Tag Info

New answers tagged

1

If you don't want to give away your site's name to these other websites, you can also test it with... openssl s_client -ssl3 -host <your host name> -port 443 If it doesn't connect then you're ok. But also make sure that your openssl is working properly with your site... openssl s_client -host <your host name> -port 443 Disabling sslv3 also ...


4

There are secure non-POODLE-vulnerable ciphers which you can use with SSLv3 - POODLE only impacts variants with CBC. The RC4 ciphers, for example, are not vulnerable to POODLE. Now, RC4 is a tricky thing. It's considered breakable (but not really actively broken), but since it's the best workaround for things like BEAST and POODLE, it's heavily used and ...


3

I see where you are going with this, and it's good, out of the box thinking. Unfortunately it isn't likely to work in many cases - if a browser supports SSLv3 chances are it supports bad ciphers too. My advice would be to put this system behind a web proxy where you can control the ciphers and protocols, and let the client connections terminate there. The ...


22

If your server does not support SSLv3, then it does not support SSLv3. "Protocol downgrade attacks" are methods to force a client and server to use a protocol version that they both support even though they both know at least one newer version that they would have wished to use, given the choice. Anecdote: I am French. Back in 2005, I was walking in the ...


18

I've published a blog on how to disable SSLv3 in some of the most common bowsers and server platforms (https://scotthelme.co.uk/sslv3-goes-to-the-dogs-poodle-kills-off-protocol/). This should at least help answer the question on how to fully mitigate POODLE be you a client or a server. Below are the key details. How to protect your server The easiest and ...


26

To disable SSL v3.0 support: In Clients: Mozilla Firefox Either Install the Mozilla add-on called "SSL Version Control" Or Type about:config into the navigation bar and press [Enter] Accept the warning and proceed Search for tls Change the value of security.tls.version.min from 0 to 1 (0 = SSL 3.0; 1 = TLS 1.0) Chrome Run Chrome with the ...


199

What is the Poodle vulnerability ? The "Poodle" vulnerability, released on October 14th, 2014, is an attack on the SSL 3.0 protocol. It is a protocol flaw, not an implementation issue; every implementation of SSL 3.0 suffers from it. Please note that we are talking about the old SSL 3.0, not TLS 1.0 or later. The TLS versions are not affected (neither is ...


1

Depending on what you are trying to do, you might get away with using neither NSS nor OpenSSL. PKCS#11 is an API that provides functions for running cryptographic primitives over keys; it is conceivable to use that API directly instead of through an extra library. You would need NSS or OpenSSL if you need some non-PKCS#11 functionality, e.g. support of ...


0

as suggested by dave_thompson_085, I change cat ${content} |\ by $(file --mime-type ${content} | awk '{printf "Content-type: %s\n",$2} ' ; echo ; cat ${content} ) |\ and it work fine, I juste have to figure out how to send binary document, but that shouldn't be a problem. thanks every one for help.


0

You can start with libengine-pkcs11-openssl. It implements today only RSA keys. Or you can move to NSS instead of OpenSSL.


0

Found a satisfying answer here , Thanks for all http://stackoverflow.com/questions/26259432/how-to-check-a-public-rsa-key-file/26260514#26260514


1

Pipe the output from openssl s_client (which includes the cert in PEM-format) into openssl x509 -noout -text and it gives a human-readable display of the cert fields, including the signing algo (in two places). You don't need the sed -n /BEGIN/,/END/p step; most OpenSSL operations on PEM-format data, including this one, ignore "extra" data outside the PEM ...


-4

Payment Card Industry Data Security Standard -> Yes, it is wrong! You can maybe check what is wrong with the handshake on the Qually SSL Labs server test: https://www.ssllabs.com/ssltest/ If it was any service, they could offer it without SSL and tell you to use it, but here it is just crazy to even suggest it. +what Xander said.


33

Yes, this is wrong, and here is why. As you mentioned, PCI-DSS requires that communication containing sensitive data be handled over a secure channel. As a part of this process, certificate validation ensures that the certificate in question is in good order and belongs to the party that you intend to talk to. If you do not validate the certificate, the ...


2

A firewall may work at different layers of the OSI model, going from layer 3 to layer 7 (depending on your firewall). Representing it in a diagram will require to set rules for each layer. I would represent the firewall and include a list of all enforced rules on each layer. Some examples could be: Layer 3: IP filtering Layer 4: port filtering (TCP/UDP) ...


0

You can't see the padding in ciphertext because ciphertext is encrypted. For commandline openssl enc, -nopad has effectively mirror meanings for encrypt and decrypt. -nopad on encrypt means no padding is added (and the plaintext must be an exact multiple of the blocksize). You obviously did not specify -nopad on encrypt so PKCS5 padding was added by ...



Top 50 recent answers are included