SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

4
votes
2answers
37 views

SSL Handshake failure when antivirus is enabled

This is a problem related to SSL handshake failures when an anti-virus (Kaspersky) is in between. From WireShark, I am able to notice the SSL handshake successful (i.e towards the end client ...
-1
votes
1answer
36 views

Server authentication during the SSL handshake

I have question regarding the server authentication during the SSL handshake. I am going to write this up as my understanding of the concept. Please feel free to point out any mistakes. We generate ...
2
votes
1answer
49 views

Are TLS session keys cached in a browser?

For example, when authenticating to a TLS protected service, and then closing the tab, you can sometimes reconnect to the service afterwards without re-authenticating. In preservation of perfect ...
0
votes
0answers
16 views

Multiple SSL certificates in Apache with clients using different certificates [migrated]

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
1
vote
2answers
34 views

What exactly is IE / Chrome checking when I view the “certification path” tab on cert connection details?

When I bring up certificate details for a web page in IE or Chrome, I have the option to view the certificate hierarchy (under a tab called "Certification Path"). Here's an example for ...
0
votes
0answers
33 views

Websites disclosing their users emails [on hold]

What if I have found several websites that do not correctly protect users information. For example, if you open the developer tools to see the XHR requests and websocket messages you may see the ...
1
vote
1answer
36 views

How much protection is really offered by TLS_FALLBACK_SCSV?

I'm researching the extent to which TLS_FALLBACK_SCSV protects against Cipher Suite Downgrade attacks. I understand that the correct way to protect is to remove support for the insecure cipher ...
1
vote
1answer
24 views

Where are the HTTPS session resumption tickets/sessionIds stored on the client?

With Session resumption in TLS/HTTPS the client stores the sessionID or the session ticket and uses it the next time it wants to communicate with the server. I am trying to find where the browser ...
22
votes
5answers
2k views

What prevents a man in the middle from requesting a certificate for your server?

Let's say you have a server at shop.example.com and you are requesting a certificate from some trusted CA like Comodo (they say they'll issue it within few minutes online). First of all, how can ...
3
votes
3answers
90 views

How do browsers negotiate SSL/TLS connection parameters?

For the purpose of this question, let assume that an SSL/TLS connection has 4 parameters: protocol, symmetric encryption method, asymmetric encryption method, MAC. During the negotiation of SSL ...
4
votes
2answers
136 views

Why is Chrome saying that “TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)” is an obsolete cipher suite?

When I go to this site, Chrome Version 44.0.2403.89 is connecting to the server with TLS_RSA_WITH_AES_128_CBC_SHA (0x2f), and it states that this is an "obsolete cipher suite". For what reason is it ...
2
votes
2answers
145 views

Should I update my SHA-1 certificates? If so, how?

Q: Should I update my SHA-1 certificates? If so, how? Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been ...
0
votes
2answers
193 views

Is HTTPS required when there's no sensitive data in the site

I'm currently building a B2B e-commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
1
vote
0answers
57 views

How to inform other sysadmins their email encryption is broken [closed]

Does anyone have a good template email to use to send to remote system/mail/security administrators to alert them to the fact that emails to them would not be getting through either at all or securely ...
3
votes
0answers
65 views

How should certificates be shared between a proxy and a frontend?

At work, I've been asked to look into creating a reference topology for a WebSocket chat application, which includes a proxy between the web-facing frontend server and the backend. At the moment, I am ...
-3
votes
1answer
29 views

A collection of tests and demos for security headers and TLS configurations [closed]

There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/) I want to build a ...
0
votes
2answers
66 views

Unable to “trust” self-signed certificate

I am currently running a setup that interfaces with many appliances running HTTP servers (running on Windows Embedded). The connections I use are HTTPS connections. My problem is, every time I open ...
4
votes
3answers
70 views

What's the purpose of DH Parameters?

For a Diffie–Hellman (D-H) key exchange (TLS) the server generates a prime p and a generator g, which is a primitive root modulo p. When setting up a webserver with SSL/TLS (e.g. nginx) one can use a ...
1
vote
1answer
35 views

SSL/TLS entity identification

Does SSL/TLS contain any form of identification in the initial handshake, so an attacker cannot simply waive the certificate around claiming they are someone else? Wikipedia did not say that it did, ...
2
votes
2answers
227 views

Why doesn't DNS spoofing work against an HTTPS site? [duplicate]

How does using SSL protect aginst dns spoof? since DNS is at a lower level and it is always work the same whether the user is visiting an HTTP or HTTPS site.
1
vote
0answers
27 views

Can server and client both use a certificate with the same CN? [migrated]

I am working on implementing TLS for a Client-Server application. But, the problem is both client and server are in same server: both communicate with just a port number. So what should the common ...
8
votes
4answers
518 views

What Country, State and City should I choose when requesting an SSL certificate?

I am really confused about the country, state and city I should select when submitting an SSL certificate. Should I provide the location of my servers or my current home address?I can always reissue a ...
1
vote
1answer
49 views

What are these two certificates I need to install - external CA root certificate

I have to install 2 certificates on a computer and I am a little puzzled by the certificates. The first certificate has these details: Issuer: CN = AddTrust External CA Root OU = AddTrust External ...
1
vote
0answers
36 views

How to use wireshark to decode SSL stream from remote API server? [migrated]

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
27
votes
2answers
3k views

Is it safe to send SSL certificates via email?

I just ordered a cheap Comodo PositiveSSL Certificate via a UK reseller, and I was rather surprised to find that the following files were emailed to me automatically, in a zip file: Root CA ...
3
votes
1answer
36 views

Authentication and protection against replay attacks on instructions over SSL

let there be two clients and a server; the clients have a shared secret and unique IDs. their communication to the server is encrypted over SSL. the problem now is sending secure instructions from ...
-4
votes
2answers
50 views

How the process of SSL handshake works? [duplicate]

I have been trying to understand the working of SSL. I know that any https website has a digital certificate with it. So when the client requests something from the server, the server sends with ...
1
vote
1answer
75 views

Should self signed wildcard certs be used?

I think this is more urban legend around where I work than anything. I do not see anything in RFC 2459 that specifically says whether or not they should be used or if there are any known problems with ...
2
votes
1answer
84 views

Securing REST API without sending or storing clear credentials

We are currently designing a REST API, and thinking about securing it. Going through a lot of documentation, it has become clear that 2 options are available. HMAC Authentication By hashing with ...
1
vote
1answer
107 views

Which kind of SSL certificate is the big one?

Okay, so I just recently visited a couple of https (secure) websites and noticed that there was a difference with the way they were shown in Chrome. As you can see, the top one has some extra ...
2
votes
4answers
138 views

SSL encryption process and its security

I know the basics of SSL encryption and how certificates work, but there are some points that are not clear to me regarding the SSL security: If there is a intercepting proxy between the web server ...
2
votes
1answer
51 views

Security bounds of TLS client authentication (from browsers)

Say that there are two servers that perform TLS. Both servers have valid end-point certificates. In other words, neither of them would raise a warning from the browsers after the connection has been ...
1
vote
0answers
42 views

Why doesn't the most powerful/powerful sites on the internet use Extended Validation SSL certificates? [duplicate]

Why does some of the biggest internet companies not use an Extended Validated certificate which makes the address bar would be green and more secure? I have noticed that Facebook, Google, Amazon the ...
0
votes
1answer
29 views

New SSL certificate not being trusted on all clients

I just got an old SSL cert renewed by GoDaddy. It works fine on most clients I've seen. However on some of our more restricted computers there is an issue. These computers have GPO's set to block ...
1
vote
1answer
33 views

Reverse Proxy SSL container

Technically and security wise, can a reverse proxy act as a "container" for SSL certs ? Meaning, for example currently my web server is running on ssl (https). Can I move the SSL cert to the reverse ...
2
votes
1answer
46 views

Does the modulus of a TLS certificate uniquely identify the client?

I'm working on a project using a trusted-peer setup. I want a way to uniquely identify each actor in the system, ideally across certificate re-issues as well. In my understanding, the modulus of a ...
13
votes
1answer
1k views

Which parts of an HTTPS connection can be revealed? [duplicate]

Say, I use a public WiFi connection to load https://google.com in the browser, and then continue browsing on that site for a few more pages (performing searches in Google). Can anyone else (like ...
1
vote
2answers
43 views

Charles Proxy can not capture message sent over SSL connection [closed]

I have setup Charles Proxy app and it can captures my https request/response sent through browser. Now instead of using the browser, i have an app that setup a SSL connection to the server, and then ...
4
votes
1answer
75 views

Different SSL/TLS certificates for subdomains

I have HSTS enabled on several domains that I host/maintain, and I'm using free verified certificates from a provider that only allows encryption of the root and one subdomain on the certificate. They ...
2
votes
1answer
98 views

OpenSSL implementation vulnerabilities vs TLS 1.0 holes

I have been reading a fair bit on OpenSSL vulnerabilities and the various SSL protocols' strengths. As far as I understand it any protocols older than TLS 1.0 are to be avoided at all cost (some would ...
-2
votes
1answer
44 views

How to upgrade from SSL3.0 to TLS 1.0

I have a website using SSL V3 and since SSL V3 is vulnerable and dead, we want to upgrade our website to use TLS 1.0. Our hosting server is using windows server 2003 R2. Can someone clarify the ...
1
vote
1answer
31 views

Clarifications sought about SSL cert signing process

Currently I have a cert (signed with SHA1) expiring soon and I have extended its expiry incorporating SHA2 signing algorithm. I have done this by creating another CSR using certutil command with the ...
25
votes
4answers
3k views

What layer is TLS?

TLS stands for "transport layer security". And the list of IP protocol numbers includes "TLSP" as "Transport Layer Security Protocol". These two things would leave me to believe that TLS is a ...
2
votes
1answer
48 views

Is it possible to use obtained wildcard certificate on more than one server?

We are using two Debian servers in our company (with apache 2 as httpd) and our services are split between those two of them. One server has the website, the other has some minor sites under ...
3
votes
1answer
51 views

Security of OpenVPN against sophisticated DPI solution

I'm planing to build a device (prototype) that act as a portable security gateway. To make this, I choosed OpenWRT running on Raspberry Pi with OpenVPN for VPN connection. My main purpose of this ...
1
vote
2answers
36 views

Combinations of key exchange and signature algorithm in TLS

Let's say that one does not trust ECC a lot, and values confidentiality over authenticity (perhaps simply for the reason that MitM is more difficult than passive eavesdropping and decryption later ...
2
votes
0answers
79 views

Should Mozilla SSL3/RC4 whitelisted sites be blacklisted by admins/users? [closed]

As of Firefox 39, Mozilla has dropped support for SSL3 and RC4... and whitelisted 519 (!) non-compliant sites: ...
-1
votes
1answer
67 views

What is the meaning of “www-ssl” in the URL https://www-ssl.intel.com/? [closed]

While browsing INTEL website I came across the following link ...
4
votes
1answer
101 views

HPKP-based persistent denial-of-service attack on web sites

HTTP Public Key Pinning (HPKP) is a standard that allows a HTTPS website to specify which certificates it trusts, and instruct the browser not to allow any connection to that site that's secured by ...
3
votes
1answer
247 views

Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1

My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean): This site uses a weak security configuration ...