SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

1
vote
1answer
56 views

Why does Google.com still support SSL v3?

The POODLE vulnerability was discovered by Google in October 2014, and unlike heartbleed, it had a simple solution: just disable SSL v3. Now, most of the websites have disabled SSL v3 but ironically ...
0
votes
2answers
31 views

Hijack attacked SSL/TLS-connections?

I think we all heard the news that China used unencrypted HTTP-connections to drive DDoS attacks on targeted websites. Now within the last few months we've learned about three new attacks ...
0
votes
1answer
19 views

How ECDHE is signed by RSA in ECDHE_RSA cipher

About ciphers that use ECDHE as Key Exchange and RSA as Authentication: How exactly this two algorithms work together, is ECDHE process encrypted by RSA public key? What are the DH parameters? ...
1
vote
1answer
25 views

Is SSL over HIP (Host Identity Protocol) possible?

In this relatively short Host Identity Protocol (HIP) overview Host Identity Protocol: Identifier/Locator Split for Host Mobility and Multihoming it is stated Most Internet applications can run ...
2
votes
1answer
57 views

Does SSL or HIP solve all TCP/IP security problem?

I recently read this paper "A Look Back at Security Problems in the TCP/IP Protocol Suite" (https://www.cs.columbia.edu/~smb/papers/acsac-ipext.pdf) explaining few attacks at the TCP/IP stack. One ...
0
votes
0answers
29 views

creating a TLS encrypted API

I have an HTTP API endpoint on my server that is encrypted (TLS). It is not a public API; users must sign-in and validate their account/identity to access the API. When I connect with my test client ...
1
vote
0answers
22 views

MySQL BACKRONYM (CVE-2015-3152) only affects MySQL client?

I read the CVE-2015-3152 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152) named BACKRONYM (http://backronym.fail/), and what I understood (ELI5 style) was the following: Attacker ...
5
votes
4answers
490 views

What is the role of RSA in ECDHE-RSA? [duplicate]

I have read some textbooks and not found a convincing explanation. In the cipher suite ECDHE-RSA-AES128-GCM-SHA256, what is the role of RSA in the first part (ECDHE-RSA)? This part of the cipher ...
4
votes
1answer
279 views

Securing Chrome against Logjam on Windows

Is there a way to fix Chrome against the Logjam TLS exploit on Windows? I have updated my Chrome to the latest version yet the https://weakdh.org/ website warns me that "web browser is vulnerable to ...
0
votes
2answers
49 views

Is TLS v1 really secure for VOIP and video calling?

Many applications are still using TLS v1 for video conferencing and VOIP calls. Is TLS v1 really secure for video and voice & video calling? or can some one can easily snoop your sessions with ...
1
vote
1answer
33 views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
2
votes
1answer
39 views

Is it safe to enable SSLv2 ClientHello support?

In the wake of the POODLE attack, many web sites have dropped support for SSLv3. But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello ...
1
vote
1answer
49 views

How to filter secure (HTTPS) websites by URL with regular expression?

I need to block access to certain pages on a website using regular expression and/or wildcard. The site uses https and therefore cannot be blocked using regular parental control filters (this is ...
4
votes
3answers
65 views

Why does Windows have a place to store intermediate SSL certificates?

As I understand the process of verifying a remote computer's SSL certificate, the remote system sends its 'leaf' certificate and any intermediate certificates, but not the root certificate. Executing ...
0
votes
2answers
49 views

Preventing SSL strip attack

Is it possible to detect a ssl strip attack by checking whether the page deliverd is https or http using javascript?I am assuming that the response page is https page instead of http?
-1
votes
0answers
16 views

TLS 1.1 android 4 support [closed]

Before Android 4.1 we couldn't add TLS 1.1 or more precisely tls pinning. IS there anyway to make android use TLS 1.1 for version before android 4.1
5
votes
3answers
127 views

Does TLS_FALLBACK_SCSV provide blanket protection against downgrade attacks?

The TLS_FALLBACK_SCSV flag was touted as a way to prevent POODLE, which abused the potential to downgrade to SSLv3 from TLS. Does the implementation of this flag prevent similar downgrade attacks ...
3
votes
1answer
51 views

Different SSL cert behavior with Chrome on desktop vs. Chrome on iOS

We have a website, https://uk.care.com, that has a GeoTrust multi-SAN cert on it. The cert is up-to-date, using SHA-256, TLS 1.2, etc. When we view the site in Chrome on various desktop systems it ...
1
vote
1answer
27 views

HTTPS in captive portals and the Apple Captive Network Assistant

Suppose I connect to the Wi-Fi of a company I trust enough to give them my credit card number (say, my local airport). When I connect to their Wi-Fi network, my web browser gets redirected from any ...
9
votes
2answers
1k views

How to Check if a server is not vulnerable to logjam?

In response to Logjam I want to prove I hardend my services. I know that the DH param has to be 2048 bits atleast and self generated. but I am unable to find a way to actually check this for something ...
5
votes
3answers
474 views

Does the recommended course of action for preventing Logjam on Tomcat servers really eliminate all risks of weak DH keys?

Can anyone verify this fix secures against the Logjam vulnerability for Apache Tomcat? I'm sceptical about it's effectiveness, since it doesn't mention how to implement the user defined 2048 bit DH ...
0
votes
2answers
80 views

Website using http and https

Is there any method to know whether a website is https only or uses http webpages as well?Can it be done without using browsers cache?
1
vote
2answers
47 views

SSL/TLS client authentication - practical client cert validation

How do real HTTPS servers validate client certificates? My context is business-to-business rather than regular human clients. I understand basic chain validation to a trusted root CA cert. But do ...
14
votes
1answer
1k views

PayPal encrypted with obsolete cryptography

My Chrome just complained from PayPal's security, similarly to this issue: Google Chrome "Your connection to website is encrypted with obsolete cryptography" The identity is verified, but ...
58
votes
4answers
7k views

What is Logjam and how do I prevent it?

I heard there is a "new" TLS vulnerability named Logjam, what does it do and how do I prevent it?
-1
votes
1answer
29 views

SSL certificate [closed]

I am in the process of renewing my Domain SSL certificate, but I get this error message about a key duplicate error when I enter my CSR? I think it might have something to do with the fact I generated ...
1
vote
0answers
43 views

PCI DSS Vulnerability Scan failed [closed]

I'm having some problems fixing two Vulnerability's that keep failing the PCI scan. The scan is failing on BEAST attack ports 443 and 25. I've followed a few articles and over the past week got the ...
3
votes
3answers
102 views

How do I deal with browsers complaining that my MediaWiki website has unsecure resources? [closed]

I recently bought a subscription to a NameCheap shared hosting plan, and I plan to primarily run MediaWiki on it. I've managed to setup everything fine except for the SSL encryption. When I visit my ...
2
votes
2answers
61 views

Is there a Cipher Suite which is only “good” when used with HTTPS, but not “good” with other protocols?

Some attacks (e.g. BEAST, CRIME) are only effective against HTTPS. Are there any cipher suites which are only "good" when in use over HTTPS? Is there any "good" HTTPS cipher suites (i.e. ...
1
vote
2answers
70 views

two factor authentication without TLS/SSL

It seems silly to ask about using two-factor authentication without TLS/SSL but, I have a vendor that is using public IP without TLS and asking for login creds. Would the login be more secure if ...
0
votes
3answers
94 views

Disadvantages of disabling RC4 in SSL/TLS [closed]

Other than requiring more server resources, are there any disadvantages of disabling RC4 from being using by an Apache webserver? My primary concern is preventing access from older browsers.
2
votes
1answer
39 views

Why does SSL/TLS MAC the Master Secret?

At the end of the SSL handshake both the client and server send a MAC over all previous messages and the master secret. However, why do we need to MAC the master secret? The master secret is computed ...
1
vote
1answer
21 views

SSL connection between MySQL, Apache and the User's device

I set up SSL connection on my apache web server and I just would like to find out is it enough to secure my connection between the MySQL server, the apache web server and the user's device. Because I ...
1
vote
0answers
40 views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
6
votes
3answers
197 views

Why does the SSL/TLS handshake have a client and server random?

In the SSL handshake both the client and server generate their respective randoms. The client then generates a pre master secret and encrypts it with the server's public key. However, why can't the ...
12
votes
5answers
668 views

Creating my own CA for an intranet

I need to create my own CA for an intranet and unfortunately it seems there's no good answer about this on Security.SE. There are many resources online about this, but all of them are different and ...
1
vote
1answer
39 views

Using a minimal set of certificate authoraties

It been known for quite a while now that SSL is more of a security-illusion than a real one. As it's not completely useless, and there's no real alternative at moment (though convergence looks ...
1
vote
1answer
62 views

Intercept https traffic [duplicate]

Is it possible for a packet sniffer such as wireshark to be able to decrypt the traffic generated by a https connection from a browser ? I do not have control of the server, but I have control of the ...
1
vote
1answer
38 views

Does a TLS-connection to a proxy-server encrypt the destination url's?

If I use a browser through a proxy-server over a secure connection (i.e. the proxy is HTTPS) - does that mean that everything is encrypted, or just the page returned from the site? And who does the ...
2
votes
1answer
57 views

SSL Decryption why is the root CA certificate required on clients?

Maybe a quick question. We have Palo Alto's that perform SSL Decryption using a sub CA certificate issued by our internal Root CA. This is working for our internal windows domain computers as the root ...
1
vote
0answers
22 views

How to correctly secure Reverse Proxy communication with actual server in LAN [migrated]

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
0
votes
0answers
59 views

Apache server chooses TLS1.2 for all request even when TLS1.2 is disabled in IE9 / Windows7 [migrated]

Following is my apache ssl protocol and cipher configuration SSLEngine on SSLProtocol all -SSLv2 SSLCipherSuite HIGH:MEDIUM:-SSLv2:!ADH When tested on IE9 with TLS1.2 checkbox checked in ...
3
votes
1answer
72 views

IoT Devices and 39 Month TLS Certificate Life

I develop IoT (Internet of Things) devices on small embedded systems, where it is very difficult to update the local certificate once they have been deployed. It really needs to be avoid if it can. ...
0
votes
1answer
44 views

HSTS implementation [closed]

I have a little doubt on using HSTS, as per this video, once HSTS is implemented , all the URLs will be going in HTTPS, but as we all know in using SSL we need pre-specified encryption algorithms and ...
10
votes
2answers
907 views

How are digital certificates compared?

I have read about SSL and TLS; I know how RSA works and why digital certificates are necessary (more or less), but I am curious about how we prevent a fake digital certificate. The operating system ...
0
votes
1answer
63 views

SSL certificate appending

On my Linux server I have a keystore which contains SSL certificates and these certs are going to expire in 20 days. Before expiry of old certs, I have installed new SSL certificates to avoid any ...
1
vote
1answer
47 views

PKCS7 vs TLS 1.2 padding

Can anyone explain why there is a difference between padding claimed in PKCS7 https://tools.ietf.org/html/rfc2315 Page 22 - which is 01 02 02 03 03 03 ... and padding used in TLS 1.2 ...
5
votes
1answer
74 views

Sites are signed with an incorrect VeriSign Class 3 G5 CA

Previously today, I encountered a SSL error trying to access twitter.com in Chrome. Investigating the issue, I encountered the same error accessing discussions.apple.com. Most other HTTPS sites were ...
3
votes
1answer
51 views

Does mutual authentication have any impact on MiTM possibilities?

When doing a Man-in-the-middle attack against a classic one-way authentication server, the attacker just have to: Use a certificate credible enough to be trusted by the victim, Act as a standard ...
0
votes
1answer
57 views

HTTPS - Can server see details of client side certificate?

I am using mitmproxy to intercept HTTPS connections from my client device to a third party server. In order for mitmproxy to intercept SSL requests, I need to install a trusted root certificate on my ...