SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
0answers
19 views

Is it possible to configure Azure Web site SSL protocols & ciphers

I want to be able to disable TLS 1.0 protocol and the RC4 cipher on an Azure website (or Web App) and I can't figure out if it's possible or not. I know what registry settings to update but the ...
0
votes
1answer
29 views

Is adding apt keys using wget secure?

Many (I would even say most) projects that have Debian repo give instructions like this (https://www.dotdeb.org/instructions/): 3. Fetch and install the GnuPG key wget ...
2
votes
1answer
46 views

SSL certificate connection is verified by proxy.abc.com, is this secure?

I am using chrome, and when I perform a google search I get the green icon in my browser. When I click on the icon to see the certificate information, in the 'Connection' tab is says: "The identity ...
0
votes
2answers
54 views

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
14
votes
3answers
2k views

Why do HTTPS requests include the host name in clear text?

I'm having a little bit of trouble understanding why the HTTPS protocol includes the host name in plain text. I have read that the host name and IP addresses of an HTTPS packet are not encrypted. Why ...
-3
votes
0answers
35 views

security reason stops me from login into facebook [on hold]

The time limited was exceeded meaning it would not allow me to go forward.i had to pick a couple of friends pictures for security reason.
4
votes
3answers
756 views

“Authorized” Man in the middle

I am implementing a TLS connection with a basic server and client. It’s a one way connection: the server has a certificate chained to the CA, and the client has a collection of trusted root ...
0
votes
1answer
50 views

“Transferring” SSL certificate to another person [on hold]

Last year, I did a lot of work on a site as a freelancer. We wanted to put the whole thing behind HTTPS, so, for reasons I can't recall but probably expediency-related, I purchased a cert for it under ...
0
votes
0answers
57 views

Connect a server and client securely without using HTTPS? [on hold]

I'm having a lot of trouble with a question on a homework assignment. Here is the question: Suppose a web client and web server for a popular shopping web site have preformed a key exchange so ...
0
votes
0answers
14 views

Blackberry 10 supported SSL/TLS/DTLS versions?

I'd like to know the supported SSL, TLS and DTLS versions in Blackberry 10? From a developer's perspective that is, what native support does BB 10 offer me to secure my app's communication? I've been ...
2
votes
1answer
123 views

This is 2015. Has SHA1 been exploited or cracked yet?

went to Qualys SSL lab and tested one web site. One of the findings says the site is signed with weak algorithm SHA1withRSA and I did some research all are saying we should change to SHA-2. may i know ...
1
vote
0answers
80 views

Consequences of disabling SSL2 and SSL3 on our webserver [migrated]

Our system is quite old and as a result gets an F grade for SSL from Qualsys SSL because the server supports SSL2 and SSl3. We have now identified all the browsers people are using. The oldest is ...
20
votes
5answers
3k views

Is it possible to “read” secure (using SSL or TLS) messages if you know the message?

If I am communicating over a secure line (secured using SSL or TLS) and I send the server a message. Could someone eavesdropping tell what that message was if they knew before hand a list of messages ...
1
vote
1answer
37 views

Running webserver with SSL enabled but not used

We have a web server hosted by a third party running on port 80. They have also enabled SSL but we did not use it. We are just using port 80. Right now, when I do a vulnerability scan, some SSL ...
0
votes
1answer
49 views

Solution for Protocol Downgrade Attacks

I have a Protocol Downgrade Attacks on my website, i have seen the solution to be as TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks refer link :- ...
0
votes
0answers
12 views

UTF8 and T61 strings, how do I see what my SSL cert uses? [migrated]

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
-1
votes
3answers
152 views

If TLS 1.2 is considered unbreakable, why do the NSA and other agencies invest in supercomputers? [on hold]

If a 2048-bit RSA key and a 256-bit AES key are considered to be unbreakable within the foreseeable future by any kind of computer, why do the NSA and other intelligence agencies invest in ...
0
votes
1answer
47 views

Limiting a CA to only issue valid certificates to internal web sites and clients

What are the possible defense measures that can be applied to a simple PKI (no intermediate CAs, etc.) used to authenticate clients and servers over TLS on an internal network only? Certificates ...
5
votes
5answers
175 views

How can I explain self-signed certificates to users?

I don't trust certificate authorities, so I'm using a self-signed certificate on my server. The server provides both a website as well as other services. Most modern SSL-capable software, upon ...
1
vote
2answers
54 views

Does each device of the same model have different SSL certificates for them?

Lets say my company produces a device which can be connected to secure websites or it may act as some kind of server. Lets say I produced 100 pieces of the same device. Should I get one SSL ...
-1
votes
0answers
11 views

Steps for setting up certificate based authentication [migrated]

We have developed wcf service which we need to expose to customers. We plan to use certificates for security and authentication of clients. How do we go about this, what are the steps involved? ...
-2
votes
0answers
55 views

Copyright Issue? [on hold]

Few months ago, I have created a few icons for my app and after copyrighting them, I published them on my website. I clearly stated on my website that it is illegal to use my icons for commercial or ...
21
votes
3answers
2k views

What ways are there to verify a self-written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter. I needed to secure ...
-3
votes
0answers
22 views

Security of SoftEther service [closed]

I have some VPN servers but I want to run a new one. What I have heard about the security of SoftEther is not really good. It logs many things on the server It is really heavy to load on client side ...
1
vote
0answers
36 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
1
vote
2answers
43 views

Is Ignoring SslPolicyErrors while doing SSL Pinning Secure?

I am implementing SSL pinning as a security requirement for a project and the HTTPS endpoint is giving me SslPolicyErrors. The following errors occur, RemoteCertificateChainErrors ...
0
votes
0answers
154 views

Your connection to website is encrypted with obsolete cryptography in Chrome [closed]

I can see the warning in about the our SSL certificate. This is chrome browser alone. See the below screenshot. I have check this problem in some links, they mentioned there is problem in key ...
-2
votes
0answers
26 views

SSL Made my Subdomain Inaccessible [migrated]

I have an SSL certificate which is for the root domain https://diginomics.com domain only. However, after I successfully installed the certificate it also changed the URL of my subdomain ...
4
votes
2answers
197 views

Is cacert.org more harmful than self-signing?

I don't understand the https security model attempted upon me by The OpenBSD Journal (undeadly.org). Instead of using self-signed certificates for https like they did in the past, they for a while ...
0
votes
1answer
36 views

MitM Chrome Mobile

I just came across the issue about MitM on Opera/Nokia browser 2013. I know, this is an "old" problem, but it seems very interesting to me. I was wondering how Chrome on mobile handles the SSL ...
1
vote
0answers
64 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
11
votes
3answers
2k views

Why is my Positive SSL certificate deemed insecure by Google Chrome? [duplicate]

We run a website over HTTPS with a wildcard certificate from Positive SSL. Today, when I opened Google Chrome (v. 42.0.2311.90 m) and navigated to the site, I noticed a red cross through the https ...
0
votes
4answers
102 views

Risks of using HTTP

What are the risks of using HTTP instead of HTTPS assuming that there isn't any rogue hacker sitting on my personal WIFI network waiting to sniff my traffic? Can a hacker sit in his boat in the ...
1
vote
2answers
54 views

Website Certificate with different public key

I've installed a ssl certificate from https://www.startssl.com/ in a server running with plesk. The website is the following: https://refood.sal-pimenta.pt/ As you can see the certificate is fine but ...
-1
votes
0answers
39 views

Your connection is not private - delete certificate/security exception? [closed]

I am trying to browse to a certain url and it gives me this error: "Your connection is not private" I understand I need an SSL certificate for that site. Well I got one for the site, but now I need ...
1
vote
2answers
70 views

SSL Authenticated SOAP Request works in SoapUI but not through code

I am connecting to a SOAP webservice that requires SSL authentication. I (the web service client) have a .pfx file and provided the public certificate for that file to the company whose web service I ...
-1
votes
0answers
13 views

Specify outgoing SSL-Port in mitmproxy [closed]

how can i change the outgoing SSL/TLS-port of mitmproxy to another port than the default 443? Reason: I want to use mitmproxy with TLS-O-Matic, which operates on different ports. Thank you!
3
votes
2answers
107 views

Payment form from http is secure? [closed]

There are lot of payment gateways (Worldpay, PayPal, ..) offering easy integration, when the plain webpage using URL redirection to the payment page. HTTPS (worldpay,paypal), where the user posts his ...
4
votes
1answer
95 views

REST API communication between two Web Servers - VPN or https?

We have two servers that will be sharing data and communicate over a REST API: our main application server will communicate with the server of our client that is managing some assets. In short: Given ...
4
votes
1answer
77 views

Does mutual SSL authentication increases protection against a Poodle attack?

Recently we found our self pondering whether a certificate based mutual SSL authentication protects against a Poodle attack over SSLv3? We’re stuck in a situation where a client-application only ...
2
votes
1answer
95 views

Security Structure of an API

I've been developing a web application and APIs for 8 months. I implemented OAuth 2.0 client credentials for authentication. And now I have to implement TLS to my APIs. I've been dealing with SSL/TLS ...
23
votes
2answers
2k views

What is the purpose of frequently rotating TLS certificates without changing underlying keys?

I read in the OWASP cheat sheet regarding certificate / public-key pinning that “Google rotates its certificates … about once a month … [but] the underlying public keys … ...
-1
votes
1answer
18 views

Cannot establish connections between clients on JRE1.8 and servers on JRE1.7 [closed]

we have a client application compiled with JDK1.8, and an external server application runs with JRE1.7 or earlier versions. We don't know the exact JRE version of the server side. The problem here is ...
1
vote
1answer
44 views

SSL Test Server with typicals Flaws [closed]

i am testing different SSL-Proxys and want to know more about their failure-handling. Do you know about an public (test)server (HTTPS) which provides the typical flaws like: Expired certificate ...
-2
votes
1answer
73 views

Fiddler Can decrypt https traffic

So apparently, a software called fiddler is able to very easily decrypt secure https traffic with a click of a few buttons: http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/DecryptHTTPS I ...
0
votes
1answer
31 views

Browser Unable to Fully Authenticate HTTPS

I'm attempting to fully verify the HTTPS encryption using Chrome & Firefox but both browsers currently display the connection as 'including resources which are not secure'. I have tried using ...
14
votes
2answers
2k views

Why is Symantec/Verisign CA appearing as an invalid authority? [closed]

Typical browsing to www.BankOfAmerica.com got me an ERR_CERT_AUTHORITY_INVALID error. This was with an up-to-date production version of Google Chrome for Mac. I tried with Safari, and got the same ...
10
votes
2answers
2k views

How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

I checked out the app Packet Capture. This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root. How can I ...
3
votes
1answer
92 views

Client Certificates

After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario. I have a ...
1
vote
1answer
37 views

Reading encrypted data before sent to remote server

I'm developing a mobile app (Android only for now) to provide a disposable e-mail service to users. Users will be given temporary e-mail addresses so they can receive and read e-mails for a certain ...