SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

1
vote
1answer
20 views

TLS Certificates only for Clients

I'm aware that sites like StartSSL use Client-Certificates, I opened mine in Firefox and it showed me: "SSL-Client-Certificate", "E-Mail-Receiver-Certificate", "E-Mail-Signer-Certificate". Now I'm ...
4
votes
1answer
44 views

Insecure https connection to reputable companies' domains?

I'm getting notifications of untrusted https connections on reputable domains such as paypal.com and skype.com. Since big companies like those probably employ the top security professionals and best ...
1
vote
2answers
31 views

What is the impact of removing TLS_RSA_WITH_RC4_128_SHA from my server's cipher suite?

I run a website that supports many clients via webservices. I'm setting up some new certificates and load balancers and when doing ssllabs's server test, it's flagging all my ciphers as OK except ...
3
votes
4answers
121 views

If the public key can't be used for decrypting something encrypted by the private key, then how do digital signatures work?

I'm learning asymmetric encryption in the use case of ssl/tls protocol. I can understand that the public key (like a padlock) can encrypt (lock) something and only the private key can decrypt ...
5
votes
1answer
36 views

Distinguish between Wi-Fi Captive portal and MitM attack

Not sure whether this should be asked in Super User or here. How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS? Are ...
0
votes
4answers
123 views

Is TLS 1.0 more secure than TLS 1.2?

I just wanted to confirm, my system admin is telling me that TLS 1.0 is more secure than TLS 1.2 and told me I should stay on TLS 1.0...is this accurate? He mentioned that TLS 1.2 is more vulnerable ...
0
votes
1answer
37 views

Why aren't the TLD registries the TLS CAs?

Here's one thing I don't understand - why is it possible for a Chinese organization to forge an SSL certificate for an American website and the other way round? What led to a design decision of ...
2
votes
0answers
45 views

Why do I get a Secure Connection Error on some sites? [migrated]

I am using Firefox version 37.0.2 with an ethernet connection at a university in Bangkok. I consider the university a network a hostile environment as the majority of the computers on this network are ...
3
votes
0answers
41 views

Retaining origin when using Snort with a loadbalancer? Or why it's a bad idea? [migrated]

Initially I deployed HAProxy so that it would be possible to notice bad traffic going into my web server (rather than it being obscured by TLS), but now I noticed the rather obvious problem that once ...
2
votes
3answers
341 views

PCI Compliance Scan Failing for supporting TLS 1.0, but removing support breaks < IE 10

My company is receiving this message causing us to fail our TrustKeeper PCI compliance scan: Note to scan customer: This vulnerability is not recognized in the National Vulnerability Database. TLS ...
2
votes
3answers
100 views

How to tell if a SSL certificate is deployed correctly and check if it is working?

I have installed a SSL certificate on a server. Now, I want to check if it is correctly installed and is working. I have heard from my friend that when you are installing your own certificates in ...
2
votes
1answer
38 views

User-friendly TLS certificate validation

I'm designing an application in which clients generate their own TLS certificates ad-hoc (there's no central authority). When two clients interact for a first time, I need for them to mutually check ...
2
votes
0answers
41 views

How to create TLS SHA256 certificate request [migrated]

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
0
votes
0answers
51 views

Windows Server 2008 R2 - SHA2 based Cipher Suites [migrated]

I am currently in the process of upgrading the SSL certificates for various websites that I manage from SHA1 to SHA2 compatible certificates. To date we have always used 'RSA' as the key exchange ...
1
vote
0answers
67 views

How to recreate the Freak attack?

Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f. I ...
1
vote
3answers
229 views

Is browsing http sites insecure?

So for example this site, security.stackexchange.com, when I look in my browser it doesn't say that it uses https and it does say that my connection is not encrypted. The same goes for, say, ...
0
votes
2answers
58 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
-4
votes
0answers
18 views

Server side script to check if browser is vulnarable to SSLv3 Poodle [migrated]

I want to implement a browser SSLv3 Poodle vulnerability test like https://zmap.io/sslv3/sslv3test.html on my web application. My idea is to put a routine in the application first page to tell to my ...
0
votes
0answers
37 views

Is it possible to configure Azure Web site SSL protocols & ciphers [closed]

I want to be able to disable TLS 1.0 protocol and the RC4 cipher on an Azure website (or Web App) and I can't figure out if it's possible or not. I know what registry settings to update but the ...
1
vote
1answer
39 views

Is adding apt keys using wget secure?

Many (I would even say most) projects that have Debian repo give instructions like this (https://www.dotdeb.org/instructions/): 3. Fetch and install the GnuPG key wget ...
2
votes
1answer
54 views

SSL certificate connection is verified by proxy.abc.com, is this secure?

I am using chrome, and when I perform a google search I get the green icon in my browser. When I click on the icon to see the certificate information, in the 'Connection' tab is says: "The identity ...
0
votes
2answers
68 views

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
19
votes
3answers
2k views

Why do HTTPS requests include the host name in clear text?

I'm having a little bit of trouble understanding why the HTTPS protocol includes the host name in plain text. I have read that the host name and IP addresses of an HTTPS packet are not encrypted. Why ...
4
votes
3answers
831 views

“Authorized” Man in the middle

I am implementing a TLS connection with a basic server and client. It’s a one way connection: the server has a certificate chained to the CA, and the client has a collection of trusted root ...
0
votes
1answer
52 views

“Transferring” SSL certificate to another person [closed]

Last year, I did a lot of work on a site as a freelancer. We wanted to put the whole thing behind HTTPS, so, for reasons I can't recall but probably expediency-related, I purchased a cert for it under ...
0
votes
0answers
18 views

Blackberry 10 supported SSL/TLS/DTLS versions?

I'd like to know the supported SSL, TLS and DTLS versions in Blackberry 10? From a developer's perspective that is, what native support does BB 10 offer me to secure my app's communication? I've been ...
2
votes
1answer
138 views

This is 2015. Has SHA1 been exploited or cracked yet?

went to Qualys SSL lab and tested one web site. One of the findings says the site is signed with weak algorithm SHA1withRSA and I did some research all are saying we should change to SHA-2. may i know ...
1
vote
0answers
81 views

Consequences of disabling SSL2 and SSL3 on our webserver [migrated]

Our system is quite old and as a result gets an F grade for SSL from Qualsys SSL because the server supports SSL2 and SSl3. We have now identified all the browsers people are using. The oldest is ...
20
votes
5answers
3k views

Is it possible to “read” secure (using SSL or TLS) messages if you know the message?

If I am communicating over a secure line (secured using SSL or TLS) and I send the server a message. Could someone eavesdropping tell what that message was if they knew before hand a list of messages ...
1
vote
1answer
37 views

Running webserver with SSL enabled but not used

We have a web server hosted by a third party running on port 80. They have also enabled SSL but we did not use it. We are just using port 80. Right now, when I do a vulnerability scan, some SSL ...
0
votes
1answer
57 views

Solution for Protocol Downgrade Attacks

I have a Protocol Downgrade Attacks on my website, i have seen the solution to be as TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks refer link :- ...
0
votes
0answers
12 views

UTF8 and T61 strings, how do I see what my SSL cert uses? [migrated]

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
-1
votes
3answers
160 views

If TLS 1.2 is considered unbreakable, why do the NSA and other agencies invest in supercomputers? [closed]

If a 2048-bit RSA key and a 256-bit AES key are considered to be unbreakable within the foreseeable future by any kind of computer, why do the NSA and other intelligence agencies invest in ...
0
votes
1answer
50 views

Limiting a CA to only issue valid certificates to internal web sites and clients

What are the possible defense measures that can be applied to a simple PKI (no intermediate CAs, etc.) used to authenticate clients and servers over TLS on an internal network only? Certificates ...
5
votes
5answers
183 views

How can I explain self-signed certificates to users?

I don't trust certificate authorities, so I'm using a self-signed certificate on my server. The server provides both a website as well as other services. Most modern SSL-capable software, upon ...
1
vote
2answers
54 views

Does each device of the same model have different SSL certificates for them?

Lets say my company produces a device which can be connected to secure websites or it may act as some kind of server. Lets say I produced 100 pieces of the same device. Should I get one SSL ...
-1
votes
0answers
11 views

Steps for setting up certificate based authentication [migrated]

We have developed wcf service which we need to expose to customers. We plan to use certificates for security and authentication of clients. How do we go about this, what are the steps involved? ...
22
votes
3answers
2k views

What ways are there to verify a self-written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter. I needed to secure ...
1
vote
0answers
42 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
1
vote
2answers
46 views

Is Ignoring SslPolicyErrors while doing SSL Pinning Secure?

I am implementing SSL pinning as a security requirement for a project and the HTTPS endpoint is giving me SslPolicyErrors. The following errors occur, RemoteCertificateChainErrors ...
-2
votes
0answers
26 views

SSL Made my Subdomain Inaccessible [migrated]

I have an SSL certificate which is for the root domain https://diginomics.com domain only. However, after I successfully installed the certificate it also changed the URL of my subdomain ...
4
votes
2answers
204 views

Is cacert.org more harmful than self-signing?

I don't understand the https security model attempted upon me by The OpenBSD Journal (undeadly.org). Instead of using self-signed certificates for https like they did in the past, they for a while ...
0
votes
1answer
37 views

MitM Chrome Mobile

I just came across the issue about MitM on Opera/Nokia browser 2013. I know, this is an "old" problem, but it seems very interesting to me. I was wondering how Chrome on mobile handles the SSL ...
1
vote
0answers
86 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
11
votes
3answers
2k views

Why is my Positive SSL certificate deemed insecure by Google Chrome? [duplicate]

We run a website over HTTPS with a wildcard certificate from Positive SSL. Today, when I opened Google Chrome (v. 42.0.2311.90 m) and navigated to the site, I noticed a red cross through the https ...
0
votes
4answers
105 views

Risks of using HTTP

What are the risks of using HTTP instead of HTTPS assuming that there isn't any rogue hacker sitting on my personal WIFI network waiting to sniff my traffic? Can a hacker sit in his boat in the ...
1
vote
2answers
56 views

Website Certificate with different public key

I've installed a ssl certificate from https://www.startssl.com/ in a server running with plesk. The website is the following: https://refood.sal-pimenta.pt/ As you can see the certificate is fine but ...
1
vote
2answers
102 views

SSL Authenticated SOAP Request works in SoapUI but not through code

I am connecting to a SOAP webservice that requires SSL authentication. I (the web service client) have a .pfx file and provided the public certificate for that file to the company whose web service I ...
3
votes
2answers
108 views

Payment form from http is secure? [closed]

There are lot of payment gateways (Worldpay, PayPal, ..) offering easy integration, when the plain webpage using URL redirection to the payment page. HTTPS (worldpay,paypal), where the user posts his ...
4
votes
1answer
106 views

REST API communication between two Web Servers - VPN or https?

We have two servers that will be sharing data and communicate over a REST API: our main application server will communicate with the server of our client that is managing some assets. In short: Given ...