SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
1answer
25 views

Limiting a CA to only issue valid certificates to internal web sites and clients

What are the possible defense measures that can be applied to a simple PKI (no intermediate CAs, etc.) used to authenticate clients and servers over TLS on an internal network only? Certificates ...
0
votes
2answers
36 views

How can I explain self-signed certificates to users?

I don't trust certificate authorities, so I'm using a self-signed certificate on my server. The server provides both a website as well as other services. Most modern SSL-capable software, upon ...
1
vote
2answers
44 views

Does each device of the same model have different SSL certificates for them?

Lets say my company produces a device which can be connected to secure websites or it may act as some kind of server. Lets say I produced 100 pieces of the same device. Should I get one SSL ...
-1
votes
0answers
11 views

Steps for setting up certificate based authentication [migrated]

We have developed wcf service which we need to expose to customers. We plan to use certificates for security and authentication of clients. How do we go about this, what are the steps involved? ...
-2
votes
0answers
48 views

Copyright Issue? [on hold]

Few months ago, I have created a few icons for my app and after copyrighting them, I published them on my website. I clearly stated on my website that it is illegal to use my icons for commercial or ...
-3
votes
0answers
19 views

Security of SoftEther service [on hold]

I have some VPN servers but I want to run a new one. What I have heard about the security of SoftEther is not really good. It logs many things on the server It is really heavy to load on client side ...
1
vote
0answers
35 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
1
vote
2answers
37 views

Is Ignoring SslPolicyErrors while doing SSL Pinning Secure?

I am implementing SSL pinning as a security requirement for a project and the HTTPS endpoint is giving me SslPolicyErrors. The following errors occur, RemoteCertificateChainErrors ...
0
votes
0answers
88 views

Your connection to website is encrypted with obsolete cryptography in Chrome [on hold]

I can see the warning in about the our SSL certificate. This is chrome browser alone. See the below screenshot. I have check this problem in some links, they mentioned there is problem in key ...
-2
votes
0answers
26 views

SSL Made my Subdomain Inaccessible [migrated]

I have an SSL certificate which is for the root domain https://diginomics.com domain only. However, after I successfully installed the certificate it also changed the URL of my subdomain ...
0
votes
1answer
35 views

MitM Chrome Mobile

I just came across the issue about MitM on Opera/Nokia browser 2013. I know, this is an "old" problem, but it seems very interesting to me. I was wondering how Chrome on mobile handles the SSL ...
1
vote
0answers
52 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
10
votes
3answers
2k views

Why is my Positive SSL certificate deemed insecure by Google Chrome? [duplicate]

We run a website over HTTPS with a wildcard certificate from Positive SSL. Today, when I opened Google Chrome (v. 42.0.2311.90 m) and navigated to the site, I noticed a red cross through the https ...
0
votes
4answers
99 views

Risks of using HTTP

What are the risks of using HTTP instead of HTTPS assuming that there isn't any rogue hacker sitting on my personal WIFI network waiting to sniff my traffic? Can a hacker sit in his boat in the ...
1
vote
2answers
50 views

Website Certificate with different public key

I've installed a ssl certificate from https://www.startssl.com/ in a server running with plesk. The website is the following: https://refood.sal-pimenta.pt/ As you can see the certificate is fine but ...
-1
votes
0answers
37 views

Your connection is not private - delete certificate/security exception? [closed]

I am trying to browse to a certain url and it gives me this error: "Your connection is not private" I understand I need an SSL certificate for that site. Well I got one for the site, but now I need ...
1
vote
2answers
49 views

SSL Authenticated SOAP Request works in SoapUI but not through code

I am connecting to a SOAP webservice that requires SSL authentication. I (the web service client) have a .pfx file and provided the public certificate for that file to the company whose web service I ...
-1
votes
0answers
12 views

Specify outgoing SSL-Port in mitmproxy [closed]

how can i change the outgoing SSL/TLS-port of mitmproxy to another port than the default 443? Reason: I want to use mitmproxy with TLS-O-Matic, which operates on different ports. Thank you!
3
votes
2answers
104 views

Payment form from http is secure? [closed]

There are lot of payment gateways (Worldpay, PayPal, ..) offering easy integration, when the plain webpage using URL redirection to the payment page. HTTPS (worldpay,paypal), where the user posts his ...
4
votes
1answer
90 views

REST API communication between two Web Servers - VPN or https?

We have two servers that will be sharing data and communicate over a REST API: our main application server will communicate with the server of our client that is managing some assets. In short: Given ...
4
votes
1answer
74 views

Does mutual SSL authentication increases protection against a Poodle attack?

Recently we found our self pondering whether a certificate based mutual SSL authentication protects against a Poodle attack over SSLv3? We’re stuck in a situation where a client-application only ...
2
votes
1answer
94 views

Security Structure of an API

I've been developing a web application and APIs for 8 months. I implemented OAuth 2.0 client credentials for authentication. And now I have to implement TLS to my APIs. I've been dealing with SSL/TLS ...
23
votes
2answers
2k views

What is the purpose of frequently rotating TLS certificates without changing underlying keys?

I read in the OWASP cheat sheet regarding certificate / public-key pinning that “Google rotates its certificates … about once a month … [but] the underlying public keys … ...
-1
votes
1answer
32 views

I want to know about all the specifications of a cell phone when it enters into particular area [closed]

I want to produce a signal such that when a cell phone enters that area, I must get all the specifications of that device. Can I do it? Which signal is good?
-1
votes
1answer
18 views

Cannot establish connections between clients on JRE1.8 and servers on JRE1.7 [closed]

we have a client application compiled with JDK1.8, and an external server application runs with JRE1.7 or earlier versions. We don't know the exact JRE version of the server side. The problem here is ...
1
vote
1answer
43 views

SSL Test Server with typicals Flaws [closed]

i am testing different SSL-Proxys and want to know more about their failure-handling. Do you know about an public (test)server (HTTPS) which provides the typical flaws like: Expired certificate ...
-2
votes
1answer
69 views

Fiddler Can decrypt https traffic

So apparently, a software called fiddler is able to very easily decrypt secure https traffic with a click of a few buttons: http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/DecryptHTTPS I ...
0
votes
1answer
31 views

Browser Unable to Fully Authenticate HTTPS

I'm attempting to fully verify the HTTPS encryption using Chrome & Firefox but both browsers currently display the connection as 'including resources which are not secure'. I have tried using ...
12
votes
2answers
1k views

Why is Symantec/Verisign CA appearing as an invalid authority? [closed]

Typical browsing to www.BankOfAmerica.com got me an ERR_CERT_AUTHORITY_INVALID error. This was with an up-to-date production version of Google Chrome for Mac. I tried with Safari, and got the same ...
9
votes
2answers
2k views

How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

I checked out the app Packet Capture. This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root. How can I ...
3
votes
1answer
91 views

Client Certificates

After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario. I have a ...
1
vote
1answer
37 views

Reading encrypted data before sent to remote server

I'm developing a mobile app (Android only for now) to provide a disposable e-mail service to users. Users will be given temporary e-mail addresses so they can receive and read e-mails for a certain ...
0
votes
1answer
26 views

Custom publickey authentication

I'm working on a REST account management system over https that should support both username/password and username/publickey authentication schemes. I.e. when a user registers an account, they may ...
2
votes
0answers
24 views

How to check SSL connectivity between certificates installed on two different server [migrated]

Suppose there are two organizations which share information with each other. Every organization installs SSL certificate in their application server and provides the same certificate to other ...
5
votes
1answer
52 views

Relationship between HTTPS and SSH Public Keys

I can use my private key to generate a public key for use with ssh. I can use the same private key to generate a CSR, to generate a CLIENT certificate for HTTPS. Specifically, my SSH public key is: ...
2
votes
1answer
46 views

Decentralized e-commerce site, what to do about SSL/security?

I'm building a service that is basically a decentralized Amazon. Basically, each seller hosts a copy of the site, at their own IP address, and accepts (bitcoin) payments using a self-hosted bitcoin ...
0
votes
1answer
36 views

TLS generates MAC for whole data or just a packet over the wire?

TLS works over transport layer, packet fragmentation/defragmentation is controlled by transport layer, when we attempt to send a file over TLS/SSL ,is the MAC is generated over entire-file-content or ...
0
votes
2answers
417 views

HTTPS icon red and crossed out - Chrome browser

I just would like to ask what actually means when HTTPS icon is red / crossed - out. Is this site is vulnerable to Man in the Middle Attack? Is it safe or not?
2
votes
1answer
79 views

SSLV3.0 Poodle Man-in-the-Middle scenario

I have gone through the answers in this thread SSL3 "POODLE" Vulnerability. In the first answer,the following has been mentioned. ""The last ciphertext block thus gets decrypted, which ...
2
votes
2answers
43 views

ssl_error_bad_certificate_domain, does Firefox still validate the certificate? [duplicate]

I have a private NAS device. It uses a self-signed SSL certificate. I can import the cert into Firefox and everything works as long as I'm accessing the device from somewhere on the internet. SSL ...
0
votes
1answer
43 views

RSA vs DSA working methodolgy?

I have looked for various answers but I am being confused on how does RSA can be used for both Digital Signatures and Encryption/Decryption like in "TLS_DHE_RSA_..." or "TLS_RSA_.." cipher suite ...
7
votes
1answer
536 views

TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error

Late last year the CA/Browser Forum decided to limit the maximum valid term of TLS/SSL certificates issued after 1 April 2015. After this time, as the official guidelines put it.. CAs SHALL NOT ...
2
votes
2answers
711 views

Chrome showing cryptography as 'obsolete'

Similar to this question, Chrome is showing the connection cryptography as obsolete. Opera, IE and Firefox seem perfectly fine with the connection. My guess would be the message authentication is ...
0
votes
1answer
42 views

Decrypting SSL within Multiple Products

I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate. I cannot find any documentation on this subject online. All of the traffic is currently flowing ...
1
vote
0answers
27 views

Server returning HTTP 404 error on HTTPS connection. 200 on HTTP connection [migrated]

I have a client app talking to a secure server implementing IPP (internet printing protocol), using WinHttp library. HINTERNET m_hRequest = WinHttpOpenRequest(m_hConnect, L"POST",L"/ipp", ...
1
vote
3answers
103 views

Benefit to disabling TLS1.1 and TLS1.2?

In light of recent developments on SSL issues such as BEAST and POODLE, I decided to configure my browser to only allow TLS1.1 and higher. The trouble is, that I am finding a lot of websites which do ...
0
votes
0answers
22 views

SSL Handshakes and authentication? [duplicate]

I was just wondering if someone could explain the complete process of SSL handshake with certificates, public - private keys and MAC exchange. And in which cases does the Certificate warnings arise ...
3
votes
2answers
109 views

How secure is MD5 for TLS message authentiaction?

I was recently viewing a website and saw its certificate info as follows: Given that MD5 is badly broken and not recommended for hashing, how good is it for use in TLS? And why?
2
votes
1answer
130 views

TLS 1.3 Makes Security Tools Obsolete?

I am a student and relative noob in IT security performing research for three reasons: school, my employer and personal curiosity, and I hoped maybe someone could answer a question for me. In a video ...
1
vote
0answers
28 views

OCSP stapling implementation in JAVA/ Android

I am trying to implement OCSP stapling in JAVA. How can this be implemented ? How can we set OCSPStatusRequest extension for TLS. and how we can verify the response ? Hi, How can we implement OCSP ...