SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
1answer
16 views

Tomcat Client authentication

I want to make sure that my webapp is secured: I have a tomcat server - and defined the connector to use clientAuth="true". In my trust store there is only the certificate of my CA (self signed). ...
1
vote
0answers
40 views

How is the username and password captured on this mobile device?

I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html The poster says: For both of these ...
1
vote
1answer
40 views

Private CA and client server authentication

I have a private application - that has one server and many clients and I want to use two way authentication(AKA client auth) I use Tomcat server and java keytool to create TLS certificates. If I ...
0
votes
0answers
23 views

Can Web Proxy Autodiscovery leak HTTPS URLs?

The WPAD protocol can in some circumstances allow an attacker to get clients to use a malicious PAC script. It appears to be well documented, that this can be used to perform MITM-attacks on HTTP ...
2
votes
3answers
91 views

Maintaining data security in motion with SSL

I am hosting with a HIPAA compliant hosting company, as we are required to do because of the industry I am in. We have a BAA executed with them, and their responsibility terminates at the application ...
32
votes
5answers
3k views

What makes Let's Encrypt secure?

Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every ...
2
votes
1answer
32 views

Certificate Pinning and Corporate MITM

What I still don't understand about certificate pinning is - why am I still able to access Google apps through a corporate MITM? I know that I have the root cert for my corporation installed on my PC, ...
1
vote
1answer
23 views

TLS Certificates only for Clients

I'm aware that sites like StartSSL use Client-Certificates, I opened mine in Firefox and it showed me: "SSL-Client-Certificate", "E-Mail-Receiver-Certificate", "E-Mail-Signer-Certificate". Now I'm ...
4
votes
1answer
75 views

Insecure https connection to reputable companies' domains?

I'm getting notifications of untrusted https connections on reputable domains such as paypal.com and skype.com. Since big companies like those probably employ the top security professionals and best ...
2
votes
2answers
43 views

What is the impact of removing TLS_RSA_WITH_RC4_128_SHA from my server's cipher suite?

I run a website that supports many clients via webservices. I'm setting up some new certificates and load balancers and when doing ssllabs's server test, it's flagging all my ciphers as OK except ...
4
votes
4answers
138 views

If the public key can't be used for decrypting something encrypted by the private key, then how do digital signatures work?

I'm learning asymmetric encryption in the use case of ssl/tls protocol. I can understand that the public key (like a padlock) can encrypt (lock) something and only the private key can decrypt ...
7
votes
1answer
57 views

Distinguish between Wi-Fi Captive portal and MitM attack

Not sure whether this should be asked in Super User or here. How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS? Are ...
0
votes
4answers
140 views

Is TLS 1.0 more secure than TLS 1.2?

I just wanted to confirm, my system admin is telling me that TLS 1.0 is more secure than TLS 1.2 and told me I should stay on TLS 1.0...is this accurate? He mentioned that TLS 1.2 is more vulnerable ...
0
votes
1answer
39 views

Why aren't the TLD registries the TLS CAs?

Here's one thing I don't understand - why is it possible for a Chinese organization to forge an SSL certificate for an American website and the other way round? What led to a design decision of ...
2
votes
0answers
45 views

Why do I get a Secure Connection Error on some sites? [migrated]

I am using Firefox version 37.0.2 with an ethernet connection at a university in Bangkok. I consider the university a network a hostile environment as the majority of the computers on this network are ...
3
votes
0answers
41 views

Retaining origin when using Snort with a loadbalancer? Or why it's a bad idea? [migrated]

Initially I deployed HAProxy so that it would be possible to notice bad traffic going into my web server (rather than it being obscured by TLS), but now I noticed the rather obvious problem that once ...
2
votes
3answers
604 views

PCI Compliance Scan Failing for supporting TLS 1.0, but removing support breaks < IE 10

My company is receiving this message causing us to fail our TrustKeeper PCI compliance scan: Note to scan customer: This vulnerability is not recognized in the National Vulnerability Database. TLS ...
2
votes
3answers
102 views

How to tell if a SSL certificate is deployed correctly and check if it is working?

I have installed a SSL certificate on a server. Now, I want to check if it is correctly installed and is working. I have heard from my friend that when you are installing your own certificates in ...
2
votes
1answer
39 views

User-friendly TLS certificate validation

I'm designing an application in which clients generate their own TLS certificates ad-hoc (there's no central authority). When two clients interact for a first time, I need for them to mutually check ...
2
votes
0answers
41 views

How to create TLS SHA256 certificate request [migrated]

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
0
votes
0answers
51 views

Windows Server 2008 R2 - SHA2 based Cipher Suites [migrated]

I am currently in the process of upgrading the SSL certificates for various websites that I manage from SHA1 to SHA2 compatible certificates. To date we have always used 'RSA' as the key exchange ...
1
vote
0answers
68 views

How to recreate the Freak attack?

Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f. I ...
1
vote
3answers
234 views

Is browsing http sites insecure?

So for example this site, security.stackexchange.com, when I look in my browser it doesn't say that it uses https and it does say that my connection is not encrypted. The same goes for, say, ...
0
votes
2answers
59 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
-4
votes
0answers
18 views

Server side script to check if browser is vulnarable to SSLv3 Poodle [migrated]

I want to implement a browser SSLv3 Poodle vulnerability test like https://zmap.io/sslv3/sslv3test.html on my web application. My idea is to put a routine in the application first page to tell to my ...
1
vote
1answer
40 views

Is adding apt keys using wget secure?

Many (I would even say most) projects that have Debian repo give instructions like this (https://www.dotdeb.org/instructions/): 3. Fetch and install the GnuPG key wget ...
2
votes
1answer
56 views

SSL certificate connection is verified by proxy.abc.com, is this secure?

I am using chrome, and when I perform a google search I get the green icon in my browser. When I click on the icon to see the certificate information, in the 'Connection' tab is says: "The identity ...
0
votes
2answers
73 views

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
19
votes
3answers
2k views

Why do HTTPS requests include the host name in clear text?

I'm having a little bit of trouble understanding why the HTTPS protocol includes the host name in plain text. I have read that the host name and IP addresses of an HTTPS packet are not encrypted. Why ...
4
votes
3answers
836 views

“Authorized” Man in the middle

I am implementing a TLS connection with a basic server and client. It’s a one way connection: the server has a certificate chained to the CA, and the client has a collection of trusted root ...
0
votes
1answer
55 views

“Transferring” SSL certificate to another person [closed]

Last year, I did a lot of work on a site as a freelancer. We wanted to put the whole thing behind HTTPS, so, for reasons I can't recall but probably expediency-related, I purchased a cert for it under ...
0
votes
0answers
18 views

Blackberry 10 supported SSL/TLS/DTLS versions?

I'd like to know the supported SSL, TLS and DTLS versions in Blackberry 10? From a developer's perspective that is, what native support does BB 10 offer me to secure my app's communication? I've been ...
2
votes
1answer
142 views

This is 2015. Has SHA1 been exploited or cracked yet?

went to Qualys SSL lab and tested one web site. One of the findings says the site is signed with weak algorithm SHA1withRSA and I did some research all are saying we should change to SHA-2. may i know ...
1
vote
0answers
81 views

Consequences of disabling SSL2 and SSL3 on our webserver [migrated]

Our system is quite old and as a result gets an F grade for SSL from Qualsys SSL because the server supports SSL2 and SSl3. We have now identified all the browsers people are using. The oldest is ...
20
votes
5answers
3k views

Is it possible to “read” secure (using SSL or TLS) messages if you know the message?

If I am communicating over a secure line (secured using SSL or TLS) and I send the server a message. Could someone eavesdropping tell what that message was if they knew before hand a list of messages ...
1
vote
1answer
37 views

Running webserver with SSL enabled but not used

We have a web server hosted by a third party running on port 80. They have also enabled SSL but we did not use it. We are just using port 80. Right now, when I do a vulnerability scan, some SSL ...
0
votes
1answer
60 views

Solution for Protocol Downgrade Attacks

I have a Protocol Downgrade Attacks on my website, i have seen the solution to be as TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks refer link :- ...
0
votes
0answers
12 views

UTF8 and T61 strings, how do I see what my SSL cert uses? [migrated]

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
-1
votes
3answers
164 views

If TLS 1.2 is considered unbreakable, why do the NSA and other agencies invest in supercomputers? [closed]

If a 2048-bit RSA key and a 256-bit AES key are considered to be unbreakable within the foreseeable future by any kind of computer, why do the NSA and other intelligence agencies invest in ...
0
votes
1answer
50 views

Limiting a CA to only issue valid certificates to internal web sites and clients

What are the possible defense measures that can be applied to a simple PKI (no intermediate CAs, etc.) used to authenticate clients and servers over TLS on an internal network only? Certificates ...
5
votes
5answers
185 views

How can I explain self-signed certificates to users?

I don't trust certificate authorities, so I'm using a self-signed certificate on my server. The server provides both a website as well as other services. Most modern SSL-capable software, upon ...
1
vote
2answers
54 views

Does each device of the same model have different SSL certificates for them?

Lets say my company produces a device which can be connected to secure websites or it may act as some kind of server. Lets say I produced 100 pieces of the same device. Should I get one SSL ...
-1
votes
0answers
11 views

Steps for setting up certificate based authentication [migrated]

We have developed wcf service which we need to expose to customers. We plan to use certificates for security and authentication of clients. How do we go about this, what are the steps involved? ...
22
votes
3answers
2k views

What ways are there to verify a self-written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter. I needed to secure ...
1
vote
0answers
44 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
1
vote
2answers
47 views

Is Ignoring SslPolicyErrors while doing SSL Pinning Secure?

I am implementing SSL pinning as a security requirement for a project and the HTTPS endpoint is giving me SslPolicyErrors. The following errors occur, RemoteCertificateChainErrors ...
-2
votes
0answers
26 views

SSL Made my Subdomain Inaccessible [migrated]

I have an SSL certificate which is for the root domain https://diginomics.com domain only. However, after I successfully installed the certificate it also changed the URL of my subdomain ...
4
votes
2answers
204 views

Is cacert.org more harmful than self-signing?

I don't understand the https security model attempted upon me by The OpenBSD Journal (undeadly.org). Instead of using self-signed certificates for https like they did in the past, they for a while ...
0
votes
1answer
38 views

MitM Chrome Mobile

I just came across the issue about MitM on Opera/Nokia browser 2013. I know, this is an "old" problem, but it seems very interesting to me. I was wondering how Chrome on mobile handles the SSL ...
1
vote
0answers
92 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...