SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

0
votes
1answer
67 views

Firefox:Secure connection failed(Error code:ssl_error_weak_server_ephemeral_dh_key)

A screenshot of the problem: Browser: Firefox 39.0 Is this a problem with my browser? How can I solve this?
5
votes
2answers
49 views

When did development on various TLS versions begin?

What I'm looking for I'm looking for an approximation of the date that the development on each TLS or SSL version started (so the development start date). So I do not want to know the date when the ...
1
vote
1answer
33 views

Can Client Certificates be tied to a Specific Server Certificate?

I have a Root Certificate Authority and and Intermediate Certificate Authority. I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with ...
2
votes
2answers
29 views

Multiple Versions of Intermediate SSL Signing Certificate

I was checking out the SSL chain on onlineaccess.ncsecu.org because a network glitch made me paranoid. Both Firefox and IE on my computer have this chain: onlineaccess.ncsecu.org Serial number ...
0
votes
1answer
27 views

Certificate validation Local DNS hosts file

I've a question regarding a certificate validation error I'm getting. I'm performing an https request from one machine to another (windows machines). On the destination machine I've configured a ...
1
vote
1answer
65 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
2
votes
3answers
57 views

In the context of SSL Labs where is the “trust store”?

When I'm testing a site with https://www.ssllabs.com/ssltest/ I'm getting this: Could you explain: Why are there two paths? Where do they come from, where are they configured? What is this "trust ...
0
votes
2answers
74 views

Could a compromised root CA impersonate any SSL certificate?

My question is about MITM attacks against https and how those would appear to the end user. Suppose a trusted root CA were compromised / coerced into producing fraudulent SSL certificates. What would ...
-1
votes
1answer
75 views

SSL and Fake Domain

I am reading information related to SSL handshake on the Internet. It seems like in the last step the domain name is compared to the domain in the certificate. How exactly is this protecting against ...
0
votes
1answer
26 views

How to verify SSL cerficate If restored session after session broken?

For example: User accessed to my web through SSL wih MYCERT. Suddenly hacker break this session, set proxy between user and my web . User connected again over restored session through HACKERCERT. How ...
3
votes
2answers
214 views

Should I be concerned at the lack for transparency by Microsoft which quietly added 17 root certs?

This week it was noticed that Microsoft apparently very quietly pushed out 17 new trusted root certificates (Infoworld Article). The lack of public announcement seems a bit strange. Is anyone aware ...
1
vote
1answer
32 views

What's RSA and ECC's role in TLS 1.2? [duplicate]

I'm trying to figure out what is RSA and ECC used for in TLS 1.2 cipher suites. Let's take TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 for example, communication between server and client would look ...
2
votes
4answers
240 views

Is it neccessary that website certificate must have site URL?

While working on a scenario, I got the error message "Server's certificates doesn't match the url". Is it necessary that the certificate given from the website must have its URL? Is it necessary that ...
2
votes
1answer
2k views

Asian websites don't use HTTPS [on hold]

In America and Europe, HTTPS is quite popular, but in most Asian countries it isn't. The majority of China, Japan and Korea's top websites don't use HTTPS. Are they using another method to protect ...
-4
votes
1answer
44 views

Is it true that breaking into the https padlock settings on a web page is easy to do? [on hold]

I found some posts on this forum that explained that https settings are possible to crack. see here. Why is it possible to sniff an HTTPS / SSL request? And here is another post that mentions ...
0
votes
1answer
31 views

Decrypting SSL traffic for Security Onion at or before the interface

I have Security Onion installed and doing full packet capture on my home network. I also have a firewall (pfSense) which does my routing. I have Security Onion sitting just behind my firewall and ...
0
votes
2answers
24 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
3
votes
1answer
73 views

Why is logjam rated as “None” for confidentiality impact in CVSS?

The CVSS score for Logjam is (AV:N/AC:M/Au:N/C:N/I:P/A:N). As noted in that nice dynamic image interpretation, the Impact metric "Confidentiality" is described as "None" (C:N). But the ...
1
vote
2answers
121 views

Why do some programming language API's not support private key passwords?

Two questions: I've recently started building a basic Go web-server, and noticed that the API for starting a TLS web-server does not support a symmetrically encrypted private RSA key. The API is ...
2
votes
1answer
42 views

Issue regarding installation of SHA256 scertificate

Can anyone help me with the installation of SHA256 certificate? I have generated the certificate perfectly but there seems to be an error below: Kindly let me know why am getting the exclamation ...
4
votes
0answers
253 views

Firebug and cURL [migrated]

I have been using Firebug and cURL for quite a while. Firebug is amazing to capture HTTPS POST request as opposed to a network analyser as it is aware of SSL/TLS negotiation. And cURL is amazing to ...
1
vote
1answer
28 views

What's the signature structure in TLS server key exchange message?

I'm writing a TLS server. While handling ECDHE-RSA cipher suite, the server key exchange is needed. According to Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) ...
2
votes
1answer
93 views

SSH like promiscuity for HTTPS

I want to build something, but I haven't seen it before. Maybe you have? I'd like to build a HTML5 app, served to modern browsers and phones from a microcomputer (e.g. BBB). The microcomputer would ...
0
votes
1answer
58 views

HTTPS and error code 503 [closed]

I tried to visit a HTTPS page and server responded with 503 response - currently unavailable. In address bar, there was an address of that Facebook page, but it was not HTTPS but HTTP, probably ...
0
votes
1answer
32 views

Beast attack and Qualys SSL test

If a server supports | SSLv3: No supported ciphers found | TLSv1.0: | ciphers: | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong | ...
1
vote
1answer
61 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
2
votes
0answers
15 views

Can I use different certifcates for www and Exchange? [migrated]

I have a website www.domainname.com and a published Exchange address of webmail.domainname.com The website is hosted offsite and the Exchange server is on-premises. I need extended validation for the ...
0
votes
4answers
125 views

Corporate PKI - is it an enterprise standard?

I've heard from one person that companies often issue own certificate for their internal usage. It's not signed by any public CA. And he says that it's an enterprise standard. I couldn't find any ...
1
vote
4answers
241 views

HTTPS: is the data downloaded when loading a page encrypted?

So as far as I know, when you go to a https enabled website, all the data you send to that server will be encrypted with their public key, and only the server holding the private key will be able to ...
2
votes
2answers
74 views

Why doesn't the client send data before server's response in TLS session resumption?

I'm referring to the Figure here. Since the client already knows the session key and only the authenticated server can decrypt the session ticket, why can't the client start sending encrypted ...
2
votes
2answers
76 views

Openssl ciphers: what does Au=ECDH mean?

I am trying to get a grasp on different stages of SSL. I have referred to some fantastic answers about how SSL/TLS works and specifically about authentication mechanisms, and numerous other sources. ...
1
vote
1answer
42 views

Influence of SSL Intercept on SSLVPN

We're considering implementing an SSL Intercept proxy in my organization. It will perform a SSL MITM to be able to inspect traffic. It will be a solution of a commercial vendor. It is clear that we ...
2
votes
3answers
232 views

Top banks using TLS 1.0

Am I vulnerable if my bank uses TLS 1.0? Is it easy for somebody to do a MITM attack? Should I just access their online banking at home where I assume it is safer to do so?
1
vote
1answer
71 views

How to determine if mail was encrypted during transport using the header information?

First things first: I know about the difference between end-to-end-encryption and transport encryption. Back to topic: I already read some things about how mail server handle transport encryption, ...
32
votes
3answers
6k views

Why do we still use the terms SSL and HTTPS? [closed]

Since TLS is preferred over SSL, why do we still use the terms SSL and HTTPS generally? The former could be anecdotal, but most people I speak to still say SSL in general conversation. The term HTTPS ...
1
vote
0answers
18 views

SSLException: Unsupported record version Unknown-84.84 [migrated]

I'm facing a weird issue on our server that happens intermittently not quite often (once a month) and can't figure it out. I've searched for this and found this thread which is pretty similar to my ...
1
vote
0answers
34 views

Metasploit reverse_http(s) PAYLOAD for linux target

During exploitation via metasploit's browzer_autopwn, I need to set a payload using http or https channel on a linux target. But there is no reverse_http(s) available in linux payload category. What ...
2
votes
2answers
33 views

HPKP and multiple SSL certificates

Some weeks ago, we enabled the HTTP Public Key Pinning header on our website. As per the specification, we included not only the SHA-256 fingerprint of our current RSA key, but also that of a backup ...
2
votes
1answer
49 views

Squid SSL Bump - getting “unknown issuer” despite having certificate, do I need CA?

I am using pfSense on the gateway of my network. I configured Squid and enabled the HTTPS filtering. I created the internal CA and configured Squid to use this internal CA for SSL Bump. Now the ...
1
vote
0answers
15 views

HPKP and Elliptic Curve certificates

There is quite some information on the web on how to extract the base 64 encoding of the SHA-256 fingerprint (which is needed for the Public Key Pinning header) for RSA certificates (e.g. by Mozilla). ...
1
vote
1answer
59 views

HTTP status 302 and subsequent redirect

I have sent a HTTP GET request to google.com and I get a 302 status. Now the location : url in http header is an http:// address, instead of https. When the browser visits this address I get back a ...
2
votes
0answers
47 views

Should I force Thunderbird to avoid RFC5746 and CVE-2009-3555 security bugs?

I see that the latest version of Thunderbird (38.0.1) still has the defaults set to ignore the error. Is this a big problem? Should I change the defaults to enforce greater security? Here is ...
-1
votes
1answer
81 views

How can you check and analyze SSL ports other than 443? [closed]

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
1
vote
1answer
37 views

SSL cert vs public-key authentication

If SSL/TLS uses a pre-created certificate why does it also use public-key ciphers such as RSA and ECDSA for authentication (I do not mean MAC integrity)? Are they related?
1
vote
1answer
37 views

Certificate authority has changed for personal website - but I haven't changed anything?

I have the Certificate Patrol addon (website) installed in Firefox. While I mostly ignore the (far too many) warnings, today I saw that the certificate authority for my personal website has changed. ...
0
votes
0answers
46 views

What is the cheapest kind of SSL cert I need for multiple sites on multiple servers? [duplicate]

Quick SSL question What is the cheapest kind of ssl cert I need? I have two servers, one windows vps with a static IP and another linux reseller with 2 domains attached and a shared IP. Ideally ...
2
votes
2answers
159 views

Chrome status warning on a netbanking secure site connection [duplicate]

I visited my bank's web banking site and clicked on the Green Lock in the address bar of my Google Chrome browser out of curiosity. Under the "Connections" tab Chrome spits out this disturbing ...
1
vote
1answer
80 views

Should I use SSL only on my admin subdomain?

I have a site at mydomain.com. Users can sign up there to create a simple little site of their own that gets automatically created and can then be found at mydomain.com/name-user-chose There is an ...
3
votes
3answers
165 views

Why do so many banks have relatively weak e-banking security? [closed]

I follow a few infosec-related Twitter personalities: Paul Moore, Taylor Swift, Troy Hunt are the main 3. Paul Moore is currently in the process of switching banks, frequently tweeting and retweeting ...
1
vote
1answer
34 views

What are the risks associated with relying on Mutual SSL & IP Filtering?

We are thinking of implementing Mutual SSL combined with IP Filtering because we are unable to setup a vpn within our external client. What are the risks associated with using Mutual SSL combined with ...