SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

1
vote
1answer
30 views

Sign certificate for localhost

I'm using HTTPS Node.js server on my localhost, and every restart (PC), when I go to 'https://localhost' I get the certificate message (Chrome). I want to ask how to install the certificate?
1
vote
2answers
30 views

TLS domain name mismatch

Suppose I want to talk to example.com over TLS the and server I am redirected to is foo.com. But during the handshake it can prove it holds the private key that matches example.com certificate. Why ...
-2
votes
2answers
50 views

How does SSL work? Simpler Explanation?

I'd like to explain my understanding first then ask a question. This question is meant as a simpler overview of other question..and talks about implication and not process as much. My understanding ...
2
votes
0answers
18 views

How to generate keystore for root signed certificate?

I need to create keystore and truststore with root signed certificates. I have these files (at this step they are identical for client and for server): client_cert.pem client_prv_key.pem ...
1
vote
1answer
41 views

Token based approach to authentication over SSL Rest API - refresh tokens

I'm quite a newbie at security. I'm developing an android app with a token based approach to authentication. I'm not using Oauth as the OAuth 2.0 is not an authentication protocol but rather used to ...
1
vote
1answer
25 views

Use of server and root certificate in ssl termination and inspection

I'm researching vendors which allow SSL termination and inspection, I came across Cisco CWSA technology, the technology was somewhat easy to understand the stuff which really boggled my mind was the ...
0
votes
0answers
30 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
2
votes
2answers
46 views

Forwarding an SSL connection

My general question: Can a two-way SSL connection be forwarded to a 3rd server? The specifics: I have a WebLogic server supporting two way-SSL, client side's cert is from their CAC card. The ...
2
votes
1answer
38 views

OpenSSL Certificate Expiry

I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL ...
1
vote
2answers
61 views

ECC and RSA 10K stronger claim

There are a lot of websites where it is claimed something akin to this but no explanation on the basis. "ECC key size of 256 bits is equivalent to a 3072-bit RSA key and 10,000 times stronger than a ...
12
votes
2answers
2k views

Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?

I want to communicate from an embedded device that only has SSL for encryption with an intranet-server that can receive HTTPS. Will SSL encrypted HTTP string be interpreted as HTTPS? or is there more ...
1
vote
2answers
77 views

LAMP MailServer without SSL… so what's the problem?

I want to set up a MailServer on Ubuntu for my website, and access the email from my POP3 client without enabling SSL encryption (I suppose the SSL is used to encrypt the password?). My questions ...
2
votes
1answer
25 views

Setting up a wildcard certificate, question about generating CSR?

I have registered a new domain for a project. The hosting is actually done by a vendor. I have set the nameservers according to the vendors specs. Now they are requiring the cert in PFX format. ...
3
votes
1answer
54 views

Adding SSL to existing applications

We need to strengthen the network communication between our systems, a mix of Windows, Linux and Embedded devices, written in C++ and C#. What we want to achieve is to prevent interception of our ...
3
votes
2answers
64 views

Where in a TLS connection can I get the signature of the content sent by the server?

I want to be able to prove that a given content returned by a HTTPS server was in fact served. I have looked over the whole TLS protocol and I found I can use ServerKeyExchange to get the server's ...
1
vote
0answers
57 views

Distribution of a public key with a dotnet client application?

I have a pretty good understanding of X509 cryptography etc, from my career in the smart card industry. So I know that the card scheme (e.g. Visa, MasterCard) is the highest level of trust - they sign ...
0
votes
2answers
61 views

Conflict between cipher-suite and certificate [duplicate]

When capturing my SSL session (using Chrome) I have noticed that the server chose TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) as the cipher-suite and the certificate signedcertificate signature ...
6
votes
2answers
71 views

SSL Handshake failure when antivirus is enabled

This is a problem related to SSL handshake failures when an anti-virus (Kaspersky) is in between. From WireShark, I am able to notice the SSL handshake successful (i.e towards the end client ...
0
votes
1answer
45 views

Server authentication during the SSL handshake

I have question regarding the server authentication during the SSL handshake. I am going to write this up as my understanding of the concept. Please feel free to point out any mistakes. We generate ...
2
votes
1answer
58 views

Are TLS session keys cached in a browser?

For example, when authenticating to a TLS protected service, and then closing the tab, you can sometimes reconnect to the service afterwards without re-authenticating. In preservation of perfect ...
0
votes
0answers
16 views

Multiple SSL certificates in Apache with clients using different certificates [migrated]

Our setup is like this. SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple ...
1
vote
2answers
37 views

What exactly is IE / Chrome checking when I view the “certification path” tab on cert connection details?

When I bring up certificate details for a web page in IE or Chrome, I have the option to view the certificate hierarchy (under a tab called "Certification Path"). Here's an example for ...
0
votes
0answers
33 views

Websites disclosing their users emails [closed]

What if I have found several websites that do not correctly protect users information. For example, if you open the developer tools to see the XHR requests and websocket messages you may see the ...
1
vote
1answer
41 views

How much protection is really offered by TLS_FALLBACK_SCSV?

I'm researching the extent to which TLS_FALLBACK_SCSV protects against Cipher Suite Downgrade attacks. I understand that the correct way to protect is to remove support for the insecure cipher ...
1
vote
1answer
27 views

Where are the HTTPS session resumption tickets/sessionIds stored on the client?

With Session resumption in TLS/HTTPS the client stores the sessionID or the session ticket and uses it the next time it wants to communicate with the server. I am trying to find where the browser ...
23
votes
5answers
2k views

What prevents a man in the middle from requesting a certificate for your server?

Let's say you have a server at shop.example.com and you are requesting a certificate from some trusted CA like Comodo (they say they'll issue it within few minutes online). First of all, how can ...
3
votes
3answers
98 views

How do browsers negotiate SSL/TLS connection parameters?

For the purpose of this question, let assume that an SSL/TLS connection has 4 parameters: protocol, symmetric encryption method, asymmetric encryption method, MAC. During the negotiation of SSL ...
4
votes
2answers
172 views

Why is Chrome saying that “TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)” is an obsolete cipher suite?

When I go to this site, Chrome Version 44.0.2403.89 is connecting to the server with TLS_RSA_WITH_AES_128_CBC_SHA (0x2f), and it states that this is an "obsolete cipher suite". For what reason is it ...
2
votes
2answers
151 views

Should I update my SHA-1 certificates? If so, how?

Q: Should I update my SHA-1 certificates? If so, how? Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been ...
0
votes
2answers
194 views

Is HTTPS required when there's no sensitive data in the site

I'm currently building a B2B e-commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
1
vote
0answers
58 views

How to inform other sysadmins their email encryption is broken [closed]

Does anyone have a good template email to use to send to remote system/mail/security administrators to alert them to the fact that emails to them would not be getting through either at all or securely ...
3
votes
1answer
76 views

How should certificates be shared between a proxy and a frontend?

At work, I've been asked to look into creating a reference topology for a WebSocket chat application, which includes a proxy between the web-facing frontend server and the backend. At the moment, I am ...
-3
votes
1answer
30 views

A collection of tests and demos for security headers and TLS configurations [closed]

There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/) I want to build a ...
0
votes
2answers
66 views

Unable to “trust” self-signed certificate

I am currently running a setup that interfaces with many appliances running HTTP servers (running on Windows Embedded). The connections I use are HTTPS connections. My problem is, every time I open ...
4
votes
3answers
75 views

What's the purpose of DH Parameters?

For a Diffie–Hellman (D-H) key exchange (TLS) the server generates a prime p and a generator g, which is a primitive root modulo p. When setting up a webserver with SSL/TLS (e.g. nginx) one can use a ...
1
vote
1answer
38 views

SSL/TLS entity identification

Does SSL/TLS contain any form of identification in the initial handshake, so an attacker cannot simply waive the certificate around claiming they are someone else? Wikipedia did not say that it did, ...
2
votes
2answers
229 views

Why doesn't DNS spoofing work against an HTTPS site? [duplicate]

How does using SSL protect aginst dns spoof? since DNS is at a lower level and it is always work the same whether the user is visiting an HTTP or HTTPS site.
1
vote
0answers
27 views

Can server and client both use a certificate with the same CN? [migrated]

I am working on implementing TLS for a Client-Server application. But, the problem is both client and server are in same server: both communicate with just a port number. So what should the common ...
8
votes
4answers
522 views

What Country, State and City should I choose when requesting an SSL certificate?

I am really confused about the country, state and city I should select when submitting an SSL certificate. Should I provide the location of my servers or my current home address?I can always reissue a ...
1
vote
1answer
54 views

What are these two certificates I need to install - external CA root certificate

I have to install 2 certificates on a computer and I am a little puzzled by the certificates. The first certificate has these details: Issuer: CN = AddTrust External CA Root OU = AddTrust External ...
1
vote
0answers
36 views

How to use wireshark to decode SSL stream from remote API server? [migrated]

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
27
votes
2answers
3k views

Is it safe to send SSL certificates via email?

I just ordered a cheap Comodo PositiveSSL Certificate via a UK reseller, and I was rather surprised to find that the following files were emailed to me automatically, in a zip file: Root CA ...
3
votes
1answer
38 views

Authentication and protection against replay attacks on instructions over SSL

let there be two clients and a server; the clients have a shared secret and unique IDs. their communication to the server is encrypted over SSL. the problem now is sending secure instructions from ...
-4
votes
2answers
51 views

How the process of SSL handshake works? [duplicate]

I have been trying to understand the working of SSL. I know that any https website has a digital certificate with it. So when the client requests something from the server, the server sends with ...
1
vote
1answer
78 views

Should self signed wildcard certs be used?

I think this is more urban legend around where I work than anything. I do not see anything in RFC 2459 that specifically says whether or not they should be used or if there are any known problems with ...
2
votes
1answer
86 views

Securing REST API without sending or storing clear credentials

We are currently designing a REST API, and thinking about securing it. Going through a lot of documentation, it has become clear that 2 options are available. HMAC Authentication By hashing with ...
1
vote
1answer
107 views

Which kind of SSL certificate is the big one?

Okay, so I just recently visited a couple of https (secure) websites and noticed that there was a difference with the way they were shown in Chrome. As you can see, the top one has some extra ...
2
votes
4answers
138 views

SSL encryption process and its security

I know the basics of SSL encryption and how certificates work, but there are some points that are not clear to me regarding the SSL security: If there is a intercepting proxy between the web server ...
2
votes
1answer
52 views

Security bounds of TLS client authentication (from browsers)

Say that there are two servers that perform TLS. Both servers have valid end-point certificates. In other words, neither of them would raise a warning from the browsers after the connection has been ...
1
vote
0answers
42 views

Why doesn't the most powerful/powerful sites on the internet use Extended Validation SSL certificates? [duplicate]

Why does some of the biggest internet companies not use an Extended Validated certificate which makes the address bar would be green and more secure? I have noticed that Facebook, Google, Amazon the ...