SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

1
vote
0answers
7 views

Which clients support only TLSv1.1 but not TLSv1.2?

I phrased the question originally as Is there any point in supporting TLSv1.1 on the server side? The recommended current setup if you don't have full control over your clients is to support TLSv1.0, ...
3
votes
2answers
44 views

How to trust root CA

When I download a browser such as Mozilla, it comes bundled with several root Certificates. How do I trust that these certificates are legitimate? How do I know that my download does not contain ...
0
votes
2answers
16 views

Integrity of downloaded Oracle JDK (/software in general)

Found something related Why aren't application downloads routinely done over HTTPS? This is a question about general security from a noob. I couldn't find anything relevant about this topic via ...
-1
votes
1answer
22 views

In what order are digital certificates verified?

I understand how digital signatures work and how they are verified, but in what order does the CA verify each of the attributes of the digital certificate such as version, issuer, validity etc..? Any ...
0
votes
0answers
18 views

SSL Certificate for Web API [duplicate]

I'm currently developping a web html/2 API for my mobile application, and I would need an SSL certificate for my application, Is it safe if i use a self-signed SSL certificate rather than a trusted ...
0
votes
1answer
57 views

Who is responsible for generating public key during secure communication?

This must be easy but I am getting a little confused. Say, facebook.com, it has a certificate which is signed by an intermediary CA. Who generated that public key that I can see in facebook ...
1
vote
3answers
56 views

Is it secure to have only https binding in IIS?

I have an API that I want to be accessible only by HTTPS. I know I can use URL-rewrite to force a redirect, but don't want to install additional modules. I was wondering whether only providing an ...
1
vote
0answers
33 views

AES256 key exchange

I'm trying to get a secure way of exchanging keys between my client application and the server. The goal is to encrypt all XML messages with AES256. These XML's will be transferred to the server ...
1
vote
2answers
70 views

Should JWT token be stored in a cookie, header or body

What is the most secure way to store transfer and store a JWT token, or any authentication token in general? Someone told me it's secure to send the authentication token as a cookie, but I don't ...
0
votes
1answer
55 views

Does HTTPS protect from session riding?

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to ...
1
vote
2answers
44 views

Should each service running on a domain have a separate certificate?

I have a domain name with dynamic DNS (DDNS) for my home server on which I expose multiple services (web server, wikis, issue trackers, etc.) online. Some services are hosted by the same software (e.g....
-4
votes
0answers
212 views

Reverse the encryption (part of the Labyrnith ctf challenge) [on hold]

So my friend and I were trying to do this ctf challenge here http://labyrenth.com/ and when we were trying to solve the first part of the "Threat" challenges we stumbled upon a challenge we have no ...
1
vote
1answer
19 views

Regarding Openssl.config file: What is the importance of policy matching when creating a self-signed certificate with the aid of this file?

When trying to go through some material for self-signing a certificate, one of the steps required me to set policy conditions in this config file. See: https://www.phildev.net/ssl/opensslconf.html ...
-8
votes
0answers
26 views

What are some real life examples of Certificate Authority? [on hold]

What are some things that use a CA & the PKI such as websites. Does Chase bank use this feature?
2
votes
1answer
38 views

Two roots for an SSL certificate

Please consider the following scenario: I have an SSL end certificate issues by a well-known authority (e.g. COMODO). I have my own self-signed root and intermediate certificates which are used by ...
1
vote
2answers
62 views

TLS version of cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA

I have a question related to the cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039). It is first mentioned in RFC3268 in 2002. The highest available TLS version in 2002 was TLS 1.0 (RFC 2246). ...
9
votes
2answers
793 views

httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?

There's a new fancy-named, branded vulnerability called HTTPOXY. My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)? ...
4
votes
1answer
59 views

How does the client pick the correct certificate from its certificate store?

As I am able to configure my SQL Server and client to establish SSL connection, I have installed the certificate on the server as well as on the client machine (Trusted Root Certification Authorities ...
2
votes
1answer
25 views

Establishing trust between a device and a developer, TLS signal vs X.509, GnuPG (or both)

Let's say you wanted to implement a "secure sideloading" mechanism for your embedded device so that the device could establish trust with authorized 3rd party developers. Developers would have local ...
4
votes
3answers
133 views

Should I provide https downloads?

I've seen several articles like The sad state of Linux download security that suggest you should offer downloads of software updates via https. But is there any point in doing this if your website ...
-6
votes
1answer
39 views

From what area did text message come from on July 16at 12:39 a.m. telephone number 202 706-2957 [closed]

phone number 202-706-2957forward the text message come from July 16th at 12:39 a.m.
2
votes
3answers
72 views

What specific information is used to verify an SSL certificate?

When a CA's SSL certificate is stored in a browser, a server which presents a certificate signed by this CA can be verified by the browser. My question is: How exactly is this verification done? I ...
2
votes
0answers
18 views

Mixing Off-The-Record and classic SSL

I am developing some pubsub system on top of Node.js and Socket.io. I decided to implement Off-The-Record (OTR) encryption by default for all of data transfers between clients and server(s). Question ...
2
votes
2answers
89 views

TLS Version specific cipher suites

I have come across that GCM, CCM, SHA-256 and SHA-384 Cipher suites are TLS 1.2 only. So TLS handshake can not be performed with lower TLS version using these suites. I am trying to figure out ...
1
vote
3answers
44 views

Mutual Authentication - client authentication to the server via IP / FQDN?

I'm trying to get a better understanding of the Server / Client Mutual Authentication process in a TLS1.2 mutual authenticated session. My understanding is that the client is able to fully ...
3
votes
1answer
95 views

sslv3 alert handshake failure with openSSL and python requests

I'm having issues invoking a RESTful API secured via mutual SSL. I have no issues invoking the API in SOAPUI after providing the keystore with the private and public key to use for mutual SSL. In a ...
4
votes
1answer
43 views

Why doesn't my leaf certificate validate against the root CA only

I created a root CA and intermediate CA, then used the intermediate to sign a leaf cert, for the purpose of enabling SSL on various web servers in an internal network. I'm trying to figure out if I ...
-1
votes
0answers
13 views

How Certicate is stored in SSL_CTX? [closed]

How CA and device Certificates are stored in SSL Context ?
1
vote
1answer
41 views

Secure channel without identifying information

Is there a way to establish a secure channel like ssl or ssh without leaking identifying information to an observer, especially the server's public key? Are there real implementations?
1
vote
1answer
39 views

Can we provide our external certificates to a customer's SQL Server for SSL?

In designing hosted software that interfaces with a client's SQL Server over TCP/IP and we may wish to offer the option of using SSL/TLS. One architecture that seems attractive is where we generate a ...
4
votes
2answers
73 views

Can a SSL Certificate dictate protocol?

I know you can set the protocol/cipher via your web server: Nginx: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; Apache: SSLProtocol all -SSLv2 SSLCipherSuite ...
1
vote
0answers
16 views

Renewing client based certificates

Could someone help me on the best practice of renewing client certificates used in SSL/TLS. Is there any standard time to renew the client certificate and if not renewed within that time limit what is ...
-1
votes
0answers
38 views

Why is SSL/TLS considered to be located in between Transport and Application layers as opposed to being 100% Application layer [closed]

In literature, I see TLS/SSL as being located in between the Application and transport layers. It is not definitively classified as belonging to either of them. When it comes to the programmer ...
1
vote
1answer
30 views

Is HPKP enforced on the server or in the client?

I'm trying to learn about HPKP and I am trying to grasp if it is just a level of protection for user agents to mitigate MiTM attacks over HTTPS or if the server also plays a role. Please keep in ...
1
vote
1answer
42 views

Which of the TLS ciphersuites are more faste and secure in Handshaking?

I know "SSL 3.0" and TLS 1.0 have weakness security, because using of "RC4" cipher. instead it, "TLS 1.2" have more security, now I want to use of a fast ciphersuite and a complicated handeshake ...
2
votes
1answer
29 views

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS)?

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS) and if so, why? With preloading: Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Without ...
6
votes
1answer
2k views

How do I know if my company or my ISP is using a TLS proxy?

I was reading the other day on "Does https prevent man in the middle attacks by proxy server?". Let me quote few lines: Blue Coat, the biggest name in the SSL interception business, is far from ...
1
vote
1answer
155 views

Do my router and OS “know” which URLs I visit, if SSL is used?

Is it possible for a router or an operating system to get access to URLs I visit in my browser, if SSL-encryption is used between a browser and a webserver?
3
votes
2answers
79 views

Choice of authentication when both HTTP and HTTPS are supported

I am looking at a system where you are able to choose if you are going to connect to the web application via HTTP and/or HTTPS. You have to authenticate on either one. I know that the best option is ...
0
votes
3answers
110 views

Securing a private API that's visible on the public Internet

I'm making an API for my own software. The API currently used for registering users, viewing users information and updating users information. In the future it will be used for billing, support etc .....
30
votes
5answers
2k views

Is there a risk to a business that is using a shared certificate?

I was looking at my bank website's certificate and discovered that it's issued to multiple websites, and the bank's domain name is only listed among many other domains in the 'alternative names' field....
2
votes
0answers
27 views

TLS 1.2 ECDHE_RSA signature [migrated]

I'm currently working on a Java TLS server. I'm trying to get the following CipherSuite to work : TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA When I test it using openssl s_client I get the following error ...
2
votes
1answer
156 views

How does a firewall doing HTTPS inspection verify the servers certificate?

I have a question about HTTPS inspection. As per Checkpoint website: In outbound HTTPS inspection, when a client in the organization initiates an HTTPS connection to a secure site, the Security ...
27
votes
5answers
3k views

What's the difference between using HSTS and doing a 301 redirection?

If I already have done a 301 redirection from all the HTTP inner pages to HTTPS, why should I use HSTS as well?
1
vote
3answers
77 views

Is SSL Interception possible without disabling Public Key Pinning on the client side?

I'm currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites. But there are some sites which use HTTP Public Key Pinning to prevent MitM ...
0
votes
2answers
52 views

Can I be MITMed when accessing an HTTPS website from my own device through a third-party network? [duplicate]

If I'm using a device which isn't mine for accessing a website, then I assume the administrator of that device/LAN could read anything I do on it, no matter if it's an HTTPS connection or not. But, ...
0
votes
1answer
25 views

compare cipher suites between different OpenSSL Versions

How to find cipher suite changes within different OpenSSL versions ? Let's assume that the OpenSSL package was update to openssl-0.9.8e-36.0.1.el5_11 and I'm able to find from release notes what ...
0
votes
3answers
136 views

Can a Man In The Middle attack cause a certificate error? [closed]

I was playing around with Ettercap and I performed an ARP spoofing, MiTM attack on a friends computer as a joke. Now (about a day later) she tried to login to a website for work and it said "Your ...
1
vote
0answers
33 views

What information can be seen when I'm using SRTP via XMPP?

Just as the title goes, basically what data/information can be tracked when using SRTP via XMPP? As client I'm using Jitsi. If things works in some aspects similar to HTTPS, I guess that maybe it ...
0
votes
1answer
52 views

How SSL server can select cipher suite from Client proposed parameter?

When Client send list of cipher suites in client hello.. at that time server will select from one cipher suite. I want to know how it is selected?