SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

1
vote
1answer
15 views

Public Key Pinning and subdomains

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
3
votes
2answers
198 views

Best way to scan for and eliminate earlier versions of SSL/TLS in a production environment

Due to new PCI DSS standards mandating that nothing lower than TLS 1.2 be used in a PCI environment, I am tasked with phasing out anything lower than TLS 1.2 on every device in this environment by our ...
1
vote
3answers
56 views

Difference between OpenSSL and keytool

I was wondering about differences between using OpenSSl or Keytool and generating certificates by them. I think Keytool is used by Java community but for someone who is not remotely connected to Java ...
1
vote
1answer
45 views

Purpose of client and server random numbers in SSL Handshake

I could not understand why in the Client hello and Server hello in SSL Handshake client needs to send to server (publicly) a random number and vice versa. From these numbers a Pre-Master secret will ...
3
votes
1answer
61 views

End-to-End (Point-to-Point?) Email encryption

I'm looking into providing security for the email server I recently deployed, however the subject matter is a touch more complex than I anticipated and I would appreciate confirmation or correction of ...
4
votes
2answers
48 views

Are the rules used to validate certificates in the major browsers documented anywhere?

I'm trying to get a certificate that's good for two subdomains. Essentially, the TLS equivalent of the human-level logical cert "*.*.example.com". I've tried: Name constraints: these work in the ...
8
votes
2answers
1k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [on hold]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
2
votes
1answer
27 views

New certificate but what about the keys?

One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a ...
2
votes
2answers
157 views

Is always using HTTPS a good idea? [duplicate]

OK, this question might seem a no-brainer for a professional but keep in mind I am not a professional web developer so my knowledge in this field is very limited. I have been pondering over time ...
2
votes
2answers
64 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
4
votes
2answers
55 views

Understanding Digital Certification as as a whole starting from a normal http request

I am very new to security and i do not come from an IT background. Please pardon me if i ask some very simple and questions that don't make sense. I am trying to understand the difference between ...
-1
votes
0answers
16 views

Is 3DES is a weak cipher? [duplicate]

Our application runs on JBoss 6 + jdk 1.7. We use the jdk provided SSL provider. The server.xml file contains SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA in the cipher lists. Is it a weak cipher? Should we ...
4
votes
2answers
50 views

Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised?

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company ...
1
vote
0answers
24 views

At what point is information encrypted when communicating from a C# program over HTTPS? [on hold]

So I was running a communication log on an application I support I noticed that within the log there was a request string that displayed my password in cipher-text, but the next request string down, ...
8
votes
2answers
161 views

Why is Tor over HTTPs insecure?

I don't get how a HTTPs connection over Tor can be insecure. Where's the difference between a normal HTTPs connection and a TOR -> HTTP connection? Many sites recommend to use the Onion-URL instead of ...
14
votes
4answers
2k views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
20
votes
4answers
2k views

Cloudflare's free SSL options require trusting them; what could they do to change that?

Cloudflare offers 3 free SSL options: Flexible SSL, Full SSL, and Full Strict SSL. The article “CloudFlare’s great new features and why I won’t use them” explores the shortcomings of the Flexible and ...
1
vote
0answers
153 views

How to explain BEAST attack to non-tech people

I'm looking for the best way to describe the Browser Exploit Against SSL/TLS (BEAST) attack to non-technical people, without being too general. So I am not looking for: "did you ever noticed the lock ...
1
vote
2answers
262 views

Should I invest my time in making my site HTTPS-only?

I'm building a Django website that does not need to have registration/authentication. The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
-5
votes
0answers
40 views

Tunnelling for security [closed]

I want to tunnel HTTP over DNS over IPSEC over PPTP over Telnet over PNG (imbedded via Steganography) over HTTPS How to do dis? EDIT: Software I am using is notepad.exe I have tried to do ...
2
votes
2answers
84 views

HTTPS POST request header versus request body

Is there any security difference between placing sensitive data, such as an API key in a POST request header versus the POST request body assuming the API server is HTTPS-only? While you frequently ...
2
votes
0answers
74 views

Impact if password is visible on interceptor in case even we deployed HTTPS [on hold]

Our application is on HTTPS but password is visible on interceptor while when we check it via Wireshark it's encrypted. Is there any risk in it? And what kind of impact it can have?. We provided the ...
4
votes
2answers
116 views

Usage of Ephemeral Diffie-Hellman ciphers in 2015 and beyond

In determining TLS standards for my company, I have come to wonder why all recommendations still suggest the use of the Ephemeral Diffie-Hellman TLS ciphers starting in TLS_DHE_xxx Background and ...
0
votes
3answers
111 views

Best way to securely send passwords from an application to a user operated server

I have the following situation: A user sets up a server that will have to receive login details. Other users then create accounts and login to this server. All this happens only over LAN. I'm ...
0
votes
0answers
51 views

How can I protect a mobile application from LogJam?

I develop a two-factor authentication app on iOS and Android and I recently noticed that they run perfectly fine against a local dev server that is vulnerable to LogJam. Is there any way to secure ...
1
vote
0answers
51 views

Can TLS provide integrity/authentication without confidentiality

It was a bit surprising when wikipedia has switched to TLS because we all know it's public information available to anyone, but I suppose that the real purpose for that is to provide ...
3
votes
1answer
53 views

Bi-directional authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the abovementioned CA. Server has its own ...
0
votes
0answers
28 views

“encrypted using an obsolete cypher suite” - After using IIS Crypto best practices [duplicate]

I've used the IIS Crypto tool, using best practices and I still get "encrypted using an obsolete cypher suite" In Google Chrome. There's so many various cypher suites, and I'm yet to find a ...
0
votes
1answer
36 views

Getting a certificate warning for one email but not another

When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private". Here are the ...
1
vote
2answers
47 views

Is the (SSL3-based) SSTP VPN protocol vulnerable to the POODLE attack?

The Secure Socket Tunneling Protocol is a VPN protocol developed by Microsoft. It sends traffic over an SSL version 3 connection. Since SSlv3 is vulnerable to the POODLE attack, does this mean that ...
3
votes
1answer
40 views

Is intercepted ssh-socks traffic revealing HTTP object count and sizes?

I read an article titled the network is hostile, in which the following is stated: Traffic analysis remains a particular problem: even knowing the size of the files requested by a TLS-protected ...
0
votes
1answer
42 views

What is the proper setup procedure for SSL Tunnel certificates?

I am a systems integrator using a system designed for bringing HVAC data up to a common interface; this system/software platform is called Niagara AX. The combination of the customer's network setup ...
0
votes
0answers
46 views

RSA BSAFE Crypto-J JCE provider - “Server Hello” returns unassigned Named Curve

I'm using the RSA BSAFE Crypto-J 6.2 JCE provider in Java as SSL/TLS server (in FIPS 140 Compliant Mode for SunJSSE). when I use any elliptic curve based key exchange mechanism the handshake fails ...
1
vote
1answer
27 views

Will TLS_FALLBACK_SCSV on a server that only supports TLSv1 block a connection from a client using TLSv1.2

I've read the draft RFC in relation to TLS_FALLBACK_SCSV and understand that if both the client and server implement this feature and a client sends this as part of clienthello, the server must reject ...
2
votes
1answer
40 views

How often should TLS Session Ticket Keys be rotated?

I am configuring a non-sticky load balanced cluster of HTTPS servers. To enable TLS session resumption when a previous client reconnects to a different server in the cluster I will be configuring ...
2
votes
2answers
125 views

Named curve value 0xffff in 'Server Hello' message

I'm using the RSA BSAFE Crypto-J 6.2 JCE provider in Java as SSL/TLS server (in FIPS 140 Compliant Mode for SunJSSE). It seems like at least Chrome and Firefox cannot establish a connection if ...
2
votes
1answer
51 views

Why not use same certificate for webserver TLS and Signing in SAML?

I have read a bit about configuring shibboleth, and recommendations for SAML at internet2 I get the point that a certificate does not have to be signed when used for SAML, because actually only the ...
15
votes
3answers
1k views

Why are CA-issued certificates considered so much more secure than self-signed certificates

I looked at other Stack Exchange posts explaining why self-signed certificates are not as secure as CA-issued certificates, and most of these pages say the same thing: If it's self-signed, and the ...
1
vote
3answers
146 views

MITM on popular sites - DNS

Can a MITM attack on popular sites such as Facebook.com Google.com be done by intercepting the DNS requests? Will the user notice something? For instance: Loading https://fb.com The client ...
1
vote
1answer
65 views

Certificate expiry validation - in what stage?

I'm implementing certificate expiry validation for a client. I'm not sure about the following. Is there a standard/popular implementation regarding the order of validation- Check if the ...
0
votes
0answers
34 views

Enable only TLS 1.2 connection to my website [migrated]

All those web browsers that cant make a TLS 1.2 connection to my website should not be able to access it. I am using apache tomcat server. What all configurational changes do I need to make in order ...
-1
votes
1answer
42 views

Scanning and SSL Bypass Options

I'm looking at implementing SSL Interception on my local firewall, as well as implementing URL filtering. How would I be able to tell if a site was being 'blocked' or not accessible because of the ...
1
vote
0answers
32 views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: ...
0
votes
2answers
72 views

Encryption in case of distributed architecture

I have application infrastructure as follows - web client -> load balancer -> Apache (web server) -> Weblogic (application server). I could understand that in case of HTTPS request, SSL handshake ...
2
votes
1answer
39 views

How to securely provide SSL certs to a Docker app

What is the most secure way to provide SSL certificates (for HTTPS) to a Docker application? The approaches I've considered: The environment It's common (but obviously not required) to use the ...
2
votes
1answer
44 views

Setting node.js TLS ciphers vs observed behavior

I have a node.js server that I'm configuring for TLS 1.2. I set the following options in the config of my https server: ciphers: ...
1
vote
0answers
15 views

Testing my TLS1.1 connection code [migrated]

I have a desktop client application (Windows) developed using C++. It connects to the web services hosted on the IIS on the server. Currently I am in the process of porting this application to use ...
2
votes
1answer
120 views

How can Heartbleed checkers determine if a site is vulnerable?

As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or ...
3
votes
1answer
163 views

Why does IE11 refuse to back navigation caching for HTTPS?

On my website, I get this error message in the console: DOM7011: The code on this page disabled back and forward caching. For more information, see: http://go.microsoft.com/fwlink/?LinkID=291337 ...
-1
votes
3answers
61 views

Can a website that uses https be absolutely reliable? [duplicate]

Https websites cover some security requirements and certify the author, but how can we be sure that an author of such an https website is not malicious?