SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
0answers
23 views

Should I be concerned at the lack for transparency by Microsoft which quietly added 17 root certs?

This week it was noticed that Microsoft apparently very quietly pushed out 17 new trusted root certificates (Infoworld Article). The lack of public announcement seems a bit strange. Is anyone aware ...
1
vote
1answer
20 views

What's RSA and ECC's role in TLS 1.2? [duplicate]

I'm trying to figure out what is RSA and ECC used for in TLS 1.2 cipher suites. Let's take TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 for example, communication between server and client would look ...
0
votes
3answers
223 views

Is it neccessary that website certificate must have site URL?

While working on a scenario, I got the error message "Server's certificates doesn't match the url". Is it necessary that the certificate given from the website must have its URL? Is it necessary that ...
1
vote
1answer
2k views

Asian websites don't use HTTPS [on hold]

In America and Europe, HTTPS is quite popular, but in most Asian countries it isn't. The majority of China, Japan and Korea's top websites don't use HTTPS. Why don't they use HTTPS? EDIT: Are they ...
-4
votes
1answer
38 views

Is it true that breaking into the https padlock settings on a web page is easy to do? [on hold]

I found some articles online that explained that https settings are easy to crack. If this is true, is there no way for us to keep our browsing private? I use Tor and used to have JonDo before it ...
0
votes
0answers
21 views

Decrypting SSL traffic for Security Onion at or before the interface

I have Security Onion installed and doing full packet capture on my home network. I also have a firewall (pfSense) which does my routing. I have Security Onion sitting just behind my firewall and ...
0
votes
2answers
22 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
3
votes
1answer
45 views

Why is logjam rated as “None” for confidentiality impact in CVSS?

The CVSS score for Logjam is (AV:N/AC:M/Au:N/C:N/I:P/A:N). As noted in that nice dynamic image interpretation, the Impact metric "Confidentiality" is described as "None" (C:N). But the ...
1
vote
2answers
116 views

Why do some programming language API's not support private key passwords?

Two questions: I've recently started building a basic Go web-server, and noticed that the API for starting a TLS web-server does not support a symmetrically encrypted private RSA key. The API is ...
2
votes
1answer
38 views

Issue regarding installation of SHA256 scertificate

Can anyone help me with the installation of SHA256 certificate? I have generated the certificate perfectly but there seems to be an error below: Kindly let me know why am getting the exclamation ...
4
votes
0answers
253 views

Firebug and cURL [migrated]

I have been using Firebug and cURL for quite a while. Firebug is amazing to capture HTTPS POST request as opposed to a network analyser as it is aware of SSL/TLS negotiation. And cURL is amazing to ...
1
vote
1answer
25 views

What's the signature structure in TLS server key exchange message?

I'm writing a TLS server. While handling ECDHE-RSA cipher suite, the server key exchange is needed. According to Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) ...
2
votes
1answer
91 views

SSH like promiscuity for HTTPS

I want to build something, but I haven't seen it before. Maybe you have? I'd like to build a HTML5 app, served to modern browsers and phones from a microcomputer (e.g. BBB). The microcomputer would ...
0
votes
1answer
58 views

HTTPS and error code 503 [on hold]

I tried to visit a HTTPS page and server responded with 503 response - currently unavailable. In address bar, there was an address of that Facebook page, but it was not HTTPS but HTTP, probably ...
0
votes
1answer
30 views

Beast attack and Qualys SSL test

If a server supports | SSLv3: No supported ciphers found | TLSv1.0: | ciphers: | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong | ...
1
vote
1answer
58 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
2
votes
0answers
15 views

Can I use different certifcates for www and Exchange? [migrated]

I have a website www.domainname.com and a published Exchange address of webmail.domainname.com The website is hosted offsite and the Exchange server is on-premises. I need extended validation for the ...
0
votes
4answers
124 views

Corporate PKI - is it an enterprise standard?

I've heard from one person that companies often issue own certificate for their internal usage. It's not signed by any public CA. And he says that it's an enterprise standard. I couldn't find any ...
1
vote
4answers
239 views

HTTPS: is the data downloaded when loading a page encrypted?

So as far as I know, when you go to a https enabled website, all the data you send to that server will be encrypted with their public key, and only the server holding the private key will be able to ...
2
votes
2answers
73 views

Why doesn't the client send data before server's response in TLS session resumption?

I'm referring to the Figure here. Since the client already knows the session key and only the authenticated server can decrypt the session ticket, why can't the client start sending encrypted ...
2
votes
2answers
73 views

Openssl ciphers: what does Au=ECDH mean?

I am trying to get a grasp on different stages of SSL. I have referred to some fantastic answers about how SSL/TLS works and specifically about authentication mechanisms, and numerous other sources. ...
1
vote
1answer
41 views

Influence of SSL Intercept on SSLVPN

We're considering implementing an SSL Intercept proxy in my organization. It will perform a SSL MITM to be able to inspect traffic. It will be a solution of a commercial vendor. It is clear that we ...
2
votes
3answers
230 views

Top banks using TLS 1.0

Am I vulnerable if my bank uses TLS 1.0? Is it easy for somebody to do a MITM attack? Should I just access their online banking at home where I assume it is safer to do so?
1
vote
1answer
69 views

How to determine if mail was encrypted during transport using the header information?

First things first: I know about the difference between end-to-end-encryption and transport encryption. Back to topic: I already read some things about how mail server handle transport encryption, ...
32
votes
3answers
6k views

Why do we still use the terms SSL and HTTPS? [closed]

Since TLS is preferred over SSL, why do we still use the terms SSL and HTTPS generally? The former could be anecdotal, but most people I speak to still say SSL in general conversation. The term HTTPS ...
1
vote
0answers
18 views

SSLException: Unsupported record version Unknown-84.84 [migrated]

I'm facing a weird issue on our server that happens intermittently not quite often (once a month) and can't figure it out. I've searched for this and found this thread which is pretty similar to my ...
1
vote
0answers
33 views

Metasploit reverse_http(s) PAYLOAD for linux target

During exploitation via metasploit's browzer_autopwn, I need to set a payload using http or https channel on a linux target. But there is no reverse_http(s) available in linux payload category. What ...
2
votes
2answers
29 views

HPKP and multiple SSL certificates

Some weeks ago, we enabled the HTTP Public Key Pinning header on our website. As per the specification, we included not only the SHA-256 fingerprint of our current RSA key, but also that of a backup ...
2
votes
1answer
43 views

Squid SSL Bump - getting “unknown issuer” despite having certificate, do I need CA?

I am using pfSense on the gateway of my network. I configured Squid and enabled the HTTPS filtering. I created the internal CA and configured Squid to use this internal CA for SSL Bump. Now the ...
1
vote
0answers
15 views

HPKP and Elliptic Curve certificates

There is quite some information on the web on how to extract the base 64 encoding of the SHA-256 fingerprint (which is needed for the Public Key Pinning header) for RSA certificates (e.g. by Mozilla). ...
1
vote
1answer
58 views

HTTP status 302 and subsequent redirect

I have sent a HTTP GET request to google.com and I get a 302 status. Now the location : url in http header is an http:// address, instead of https. When the browser visits this address I get back a ...
2
votes
0answers
45 views

Should I force Thunderbird to avoid RFC5746 and CVE-2009-3555 security bugs?

I see that the latest version of Thunderbird (38.0.1) still has the defaults set to ignore the error. Is this a big problem? Should I change the defaults to enforce greater security? Here is ...
-1
votes
1answer
78 views

How can you check and analyze SSL ports other than 443? [closed]

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
1
vote
1answer
36 views

SSL cert vs public-key authentication

If SSL/TLS uses a pre-created certificate why does it also use public-key ciphers such as RSA and ECDSA for authentication (I do not mean MAC integrity)? Are they related?
1
vote
1answer
37 views

Certificate authority has changed for personal website - but I haven't changed anything?

I have the Certificate Patrol addon (website) installed in Firefox. While I mostly ignore the (far too many) warnings, today I saw that the certificate authority for my personal website has changed. ...
0
votes
0answers
46 views

What is the cheapest kind of SSL cert I need for multiple sites on multiple servers? [duplicate]

Quick SSL question What is the cheapest kind of ssl cert I need? I have two servers, one windows vps with a static IP and another linux reseller with 2 domains attached and a shared IP. Ideally ...
2
votes
2answers
152 views

Chrome status warning on a netbanking secure site connection [duplicate]

I visited my bank's web banking site and clicked on the Green Lock in the address bar of my Google Chrome browser out of curiosity. Under the "Connections" tab Chrome spits out this disturbing ...
1
vote
1answer
79 views

Should I use SSL only on my admin subdomain?

I have a site at mydomain.com. Users can sign up there to create a simple little site of their own that gets automatically created and can then be found at mydomain.com/name-user-chose There is an ...
3
votes
3answers
165 views

Why do so many banks have relatively weak e-banking security? [closed]

I follow a few infosec-related Twitter personalities: Paul Moore, Taylor Swift, Troy Hunt are the main 3. Paul Moore is currently in the process of switching banks, frequently tweeting and retweeting ...
1
vote
1answer
34 views

What are the risks associated with relying on Mutual SSL & IP Filtering?

We are thinking of implementing Mutual SSL combined with IP Filtering because we are unable to setup a vpn within our external client. What are the risks associated with using Mutual SSL combined with ...
1
vote
0answers
41 views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
1
vote
1answer
53 views

Nginx - SSL Website shows up on desktop but not mobile

So I bought a Comodo SSL from Namecheap and put my site up on a Ubuntu droplet on DigitalOcean on a nginx server. My default virtual host file on /etc/nginx/sites-available/: server { listen ...
1
vote
0answers
29 views

Potential hazards for reusing an X.509 private key for multiple services?

One thing I've been thinking about for a while is using a X.509 private key stored in a hardware security device (think YubiKey et al) on a one-per-machine basis. Theoretically, it should be possible ...
1
vote
0answers
31 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
1
vote
2answers
79 views

Browser rejects certificate, but openssl s_client works

I'm migrating a secure website. I've installed the same certificate on the new host and pointed the domain name to the new IP address (via my hosts file). However, when I try to hit that server with a ...
0
votes
1answer
58 views

Why am I sometimes spontaneously presented with an SSL certificate from my U-Verse Residential Gateway?

Sometimes, we will experience a brief "hiccup" in our AT&T UVerse internet service. When this happens, and a user happens to be surfing the web at the same time, we will suddenly be presented with ...
3
votes
2answers
100 views

Any reasons for using “Basic HTTP” authentication?

I'm building a simple API that will be used in an android app (that only about 3-4 users will ever have). The app connects to the server and sends GET/PUT requests. I've read through my googling that ...
1
vote
1answer
62 views

Why doesn't TLS have a threat model?

I was looking at the TLS 1.2 RFC and I see no official "threat model". I've looked a bit around and no sign of it. How come TLS has no threat model?
1
vote
1answer
73 views

Is CVE-2013-2566 a practical attack against RC4 or still conceptual?

Is CVE-2013-2566 a practical attack against RC4 or still conceptual and does it only apply to WPA/TKIP?
0
votes
2answers
23 views

Is there a way to attack STARTTLS + certificate pinning probed from multiple places?

I just had this discussion on IRC and I have to admit I did not understand why other users were not convinced this would be enough... Let's say I would like to protect e-mails sent out from my ...