SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
0answers
12 views

Log to file my own SSL traffic coming from websocket

I have to decode and capture my own traffic that come from a websocket WSS listening on port 7072, when I use browser to connect to my data provider. My idea is: to redirect traffic to ...
-1
votes
0answers
6 views

OpenSSL 0.9.8zg [migrated]

A week ago, as part of the installation a PHP 5.4 cartridge from openshift.com on my Mac with OS X v10.10.5 in the Terminal I noticed a message about it is loading OpenSSL 0.9.8?? for compatibilty ...
-1
votes
2answers
38 views

HTTPS - if this protocol protect against connecting to false server?

I know about SSL certificates. However it is ok to say: protocol HTTPS protects against connecting to false server ?
1
vote
2answers
61 views

Which of the TLS/SSL and IPsec protocols is effective?

Which of those two protocols is the most effective for sending data from a client to a server on a local network (knowing that I aim to use it for FTP traffic)?
-2
votes
0answers
33 views

Are VPNs more secure than TOR? Why? [duplicate]

I've heard from multiple sources that a trusted VPN service is more secure than using TOR. Is this true? Even if TOR is used with SSL? Why or why not? And how do they compare with regard to anonymity? ...
4
votes
2answers
82 views

What is the difference between MITMproxy and SSLsplit?

I am aware that MITMproxy only captures HTTP/HTTPS protocols where SSLsplit is a transparent proxy and therefore can capture also other non-HTTP protocol communications. However MITMproxy can operate ...
19
votes
7answers
4k views

Why are self signed certificates not trusted and is there a way to make them trusted?

I have locally made a Root CA certificate. I used the CA cert to sign the IA cert and used the IA cert to sign the server certificate. When I try to access the local server which uses the server ...
-7
votes
1answer
43 views

why we use SSL/TLS tunnelling instead of creating new secure protocol [on hold]

I don't know why people use tunelling SSL instead of creating safce protocol like HTTPS. Could you have an idea ?
3
votes
2answers
34 views

Question about SSL certificate and third party server

I have a system which consume web-services from a public server on Internet (but the data are not public) I have to provide credentials in Basic Auth to get the data, that is why we use SSL. The ...
2
votes
1answer
44 views

Why does my TLS v1.2 handshake take 2 tcp/ip connections?

All, I have an HP VuGen client that is using 2 TCP/IP connections to do the TLS v1.2 handshake with my server when mutual authentication is enabled. According to Wireshark, the sequence is ...
2
votes
1answer
62 views

What are the main advantages of using LibreSSL in favor of OpenSSL

What are the main advantages of using LibreSSL vs OpenSSL? As I understood LibreSSL is a fork of OpenSSL: LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014, with goals of ...
2
votes
1answer
32 views

Is TLS_FALLBACK_SCSV useless if only TLS (1.0, 1.1, 1.2) is supported?

Ssllabs does not give A+ (highest) rating if the server does not support TLS_FALLBACK_SCSV to prevent downgrade attack. But I am wondering, is it really any useful if the server legitimately provide ...
1
vote
1answer
76 views

How secure and how to find if a website use Flexible SSL from Cloudflare?

How secure is that technology? Can someone tamper with your traffic between a server and Cloudflare in the first place? And if the answer is yes, how can you check if a website is using the ...
3
votes
1answer
48 views

Identifying cipher mode in TLS

I'm trying to check my private server for TLS poodle attack. In Microsoft's article it says: "TLS 1.0, TLS 1.1, TLS 1.2, and all cipher suites that do not use CBC mode are not affected" How can I ...
26
votes
7answers
4k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
0
votes
1answer
33 views

Remote VPN access and moving to the cloud

First of all, my question is related to Web Application security. Often when I want to suggest customers to move to the cloud for certain applications, I am being told that our customers are ...
4
votes
3answers
106 views

Can browsers connect HTTPS w/ the NONE cipher?

I came across a mention of the NONE cipher being possible/available for HTTPS. Is it supported by any browsers for accessing any web-sites over the https:// address scheme? (What would be a snippet ...
4
votes
2answers
75 views

Check validity of SSL cert on public network?

So my company has just started issuing their own SSL certificates, so HTTPS sites now show as being secure, but if you check the certificate used the root CA is us, not whoever the site used. This ...
0
votes
1answer
46 views

Sample attack scenarios on file downloads over HTTP

The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow? The downside to serving files over HTTPS is that you will lose the caching as ...
4
votes
2answers
110 views

Why doesn't the HTTP/2 spec require TLS?

Although no browser implements the full HTTP/2 spec right now limiting themselves to just the TLS part there are stories on the internet that this incomplete implementation of the spec is a way of ...
-1
votes
2answers
44 views

what is the different between X.509 certificate and 2-way SSL? or both are same? [duplicate]

Can anyone clarify what is the difference between an X509 certificate and two-way SSL? or both are same?
0
votes
1answer
70 views

Server providing two different SSL certificates

When I check on browser for a site example.com, I see that site has a valid certificate, not expired, with validity till end of 2016. At the same time, When I scan for the same domain on the port 443 ...
2
votes
2answers
47 views

Risk to self-signed SSL certificate on OpenVPN server

I am building an OpenVPN server in AWS for my organization with a DNS record pointing it to vpn.myOrgnization.com. SIDE NOTE: We have recently migrated all of our SSL certificates over to the new ...
-1
votes
1answer
38 views

Plex owns SSL cert correct?

Plex's HTTPS certificate is great to have for the average MITM attack, however it is my understanding that the private key would still be controlled by Plex, correct? They are issuing the certificate, ...
4
votes
3answers
82 views

Is it ok to have self-signed certificates in source control?

I just asked the question SSL self-signed certificates in development vs acquired cert in production? which has promptly been answered (THANKS!). Out of that, I have the following question: Is it ...
3
votes
1answer
27 views

SSL Labs report question: Is “Insecure Renegotiation” possible if weak cipher suites are not available on server?

On one server, we have removed weak cipher suites and insecure protocols to try to pass SSLScan / SSL Labs. One outstanding problem is Insecure Renegotiation. I read that: The Apache Software ...
3
votes
1answer
47 views

SSL self-signed certificates in development vs acquired cert in production?

I am a developer, I have created self-signed certificates before for my work. This time, I am involved up until going live with the whole app (usually there was someone else in charge of this). ...
1
vote
2answers
183 views

Why do porn websies not use HTTPS? [closed]

It seems that information relating to porn habits is quite telling, why wouldn't porn websites make the effort in protecting them?
1
vote
2answers
68 views

Large file encryption to mitigate MITM

This is both a performance and security question that I'm looking for efficient and long term security with large file pushing over the internet. My scenario is as follows. - Server receives a large ...
0
votes
1answer
101 views

Why doesn't outlook 2013 meet modern security standards?

It is required to turn on the allow less secure apps setting in order to be able to use a gmail account with outlook 2013, despite it is using the IMAP and SMTP services with SSL protocol enabled. ...
6
votes
1answer
195 views

Bank Has Emailed My Social Security Number

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first ...
0
votes
1answer
30 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
0
votes
1answer
36 views

Can I use a TLS certificate (first generated for a Windows Server) on a Linux Server?

I don't have any experience on this kind of things, so please bear with me. And I apologise if this has been asked before, but I couldn't find it in this site. My situation: I have a Windows ...
3
votes
3answers
154 views

Why are root certificate authorites allowed to issue certficates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
0
votes
2answers
38 views

How to avoid writing .pem while signing a csr?

I am using following command to sign a certificate, openssl ca \ -in client.csr \ -keyfile server.key \ -cert server.crt \ -outdir ./some_dir \ ...
0
votes
0answers
27 views

Java Client not able to establish SSL handshake with server [migrated]

I have a Java client which is using the Apache HttpClient 4.1 library to make an HTTPs request to a server which doesn't require authentication. If I call that server with my browser or curl, the ...
0
votes
0answers
16 views

encryption alert 21 [migrated]

we have a client/server running TLS v1.0 and keep getting the Encryption Alert 21 from the client after the initial handshake. They are using cipher block chaining and I've read where the block cipher ...
0
votes
3answers
83 views

what do you do when an ssl certificate expires and your app uses ssl pinning?

I originally posted this question on StackOverflow, but reposted here due to lack of responses. I am trying to decide if it's a good idea to do ssl pinning in my iOS game that uses a server to ...
0
votes
1answer
68 views

Where in the CSR is the public key?

I am reading http://www.akadia.com/services/ssh_test_certificate.html In step 2 openssl req -new -key server.key -out server.csr server.key is generated earlier using openssl genrsa -des3 -out ...
1
vote
0answers
24 views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...
1
vote
2answers
77 views

Self-signed cert - how it works

I am new to SSL / digital certificates / signatures. What I know is that a digital signature must be verified/decrypted using the public key. So a cert that is signed by a CA must be ...
0
votes
1answer
29 views

What is the added value of dynamic payload in Ping/Heartbeat commands?

Many protocols, including TLS and WebSocket, have a ping/heartbeat packet format that we encapsulate a variable payload that the remote end must reply back. In other terms, If I (client) send a ping ...
0
votes
2answers
107 views

Does SSL/TLS (https) reveals your IP address? [duplicate]

Because the NSA monitors traffic going through the major nodes of the internet, they can know which IP address does what on your website, even if you are using HTTPS. Is this true or false?
-1
votes
1answer
68 views

proxies do not render HTTPS pages with javascript correctly [closed]

In technical terms, how come all proxies fail to display https pages (e.g. Facebook) correctly? The use of javascript is almost always disabled. The problem is in https? Can someone technically ...
7
votes
3answers
2k views

Can we drop XP from HTTPS support? If not, when? [closed]

XP support was dropped by MS on April 8 2014, almost two years ago, but there are still many people who use XP for internet surfing. Also, there are still many sites like Google or Facebook who offer ...
4
votes
4answers
465 views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With ...
0
votes
2answers
89 views

SSL digital certificate process - high level

I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database. In this case, I have an web server and needs to implement SSL ...
2
votes
2answers
110 views

HTTPS is able to prevent ARP poison attack in LAN?

I simulate an ARP poison attack in my LAN network. In the network I have 4 devices: victim, attacker, router and a web server. The victim try to log in the website on the web server and the attacker ...
0
votes
2answers
50 views

Can we prevent DNS-based attacks with SSL/TLS? [duplicate]

Consider the following scenario giving a hypothetical attack: Crypto.com is selling cryptostocks and accepts payments using a payment processor PayEasy.com. The entire site pages (of crypto.com) are ...
1
vote
1answer
71 views

TLSv1 HandShake but SSLv2 client hello

I found this question: SSLv3 HandShake but TLSv1 client hello However, my situation is opposite: SSLv2 client hello then TLSv1 handshake. Can you please explain this for me? I use Wireshark to ...