
vote
1answer
48 views

How to know if certificate is self-signed

How do I find out if a certificate is self-signed or authorized by CA? Somewhere I read that self-signed subject and issuer will be same, is it correct?
3
votes
1answer
306 views

In SSL server handshake, does server also send CA certificate [duplicate]

In the TCP SSL sever handshake, does the server also send CA certificates? Does the server need to send all intermediate CA certificates in the Server Hello?
3
votes
1answer
5k views

Firefox:Secure connection failed(Error code:ssl_error_weak_server_ephemeral_dh_key)

A screenshot of the problem: Browser: Firefox 39.0 Is this a problem with my browser? How can I solve this?
7
votes
2answers
71 views

When did development on various TLS versions begin? [on hold]

What I'm looking for I'm looking for an approximation of the date that the development on each TLS or SSL version started (so the development start date). So I do not want to know the date when the ...
1
vote
2answers
43 views

Can Client Certificates be tied to a Specific Server Certificate?

I have a Root Certificate Authority and and Intermediate Certificate Authority. I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with ...
2
votes
2answers
47 views

Multiple Versions of SSL Signing Certificate

I was checking out the SSL chain on onlineaccess.ncsecu.org because a network glitch made me paranoid. Both Firefox and IE on my computer have this chain: onlineaccess.ncsecu.org Serial number ...
0
votes
1answer
29 views

Certificate validation Local DNS hosts file

I've a question regarding a certificate validation error I'm getting. I'm performing an https request from one machine to another (windows machines). On the destination machine I've configured a ...
1
vote
1answer
70 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
2
votes
3answers
60 views

In the context of SSL Labs where is the “trust store”?

When I'm testing a site with https://www.ssllabs.com/ssltest/ I'm getting this: Could you explain: Why are there two paths? Where do they come from, where are they configured? What is this "trust ...
0
votes
2answers
79 views

Could a compromised root CA impersonate any SSL certificate?

My question is about MITM attacks against https and how those would appear to the end user. Suppose a trusted root CA were compromised / coerced into producing fraudulent SSL certificates. What would ...
-1
votes
1answer
76 views

SSL and Fake Domain

I am reading information related to SSL handshake on the Internet. It seems like in the last step the domain name is compared to the domain in the certificate. How exactly is this protecting against ...
0
votes
1answer
26 views

How to verify SSL cerficate If restored session after session broken?

For example: User accessed to my web through SSL wih MYCERT. Suddenly hacker break this session, set proxy between user and my web . User connected again over restored session through HACKERCERT. How ...
3
votes
2answers
227 views

Should I be concerned at the lack for transparency by Microsoft which quietly added 17 root certs?

This week it was noticed that Microsoft apparently very quietly pushed out 17 new trusted root certificates (Infoworld Article). The lack of public announcement seems a bit strange. Is anyone aware ...
1
vote
1answer
32 views

What's RSA and ECC's role in TLS 1.2? [duplicate]

I'm trying to figure out what is RSA and ECC used for in TLS 1.2 cipher suites. Let's take TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 for example, communication between server and client would look ...
2
votes
4answers
244 views

Is it neccessary that website certificate must have site URL?

While working on a scenario, I got the error message "Server's certificates doesn't match the url". Is it necessary that the certificate given from the website must have its URL? Is it necessary that ...
2
votes
1answer
2k views

Asian websites don't use HTTPS [closed]

In America and Europe, HTTPS is quite popular, but in most Asian countries it isn't. The majority of China, Japan and Korea's top websites don't use HTTPS. Are they using another method to protect ...
-4
votes
1answer
46 views

Is it true that breaking into the https padlock settings on a web page is easy to do? [closed]

I found some posts on this forum that explained that https settings are possible to crack. see here. Why is it possible to sniff an HTTPS / SSL request? And here is another post that mentions ...
0
votes
1answer
33 views

Decrypting SSL traffic for Security Onion at or before the interface

I have Security Onion installed and doing full packet capture on my home network. I also have a firewall (pfSense) which does my routing. I have Security Onion sitting just behind my firewall and ...
0
votes
2answers
24 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
4
votes
1answer
86 views

Why is logjam rated as “None” for confidentiality impact in CVSS?

The CVSS score for Logjam is (AV:N/AC:M/Au:N/C:N/I:P/A:N). As noted in that nice dynamic image interpretation, the Impact metric "Confidentiality" is described as "None" (C:N). But the ...
1
vote
2answers
124 views

Why do some programming language API's not support private key passwords?

Two questions: I've recently started building a basic Go web-server, and noticed that the API for starting a TLS web-server does not support a symmetrically encrypted private RSA key. The API is ...
2
votes
1answer
42 views

Issue regarding installation of SHA256 scertificate

Can anyone help me with the installation of SHA256 certificate? I have generated the certificate perfectly but there seems to be an error below: Kindly let me know why am getting the exclamation ...
4
votes
0answers
253 views

Firebug and cURL [migrated]

I have been using Firebug and cURL for quite a while. Firebug is amazing to capture HTTPS POST request as opposed to a network analyser as it is aware of SSL/TLS negotiation. And cURL is amazing to ...
1
vote
1answer
28 views

What's the signature structure in TLS server key exchange message?

I'm writing a TLS server. While handling ECDHE-RSA cipher suite, the server key exchange is needed. According to Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) ...
2
votes
1answer
93 views

SSH like promiscuity for HTTPS

I want to build something, but I haven't seen it before. Maybe you have? I'd like to build a HTML5 app, served to modern browsers and phones from a microcomputer (e.g. BBB). The microcomputer would ...
0
votes
1answer
58 views

HTTPS and error code 503 [closed]

I tried to visit a HTTPS page and server responded with 503 response - currently unavailable. In address bar, there was an address of that Facebook page, but it was not HTTPS but HTTP, probably ...
0
votes
1answer
33 views

Beast attack and Qualys SSL test

If a server supports | SSLv3: No supported ciphers found | TLSv1.0: | ciphers: | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong | ...
1
vote
1answer
68 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
2
votes
0answers
15 views

Can I use different certifcates for www and Exchange? [migrated]

I have a website www.domainname.com and a published Exchange address of webmail.domainname.com The website is hosted offsite and the Exchange server is on-premises. I need extended validation for the ...
0
votes
4answers
125 views

Corporate PKI - is it an enterprise standard?

I've heard from one person that companies often issue own certificate for their internal usage. It's not signed by any public CA. And he says that it's an enterprise standard. I couldn't find any ...
1
vote
4answers
244 views

HTTPS: is the data downloaded when loading a page encrypted?

So as far as I know, when you go to a https enabled website, all the data you send to that server will be encrypted with their public key, and only the server holding the private key will be able to ...
2
votes
2answers
75 views

Why doesn't the client send data before server's response in TLS session resumption?

I'm referring to the Figure here. Since the client already knows the session key and only the authenticated server can decrypt the session ticket, why can't the client start sending encrypted ...
2
votes
2answers
78 views

Openssl ciphers: what does Au=ECDH mean?

I am trying to get a grasp on different stages of SSL. I have referred to some fantastic answers about how SSL/TLS works and specifically about authentication mechanisms, and numerous other sources. ...
1
vote
1answer
42 views

Influence of SSL Intercept on SSLVPN

We're considering implementing an SSL Intercept proxy in my organization. It will perform a SSL MITM to be able to inspect traffic. It will be a solution of a commercial vendor. It is clear that we ...
2
votes
3answers
234 views

Top banks using TLS 1.0

Am I vulnerable if my bank uses TLS 1.0? Is it easy for somebody to do a MITM attack? Should I just access their online banking at home where I assume it is safer to do so?
1
vote
1answer
72 views

How to determine if mail was encrypted during transport using the header information?

First things first: I know about the difference between end-to-end-encryption and transport encryption. Back to topic: I already read some things about how mail server handle transport encryption, ...
32
votes
3answers
6k views

Why do we still use the terms SSL and HTTPS? [closed]

Since TLS is preferred over SSL, why do we still use the terms SSL and HTTPS generally? The former could be anecdotal, but most people I speak to still say SSL in general conversation. The term HTTPS ...
1
vote
0answers
18 views

SSLException: Unsupported record version Unknown-84.84 [migrated]

I'm facing a weird issue on our server that happens intermittently not quite often (once a month) and can't figure it out. I've searched for this and found this thread which is pretty similar to my ...
1
vote
0answers
36 views

Metasploit reverse_http(s) PAYLOAD for linux target

During exploitation via metasploit's browzer_autopwn, I need to set a payload using http or https channel on a linux target. But there is no reverse_http(s) available in linux payload category. What ...
2
votes
2answers
34 views

HPKP and multiple SSL certificates

Some weeks ago, we enabled the HTTP Public Key Pinning header on our website. As per the specification, we included not only the SHA-256 fingerprint of our current RSA key, but also that of a backup ...
2
votes
1answer
50 views

Squid SSL Bump - getting “unknown issuer” despite having certificate, do I need CA?

I am using pfSense on the gateway of my network. I configured Squid and enabled the HTTPS filtering. I created the internal CA and configured Squid to use this internal CA for SSL Bump. Now the ...