290 reputation
311
bio website
location Queensbury, NY
age 31
visits member for 3 years, 3 months
seen Apr 23 at 18:52

Java generalist, interested in security (appsec/websec), performance/tuning/gc and concurrency.


Jul
3
comment Internal SSL Certificates?
Awesome answer (+1) - thank you Shivam; I wish I could split the "green check" between both you and @Bart but Bart was first ~ thanks again!
Jul
2
comment Internal SSL Certificates?
Ahhh - so one more time (just so I completely understand): (1) my end users and my frontend servers communicate over a SSL cert generated from a known CA (like VeriSign); (2) as soon as the request is consumed from my frontend server, all subsequent communication uses SSL certs generated by either: (a) OpenSSL, or (b) my own CA that I set up. Am I on target? And thanks again!
Jul
2
comment Internal SSL Certificates?
That's a great suggestion - thanks (+1)! If I did that - if I set up my own private CA and asked my frontend servers to trust it, would my end users' browsers trust it? Or would they still get the nasty warning messages?
Jul
2
comment OWASP Top 10? How about OWASP Top 1000?
Awesome answer - thanks @Rory - I figured CVE would crop up in some answers and this was just the kind of structure I was looking for. Thanks again
Jun
28
comment Inner Workings of Public Key Encryption
Wow - fantastic answer (+1). So is this "secret key" the message that is encrypted, or is it yet another key for decrypting the message? If the latter is the case, then if I understand your answer, asymmetric public/private keys are used for transmitting symmetric secret keys, which are then in turn used to encrypt/decrypt messages. Yes, no? Thanks again!
Jun
28
comment What does it mean for a digital certificate to be “signed”?
Thanks @Oleksi - but I think you misunderstand what my question was! You say "To do this, they use their signing key to sign the certificate." I don't understand what the "signing" part is!! Are they encrypting the cert with their signing key, or are they adding their signing key to the cert? Thanks again (and +1)!
Jun
28
comment Purpose and Uses of Root SSL Certificates
Thanks @Mike Scott - so let me see if I understand you: (1) If I want to be the CA for my own private network, I obtain a root SSL from, say, a company like VeriSign, and that root gives me the ability to generate my own "normal" (end-user) certs or chained certs (which end up being end-user certs); and (2) since client browsers will not have my CA in their registries, I need to figure out a way to get them to trust me. Please correct me if any of this is wrong, and if you don't mind telling me, what are my options for setting up this "secure delivery channel" as you mention? Thanks (+1)!
Sep
21
comment Appsec Standards Organizations?
Thanks @Rory - that was just the assurance I was looking for.