SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

3
votes
1answer
61 views

OpenSSL vulnerability CVE-2015-0205

I can't seem to make any sense out of the following vulnerability in OpenSSL: DH client certificates accepted without verification [Server] (CVE-2015-0205) ...
0
votes
2answers
43 views

HTTPS in request and HTTP in response [on hold]

If I have an API that calls a backend webservice, is it possible to use HTTPS in the request and just HTTP in the response? I have such a question because I want to protect my OAuth token in my ...
0
votes
0answers
16 views

What is the difference between “TLS” and “NETLOGON Secure Channel” authentication?

I would like to make sure what is the difference between "TLS" and "NETLOGON Secure Channel"(using signing and encryption) authentication? I know that TLS is aka SSL and I know that NETLOGON secure ...
1
vote
1answer
27 views

SRP in local, private wireless network

i am trying to secure the connection between a single-page webApp (angularJS, loaded from a secure source via SSL) to a local server (called BOX) inside the private, local wifi of the user. So the ...
0
votes
1answer
43 views

Perfect Forward secrecy in TLS session

I am looking at packet captures of perfect forward secrecy for cipher "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256". Per definition of PFS, after initial client and server hellos exchanged, both sides ...
0
votes
1answer
155 views

SSL mismatch error using ISP-provided IP address but not VPN IP address

I keep seeing error messages reporting issues with SSL (Chrome, IE, Mozilla) when clicking on links in the YAHOO homepage to stories from different YAHOO sites (screen, autos, movies, hsrd, etc.) ...
1
vote
2answers
78 views

DNSSec vs SSL and IPsec

Theoretically, DNS cache poisoning shouldn't matter,because everything important is protected by SSL and IPsec. So why DNSSec was developed? Aren't the first two protocols sufficient?
1
vote
0answers
41 views

openvpn tls 1.2 [migrated]

Openvpn cant establish connection with any tls 1.2 cipher. TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 ...
0
votes
1answer
37 views

Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?

We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test Specifically we're losing points for the following reasons: Forward ...
4
votes
2answers
71 views

Why not generate a client SSL with expiration date in very distant future?

In case of server SSL certificate it is issued by a CA which can then recall it until it expired and also the CA typically collects a fee for each certificate so it is interested in certificates ...
-3
votes
0answers
43 views

Dodgy security certification agencies? [on hold]

While researching the credentials of a pentesting company, I just found two organisations which lack SSL support on their main web sites. This seems sketchy for two reasons: While researching ...
1
vote
0answers
23 views

haproxy with client certificate authentication signed by 'common' CA

Excuse me if I posted this here wrongly, I know the question is partly about haproxy itself. I am setting up haproxy as an SSL terminator/load balancer in front of an API that we need to expose over ...
4
votes
1answer
46 views

Wildcard SSL and EV SSL

Is it possible to mix a Wildcard SSL for subdomains and an EV SSL for the www and non-www domain? I know that an EV SSL can't have a wildcard. Example: hello.test.com -> wildcard ssl ...
1
vote
2answers
51 views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
-1
votes
0answers
51 views

SSL Certificate for .com with cuba in it [closed]

I tried to register for an SSL certificate from Comodo, for a domain with the word "cuba" in it. They rejected it on that basis. I talked to RapidSSL and they said they could only accept it if I ...
0
votes
0answers
17 views

Recommendations for implementing TLS/SRP [closed]

I am currently trying to implement basic TLS/SRP as a prove of concept that SRP is more secure when using a browser. Below are a few questions that I wish to be clarified: I have found many ways to ...
0
votes
1answer
49 views

Why openssl shows www.google.com sha1WithRSAEncryption?

According to Chromium Blog, Google Chrome 39 with SHA-1 certificate will show a yellow icon, but my Google Chrome shows: Google Chrome (39.0.2171.99 (64-bit) on Ubuntu 12.04) I've confirmed it's ...
2
votes
1answer
98 views

Can a corporate proxy downgrade an SSL handshake?

At work, I'm behind an NTLM Proxy. When the SSL Poodle flaw came out, I hardened the configuration of my private server, and found out that even if the client and server shared common ciphers, some ...
1
vote
0answers
44 views

Why do browsers clear HTML forms when the user click the back button over an HTTPS connection?

There is already couple of questions regarding this behavior Losing form data when clicking the back button on browser Why are HTML forms sometimes cleared when clicking on the browser back button ...
2
votes
2answers
57 views

SSL/TLS: How to fix “Chain issues: Contains anchor”

I just ran a quick test at ssllabs.com: got A+, which I'm happy about. However there's one thing I don't know how to "fix": My site supports OCSP stapling and ssllabs keeps telling me: Chain issues: ...
1
vote
0answers
128 views

How to switch between TLS 1.0 and SSL 3.0 at Java/JRE level? [migrated]

I am using java 1.6. I have setup my tomcat as my ssl enabled server. And i have setup a ssl enabled client (java code). When i do a communication from my client to server. In java ssl dump in tomcat ...
-1
votes
1answer
21 views

What if I have an address-based certificate and a domain based certificate loading HTTPs resources in the background

What if I have an address-based certificate and a domain based certificate loading HTTPs resources in the background, will this change the Lock-Logo in the Browser Address bar? Does an address based ...
-2
votes
0answers
36 views

How to check for SSL POODLE / SSLv3

How can I check SSL POODLE / SSLv3 locally.My Url is localhost:8888/test.I have tried to test using openssl s_client -connect localhost:8888/newui:443 -ssl3 but am getting eror like ...
1
vote
1answer
42 views

What's the purpose of Server Key Exchange when using Ephemeral Diffie-Hellman?

What's the purpose of ServerKeyExchange when using ephemeral Diffie-Hellman? In this case, the ClientHello advertised EDH and EECDH (and not anonymous protocols), and the server selected ...
1
vote
1answer
65 views

Is it safe to combine AES with TLS?

Given that two clients want to sync data through a server, is it safe to use AES to encrypt the data and TLS to communicate with the server? Assumptions: Server has never access to unencrypted data ...
10
votes
4answers
2k views

How does HTTPS help websites under DoS attacks

From time to time one of the websites I browse regularly becomes a victim of a DoS/DDoS attack and usually they solve the problem by switching to https. I cant see the connection between the attack ...
3
votes
1answer
238 views

Can a malicious Tor exit node perform a HTTPS man-in-the-middle attack to see/modify your HTTPS traffic?

Let's say I am browsing the Internet using Tor - visiting https://example.com/login.php - and the NSA is operating the Tor exit node which I am currently routed to use. Can that NSA exit relay swap ...
3
votes
1answer
120 views

In depth TOR encryption design details

I am currently struggling with understanding the details of a connection in tor, mainly because I try to understand PCTCP. In this paper the authors claim that the changes are local to the onion ...
0
votes
1answer
14 views

What to choose ipsec or tlsv1 for rdp

I found a link but it didn't answered on my questions. (http://www.k2esec.com/secure-communications/network-security-protocols-ipsec-vs-tlsssl-vs-ssh-part-ii). I want to create secure connection for ...
5
votes
1answer
83 views

Mixing cheap SSL and EV SSL

We are a non profit and have been hosting an online site that accepts payments. It has been getting enough exposure now that we want to put an EV SSL certificate on the site. The question I have is ...
5
votes
1answer
40 views

What is the status of TLS snap start?

TLS snap start is an extension to TLS that allows one to use 0-RTT handshakes with TLS. The draft was created on June 2010 and expired in December 2010. I don't see any updates to the draft since. Is ...
0
votes
1answer
74 views

What does this mismatching SSL certificate hint at?

I'm currently visiting China, and I use a well known VPN service for both my laptop and my phone. Every now and then, I get certificate errors when using my phone when I'm connected to a VPN, but ...
1
vote
1answer
59 views

Check SSLv3 in Apache Tomcat locally as well as on server on windows/linux

I have given my website for testing, after testing they sent me a test report with details that the site has a security issue "SSLv3 POODLE information disclosure", and SSLv3 should be disabled to ...
-1
votes
2answers
65 views

SSL tunneling and how it is used to attack targets

How can SSL tunneling be used to attack a target, and how can I prevent such thing from happening? Does modern network/appliction firewalls have the capability to detect SSL tunneling? thanks Update: ...
0
votes
1answer
70 views

Can I create an SSL certificate on windows signed with the machine's certificate?

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a ...
1
vote
1answer
36 views

Re-Use Client Certifactes

I have a legacy web application where user are identified and authenticated with client certificates. Now, customer wants to use the same client certificate to authenticate against a newly created web ...
0
votes
1answer
125 views

Can HTTPS be compromised by first contact?

Let's say I am behind my PC and want to go to any secured website (HTTPS). I have the direct IP address so any possible hack on DNS level is not possible (because I am not using it ;) ). The packet ...
1
vote
1answer
57 views

Is microsoft.com not using TLS/SSL?

On my way to Microsoft to download "security essentials", I noticed that the download page isn't a secure site. Is this legitimately the case, or an indication that I may be compromised in some way? ...
0
votes
2answers
32 views

HTTP/S <-> HTTP/S cross-site requests: what do third-party websites know about where their objects are being referenced from?

There are four general cross-site request combinations security-wise, and I want to know whether ysite.com, in each case, knows that the reason I downloaded one of its resources was because I was ...
0
votes
1answer
53 views

RC4 support in SSL configuration

GitHub recently improved its SSL setup by removing RC4 support: To keep GitHub as secure as possible for every user, we will remove RC4 support in our SSL configuration on github.com and in the ...
1
vote
0answers
60 views

POODLE vulnerability solution : Effect on customer or client side

I am using windows server 2008 R2 and I have lot of customers who use windows XP,7 and 8 with some of them still using IE6. So now I want to disable SSL3 and enable TLS 1.1 as a security measure for ...
0
votes
1answer
38 views

Will Let's Encrypt require SNI from the operators?

I'm curious if anyone knows whether the upcoming Let's Encrypt initiative would effectively require SNI. What I mean is, with the proliferation of the cloud, almost every web-site owner, even with ...
-1
votes
0answers
64 views

How to protect TLSv1.2-transmitted data (such as login credentials) against the POODLE attack? [duplicate]

The TLS v1.2 is vulnerable to poodle attack, so my ques is that, if any user password is transmitting in plain text through TLS 1.2 then how we can secure the user credentials. Is it necessary to ...
1
vote
1answer
57 views

Perfect Forward Secrecy cipher suites

I have not found a straight forward way to determine where a given cipher list supports PFS or not. For instance, how can I use output of: $ openssl ciphers -v aECDSA:aECDH:kEDH:kRSA to determine ...
5
votes
1answer
110 views

Wordpress site redirects to different site when using https. Have I been hacked?

I own my domain and blog infrequently, when I try to access it over https I'm first shown a warning which says that the certificate isn't trusted. This is expected as I never configured SSL for my ...
0
votes
0answers
12 views

How to update libssl for TLS_FALLBACK_SCSV vulnerability on nginx configuration? [migrated]

I can't get the TLS_FALLBACK_SCSV to work when testing on SSLabs, keeping me from an A+ rating. Seems it an issue of libssl, not nginx configuration. I have updated to OpenSSL 1.0.1k 8 Jan 2015, but ...
2
votes
1answer
75 views

Does HTTPS protect you from fingerprinting by the NSA?

We've established that, for all intents and purposes, HTTPS hides what page you visit on a given server from NSA backbone wiretapping, but not the domain itself. But that's only IP / domain ...
12
votes
4answers
3k views

Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?

The reason I ask whether HTTPS protects the metadata of your Internet activity from a wiretapping entity on the backbone like the NSA or not, is the following scenario: Say I am browsing the ...
0
votes
2answers
130 views

SSL handshake exception: unable to find valid certification path to requested target

We are using a third party payment service for our web users to be able to pay for courses. Once payment is completed however, payu attempts to connect to our site and run an IPN. However, they get ...
-1
votes
1answer
66 views

Android phone (Kitkat) list A LOTS of CA under setting->security->Trusted credential,

My Android phone (Kitkat) list a LOTS of CA under setting->security->Trusted credential, does it mean that anyone who has accessed to anyone of those private keys of those CA(s) can monitor or do "Man ...