SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
1answer
34 views

How to generate self-signed EV SSL Certificate?

I configured XAMPP / Windows on my laptop so that this URL: https://www.supersite.com/ points to XAMPP / localhost rather look elsewhere. I basically generated a self-signing certificate, imported ...
0
votes
0answers
27 views

SSL cipher suite usage statistics based on captured data [migrated]

Is there a reasonable method of building SSL cipher usage statistics based on captured packets? Let's say my web server supports a set of ciphers and I would like to find out how many clients ...
0
votes
0answers
10 views

upload received ssl data to distributed servers

I am doing the network traffic analysis for a live camera device from a Chinese company which allows to view the real time video from ios6 app. 172.17.200.2 is the IP of the ios device.And the ...
10
votes
2answers
600 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
0
votes
0answers
27 views

TLSV1 and TLSV1.2 coexist issue in wireshark

I analysed an live camero's net traffic and found that the client uses both TLS1.0 and TLS1.2 in the handshakings while the server only uses TLS1.0. How can the handshaking uses both TLSV1.0 and ...
2
votes
0answers
21 views

Is it necessary to purchase an OID for ADCS? [migrated]

I am interested in utilizing ADCS to generate trusted certificates for internal web applications. However, from my readings it appears that I need to purchase an OID, which looks pretty expensive. Is ...
0
votes
0answers
33 views

Calling a HTTPS web service [on hold]

Background I have a Java application, one part of it is to call a HTTPS web service regarding payment (offered by a company called PayPoint). The application is sitting on a IBM Websphere server. ...
1
vote
0answers
16 views

JKS - Keystore protection and configuration file

It appears that Java Keystore is often used by web server using a configuration file, with the password opening the JKS written in it and also the password protecting the specific entry. How could ...
4
votes
2answers
126 views

Decide to REST API Security

I've developed an API. I got confused and I've been reading articles for days. Actually my question is close to these but not exact (maybe a combination of them); Securing REST API that will ...
3
votes
2answers
98 views

Decrypt and then re-encrypt all requests to the internet at firewall level

I don't have strong skills about this matter but I am very curious about the following communication so may I ask: One institution sent a message to all network users saying that "all requests to the ...
0
votes
1answer
22 views

Audio not playing on Android (Kitkat 4.4.2 on LG G Pro 2 D838) via HTTPS [on hold]

I am having issues playing an audio file on the chrome browser! This audio file plays on the chrome browser on my mobile LG G Pro-2(D838) running Kitkat 4.4.2 without any issues. But when i uploaded ...
0
votes
1answer
31 views

Subject verification of certificates

Suppose H has taken C’s certificate and manually changed the subject information in C’s certificate from C to H. Would this modification be detected by A during the certificate verification process?
5
votes
1answer
71 views

How to add certificate pinning for a certain domain to my web browser?

There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted. Google's Chrome and ...
8
votes
1answer
137 views

Is it unwise to use Redis to store PII, private keys, and other secrets?

I'm reviewing a system that is using Redis to store all client secrets, private keys, and other things. The problem is that Redis loads the entire DB into RAM Since SSL's heartbleed, Rowhammer, and ...
2
votes
1answer
82 views

DHE_DSS vs. DHE_RSA

I have been studying to learn about various cipher suites and their performance; I'm wondering about the difference between DHE_DSS_AES256_CBC ciphersuites and DHE_RSA_AES256_CBC ciphersuites. I ...
0
votes
0answers
32 views

Confused about SSL certificates needed for Windows proxy [migrated]

I am completely new to security, and I'm confused about what kind and how many SSL certificates I need. I have a REST API server running on a windows server 2012. It's currently listening to HTTP ...
2
votes
0answers
26 views

Why were CBC_SHA256 ciphersuites like TLS_RSA_WITH_AES_128_CBC_SHA256 defined?

It is my understanding that: In TLS, the hash function is used only in HMAC construct. SHA-1 is secure when used in HMAC. TLS 1.2 switched the PRF used to derive the symmetric keys to no weaker than ...
2
votes
2answers
32 views

non-https winscp website

The whole point of WinSCP is to provide a secure channel between a computer and a server. "Secure" means that there is a possibility of an attacker that can view or modify bytes sent both ways. Let's ...
1
vote
1answer
30 views

What is the key when the client want to get a session id in SSL

According to the abbreviated handshake protocol, the client hello will contains a session id if it knows one. So my question here is: what is the key for a client to find session id if it is talking ...
0
votes
0answers
21 views

Problem with TLS identity not verified [migrated]

I run a CA server "Microsoft CA Server Enterprise" and I generate certificates then bind the cert to my site. In all clients in my network, I add the cert with certutil -addstore ca org.cer When my ...
0
votes
3answers
46 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...
-1
votes
1answer
48 views

Custom TLS in Browser [duplicate]

We are developing a JSF web application that has a main requirement of using our own TLS implementation (custom algorithm suites). The clients will connect via a browser. Is there any way (customising ...
2
votes
1answer
52 views

Can I modify my certificate chain?

I've had SSL/TLS running on my site now for a while. In order to learn a bit more about general PKI, I studied Qualys' SSL test, and optimised my configuration (including the adoption of OCSP ...
2
votes
0answers
15 views

Trust CA and parent CA, but not other derivative CAs [duplicate]

I've got a problem with a client connecting to a server through an SSL-secured socket. The problem is with my requirements and the way the certificate chain gets validated. I've got three CAs to sign ...
0
votes
0answers
10 views

Impact on Network printers which the SSL certificates are expired? [duplicate]

Any one please help me on what is the impact of network printers which the SSL certificate is expired also need to know whether we can remotely renew the certificate from another location??
0
votes
2answers
66 views

Browser Updated, yet still vulnerable to POODLE

So here's a situation, some of my company's partners notified us that they will be entirely disable their server's SSLv3 support. This prompts my superior to take this chance to update our operation ...
0
votes
1answer
48 views

Security at application layer

Originally asked on http://crypto.stackexchange.com/questions/24430/security-at-application-layer but was suggested to ask here instead. I saw lots of questions asking about encryption over http, ...
1
vote
3answers
77 views

Is it possible to have two SSL certs - one wildcard and the other single sub-domain for a single domain?

We have a case where we are currently using *.yourdomain.com (wildcard certificate) and due to some reason we need another certificate (Multi-domain UCC certificate) for subdomain.yourdomain.com. On ...
3
votes
1answer
33 views

Does DTLS support SNI?

The client hello record format in DTLS RFC at https://tools.ietf.org/html/rfc4347#section-4 does not mention this. However, since SNI is mentioned in TLS extensions RFC at ...
0
votes
1answer
17 views

Pre-Requisites for Mutual Authentication

For Mutual Authentication, the client must contain the CA certificate of the Server and his own Certificates, and the server must contain the CA certificate of the Client and his own Certificates.In ...
0
votes
0answers
14 views

Combining Hash Visualisation (VisualHostKey) and SiteKey to prevent MITM

TL;DR Skip to the No SiteKey + Plugin if you don't want to read this whole thing. VisualHostKey shows an SSH hash like this: # Host github.com found: line 53 type RSA 2048 ...
0
votes
1answer
36 views

Combining wildcard and subdomain-specific SSL certificates

Not quite sure which Google terms to use to find the answer, so I thought I'd ask it here, presented as a scenario: Say you have a corporate entity (Example Co) with a wildcard SSL cert issued for ...
1
vote
1answer
77 views

Is a self-signed SHA-1 certificate sufficient security for a company transmitting sensitive data?

We recently decided to pay an ISP (a substantial sum, mind) for a managed internet service up to and including the router in our head office. Part of the initial discussions made it clear that ...
0
votes
1answer
72 views

Is cloud server without HTTPS secure

I am running a Seafile Open Source Cloud server (v 4.0.6) on my Raspberry Pi 2. Currently it is set up to simply run without HTTPS or even a domain name on [myIP]:8000. I am also running an Apache web ...
9
votes
1answer
1k views

Why would Chrome not display a padlock icon at all on an SSL site?

I have an internal website running on SSL, but when going through it in Chrome, I don't get a padlock icon at all: However, clicking it does show that the site is encrypted. There are a bunch of ...
1
vote
2answers
39 views

What negotiates SSL ciphers? [duplicate]

In light of the recent FREAK vulnerability I am trying to get a hold on what ciphers are being used by inbound connections. I have FTP tracing on which is giving me which ciphers are being negotiated ...
12
votes
3answers
973 views

Why for some SSL websites browsers show extra info, while for others dont

While visiting some https websites (like online banks, etc) url string appear to have little extra green box on the left hand side, with some organisation details. While other https websites just ...
2
votes
0answers
90 views

Did Google relax their SHA1 deprecation schedule?

In the original post on the subject they said that in Chrome 41: Sites with end-entity certificates that expire on or after 1 January 2017, and which include a SHA-1-based signature as part of the ...
6
votes
1answer
861 views

Is Man-In-The-Middle necessary for a CA to read HTTP plaintext?

Although I understand the basic theory behind certificates and asymmetric cryptography, I'm not quite sure on the details of the X.509 protocol. I'm wondering what attacker model a given CA requires ...
5
votes
1answer
50 views

Do CA Public Audit Records increase the visibility, and risk of attack?

Does the CA feature of Public Audit Records increase the visibility of my hosts, and therefore the risk of host-specific attacks? Would the only mitigation be to only enable this for wildcard ...
2
votes
2answers
65 views

Is HTTPS required for PCI Compliance when downloading desktop software patches, if no PII is transmitted, and content is digitally signed + verified?

We have a desktop app that downloads patch content via HTTP. The content is digitally signed and verified by client software after download. Is HTTPS required to achieve PCI compliance if: No PII ...
1
vote
1answer
38 views

Segregating a Printer in my Enterprise Network

I have a EAP-TLS network at home which I've managed for some time now. I just got a new Brother HL-5470 printer so I can finally print things at home, which is really nice. The only problem is that ...
0
votes
0answers
20 views

Unable to authenticate with Client cert in TLS1.0 [migrated]

I have my own application running in Windows machine (server). I am using a browser as a client to do operations. I have multiple users connecting to the server using client certificates as the ...
0
votes
1answer
53 views

How to enforce TLS on Windows [duplicate]

In Windows 2008 R2 and 2012, how do you enforce TLS-only and how do you demonstrate that posture? I am in IP Compliance and have a strong background in practical system administration and support. I ...
3
votes
0answers
13 views

Can I detect if the SSL client doesn't support Server Name Indication and provide the standard HTTP website in that case? [migrated]

I will need to use SSL SNI, but unfortunately from a recent Cloudflare blogpost only 90% of the network supports it. How can I (for example, with nginx) detect if the client supports SNI and ...
0
votes
0answers
28 views

How to create certificates for local network [migrated]

I have a local network (a intranet of about 50 to 70 computers) where is a Windows Server 2008 with a ASP.NET MVC application. To encrypt the connection with HTTPS i need a server certificate (not ...
4
votes
2answers
334 views

Disabling TLS protocol in protocol level or in cipher list level: What's the difference?

So, I stumbled into this question: Why doesn't the TLS protocol work without the SSLv3 ciphersuites? In that question OP tried to disable SSLv3 by disabled it at both protocol and cipher list (by ...
1
vote
1answer
83 views

Is End to End encryption possible for all servers across the whole infrastructure?

Running into a possible situation where a client I am working with is requesting that all data that leaves the servers should be encrypted and here, we are talking of hundreds of Linux servers ...
2
votes
1answer
157 views

Why is FREAK being presented as a brand-new vulnerability?

If I understand correctly, FREAK refers to a "vulnerability" in which, when a client offers weak cipher suites (usually export-grade cipher suites with 40 or 56 bit encryption) and a server can accept ...
0
votes
1answer
73 views

Is native app vulnerable to FREAK attack? If yes, how to detect it as a user?

When I research about FREAK attack, most of them explain about the server and browser vulnerability, but how about native apps (e.g. Windows executable program, mobile apps)? From Mark's answer on ...