SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
0answers
18 views

Regarding the storage of Root CA certificate and any Intermediate root CA certificate on Embedded Device

The overall system setup is as explained SERVER which connects with the client(Embedded device) on SSL/TLS Embedded Device which acts a CLIENT and communicates with the server The Server can also ...
1
vote
1answer
27 views

Does SSL/TLS have the feasibility of detecting malicious things during transmission? [on hold]

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly ...
3
votes
2answers
79 views

Bank login in foreign country

I have friends an family that travel/live in foreign countries and compromised unsecure wireless networks and credit card scanners have always been a problem. I was recently asked a question about ...
2
votes
1answer
27 views

Website Implementing https site w/ self signed certs and CA

Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)? I am some what torn on how to do this - I have a number of implementaiton ...
0
votes
3answers
56 views

commercial CA for your client certificates?

I seem to have mis-understanding around client auth certs... If you have software that will use Client Auth certificates over SSL (such as those installed on a remote desktop via Windows Certificate ...
0
votes
3answers
100 views

Decrypting SSL over a Mobile Network

I work for a large company and we are trying to judge the safety of some proprietary information that is being sent and received in a new application we are developing. After our initial testing we ...
5
votes
1answer
33 views

Protecting information in TLS client certificates

If I understood correctly, when using TLS with client authentication, the client certificate is transmitted to the server in plain text. The client certificate might include personal information, ...
0
votes
1answer
41 views

SSL over self-implemantation of RSA?

I currently write a client application which communicates with a PHP server. The application itself requires valid user credentials and get all of his information by doing POST requests to the PHP ...
0
votes
2answers
21 views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
4
votes
2answers
162 views

OpenSSL vulnerability CVE-2015-0205

I can't seem to make any sense out of the following vulnerability in OpenSSL: DH client certificates accepted without verification [Server] (CVE-2015-0205) ...
0
votes
2answers
45 views

HTTPS in request and HTTP in response [on hold]

If I have an API that calls a backend webservice, is it possible to use HTTPS in the request and just HTTP in the response? I have such a question because I want to protect my OAuth token in my ...
0
votes
0answers
18 views

What is the difference between “TLS” and “NETLOGON Secure Channel” authentication?

I would like to make sure what is the difference between "TLS" and "NETLOGON Secure Channel"(using signing and encryption) authentication? I know that TLS is aka SSL and I know that NETLOGON secure ...
1
vote
1answer
31 views

SRP in local, private wireless network

i am trying to secure the connection between a single-page webApp (angularJS, loaded from a secure source via SSL) to a local server (called BOX) inside the private, local wifi of the user. So the ...
0
votes
1answer
50 views

Perfect Forward secrecy in TLS session

I am looking at packet captures of perfect forward secrecy for cipher "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256". Per definition of PFS, after initial client and server hellos exchanged, both sides ...
0
votes
1answer
500 views

SSL mismatch error using ISP-provided IP address but not VPN IP address

I keep seeing error messages reporting issues with SSL (Chrome, IE, Mozilla) when clicking on links in the YAHOO homepage to stories from different YAHOO sites (screen, autos, movies, hsrd, etc.) ...
1
vote
2answers
83 views

DNSSec vs SSL and IPsec

Theoretically, DNS cache poisoning shouldn't matter,because everything important is protected by SSL and IPsec. So why DNSSec was developed? Aren't the first two protocols sufficient?
1
vote
0answers
41 views

openvpn tls 1.2 [migrated]

Openvpn cant establish connection with any tls 1.2 cipher. TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 ...
0
votes
1answer
41 views

Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?

We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test Specifically we're losing points for the following reasons: Forward ...
4
votes
2answers
73 views

Why not generate a client SSL with expiration date in very distant future?

In case of server SSL certificate it is issued by a CA which can then recall it until it expired and also the CA typically collects a fee for each certificate so it is interested in certificates ...
-3
votes
0answers
44 views

Dodgy security certification agencies? [closed]

While researching the credentials of a pentesting company, I just found two organisations which lack SSL support on their main web sites. This seems sketchy for two reasons: While researching ...
1
vote
1answer
38 views

haproxy with client certificate authentication signed by 'common' CA

Excuse me if I posted this here wrongly, I know the question is partly about haproxy itself. I am setting up haproxy as an SSL terminator/load balancer in front of an API that we need to expose over ...
4
votes
1answer
46 views

Wildcard SSL and EV SSL

Is it possible to mix a Wildcard SSL for subdomains and an EV SSL for the www and non-www domain? I know that an EV SSL can't have a wildcard. Example: hello.test.com -> wildcard ssl ...
1
vote
2answers
52 views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
-1
votes
0answers
52 views

SSL Certificate for .com with cuba in it [closed]

I tried to register for an SSL certificate from Comodo, for a domain with the word "cuba" in it. They rejected it on that basis. I talked to RapidSSL and they said they could only accept it if I ...
0
votes
0answers
18 views

Recommendations for implementing TLS/SRP [closed]

I am currently trying to implement basic TLS/SRP as a prove of concept that SRP is more secure when using a browser. Below are a few questions that I wish to be clarified: I have found many ways to ...
0
votes
1answer
50 views

Why openssl shows www.google.com sha1WithRSAEncryption?

According to Chromium Blog, Google Chrome 39 with SHA-1 certificate will show a yellow icon, but my Google Chrome shows: Google Chrome (39.0.2171.99 (64-bit) on Ubuntu 12.04) I've confirmed it's ...
2
votes
1answer
99 views

Can a corporate proxy downgrade an SSL handshake?

At work, I'm behind an NTLM Proxy. When the SSL Poodle flaw came out, I hardened the configuration of my private server, and found out that even if the client and server shared common ciphers, some ...
1
vote
0answers
47 views

Why do browsers clear HTML forms when the user click the back button over an HTTPS connection?

There is already couple of questions regarding this behavior Losing form data when clicking the back button on browser Why are HTML forms sometimes cleared when clicking on the browser back button ...
2
votes
2answers
60 views

SSL/TLS: How to fix “Chain issues: Contains anchor”

I just ran a quick test at ssllabs.com: got A+, which I'm happy about. However there's one thing I don't know how to "fix": My site supports OCSP stapling and ssllabs keeps telling me: Chain issues: ...
1
vote
0answers
128 views

How to switch between TLS 1.0 and SSL 3.0 at Java/JRE level? [migrated]

I am using java 1.6. I have setup my tomcat as my ssl enabled server. And i have setup a ssl enabled client (java code). When i do a communication from my client to server. In java ssl dump in tomcat ...
-1
votes
1answer
21 views

What if I have an address-based certificate and a domain based certificate loading HTTPs resources in the background

What if I have an address-based certificate and a domain based certificate loading HTTPs resources in the background, will this change the Lock-Logo in the Browser Address bar? Does an address based ...
-2
votes
0answers
37 views

How to check for SSL POODLE / SSLv3

How can I check SSL POODLE / SSLv3 locally.My Url is localhost:8888/test.I have tried to test using openssl s_client -connect localhost:8888/newui:443 -ssl3 but am getting eror like ...
1
vote
1answer
47 views

What's the purpose of Server Key Exchange when using Ephemeral Diffie-Hellman?

What's the purpose of ServerKeyExchange when using ephemeral Diffie-Hellman? In this case, the ClientHello advertised EDH and EECDH (and not anonymous protocols), and the server selected ...
1
vote
1answer
65 views

Is it safe to combine AES with TLS?

Given that two clients want to sync data through a server, is it safe to use AES to encrypt the data and TLS to communicate with the server? Assumptions: Server has never access to unencrypted data ...
10
votes
4answers
2k views

How does HTTPS help websites under DoS attacks

From time to time one of the websites I browse regularly becomes a victim of a DoS/DDoS attack and usually they solve the problem by switching to https. I cant see the connection between the attack ...
3
votes
1answer
242 views

Can a malicious Tor exit node perform a HTTPS man-in-the-middle attack to see/modify your HTTPS traffic?

Let's say I am browsing the Internet using Tor - visiting https://example.com/login.php - and the NSA is operating the Tor exit node which I am currently routed to use. Can that NSA exit relay swap ...
3
votes
1answer
121 views

In depth TOR encryption design details

I am currently struggling with understanding the details of a connection in tor, mainly because I try to understand PCTCP. In this paper the authors claim that the changes are local to the onion ...
0
votes
1answer
15 views

What to choose ipsec or tlsv1 for rdp

I found a link but it didn't answered on my questions. (http://www.k2esec.com/secure-communications/network-security-protocols-ipsec-vs-tlsssl-vs-ssh-part-ii). I want to create secure connection for ...
5
votes
1answer
84 views

Mixing cheap SSL and EV SSL

We are a non profit and have been hosting an online site that accepts payments. It has been getting enough exposure now that we want to put an EV SSL certificate on the site. The question I have is ...
5
votes
1answer
43 views

What is the status of TLS snap start?

TLS snap start is an extension to TLS that allows one to use 0-RTT handshakes with TLS. The draft was created on June 2010 and expired in December 2010. I don't see any updates to the draft since. Is ...
0
votes
1answer
75 views

What does this mismatching SSL certificate hint at?

I'm currently visiting China, and I use a well known VPN service for both my laptop and my phone. Every now and then, I get certificate errors when using my phone when I'm connected to a VPN, but ...
1
vote
1answer
72 views

Check SSLv3 in Apache Tomcat locally as well as on server on windows/linux

I have given my website for testing, after testing they sent me a test report with details that the site has a security issue "SSLv3 POODLE information disclosure", and SSLv3 should be disabled to ...
-1
votes
2answers
66 views

SSL tunneling and how it is used to attack targets

How can SSL tunneling be used to attack a target, and how can I prevent such thing from happening? Does modern network/appliction firewalls have the capability to detect SSL tunneling? thanks Update: ...
0
votes
1answer
72 views

Can I create an SSL certificate on windows signed with the machine's certificate?

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a ...
1
vote
1answer
36 views

Re-Use Client Certifactes

I have a legacy web application where user are identified and authenticated with client certificates. Now, customer wants to use the same client certificate to authenticate against a newly created web ...
0
votes
1answer
125 views

Can HTTPS be compromised by first contact?

Let's say I am behind my PC and want to go to any secured website (HTTPS). I have the direct IP address so any possible hack on DNS level is not possible (because I am not using it ;) ). The packet ...
1
vote
1answer
57 views

Is microsoft.com not using TLS/SSL?

On my way to Microsoft to download "security essentials", I noticed that the download page isn't a secure site. Is this legitimately the case, or an indication that I may be compromised in some way? ...
0
votes
2answers
33 views

HTTP/S <-> HTTP/S cross-site requests: what do third-party websites know about where their objects are being referenced from?

There are four general cross-site request combinations security-wise, and I want to know whether ysite.com, in each case, knows that the reason I downloaded one of its resources was because I was ...
0
votes
2answers
66 views

RC4 support in SSL configuration

GitHub recently improved its SSL setup by removing RC4 support: To keep GitHub as secure as possible for every user, we will remove RC4 support in our SSL configuration on github.com and in the ...
1
vote
0answers
64 views

POODLE vulnerability solution : Effect on customer or client side

I am using windows server 2008 R2 and I have lot of customers who use windows XP,7 and 8 with some of them still using IE6. So now I want to disable SSL3 and enable TLS 1.1 as a security measure for ...