SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
0answers
39 views

How to check for vulnerability against WPAD / HTTPS attacks?

As described at New attack bypasses HTTPS protection on Macs, Windows, and Linux | Ars Technica, there is a newly identified attack at wifi hotspots etc that can expose the URLs you use even if they ...
-2
votes
0answers
26 views

decryption https traffic from a mobile app

I'm looking for to decrypt https requests from an mobile app. I have been using charless and fiddler to fetch some requests made in the app but am receiving errors : SSL certificate error.
2
votes
1answer
39 views

What are read state and write state in SSL connections?

The SSL handshake contains the change_cipher_spec. When this change_cipher_spec is received, the pending read state is copied to current read state, and when change_cipher_spec is sent, the pending ...
1
vote
1answer
52 views

What's the difference between SSLv3 being deprecated and SSLv2 being prohibited?

I've been working on some security docs for a database at work - a quick guide on how to create a JDBC connection over TLS for this. The docs I have mention that while it supports SSLv2, SSLv3 and ...
-1
votes
1answer
58 views

Best option for DDoS protection on DigitalOcean server?

I would not like to use CloudFlare since they effectively act as a man in the middle and handle unencrypted data. Is there a CDN that mitigates the security risks that CloudFlare imposes? If not, is ...
0
votes
1answer
13 views

Mode of operation are availables with Camellia

What cipher mode of operation are available using Camellia in a SSL certificate context ? I'm mostly interested if XEX (Xor-Encrypt-Xor) or related mode (LRW, XTS...) can be used because they seem ...
1
vote
1answer
75 views

How to access an HTTPS service running deprecated technology? (TLS 1.0) (phone works but not PC)

So this is the issue: I have a modem/router provided by my telco. The router exposes the usual 192.168.1.254 address for managment, but with my pc there's no way to open it, I tried with firefox, ...
0
votes
1answer
61 views

Perfoming a MITM to intercept SSL/TLS with valid certificate

Supposing an attacker is able to perform a Man In The Middle attack and intercept requests from a client that wants to connect to an HTTPS server (let's say www.google.com). The attacker has a valid ...
0
votes
1answer
65 views

How does the symmetric key get exchanged in SSL/TLS handshake?

I've been reading a lot about SSL/TLS handshake between a client and a server and many articles on it are very contradictory. Some say that the symmetric key that will be used to communicate between ...
-1
votes
2answers
77 views

What are the odds of someone modifying binaries downloaded over HTTP?

I recently read that most software available on the Web isn't sent over HTTPS (even if the link is on an HTTPS page). This means that the binaries downloaded were never authenticated and could in ...
1
vote
1answer
61 views

How is a root certificate revoked?

I know that CAs use intermediate certificates to mitigate the impact of potentially having to revoke a root CA (i.e., the need to update all browser clients on peoples computers allover the world). ...
0
votes
2answers
80 views

How TLS certificate chain is verified

Assume the verification of a TLS certificate chain. Suppose the chain has certificates A-B-C-D where D is the root certificate and A is signed by B, B by C, C by D. Suppose the intermediate ...
1
vote
0answers
23 views

Which clients support only TLSv1.1 but not TLSv1.2? [on hold]

I phrased the question originally as Is there any point in supporting TLSv1.1 on the server side? The recommended current setup if you don't have full control over your clients is to support TLSv1.0, ...
3
votes
2answers
59 views

How to trust root CA

When I download a browser such as Mozilla, it comes bundled with several root Certificates. How do I trust that these certificates are legitimate? How do I know that my download does not contain ...
0
votes
2answers
20 views

Integrity of downloaded Oracle JDK (/software in general) [duplicate]

Found something related Why aren't application downloads routinely done over HTTPS? This is a question about general security from a noob. I couldn't find anything relevant about this topic via ...
-1
votes
1answer
32 views

In what order are digital certificates verified?

I understand how digital signatures work and how they are verified, but in what order does the CA verify each of the attributes of the digital certificate such as version, issuer, validity etc..? Any ...
0
votes
0answers
18 views

SSL Certificate for Web API [duplicate]

I'm currently developping a web html/2 API for my mobile application, and I would need an SSL certificate for my application, Is it safe if i use a self-signed SSL certificate rather than a trusted ...
0
votes
1answer
63 views

Who is responsible for generating public key during secure communication?

This must be easy but I am getting a little confused. Say, facebook.com, it has a certificate which is signed by an intermediary CA. Who generated that public key that I can see in facebook ...
1
vote
3answers
60 views

Is it secure to have only https binding in IIS?

I have an API that I want to be accessible only by HTTPS. I know I can use URL-rewrite to force a redirect, but don't want to install additional modules. I was wondering whether only providing an ...
1
vote
0answers
37 views

AES256 key exchange

I'm trying to get a secure way of exchanging keys between my client application and the server. The goal is to encrypt all XML messages with AES256. These XML's will be transferred to the server ...
1
vote
2answers
76 views

Should JWT token be stored in a cookie, header or body

What is the most secure way to store transfer and store a JWT token, or any authentication token in general? Someone told me it's secure to send the authentication token as a cookie, but I don't ...
0
votes
1answer
56 views

Does HTTPS protect from session riding?

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to ...
1
vote
2answers
46 views

Should each service running on a domain have a separate certificate?

I have a domain name with dynamic DNS (DDNS) for my home server on which I expose multiple services (web server, wikis, issue trackers, etc.) online. Some services are hosted by the same software (e.g....
-4
votes
0answers
308 views

Reverse the encryption (part of the Labyrnith ctf challenge) [closed]

So my friend and I were trying to do this ctf challenge here http://labyrenth.com/ and when we were trying to solve the first part of the "Threat" challenges we stumbled upon a challenge we have no ...
1
vote
1answer
20 views

Regarding Openssl.config file: What is the importance of policy matching when creating a self-signed certificate with the aid of this file?

When trying to go through some material for self-signing a certificate, one of the steps required me to set policy conditions in this config file. See: https://www.phildev.net/ssl/opensslconf.html ...
-8
votes
0answers
28 views

What are some real life examples of Certificate Authority? [closed]

What are some things that use a CA & the PKI such as websites. Does Chase bank use this feature?
2
votes
1answer
40 views

Two roots for an SSL certificate

Please consider the following scenario: I have an SSL end certificate issues by a well-known authority (e.g. COMODO). I have my own self-signed root and intermediate certificates which are used by ...
1
vote
2answers
74 views

TLS version of cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA

I have a question related to the cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039). It is first mentioned in RFC3268 in 2002. The highest available TLS version in 2002 was TLS 1.0 (RFC 2246). ...
10
votes
2answers
886 views

httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?

There's a new fancy-named, branded vulnerability called HTTPOXY. My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)? ...
4
votes
1answer
64 views

How does the client pick the correct certificate from its certificate store?

As I am able to configure my SQL Server and client to establish SSL connection, I have installed the certificate on the server as well as on the client machine (Trusted Root Certification Authorities ...
2
votes
1answer
25 views

Establishing trust between a device and a developer, TLS signal vs X.509, GnuPG (or both)

Let's say you wanted to implement a "secure sideloading" mechanism for your embedded device so that the device could establish trust with authorized 3rd party developers. Developers would have local ...
5
votes
3answers
141 views

Should I provide https downloads?

I've seen several articles like The sad state of Linux download security that suggest you should offer downloads of software updates via https. But is there any point in doing this if your website ...
2
votes
3answers
78 views

What specific information is used to verify an SSL certificate?

When a CA's SSL certificate is stored in a browser, a server which presents a certificate signed by this CA can be verified by the browser. My question is: How exactly is this verification done? I ...
2
votes
0answers
19 views

Mixing Off-The-Record and classic SSL

I am developing some pubsub system on top of Node.js and Socket.io. I decided to implement Off-The-Record (OTR) encryption by default for all of data transfers between clients and server(s). Question ...
2
votes
2answers
93 views

TLS Version specific cipher suites

I have come across that GCM, CCM, SHA-256 and SHA-384 Cipher suites are TLS 1.2 only. So TLS handshake can not be performed with lower TLS version using these suites. I am trying to figure out ...
1
vote
3answers
52 views

Mutual Authentication - client authentication to the server via IP / FQDN?

I'm trying to get a better understanding of the Server / Client Mutual Authentication process in a TLS1.2 mutual authenticated session. My understanding is that the client is able to fully ...
3
votes
1answer
124 views

sslv3 alert handshake failure with openSSL and python requests

I'm having issues invoking a RESTful API secured via mutual SSL. I have no issues invoking the API in SOAPUI after providing the keystore with the private and public key to use for mutual SSL. In a ...
4
votes
1answer
47 views

Why doesn't my leaf certificate validate against the root CA only

I created a root CA and intermediate CA, then used the intermediate to sign a leaf cert, for the purpose of enabling SSL on various web servers in an internal network. I'm trying to figure out if I ...
1
vote
1answer
43 views

Secure channel without identifying information

Is there a way to establish a secure channel like ssl or ssh without leaking identifying information to an observer, especially the server's public key? Are there real implementations?
1
vote
1answer
40 views

Can we provide our external certificates to a customer's SQL Server for SSL?

In designing hosted software that interfaces with a client's SQL Server over TCP/IP and we may wish to offer the option of using SSL/TLS. One architecture that seems attractive is where we generate a ...
4
votes
2answers
75 views

Can a SSL Certificate dictate protocol?

I know you can set the protocol/cipher via your web server: Nginx: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; Apache: SSLProtocol all -SSLv2 SSLCipherSuite ...
1
vote
0answers
16 views

Renewing client based certificates

Could someone help me on the best practice of renewing client certificates used in SSL/TLS. Is there any standard time to renew the client certificate and if not renewed within that time limit what is ...
1
vote
1answer
32 views

Is HPKP enforced on the server or in the client?

I'm trying to learn about HPKP and I am trying to grasp if it is just a level of protection for user agents to mitigate MiTM attacks over HTTPS or if the server also plays a role. Please keep in ...
1
vote
1answer
46 views

Which of the TLS ciphersuites are more faste and secure in Handshaking?

I know "SSL 3.0" and TLS 1.0 have weakness security, because using of "RC4" cipher. instead it, "TLS 1.2" have more security, now I want to use of a fast ciphersuite and a complicated handeshake ...
2
votes
1answer
30 views

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS)?

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS) and if so, why? With preloading: Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Without ...
6
votes
1answer
2k views

How do I know if my company or my ISP is using a TLS proxy?

I was reading the other day on "Does https prevent man in the middle attacks by proxy server?". Let me quote few lines: Blue Coat, the biggest name in the SSL interception business, is far from ...
1
vote
1answer
156 views

Do my router and OS “know” which URLs I visit, if SSL is used?

Is it possible for a router or an operating system to get access to URLs I visit in my browser, if SSL-encryption is used between a browser and a webserver?
3
votes
2answers
81 views

Choice of authentication when both HTTP and HTTPS are supported

I am looking at a system where you are able to choose if you are going to connect to the web application via HTTP and/or HTTPS. You have to authenticate on either one. I know that the best option is ...
0
votes
3answers
112 views

Securing a private API that's visible on the public Internet

I'm making an API for my own software. The API currently used for registering users, viewing users information and updating users information. In the future it will be used for billing, support etc .....
30
votes
5answers
2k views

Is there a risk to a business that is using a shared certificate?

I was looking at my bank website's certificate and discovered that it's issued to multiple websites, and the bank's domain name is only listed among many other domains in the 'alternative names' field....